Security Squawk - The Business of Cybersecurity

Your business can be taken down in three completely different ways, and only one involves a hacker. This week, a cyberattack froze Boston Scientific, the company that ships pacemakers and defibrillators to hospitals worldwide. Microsoft ended a free program, and roughly 171,000 nonprofits lost everything in their cloud storage. And a ransomware gang breached a federal agency that kept running. *Control what a disaster can reach, before it reaches everything.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to follow cyber news but can't afford to be blindsided. Start with Boston Scientific. On August 25th, a cyberattack knocked out the systems this medical-device giant uses to process and ship orders worldwide, sending thousands of staff in Ireland home. The factories were never the problem. The systems that take and fulfill orders were, leaving hospitals waiting on pacemakers and stents. A group called ShinyHunters claims it stole more than 9 million records of personal data. Boston Scientific now faces two disasters: an outage it can fix and stolen data it cannot un-steal. Then there is Microsoft, where nobody got hacked. Microsoft ended a free software grant that about 400,000 nonprofits relied on. During the transition, roughly 171,000 of them lost everything in their OneDrive. One nonprofit leader had a paid renewal good through October 2026, and his data was deleted anyway. Here is what every owner needs to hear: Microsoft 365 does not back up your data. Microsoft keeps the service online, but protecting the actual files is entirely on you. Most people have that exactly backwards. We close with the ATF. The federal agency over firearms and explosives confirmed the Qilin ransomware gang hit a system holding information about the targets of its investigations, and the Department of Justice called it a "major incident." Yet the agency kept running because that sensitive system was deliberately walled off from everything else. One box got hit instead of the whole agency. Qilin is the most active ransomware brand of 2026, with victim counts up around 443 percent and North America accounting for more than half its targets. This is the playbook coming for businesses of every size. Three different villains. One lesson: you don't control when trouble arrives, only how far it gets once it does. In this episode, we discuss: • How a cyberattack froze Boston Scientific and stalled hospital device shipments worldwide • Why 171,000 nonprofits lost their data when Microsoft ended a grant, no hacker required • How the ATF survived a Qilin ransomware breach because one system was walled off • Why your cloud provider is not your backup, and what that means for your files • The one idea connecting all three: control what a disaster can reach before it reaches everything • Practical moves owners can make this week on backups, segmentation, and vendor notices Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #BostonScientific #Microsoft #Ransomware #DataBreach #Qilin #ShinyHunters #VendorRisk #BackupStrategy #BusinessRisk #MSP

Five federal agencies just warned that hackers are using AI to attack the computers running America's water plants and factories. That same week, a trillion-dollar investment firm was breached, not by a virus, but by a phone call. The hard part of hacking is disappearing. Every business owner needs to understand why. What used to keep attackers out is now what lets them in. Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to keep up with cyber news but can't afford to be blindsided. Start with the story that should stop you cold. The NSA, CISA, the FBI, the Department of Energy, and the EPA issued a rare joint warning: hackers are using AI to write code that attacks Siemens industrial controllers, the small computers that physically run water systems, power, and manufacturing. They took free, legitimate engineering tools and had AI turn them into custom attack software. The agencies say this dramatically cuts the skill and time an attack like this used to require. Difficulty was the wall that kept amateurs out of industrial systems. AI is tearing it down. And it is not theoretical. Security firm Dragos already documented a real intrusion where someone with no industrial background used commercial AI to go after a water utility's controls. The advisory names six sectors in the line of fire, from energy and water to food and manufacturing. These attacks are as weak as they will ever be, because the AI only gets better from here. Then Randy takes on Apollo Global Management, the Wall Street giant with about a trillion dollars under management. Attackers didn't break its technology. They called employees pretending to be internal IT, then guided them to fake login pages that captured their passwords and security codes. From there, they reached names, birth dates, home addresses, and Social Security numbers. This was not a lone hacker. Google ties it to a professionalized extortion crew that moves from one industry to the next running the same script, with demands that often start around three million dollars. A firm with a massive security budget was beaten by a convincing conversation, and a class-action lawsuit started forming within days. If a phone call works on Apollo, it can work on your team too. Reginald closes with SickKids, one of the most respected children's hospitals in the world. No patient records were touched. Employee and job-applicant data leaked through a flaw in third-party software the hospital didn't even build. Consider that last group: job applicants who handed over Social Security numbers to a place they did not even work yet. This repeat victim has now been burned by outside software three times, and it fits a bigger pattern: through the first half of 2026, vendors were involved in 43 percent of healthcare breaches. Another vendor breach this year hit 1.8 million people. Your biggest risk is often a company you'll never meet, inside a tool you already trust. • How hackers are using AI to attack the industrial controllers behind US water and power • Why Apollo Global Management got breached by a phone call, not a virus • How SickKids leaked employee and applicant data through a vendor's software • Why the skill it takes to attack a business is collapsing fast • What "verify who's really calling" actually looks like for your team • How to find the vendors quietly holding your most sensitive data • The one thread connecting all three: what used to keep attackers out now lets them in Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #AI #CriticalInfrastructure #Apollo #DataBreach #SocialEngineering #VendorRisk #SickKids #BusinessRisk #MSP #SmallBusiness

A fake Wi-Fi network at 35,000 feet turned a Delta flight into a crime scene. Someone on a flight out of Las Vegas set up a fake network to steal passengers' logins, a ransomware gang seized a hospital's Facebook page to post its ransom note, and a White House memo would let private firms hack foreign cybercriminals back for the first time in U.S. history. *Cybercrime is out in the open now, and so is the fight back.* Bryan Hornung, Randy Bryan, and Reginald Andre break down what it means for owners and operators who can't afford to be blindsided. On a Delta flight from Las Vegas to Atlanta, a passenger set up a fake network posing as the plane's Wi-Fi, and the crew pulled the real one offline. It's an "evil twin," a lookalike network that tricks you into connecting so an attacker can steal your logins. A man in Australia did exactly this on real flights and got more than seven years. A nonprofit hospital system, AnMed, got hit with malware and had to close nearly 80 facilities. Then a ransomware crew took over its verified Facebook page and posted the ransom demand in public. When criminals can post from your own account, they steal your megaphone, not just your data. For the first time ever, a White House memo would let vetted private firms strike foreign cybercriminals, with a million-dollar escrow and sign-offs from Justice and Homeland Security. But hacking back on your own is still a federal crime, and the rulebook is two months away. Support the show: buymeacoffee.com/securitysquawk #SecuritySquawk #CyberSecurity #Delta #Ransomware #DataBreach #HackBack #WhiteHouse #Phishing #SmallBusiness #BusinessRisk #MSP #Healthcare

A six-billion-dollar brand got breached this week, and the attackers never wrote a line of code. They called three employees and pretended to be IT. Every business owner should sit with this: the same phone call works even better on a company your size. *Every breach is won or lost before it begins.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who do not have time to keep up with cyber news but cannot afford to be blindsided. The good news first. The City of Coweta, Oklahoma, a town of about ten thousand people, got hit with a ransomware attack that locked up every computer in City Hall. Permits, transactions, and in-person card payments stopped cold. But 911 never went down because police and fire systems run on separate off-site servers the attack could not reach. Coweta is refusing to pay the ransom for one reason: its backups actually work. That is the whole lesson in one town. Levi Strauss told the SEC that attackers stole corporate data after socially engineering just three employees. No malware. No exploit. Someone called pretending to be the internal help desk, led employees to a fake login page, and captured their passwords and live sessions in real time. Then they registered their own login devices, removed the real ones, and deleted security alerts so nobody got a warning. Google's threat team says the crew behind this style of attack built tools to hit more than two hundred companies in about five weeks. If they will call Levi's, they will call your front desk. LockBit is back. Law enforcement broke up the ransomware crew in 2024, but its 5.0 version has already listed more than two hundred victims. The latest is Microphase, a Connecticut company that has made radio and radar parts for the defense world since 1955. This is double extortion: they steal your data first, then threaten to publish it unless you pay. Backups alone will not save you. If they will hit a specialty parts shop, "we're too small to be a target" is not a plan. Three stories, one thread. Coweta survived because of decisions made long before the attack. Levi's got hurt in a single moment of misplaced trust. LockBit proves attackers are coming whether you are a household name or a shop nobody has heard of. The outcome was decided long before the attack. In this episode, we discuss: • How the City of Coweta kept 911 online while ransomware locked up City Hall • Why refusing to pay a ransom only works when your backups actually do • How attackers breached Levi Strauss with three phone calls and no malware • Why regular text-message MFA did not stop the Levi's attackers, and what does • LockBit's return and why a 1955 defense parts maker landed on its leak site • Why "we're too small to be a target" is the most expensive assumption in business • The one habit that shuts down the fake-IT phone call for free Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk #CyberSecurity #Ransomware #DataBreach #LeviStrauss #LockBit #SocialEngineering #Vishing #SmallBusiness #BusinessRisk #MSP #Backups