> InfoSec News Nuggets 10/02/2025

UK Government Issues New Order to Access iCloud User Data The report reveals that, in early September, the UK Home Office demanded that Apple creates a way for officials to access encrypted ‌iCloud‌ backups. Unlike its previous order, the latest request focuses on the ‌iCloud‌ data of British citizens specifically. The demand is designed to aid law enforcement with investigations into terrorism and child sexual abuse. The Home Office’s previous request from January sought access to encrypted user data worldwide, which triggered a diplomatic clash between the UK and U.S. governments. The Trump administration pressured the UK to discard the order and, in August, director of national intelligence Tulsi Gabbard said that the UK had “agreed to drop” its demand, at least with regards to the encrypted data of American citizens.   Air Force admits SharePoint privacy issue as reports trickle out of possible breach The US Air Force confirmed it’s investigating a “privacy-related issue” amid reports of a Microsoft SharePoint-related breach and subsequent service-wide shutdown, rendering mission files and other critical tools potentially unavailable to service members. “The Department of the Air Force is aware of a privacy-related issue,” an Air Force spokesperson told The Register on Wednesday, while declining to answer specific questions about the alleged digital intrusion.     Red Hat confirms security incident after hackers claim GitHub breach An extortion group calling itself the Crimson Collective claims to have breached Red Hat’s private GitHub repositories, stealing nearly 570GB of compressed data across 28,000 internal projects. This data allegedly includes approximately 800 Customer Engagement Reports (CERs), which can contain sensitive information about a customer’s network and platforms. A CER is a consulting document prepared for clients that often contains infrastructure details, configuration data, authentication tokens, and other information that could be abused to breach customer networks.   766,000 Impacted by Data Breach at Dealership Software Provider Motility Dealership software company Motility Software Solutions is notifying over 766,000 people that their personal information was compromised in a ransomware attack. A provider of software for recreational vehicle and power sport dealers, Motility discovered the incident on August 19, after hackers accessed servers that support the company’s business operations. The attackers, the company says, deployed file-encrypting ransomware on its systems, but also stole files containing customers’ personal information. The affected data, it says, includes names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, and driver’s license numbers.   Extortion Emails Sent to Executives by Self-Proclaimed Clop Gang Member An individual or group of people claiming to be working with the Clop ransomware has been sending extortion emails to executives at several organizations since September 29, according to Google. The threat actor also claims to have stolen sensitive data from its target Oracle E-Business Suite. Researchers at Mandiant and Google Threat Intelligence Group (GTIG) are investigating a case but have not yet gathered enough evidence to substantiate the individual’s claims. Charles Carmakal, CTO of Mandiant at Google Cloud, commented: “We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts.”   The post InfoSec News Nuggets 10/02/2025 appeared first on AboutDFIR - The Definitive Compendium Project.