> InfoSec News Nuggets 10/21/2025

Prisoner hacks prison IT system, goes wild! A convict at a Romanian prison has hacked the country’s prisoner management platform in a security breach that has rocked Romania’s penitentiary agency. The incident took place in August and continued through October. From various reports in Romanian media and a statement released by the national penitentiary police union, the incident appears to have originated in the city of Dej, in Romania’s Transilvania region, at a prison hospital complex, where prisoners are sent to treat illnesses and then return to finish their sentence at their normal jails.   AI-Driven Cyber Threats Are the Biggest Concern for Cybersecurity Professionals Going Into 2026, Finds New ISACA Research Over half (51%) of European IT and cybersecurity professionals fear AI-driven cyber threats and deepfakes will keep them up at night next year, according to new ISACA research. What’s driving this concern is a lack of preparedness for AI-related risks across the industry. Only 14% of respondents feel their organisation is very prepared to manage the risks associated with generative AI solutions in 2026. The majority (82%) feel they are only somewhat prepared, not very prepared, or not prepared at all.   Foreign hackers breached a US nuclear weapons plant via SharePoint flaws A foreign threat actor infiltrated the Kansas City National Security Campus (KCNSC), a key manufacturing site within the National Nuclear Security Administration (NNSA), exploiting unpatched Microsoft SharePoint vulnerabilities, according to a source involved in an August incident response at the facility. The breach targeted a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons under the NNSA, a semi-autonomous agency within the Department of Energy (DOE) that oversees the design, production, and maintenance of the nation’s nuclear weapons. Honeywell Federal Manufacturing & Technologies (FM&T) manages the Kansas City campus under contract to the NNSA.   Data brokers are constantly doxing us, and we can’t do anything about it Data brokers are companies that scrape your personal information from all areas of the web to then sell on to other companies for profit. What’s important to remember is that data brokers don’t discriminate, they can sell your information to anyone who wants it. Whether that’s an advertising company trying to sell you products or an angry ex-partner who wants to craft your digital profile to exploit you, data brokers are a lot more dangerous than we might think. Cybernews spoke to the CEO and co-founder of DeleteMe, Rob Shavell, to discuss how data brokers can facilitate cybercrime.   Ransomware Payouts Surge to $3.6m Amid Evolving Tactics The average ransomware payment has increased to $3.6m this year, up from $2.5m in 2024 – a 44% surge despite a decline in the overall number of attacks.  The 2025 Global Threat Landscape Report findings from ExtraHop point to a clear evolution in cybercriminal strategy: fewer, more targeted operations that aim for higher returns and longer-lasting impact.  The report surveyed 1800 IT and security leaders across seven countries, who reported an average of five to six ransomware incidents over the past year, down roughly 25% from 2024. While the number of attacks dropped, the damage intensified. Seventy percent of affected organizations paid the ransom, and payouts in critical sectors were significantly higher than average. Healthcare and government agencies faced the most significant financial burdens, both with payouts of nearly $7.5m, while finance averaged $3.8m per incident. The post InfoSec News Nuggets 10/21/2025 appeared first on AboutDFIR - The Definitive Compendium Project.