NCSC – CERT-SE veckobrev v.46
Swedish cybersecurity agencies issue weekly brief highlighting recent cyberattacks and phishing campaigns.
The NCSC-CERT-SE weekly brief from Sweden highlights recent cyberattacks, including extensive disruptions to Microsoft services affecting users in 74 countries. It also details intrusions at furniture company Kinnarps, a data breach at Maersk involving the WhiteArmor ransomware, and exposed booking data from IT provider Amadeus impacting airlines like SAS. Additionally, Sega reported a breach at a third-party vendor exposing customer email addresses, and a threat actor exploited compromised IAM credentials to access multiple customer AWS environments via the Qubole data platform.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis weekly brief illustrates how a single weak link in the supply chain — whether a third-party vendor like Sega's unnamed partner, the Amadeus IT provider, or the Qubole data platform — can cascade into widespread customer data exposure. In the AWS case, a threat actor exploited compromised IAM credentials to pivot laterally across multiple customer environments, demonstrating how poor credential hygiene in a shared platform magnifies blast radius. Organizations are often unaware of the security posture of their technology partners until a breach occurs. This matters because customer trust, regulatory obligations, and operational continuity all depend on the security controls of vendors that organizations may have little direct visibility into.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — WhiteArmor