> InfoSec News Nuggets 10/28/2025

Cities reverse course on automated license plate reader cameras amid privacy concerns Cambridge, Massachusetts officials turned off 16 automated license plate reader cameras (ALPR) last week after the city council voted to pause their use following reports of the cameras’ manufacturer sharing data with immigration authorities. Cambridge is one of several cities where the Flock Safety cameras — which are now present in thousands of cities across the country — have recently been taken offline.  On October 14, Eugene, Oregon officials disabled 57 cameras there after the City Council voted to pause their use following an intense backlash from residents. Officials in Austin, Texas ended their contract with Flock in June amid similar public objections. In August, Evanston, Illinois deactivated 19 cameras.   Iran’s school for cyberspies could’ve used a few more lessons in preventing breaches Iran’s school for state-sponsored cyberattackers admits it suffered a breach exposing the names and other personal information of its associates and students. The Ravin Academy was established in 2019, ostensibly to train individuals in all facets of cybersecurity and recruit the best to work on Iranian intelligence (MOIS) projects. As part of some broader actions against Iran, Ravin was sanctioned by the UK, US, and EU between 2022 and 2023 for its role in recruiting cyber specialists to carry out human rights violations. In a statement posted to its Telegram channel on October 22, Ravin confirmed that the attack targeted one of the online platforms it hosts, and highlighted the timing as an attempt to undermine confidence in Iranian security.   Europol Warns of Rising Threat From Caller ID Spoofing Attacks A growing wave of caller ID spoofing attacks, in which criminals falsify the number displayed on a phone to appear legitimate, has prompted Europol to call for urgent, coordinated action across Europe. The agency’s new Position Paper on Caller ID Spoofing highlights that the practice underpins a wide range of online fraud schemes and social engineering scams, costing an estimated €850m ($990m) globally each year. Caller ID spoofing now accounts for roughly 64% of reported fraud cases involving phone calls and text messages. Criminals use this technique to impersonate trusted institutions such as banks, government agencies or even relatives, tricking victims into revealing personal data or transferring money. Europol warned that organized networks have turned this into a borderless business model, offering “spoofing-as-a-service” to other offenders.   Hackers Target Swedish Power Grid Operator Swedish state-owned power grid operator Svenska kraftnät on Monday confirmed that it fell victim to a cyberattack that resulted in a data breach. The incident, the company said, was discovered on Saturday and affected an isolated, external file transfer solution, but not the power grid. The country’s electricity supply has not been affected by the attack, the public utility’s Chief Information Security Officer Cem Göcören said. Since learning of the attack, Svenska kraftnät has been scrambling to understand its scope and impact. The incident has been reported to the authorities, the company said.   Industrial Giants Schneider Electric and Emerson Named as Victims of Oracle Hack Industrial giants Schneider Electric and Emerson have been named by cybercriminals as victims of the recent campaign targeting Oracle E-Business Suite (EBS) instances. Threat actors, presumably a cluster of the FIN11 profit-driven threat group, have exploited Oracle EBS vulnerabilities to steal data from dozens of organizations, including major companies. The hackers have started naming alleged victims on the leak website set up for the Cl0p ransomware, and in some cases they have started releasing data that allegedly originates from the targeted companies. Two of those alleged victims are Schneider Electric and Emerson, neither of which has responded to SecurityWeek’s repeated requests for comment.  The post InfoSec News Nuggets 10/28/2025 appeared first on AboutDFIR - The Definitive Compendium Project.