Blog

Modern Data Technology Center Server Racks in Dark Room with VFX. Visualization Concept of Internet of Things, Data Flow, Digitalization of Internet Traffic. Electric Equipment Warehouse.

<p>In the tail end of June 2025, Citrix disclosed a severe vulnerability—CVE‑2025‑5777—impacting NetScaler ADC and Gateway appliances when configured for VPN, ICA/RDP proxy, or AAA virtual server roles. Dubbed Citrix Bleed 2 by security researcher Kevin Beaumont, the flaw enables unauthenticated attackers to exploit an out-of-bounds memory read and extract session tokens directly from memory.</p><p>This vulnerability is especially dangerous because those session tokens can be used to hijack active sessions and bypass multi-factor authentication (MFA). That kind of access grants attackers full control of user sessions and potentially wide access across internal systems.</p><figure id="figure-wp68ggrd6cmcm2eymx"><img id="wp68ggrd6cmcm2eymx" src="https://cdn.durable.co/getty/22jr6azmtFMi1Y8jfHVi9qmlU206vSCApf0usACJkrFn3i1VENu7qTy6w4oPuanW.jpeg" alt="Abstract Warning of a detected malware program" title="Abstract Warning of a detected malware program" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/22jr6azmtFMi1Y8jfHVi9qmlU206vSCApf0usACJkrFn3i1VENu7qTy6w4oPuanW.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Evidence of Exploitation</h3><p>Despite no official confirmation from Citrix, cybersecurity firms and threat researchers have reported strong signs of active exploitation in the wild. These include indicators such as token reuse from different IP addresses, unauthorized session takeovers without user involvement, and internal reconnaissance behaviors such as LDAP queries and Active Directory enumeration.</p><p>Security teams have observed attackers maintaining access even after original user browser sessions end—indicating the misuse of backend tokens rather than browser-bound cookies. The exploit enables attackers to silently impersonate users and move laterally across networks with minimal detection.</p><h3>Widespread Risk to Enterprises</h3><p>The scope of this vulnerability is considerable. Tens of thousands of NetScaler appliances are exposed to the public internet, with a significant portion still unpatched weeks after disclosure. Devices running unsupported firmware are especially vulnerable.</p><p>What makes Citrix Bleed 2 more critical than previous vulnerabilities is the nature of the session tokens it exposes. These tokens are used across a wide range of Citrix services—not just web sessions—meaning a compromise could potentially lead to long-term persistence, API abuse, and unrestricted administrative access.</p><h3>How to Mitigate</h3><p>Citrix has released patches for all supported versions of NetScaler ADC and Gateway. Organizations should immediately upgrade to fixed firmware versions and terminate all active ICA and PCoIP sessions following patching to evict any hijacked sessions.</p><p>Network administrators are also encouraged to review firewall and access control rules to reduce unnecessary external exposure. Unusual authentication patterns, use of Active Directory tools like ADExplorer, and token reuse across IPs should be treated as high-risk events.</p><p>In addition, systems running unsupported versions (such as NetScaler 12.1 and 13.0) should be decommissioned or isolated as part of long-term security hygiene.</p><h3>Strategic Implications</h3><p>Citrix Bleed 2 underscores the need for rapid patching practices, proactive session management, and vigilant monitoring for anomalies in user access behavior. Like Heartbleed and the original Citrix Bleed, this vulnerability is a wake-up call for organizations relying on perimeter authentication appliances without sufficient segmentation or audit controls.</p><p>Beyond patching, a layered security approach—embracing principles like zero trust and continuous monitoring—is essential to defending against session hijacking and token-based attacks in modern environments.</p><figure id="figure-gc8gbk5mcmcm2fs4h"><img id="gc8gbk5mcmcm2fs4h" src="https://cdn.durable.co/getty/7rcY8HMO6qpQfxuyyLEUGGIWM6g5Wb4gERhptCpcvEirFaDVyCzs96BG53kG145l.jpeg" alt="White and blue firewall activated on server room data center 3D rendering" title="White and blue firewall activated on server room data center 3D rendering" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/7rcY8HMO6qpQfxuyyLEUGGIWM6g5Wb4gERhptCpcvEirFaDVyCzs96BG53kG145l.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion</h3><p>Citrix Bleed 2 is a critical reminder that even trusted enterprise infrastructure can become a single point of failure when vulnerabilities are left unpatched. With evidence of active exploitation and the ability to bypass authentication entirely, the window for safe inaction is closing. If your company has concerns about how these attacks could affect operations TechHorizon Consulting can help. We can provide tools like real time network monitoring that stop these attacks in their tracks. If this interests you or your company please visit our "Contact Us" page. &nbsp;</p>

Citrix Bleed 2: A Critical New Threat (CVE‑2025‑5777)

Cyber security and data protection. Women are encrypting to access private information through face id and Scanned fingerprint to verify of identity on virtual interface network. Smart innovation.

<p>Microsoft just rolled out a new feature to help businesses defend against a growing and frustrating email threat: mail bombing.</p><p>If your organization uses Microsoft Defender for Office 365, this new protection is already being enabled and will automatically detect and block mail bombing attacks. That’s a win for security teams—and for anyone who’s ever dealt with an inbox flooded with thousands of messages in minutes.</p><p>But while this is a strong move in the right direction, it’s also a good reminder that email remains one of the most common and dangerous entry points for cyberattacks. So let’s look at what’s changing, what it means for your business, and what other email protections you should have in place.</p><h3>What Is Email Bombing?</h3><p><br>Email bombing is exactly what it sounds like, an attacker floods a user’s inbox with a massive number of messages, often in the span of just a few minutes. Sometimes these are auto-generated newsletters, other times they’re bulk email blasts from compromised systems.</p><p>What is the goal of these email blasts? To overwhelm the victim’s inbox, hide important messages, or distract and confuse them during a social engineering attack. It’s not just annoying, it can be the first step in a larger compromise.</p><p>Recent attacks have shown just how damaging this tactic can be. Ransomware gangs like BlackBasta and affiliates of FIN7 have used email bombing to set up voice phishing attacks. In some cases, they’ve called employees pretending to be IT support and convinced them to install remote access tools. Once inside, they moved laterally through networks and deployed ransomware.</p><h3>What’s New in Defender for Office 365?</h3><p><br>To help combat this, Microsoft has added automatic detection for mail bombing in Defender for Office 365. This feature started rolling out in June 2025 and should reach all tenants by late July. It’s enabled by default and doesn’t require any manual setup.</p><p>When a mail bombing campaign is detected, those messages are automatically redirected to the Junk folder, helping reduce the noise and keep users focused on legitimate communications.</p><p>Security teams will also be able to see these attacks in Microsoft’s Threat Explorer, Advanced Hunting, and other key security dashboards.</p><figure id="figure-5apubajg6dmckpq5x6"><img id="5apubajg6dmckpq5x6" src="https://cdn.durable.co/getty/6kH1zk6jIT7ZLHdc59FlcL1zjDqOcYEDbB1OpFLM8egB1JtGHuo3YnorIHCrdA8n.jpeg" alt="Stressed person sending work emails" title="Stressed person sending work emails" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/6kH1zk6jIT7ZLHdc59FlcL1zjDqOcYEDbB1OpFLM8egB1JtGHuo3YnorIHCrdA8n.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What Else Should You Be Doing?</h3><p><br>While Microsoft’s update is a great start, email threats aren’t going away. Attackers are constantly adapting their tactics. That’s why we recommend a layered approach to email security, especially for small and mid-sized businesses that may not have a full-time security team.</p><p>Here are a few key settings and steps you should have in place:</p><ol><li>Use MFA Everywhere<br>Make sure multi-factor authentication is turned on for all email accounts, especially for admins and executives. Even if someone gets tricked into giving up a password, MFA can block the login.</li><li>Enable Safe Links and Safe Attachments<br>These Microsoft Defender features scan links and files in real time. They’re especially useful for stopping phishing and malware that slips past initial filters.</li><li>Configure Anti-Phishing Policies<br>Make use of Microsoft’s built-in impersonation protection to catch spoofed messages that pretend to come from your CEO, CFO, or other high-risk users.</li><li>Limit Mail Forwarding Rules<br>Attackers often set up hidden forwarding rules after they compromise an inbox. Review your mail flow settings and consider disabling auto-forwarding to external domains unless it's absolutely necessary.</li><li>Monitor for Unusual Login Behavior<br>Enable alerts for sign-ins from suspicious locations or impossible travel scenarios. This can help you catch compromised accounts early.</li><li>Provide Ongoing Security Awareness Training<br>Even with all the right tools, human error is still a big risk. Regular training helps your team spot phishing attempts and avoid common traps like fake IT support calls.</li></ol><figure id="figure-ymp7ki997umckprvjy"><img id="ymp7ki997umckprvjy" src="https://cdn.durable.co/getty/13FeMwCQVOD6Bi4R4v8DRfTJH6iAuh7ioqDcA5TM4UaNTHlBEclyXT6t6odtx5kH.jpeg" alt="Sending encrypted E-Mail protection secure mail internet blue computer keyboard" title="Sending encrypted E-Mail protection secure mail internet blue computer keyboard" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Final Thoughts</h3><p><br>Email bombing may not sound as serious as ransomware, but in many cases, it’s the smoke before the fire. With attackers combining tactics like inbox flooding, voice phishing, and social engineering, it’s more important than ever to make sure your email defenses are up to date.</p><p>Microsoft is helping by adding better default protections. But don’t stop there. Take the time to review your email settings, check your policies, and train your users.</p><p>And if you're not sure whether your email defenses are strong enough, or if you just need a second set of eyes, TechHorizon Consulting can help. Our virtual CISO service gives you expert security guidance without the full-time overhead. We’ll help you assess risks, tune your defenses, and build a strategy that works for your team.</p><p>If you're interested, head over to our Contact Us page. We're happy to help.</p>

Microsoft Defender for Office 365 Adds Email Bombing Protection, What You Need to Know

<h3>Introduction</h3><p>In a troubling development for the insurance industry, a hacking group known as <em>Scattered Spider</em> has launched a series of cyberattacks against major U.S. insurance providers. Unlike traditional ransomware gangs that rely on malicious software, this group exploits people—tricking employees into giving them access through clever social engineering tactics.</p><p>The result? Sensitive customer data may have been exposed, services were disrupted, and companies are left scrambling to respond. Here’s what happened, why it matters, and what can be done to protect against similar attacks in the future.</p><figure id="figure-ocdq0l2iymcccarj4"><img id="ocdq0l2iymcccarj4" src="https://cdn.durable.co/getty/19ioI7D29OssEKjugPACqG1x0LwvQZlYN9sZz06iAlFc5CcucMuj4gur7JlxSjiO.jpeg" alt="Cyber Security Data Breach, data leak, cybersecurity hack, phishing" title="Cyber Security Data Breach, data leak, cybersecurity hack, phishing" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/19ioI7D29OssEKjugPACqG1x0LwvQZlYN9sZz06iAlFc5CcucMuj4gur7JlxSjiO.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Who Is Scattered Spider?</h3><p>Scattered Spider, also known as UNC3944, is a loosely organized hacking group believed to be composed primarily of young English-speaking members based in the U.S. and U.K. They have made a name for themselves by targeting large, high-profile companies in industries such as gaming, telecommunications, and retail.</p><p>What sets them apart is their method. Rather than exploiting software vulnerabilities, Scattered Spider relies on social engineering—posing as employees to gain trust from help desks and support teams. Once they’re in, they use legitimate tools and credentials to move through systems largely undetected.</p><h3>What Happened in June 2025</h3><p>Between June 7 and June 12, three major insurance companies were targeted in quick succession: Erie Insurance, Philadelphia Insurance, and Aflac.</p><p>Erie Insurance reported a disruption to its network operations. While no ransomware was deployed, the company took systems offline to investigate and contain the incident.</p><p>Philadelphia Insurance faced outages in its phone systems, email, and customer portals. The company confirmed unauthorized access but said no sensitive customer data was stolen—though investigations are ongoing.</p><p>Aflac disclosed that a breach had occurred, resulting in unauthorized access to customer information, including Social Security numbers and claims data. While the attack was contained quickly and no ransom was demanded, the exposure of such data raises serious privacy concerns.</p><p>This cluster of attacks suggests a coordinated effort and marks a clear escalation in Scattered Spider’s focus.</p><h3>How the Attacks Work</h3><p>Scattered Spider’s techniques rely heavily on manipulating people, not machines. They typically begin by gathering information on a company’s employees—names, titles, and contact details—often using public sources or stolen credentials from prior breaches.</p><p>Then they initiate contact, usually by calling the help desk and pretending to be an employee in distress. By sounding credible and urgent, they can often persuade staff to reset passwords or bypass multi-factor authentication (MFA) protocols.</p><p>In some cases, they use what's known as "MFA fatigue"—flooding an employee with login requests until they finally approve one out of frustration or confusion.</p><p>Once inside, they use real employee accounts and internal tools to navigate systems, download data, or prepare ransomware attacks. Because they operate using legitimate credentials, detecting them can be extremely difficult without strong behavioral monitoring in place.</p><h3>Why Insurance Companies?</h3><p>Insurance firms are an appealing target for several reasons. First, they hold vast amounts of sensitive data, including health records, financial information, and identification details like Social Security numbers. This type of information is highly valuable on the black market.</p><p>Second, these companies often serve as third-party assessors of cybersecurity risks for others, which can give attackers insights into potential vulnerabilities elsewhere.</p><p>Lastly, disrupting an insurer’s operations has a wide-reaching impact—delaying claims, straining customer support, and eroding trust—which gives attackers leverage, even in the absence of a ransomware demand.</p><h3>The Impact</h3><p>For customers, the fallout can include identity theft, fraudulent claims, and a loss of confidence in how their information is handled.</p><p>For companies, these attacks bring service disruptions, reputational damage, and potential legal and regulatory consequences. Organizations may face lawsuits, regulatory fines, and increased scrutiny from government agencies.</p><p>Even when no ransom is paid, the cost of incident response, forensic investigations, and rebuilding public trust can be substantial.</p><h3>How Companies Can Defend Themselves</h3><p>There is no single solution to prevent these kinds of attacks, but a layered approach significantly reduces risk. Companies should:</p><ul><li>Strengthen help desk protocols by requiring multiple, independent identity verifications before resetting passwords or modifying access rights.</li><li>Replace push-based MFA systems with phishing-resistant alternatives such as security keys or biometrics.</li><li>Continuously train employees to recognize and respond to social engineering attempts.</li><li>Monitor authenticated user activity for unusual behavior, such as access during odd hours or large data transfers.</li><li>Maintain and test an incident response plan that includes input from cybersecurity experts and legal counsel.</li></ul><p>By making it harder for attackers to manipulate people and by quickly detecting suspicious behavior, organizations can reduce both the likelihood and impact of a successful breach.</p><figure id="figure-ptn8sdpybhmcccerub"><img id="ptn8sdpybhmcccerub" src="https://cdn.durable.co/getty/18hLk8RYTf7mYtogijixiHYQWekatcZCGf0vgdACIEuD5DZqVKsBg3cGAVGj8z3X.jpeg" alt="Blue circuitry digital lock on binary code" title="Blue circuitry digital lock on binary code" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/18hLk8RYTf7mYtogijixiHYQWekatcZCGf0vgdACIEuD5DZqVKsBg3cGAVGj8z3X.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Conclusion</h3><p>The recent attacks against insurance companies by Scattered Spider are a stark reminder that cybersecurity threats are evolving. This group doesn’t rely on sophisticated malware or brute-force hacking—instead, they exploit trust, communication, and human error.</p><p>As attackers shift focus to industries rich in personal data, it’s essential for organizations to adapt their defenses accordingly. That means going beyond firewalls and antivirus software, and investing in people, processes, and proactive detection. It's important to remember&nbsp;that these attacks can happen to any company at any time, if your company has concerns about how these attacks could affect operations TechHorizon Consulting can help. We can provide tools like real time network monitoring that stop these attacks in their tracks. If this interests you or your company please visit our "Contact Us" page.&nbsp;&nbsp;</p>

Scattered Spider Strikes: Why Insurance Companies Are Suddenly in the Crosshairs

Cyber security network. Data protection privacy concept

<p>Microsoft just announced some important changes to the way Windows 365 Cloud PCs are secured. Starting in the second half of 2025, new Cloud PCs will come with tighter default security settings—designed to make it harder for attackers to move files around or sneak in malware.</p><p>For small and medium-sized businesses, these changes are good news. But they also raise an important question: are these new defaults enough to protect your company, or do you still need to do more?</p><h3>What’s Actually Changing?</h3><p><br>If you’re setting up a new Cloud PC or reprovisioning an existing one, Microsoft is now turning off some features by default. Specifically, clipboard, drive, USB, and printer redirection will all be disabled. That means users won’t be able to copy files between their Cloud PC and their local device unless you turn that setting back on.</p><p>This helps prevent sensitive data from being accidentally moved, or stolen, and makes it harder for malware to find its way in through things like USB drives.</p><p>It’s worth noting that USB mice, keyboards, and webcams are still allowed. Microsoft is only blocking the kind of USB access that could be risky. So your hardware should still work as expected.</p><p>Microsoft has also added some under the hood protections. New Cloud PCs running Windows 11 now come with virtualization-based security, Credential Guard, and something called HVCI (hypervisor-protected code integrity). In simple terms, these tools help keep malware from messing with your system’s core processes.</p><p>If you’re using Intune or Group Policy, you’ll still be able to override these defaults if your team needs specific redirection features. Microsoft will flag these changes in the Intune Admin Center so you can adjust things as needed.</p><figure id="figure-bdzzm9xxtdmcapd6vk"><img id="bdzzm9xxtdmcapd6vk" src="https://cdn.durable.co/getty/16p1CsKPkWkqiQ8aMTGK57m9QzccAJKcYMwygDiEvzb6AYNuf9lHhnV0LU3N4Ntw.jpeg" alt="Protecting herself from cyber attacks and personal data.Protection data access.Cyber security protection concept." title="Protecting herself from cyber attacks and personal data.Protection data access.Cyber security protection concept." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/16p1CsKPkWkqiQ8aMTGK57m9QzccAJKcYMwygDiEvzb6AYNuf9lHhnV0LU3N4Ntw.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>How This Affects You<br></h3><p><br>For smaller companies, these new defaults are actually a solid step forward. A lot of SMBs don’t have the time or resources to fine-tune every setting in Microsoft’s security stack. With these changes, Microsoft is handling some of that heavy lifting right out of the box.</p><p>But here’s the catch: these updates only apply to new or reprovisioned Cloud PCs. If your existing setup has weak spots, nothing will automatically change. And while these defaults help reduce some risks, they don’t cover everything.</p><p>You’ll still need protection against phishing, insider threats, account takeovers, and a long list of other modern attacks.</p><h3>What Else Should You Be Doing?</h3><p><br>If you want to build on Microsoft’s changes and give your business stronger protection, here are a few key things to focus on:</p><ul><li>Start with multi-factor authentication. It’s one of the easiest ways to prevent account takeovers.</li><li>Make sure you’re running some form of endpoint detection so you know when something suspicious is happening on a Cloud PC or local device.</li><li>Limit who has admin rights. Not everyone needs to install software or change settings.</li><li>Set up some basic data loss prevention rules to catch when sensitive files are moving around in ways they shouldn’t.</li><li>Keep an eye on your audit logs and access controls. These can help you spot trouble before it becomes a bigger problem.</li><li>And don’t forget employee training. Even the best security tools won’t help if someone clicks the wrong link.</li></ul><figure id="figure-sikgiw2gqlmcapi41k"><img id="sikgiw2gqlmcapi41k" src="https://cdn.durable.co/getty/1AxQln4MjCEFp09MtuEL5Y2gJ5LTnb9ucUcFKnfiSEJqjTDJeylnMm2cDIXBtdRJ.jpeg" alt="User enter password for personal information access. Data login protect and secure internet access, padlock technology, cyber security, encryption privacy, Cybersecurity and data protection concept." title="User enter password for personal information access. Data login protect and secure internet access, padlock technology, cyber security, encryption privacy, Cybersecurity and data protection concept." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="null" data-positionY="null" data-fullWidth="false"/></figure><h3>Not Sure If You're Covered?</h3><p><br>Security settings can be tricky, especially when your team is juggling other priorities. If you’re not sure whether Microsoft’s new defaults are enough, or if you’d like help filling in the gaps, we’ve got you covered.</p><p>At TechHorizon Consulting, we offer a virtual CISO service that gives you expert cybersecurity leadership without the full-time cost. We help you make sense of changes like this, understand your risks, and build a plan that fits your business, not someone else’s.</p><p>If that sounds helpful, head over to our Contact Us page. We’re always happy to talk and help you figure out the best next steps.</p>

Microsoft’s New Cloud PC Security Defaults: Are They Enough for Your Business?

<p>In June 2025, the UK’s Information Commissioner’s Office (ICO) imposed a £2.31 million ($3.12 million) fine on genetic testing firm 23andMe, due to failures to comply with data protection regulations following a data breach. This enforcement action is more than a punitive measure—it is a reminder to all organizations that compliance is not optional, especially when handling high-risk data such as genetic information.</p><figure id="figure-p8u0x5sl6omc3kg307"><img id="p8u0x5sl6omc3kg307" src="https://cdn.durable.co/getty/28ZIQKqRFHgAlifHeJJoUSCTPVQg5qJrzD1MkpDZ3MUFSYef56NpBTaLgRImZENL.jpeg" alt="3d render infected DNA molecule over dark background in bokeh light paticles." title="3d render infected DNA molecule over dark background in bokeh light paticles." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/28ZIQKqRFHgAlifHeJJoUSCTPVQg5qJrzD1MkpDZ3MUFSYef56NpBTaLgRImZENL.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What Went Wrong?</h3><p>Between April and September 2023, threat actors successfully carried out a credential-stuffing attack on 23andMe. By exploiting reused passwords, attackers accessed accounts containing&nbsp; sensitive information such as genetic data and family connections. While only a portion of accounts were directly compromised, the breach affected a much wider group due to features that allowed users to share their DNA data with relatives. Over 6.9 million individuals were ultimately impacted, including more than 155,000 UK residents.</p><p>The nature of the data involved—names, locations, ethnic origins, health insights, and raw genetic files—placed the breach in a category far more serious than a typical incident involving email addresses or passwords. According to the ICO, the data exposed is "so sensitive and so immutable" that the potential harm to affected individuals is long-term and irreversible.</p><h3>Regulatory Findings and the Cost of Non-Compliance</h3><p>The ICO’s investigation uncovered multiple violations of the UK General Data Protection Regulation (UK GDPR). These included:</p><ul><li>A failure to implement multi-factor authentication (MFA), despite the sensitivity of the data.</li><li>Inadequate monitoring and detection systems that allowed the attack to persist undetected for months.</li><li>Poor access control mechanisms that allowed users—and, by extension, attackers—to access and download raw genetic data without reauthentication.</li><li>A slow and insufficient response: 23andMe did not fully investigate the breach until data began circulating publicly in October 2023.</li></ul><p>These findings point to systemic non-compliance with fundamental data protection principles. In response, the ICO issued a fine of £2.31 million—reduced from an initial £4.59 million due to financial considerations. The regulator made clear that organizations entrusted with high-risk data are expected to meet the highest standards of data governance and security.</p><h3>Compliance Is Not a Checkbox—It’s a Responsibility</h3><p>This case reinforces that regulatory compliance is not merely a box to tick. It is an ongoing obligation—particularly for organizations operating in regulated sectors or managing sensitive personal data. The ICO’s message is clear: failure to implement well-established security controls, such as MFA and activity monitoring, is a breach of duty that will result in penalties.</p><p>The incident also highlights a broader truth: reputational and financial fallout from non-compliance can be devastating. In early 2025, 23andMe filed for Chapter 11 bankruptcy protection in the United States. The company’s former CEO, Anne Wojcicki, has since moved to acquire its remaining assets via a nonprofit organization and has pledged to prioritize user control and data protection moving forward. But the damage—financial, legal, and reputational—is already done.</p><h3>A Call to Action</h3><p>The enforcement against 23andMe should serve as a wake-up call for any organization collecting, storing, or processing personal data. Regulators are increasingly willing to impose significant penalties for failures to comply with data protection laws, particularly when the data in question is as sensitive as health or genetic information.</p><p>Key areas of focus for organizations seeking to avoid similar outcomes include:</p><ul><li>Authentication and access control: Multi-factor authentication and strong password requirements must be standard.</li><li>Monitoring and detection: Real-time detection is critical for early breach response.</li><li>Data minimization and access governance: Limit who can access what—and require reauthentication for the most sensitive data.</li><li>Incident response readiness: Breach detection, reporting, and mitigation plans must be in place and regularly tested.</li></ul><p>More than ever, data protection authorities expect not only compliance on paper, but evidence of meaningful and proactive efforts to safeguard personal data. Organizations that fall short may not just face fines—they may face irreparable harm to their public image.</p><figure id="figure-hyw2s4rgynmc3khh1x"><img id="hyw2s4rgynmc3khh1x" src="https://cdn.durable.co/getty/33YuMV3c1gMLKcW50o9TTnrZfLcAAgxHEPFfTVacrC1ZOb7pB2sLMfP3j4iIt5EV.jpeg" alt="Businessman holding DNA symbol.Digital healthcare and network connection on virtual interface, medical technology and innovation concept." title="Businessman holding DNA symbol.Digital healthcare and network connection on virtual interface, medical technology and innovation concept." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Conclusion</h3><p>The 23andMe case stands as a clear example of what can happen when regulatory compliance is treated as a secondary concern. In today’s environment, where data is both a strategic asset and a potential liability, maintaining compliance with data protection regulations is not simply a matter of legal necessity—it is central to an organization’s ethical and operational integrity. Compliance with regulations is important even if you're not handling genetic information, if your company has concerns about meeting compliance standards TechHorizon Consulting can help. Our vCISO service can help you to meet challenging compliance metrics and provide real time network monitoring to stop breaches in their tracks. If this interests you or your company visit our "Contact Us" page.&nbsp;</p>

23andMe Fined £2.31 Million: A Reminder of the Cost of Non-Compliance

Satisfaction, Document, Checklist,
Database, Contract, Checkbox, Insurance,
Manager,Technology,Marketing,Security,Choice,Working,Laptop,Success,Finance,Service,Questionnaire,Computer,Paper,Business,Virtual Reality,Organization,Surveyor,Check Mark

<p>Cyber insurance has become an important safety net for businesses facing the growing threat of cyberattacks. Policies promise financial protection against costly incidents like ransomware, data breaches, and business interruption. But recently, many organizations have found that their claims are being denied or only partially paid out. This troubling trend is catching a lot of companies off guard and creating confusion about what cyber insurance really covers.</p><h3>Why Claims Are Being Denied</h3><p><br>Several factors are contributing to the rise in denied cyber insurance claims. One big reason is that insurance providers are tightening their requirements and scrutinizing claims more closely. They are no longer offering broad, one-size-fits-all policies. Instead, policies come with detailed conditions and exclusions that can easily trip up an unprepared business.</p><p>Another challenge is that many companies lack the thorough documentation insurers require to prove the legitimacy and scope of a claim. If your team hasn’t kept detailed incident records or followed best practices for reporting and containment, insurers may reject the claim or dispute the amount owed.</p><p>Some insurers are also pushing back on claims related to ransomware payments. In some cases, they argue that the payment was made without proper approval or that the insured didn’t take sufficient preventative measures. The legal and regulatory environment around ransomware is also evolving, which makes insurers more cautious.</p><figure id="figure-sec6nbbk2hmc0p2qua"><img id="sec6nbbk2hmc0p2qua" src="https://cdn.durable.co/getty/27bl4ET4wJSBjvLvVWGQuIKFUeyVMRBZOEkOzXYkpj05SKelJ3zF0AbMHha28D2w.jpeg" alt="CLAIM, message on keyboard" title="CLAIM, message on keyboard" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/27bl4ET4wJSBjvLvVWGQuIKFUeyVMRBZOEkOzXYkpj05SKelJ3zF0AbMHha28D2w.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What Businesses Need to Do</h3><p><br>To avoid denied claims, businesses must understand their policies fully and prepare well in advance. Start by reviewing your cyber insurance contract carefully. Make sure you know what’s covered, what’s excluded, and what documentation you’ll need if you ever file a claim. Insurance brokers or legal experts can help translate complex policy language.</p><p>Another important step is to invest in strong cybersecurity practices. Insurers increasingly expect businesses to have solid defenses in place. This means patching systems regularly, implementing multi-factor authentication, conducting employee training, and maintaining a comprehensive incident response plan. When insurers see these steps, they are more likely to honor claims and even offer better premiums.</p><p>Documentation is also critical. Make sure to keep detailed records of all security incidents including timestamps, affected systems, actions taken, and communications with external parties like law enforcement or forensic teams. When filing a claim, this information helps demonstrate that you acted responsibly and transparently.</p><figure id="figure-h6fsqvvpqfmc0p26kp"><img id="h6fsqvvpqfmc0p26kp" src="https://cdn.durable.co/getty/0K6KjiegK2gSSaCkDMpjGvK5HRrHeKJgwG0lGZdGyS48fqPhEnx92Hvt6GVOPhhn.jpeg" alt="Digital form checklist, Online survey concept. Person interacts with digital form checklist on laptop with process of filling out online survey and completing digital forms with checkbox and document." title="Digital form checklist, Online survey concept. Person interacts with digital form checklist on laptop with process of filling out online survey and completing digital forms with checkbox and document." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/getty/0K6KjiegK2gSSaCkDMpjGvK5HRrHeKJgwG0lGZdGyS48fqPhEnx92Hvt6GVOPhhn.jpeg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Preparing for the Future</h3><p><br>As cyber threats evolve, so will insurance requirements. Companies should treat cyber insurance as just one part of a broader risk management strategy rather than a silver bullet. Combining insurance with proactive security measures, employee awareness, and strong vendor management will put businesses in the best position to minimize losses and recover quickly.</p><p>If your organization is concerned about your cybersecurity posture or needs help navigating cyber insurance options, TechHorizon Consulting can assist. Our experienced team offers virtual CISO services to help strengthen your defenses and ensure you’re prepared for today’s complex threat landscape. Visit our Contact Us page to learn more.&nbsp;</p>

Articles

Citrix Bleed 2: A Critical New Threat (CVE‑2025‑5777)

Microsoft Defender for Office 365 Adds Email Bombing Prot...

Scattered Spider Strikes: Why Insurance Companies Are Sud...

Microsoft’s New Cloud PC Security Defaults: Are They Enou...

23andMe Fined £2.31 Million: A Reminder of the Cost of No...

The Growing Challenge of Getting Cyber Insurance Claims A...

Articles

Citrix Bleed 2: A Critical New Threat (CVE‑2025‑5777)

Microsoft Defender for Office 365 Adds Email Bombing Prot...

Scattered Spider Strikes: Why Insurance Companies Are Sud...

Microsoft’s New Cloud PC Security Defaults: Are They Enou...

23andMe Fined £2.31 Million: A Reminder of the Cost of No...

The Growing Challenge of Getting Cyber Insurance Claims A...

Citrix Bleed 2: A Critical New Threat (CVE‑2025‑5777)