This episode of the Endpoints Of View podcast reviews three significant data breach incidents reported recently, demonstrating that cyberattacks are increasingly sophisticated and target a wide range of organizations, including government, critical infrastructure (postal service), and healthcare.

Talking Points:

• Government Breach: The Dutch government breach impacting multiple ministries raises "serious concerns over the cybersecurity posture of public sector agencies in the Netherlands."
• Critical Infrastructure Breach: The Royal Mail breach, leaking 144GB of internal data, highlights the vulnerability of "even legacy institutions" and the significant risks associated with supply chain security.
• Healthcare Breach: The Yale New Haven Health System (YNHHS) breach, affecting over 5.5 million individuals, is described as "the largest healthcare data breach reported in 2025," emphasizing the persistent threat to this sector.

Consequences of Data Breaches

The breaches have significant consequences, including potential impacts on national security (Dutch breach), reputational and operational risks (Royal Mail), and a high risk of "identity theft, insurance fraud, and targeted phishing campaigns" (YNHHS).

These incidents highlight a concerning trend of escalating cyberattacks targeting both public and private sector organizations, emphasizing the critical role of endpoint security in preventing data compromise. The breaches underscore the effectiveness of infostealer malware employing keylogging and screen capture techniques and strongly advocate for proactive cybersecurity strategies, particularly advanced endpoint protection solutions like SentryBay's Armored Client.

A significant step forward in enhancing endpoint security for organizations leveraging IGEL OS!

In this episode of SentryBay's Endpoints of View podcast we assess the partnership between IGEL and SentryBay, highlighting why it represents a significant step forward in enhancing endpoint security for organizations leveraging IGEL OS.

Talking Points:

• Why IGEL, a leader in secure endpoint OS for cloud workspaces, has partnered with SentryBay, a global leader in Endpoint Threat Prevention. The partnership between IGEL and SentryBay represents a significant step forward in enhancing endpoint security for organizations leveraging IGEL OS.
• How this partnership integrates SentryBay's "Armored Client" solution with IGEL OS to enhance endpoint security, particularly against evolving threats like keylogging, screen capture, credential theft, and AI-driven malware. The integration of SentryBay's Armored Client offers a proactive defense mechanism against increasingly sophisticated cyber threats, supporting a zero-trust security framework without compromising user experience.
• This game changing collaboration provides a proactive, zero-trust security layer for enterprises, especially those with remote and hybrid workforces. Their joint presence at IGEL Now & Next 2025 underscores their commitment to innovation and providing comprehensive security solutions for the evolving landscape of end-user computing.

What are the top three ransomware threats currently active, and what makes them so dangerous?

In this episode of SentryBay's Endpoints of View podcast we assess the top three ransomware threats currently active – LockBit, Lynx, and Virlock. LockBit is known for its efficient encryption, double extortion tactics, and use of a Ransomware-as-a-Service (RaaS) model, allowing widespread distribution. Lynx, a newer group, aggressively targets small and mid-sized businesses using double extortion tactics. Virlock is unique in that it not only encrypts files but also infects them, turning each into a polymorphic file infector, enabling rapid spread via cloud storage.

Talking Points:

• How does LockBit's Ransomware-as-a-Service (RaaS) model impact the spread of ransomware attacks? The RaaS model enables LockBit to expand its reach by allowing affiliates to distribute the malware. This means that multiple actors can deploy the ransomware, leading to widespread attacks across various industries and a greater volume of victims. This significantly increases the potential impact and makes it more difficult to track and stop.
• Why are small and mid-sized businesses specifically targeted by the Lynx ransomware group? Lynx specifically targets small and mid-sized businesses because they often have weaker security measures compared to larger corporations, making them easier targets. Lynx exploits these vulnerabilities to quickly gain access and extort these companies, knowing they may be more likely to pay to avoid data breaches and operational disruptions.
• How does the Virlock ransomware differ from other types of ransomware, and how does it spread? Virlock differs from traditional ransomware because it not only encrypts files but also infects them, making each encrypted file into a polymorphic file infector. This unique trait allows Virlock to spread rapidly, particularly via cloud storage and collaboration platforms. When an infected file is shared, collaborators who open the file inadvertently trigger the infection on their systems, leading to further propagation within an organization.

This episode also examines the ways to counter the growing ransomware threat including proactive defenses that block attacks at their source. Specifically, adopting advanced tools which features endpoint isolation to prevent keylogging and credential theft—common entry points for ransomware attacks.

The Middle East is experiencing rapid digital transformation and economic growth, making it an increasingly attractive target for cyberattacks.

While historically the region has seen a relatively low number of publicized cyber incidents, the potential impact of a successful attack is significant, due to the region's crucial role in the global energy sector and its growing dependence on digital technologies. The costs of data breaches in the region are already high, and various cyber threats are becoming more sophisticated. This briefing outlines the key vulnerabilities, risks, and necessary steps for mitigating potential cyber threats in the Middle East.

Talking Points:

• High Potential Impact to Energy Sector: The energy sector is considered one of the most important and sensitive sectors that must be protected from cyber attacks due to the devastating impact this sector might have on Middle Eastern economies.Geopolitical Tensions Exacerbate Risk: Complicating matters is geopolitical tension in parts of the Middle East: With its escalation, any high-profile or state-owned businesses will be at increased risk of cyber attacks from hacktivists.

Proactive cybersecurity solutions that isolate endpoints and prevent credential-based exploits are essential for organizations in the Middle East to safeguard their infrastructure, maintain operational trust, and ensure resilience against evolving cyber threats.

This year-end episode of the Endpoints Of View podcast discusses the significant rise in cyberattacks globally in 2024, with a 75% increase in weekly averages compared to 2023. All sectors are vulnerable, but education, government, healthcare, and communications are prime targets. Also under discussion is the news that SentryBay is certified for meeting the requirements of ISO 27001 for the development, supply, maintenance and support of IT security software products and the provision of SaaS solutions worldwide.

Talking Points:

Increased Data breaches: Several high-profile data breaches exposed sensitive personal information, leading to financial losses and reputational damage for organizations and individuals:

• Change Healthcare: Exposed protected health information of 100 million individuals, making it the largest healthcare data breach in US history.
• Synnovis: Ransomware attack crippled pathology services across London, impacting hundreds of thousands of patients and demonstrating the fragility of critical healthcare infrastructure.
• Ticketmaster: Over 500 million customer records stolen by ShinyHunters, likely exploiting a vulnerability in a third-party cloud data warehouse.
• AT&T: Unauthorized access and download of call and text records of nearly all AT&T customers, highlighting privacy concerns and risks associated with third-party cloud platforms.
• Dell: “Grep” accessed and stole data belonging to over 10,000 employees and partners, likely through a phishing campaign.
• MediSecure: Ransomware attack compromised personal and health information of 12.9 million Australians, making it one of the largest healthcare data breaches in the country.
• Snowflake Attacks: UNC5537 targeted Snowflake customers, exploiting compromised credentials to access data. The attacks highlighted the importance of multi-factor authentication.

Importance of ISO 27001 Certification: SentryBay, a leader in endpoint isolation technology, achieved ISO 27001 certification, demonstrating its commitment to information security best practices. The certification provides clients and partners with peace of mind, knowing that SentryBay’s technology aligns with data protection and information security standards.

International Fraud Awareness Week 2024 (IFAW) serves as a critical reminder of the growing threat of fraud and the importance of robust data security measures for businesses and individuals. This special IFAW edition of SentryBay’s Endpoints Of View podcast provides insights into the evolving fraud landscape, highlighting key threats, costs, prevention strategies, and the critical role of endpoint security.

Talking Points:

1. The Escalating Threat of Fraud in a Digital World:

• Fraudulent activities are increasing at an alarming rate, fueled by rapid digitization and advanced technologies like AI.
• Cybercriminals leverage AI for sophisticated attacks, including creating fake identities, phishing scams, forging documents, and impersonation using voice cloning and deepfakes.

2. The High Cost of Data Breaches:

• The global average cost of a data breach reached $4.45 million in 2024, encompassing financial losses, reputational damage, regulatory fines, and remediation costs.
• Data breaches erode trust among customers and employees, leading to irreparable reputational harm and potential identity theft.

3. Key Cyber Threats:

• Keylogging: Malicious software or hardware records a user's keystrokes to capture sensitive information.
• Screen Capture: Cybercriminals take screenshots of a victim's device to reveal sensitive data displayed on the screen.
• Malicious Injection: Harmful code is inserted into legitimate applications or websites to compromise databases and critical infrastructure.
• Insider Threats: Employees, contractors, or suppliers with insider access can intentionally or unintentionally compromise data security, leading to data theft, sabotage, or data leaks.

4. The Crucial Role of Endpoint Security:

• Endpoint security serves as the frontline defense against cyber threats, protecting devices like desktops, laptops, and mobile phones.
• Key features include real-time threat detection, multi-layered defense, behavioral analytics, and patch management.

5. Building a Culture of Fraud Prevention:

• Employee education and training are paramount to help staff recognize phishing attempts, report suspicious activity, and adhere to best practices.
• Organizations must establish robust fraud risk assessment procedures and incident response plans.
• A culture of transparency and trust encourages employees to report suspicious activities.

6. Proactive Measures and Best Practices:

• Implement comprehensive data protection measures to comply with regulations like GDPR and CCPA.
• Adopt robust solutions with built-in prevention, detection, and real-time threat response capabilities.
• Establish clear company policies, least-privilege access controls, and monitoring capabilities to mitigate insider threats.

This episode of the Endpoints Of View podcast discusses the prevalence of cyberattacks on stock exchanges. Research by IOSCO and the World Federation of Exchanges indicates that approximately half of the world’s securities exchanges have experienced cyberattacks.

Talking points include:

• Cybersecurity vulnerabilities of stock exchanges: Stock exchanges are increasingly vulnerable to cyberattacks, which can have serious consequences for market integrity and investor confidence.
• Regulatory requirements for cybersecurity: Regulatory bodies like the SEC are placing greater emphasis on cybersecurity, requiring timely reporting of incidents and robust security measures.
• Privileged Access Workstation (PAW) security: Securing privileged access workstations, particularly with “clean keyboard” solutions, is crucial for protecting sensitive data and systems.

This episode of the Endpoints Of View podcast discusses current cybercrime trends and the importance of robust cybersecurity solutions, specifically zero trust endpoint security.

Talking points include:

• Global Cybercrime Landscape: The World Cybercrime Index identifies Russia, Ukraine, China, USA, Nigeria, and Romania as leading sources of cybercriminal activity.
• Infostealers Pose a Significant Threat: Keylogging is identified as the most prevalent technique employed by infostealers in 2024, affecting 73% of the top 15 strains.
• Zero Trust Approach as an Effective Countermeasure: The adoption of a zero-trust security model, reinforced by solutions like SentryBay's Armored Client, will be instrumental in safeguarding sensitive data and mitigating the escalating costs associated with cybercrime.

The Endpoints Of View podcast is brought to you by SentryBay – the world’s most advanced endpoint protection!

This episode of the Endpoints Of View podcast discusses the game changing partnership between SentryBay and TD SYNNEX:

• How the partnership addresses security gaps in Microsoft AVD and Windows 365. The partnership will initially serve TD SYNNEX’s channel network of resellers in the USA and Canada, with plans to expand globally in the future, particularly into Europe and Asia.
• Armored Client’s impenetrable defensive layer that once deployed on an endpoint isolates and protects a DaaS session and all applications run within it from Keyloggers, Screen Capture and Malicious Injection to remove the risk from data leakage and credential theft without any need to identify the threat first.

As the business world pivots to manage vulnerable devices accessing corporate networks via Microsoft Azure Desktop and W365, it is more important than ever to provide comprehensive solutions to address these challenges. The SentryBay / TD SYNNEX partnership webpage can be accessed here: https://sentrybay.lll-ll.com/

The Endpoints Of View podcast is brought to you by SentryBay – the world’s most advanced endpoint protection!

This episode of the Endpoints Of View podcast discusses the wave of data breaches hitting financial institutions.

Talking points include:

• The ransomware group Hunters International who allegedly stole 5.2 million files from the Industrial and Commercial Bank of China (ICBC), the world’s largest bank in terms of assets.
• Payment processing solutions provider Slim CD who recently announced a data breach that has affected nearly 1.7 million individuals, exposing their credit card and personal information.

Both cases prove the need for strong cybersecurity protocols in banks and financial institutions to protect sensitive data from cyberattacks.

The Endpoints Of View podcast is brought to you by SentryBay – the world’s most advanced endpoint protection!