The inside story of the teenager whose “swatting” calls sent armed police racing into hundreds of schools nationwide—and the private detective who tracked him down.

The School Shootings Were Fake. The Terror Was Real

Misconfigured license-plate-recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes by them.

In just 20 minutes this morning, an automated license-plate-recognition (ALPR) system with an IP address geolocated to Tennessee captured photographs and detailed information from nearly 1,000 vehicles as they passed by. Among them: eight black Jeep Wranglers, six Honda Accords, an ambulance, and a yellow Ford Fiesta with a vanity plate.

This trove of real-time vehicle data, collected by one of Motorola’s ALPR systems, is meant to be accessible by law enforcement. However, a flaw discovered by a security researcher has exposed live video feeds and detailed records of passing vehicles, revealing the staggering scale of surveillance enabled by this widespread technology.

More than 150 Motorola ALPR cameras have exposed their video feeds and leaking data in recent months, according to security researcher Matt Brown, who first publicized the issues in a series of YouTube videos after buying an ALPR camera on eBay and reverse engineering it.

As well as broadcasting live footage accessible to anyone on the internet, the misconfigured cameras also exposed data they have collected, including photos of cars and logs of license plates. The real-time video and data feeds don’t require any usernames or passwords to access.

Alongside other technologists, WIRED has reviewed video feeds from several of the cameras, confirming vehicle data—including makes, models, and colors of cars—have been accidentally exposed. Motorola confirmed the exposures, telling WIRED it was working with its customers to close the access.

Over the last decade, thousands of ALPR cameras have appeared in towns and cities across the US. The cameras, which are manufactured by companies such as Motorola and Flock Safety, automatically take pictures when they detect a car passing by. The cameras and databases of collected data are frequently used by police to search for suspects. ALPR cameras can be placed along roads, on the dashboards of cop cars, and even in trucks. These cameras capture billions of photos of cars—including occasionally bumper stickers, lawn signs, and T-shirts.

“Every one of them that I found exposed was in a fixed location over some roadway,” Brown, who runs cybersecurity company Brown Fine Security, tells WIRED. The exposed video feeds each cover a single lane of traffic, with cars driving through the camera’s view. In some streams, snow is falling. Brown found two streams for each exposed camera system, one in color and another in infrared.

Broadly, when a car passes an ALPR camera, a photograph of the vehicle is taken, and the system uses machine learning to extract text from the license plate. This is stored alongside details such as where the photograph was taken, the time, as well as metadata such as the make and model of the vehicle.

Brown says the camera feeds and vehicle data were likely exposed as they had not been set up on private networks, possibly by law enforcement bodies deploying them, and instead exposed to the internet without any authentication. “It’s been misconfigured. It shouldn’t be open on the public internet,” he says.

WIRED tested the flaw by analyzing data streams from 37 different IP addresses apparently tied to Motorola cameras, spanning more than a dozen cities across the United States, from Omaha, Nebraska, to New York City. Within just 20 minutes, those cameras recorded the make, model, color, and license plates of nearly 4,000 vehicles. Some cars were even captured multiple times—up to three times in some cases—as they passed different cameras.

License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data

Plus: The FBI discovers a historic trove of homemade explosives, new details emerge in China’s hack of the US Treasury Department, and more.

It may be a new year, but the hacks, scams, and dangerous people lurking online haven’t gone anywhere.

Just a day before the ball dropped, the United States Treasury Department said it had been hacked. Officials believe the attackers are an as-yet-unidentified Advanced Persistent Threat group linked to China’s government that exploited flaws in remote tech support software made by BeyondTrust to carry out what the Treasury Department described as a “major” breach. The company told the Treasury on December 8 that the attackers stole an authentication key, which ultimately allowed them to access department computers. While the Treasury says the attackers were only able to steal “certain unclassified documents,” new details have already begun to emerge, which we’ll get into more below.

Before the murder of UnitedHealthcare CEO Brian Thompson last month, gun silencers were mostly a thing you encountered in Hollywood films—or in Facebook and Instagram ads, if you looked closely. WIRED found that someone has run thousands of ads for “fuel filters” that are, in fact, meant to be used as gun silencers, which are heavily regulated by US law. Meta, which owns Facebook and Instagram, has since removed many of the ads, but new ones keep popping up. So if you see one, keep scrolling—owning an unregistered silencer could result in felony charges.

When an Amber Alert push notification pops up on your phone, getting all the information you need to help find an abducted child can literally be a matter of life and death. That’s a lesson the California Highway Patrol learned this week when it sent out an Amber Alert that linked to a post on X, which people couldn’t access unless they were signed in. While CHP says it has linked to posts on the social network since 2018 without any issues until this week, a spokesperson tells WIRED they’re “looking into it” now.

If you’ve added better privacy and security practices to your list of 2025 goals, one easy place to start is your old chat histories. You might be surprised how much sensitive information is out there, perhaps forgotten but definitely not gone.

That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Apple Will Pay $95 Million to End a Siri Privacy Lawsuit**

Apple this week agreed to pay $95 million to settle a class action over its Siri voice assistant’s alleged eavesdropping. The lawsuit, _Lopez et al v. Apple Inc._, accused Apple of recording people’s conversations without their knowledge and sharing that data with third parties to serve advertisements. The issue stemmed from Siri’s voice-activation function—”Hey, Siri”—which two plaintiffs say surreptitiously captured conversations that resulted in ads for Nike shoes and the Olive Garden. One plaintiff claimed to have been served an ad for a medical treatment after having a conversation with his doctor. People who qualify as part of the class covered by the settlement, which must be approved by a federal judge in California, could receive up to $20 per device, for as many as five devices. As Reuters points out, the settlement amount is approximately nine hours of profit for Apple, which made nearly $94 billion in the last fiscal year. The company will not admit to any wrongdoing as part of the agreement.

**FBI Unearths Historic Cache of Homemade Explosives in Virginia**

Newly unsealed court documents revealed that the FBI allegedly discovered during a search for a single illegal firearm the “largest seizure of homemade explosives in FBI history.” According to court records, the explosives arsenal was found at the Virginia home of Brad Spafford, where investigators allegedly found more than 150 pipe bombs and other explosive devices. Prosecutors say the FBI found a backpack containing pipe bombs and adorned with a grenade-shaped patch with the hashtag #NoLivesMatter—a potential reference to a far-right extremist “accelerationist” group, The New York Times reports. While prosecutors claim that Spafford—who allegedly used a photo of US president Joe Biden for target practice—aimed to “bring back political assassinations,” his attorney contends that he is a harmless “family man” who should be granted release

**China’s State-Backed Hackers Targeted US Sanctions Office, Treasury Leadership**

Following revelations earlier this week that Chinese state-backed hackers breached the US Treasury in early December, the Washington Post reported on Wednesday that the hackers specifically targeted the Office of Foreign Assets Control. The attackers may have been looking for information about the Office’s possible plans to sanction Chinese entities. Additionally, Bloomberg reported on Thursday that the attackers targeted the computers of senior Treasury officials, where they were able to access unclassified material. Thus far, investigators have reportedly identified about 100 computers compromised by the hackers. Sources told Bloomberg, though, that the attack seems to have been more of a crime of opportunity than a clandestine, long-planned operation like China’s recent infiltration of US telecom companies.

**White House Chides Telecoms for Lax Security Following China Hack**

As China’s Treasury hack comes into focus, the impact of its intrusions into American telecommunications firms is still widening. Two days after Christmas, Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, held a briefing with reporters in which she raised the count of telecoms breached by the Chinese hackers known as Salt Typhoon from eight to nine and suggested that at least some of the blame for those breaches lies with the companies’ own inadequate security. “The reality is that, from what we’re seeing regarding the level of cybersecurity implemented across the telecom sector, those networks are not as defensible as they need to be to defend against a well-resourced, capable offensive cyber actor like China,” Neuberger said. She added that the hackers had targeted the communications histories of fewer than 100 people—mostly in Washington, DC, reportedly including president-elect Donald Trump and vice president-elect JD Vance. Neuberger said that the espionage incident calls for new Federal Communications Commission cybersecurity regulations that she says might have limited the scope of the breaches had they been in place.

**Volkswagen Exposed Location Data for 800,000 Electric Vehicles**

Cars collect and transmit as much sensitive location data as any modern digital device, and the privacy pitfalls of all that tracking are becoming all too clear. Case in point: A whistleblower warned Germany’s Chaos Computer Club and the country’s Der Spiegel news outlet that Cariad, a subsidiary of Volkswagen, left exposed online a trove of 800,000 electric vehicles’ location data. The leak included cars sold by not only Volkswagen but also other brands, including Seats, Audi, and Skoda. For Audi and Skoda, that location data was accurate only to within about six miles, but Volkswagen and Seats cars could be located to within about four inches. The exposed data has since been secured, but the incident nonetheless demonstrates how far carmakers have yet to go to rein in their data collection.

Apple May Owe You $20 in a Siri Privacy Lawsuit Settlement

Many people reported they hit a screen preventing them from seeing the alert unless they signed in.

Earlier this week, the California Highway Patrol sent an Amber Alert push notification to phones in the Los Angeles area about a 14-year-old girl that authorities believed had been abducted. But instead of conveying vital information that could help locate the victim within the notification itself, the law enforcement agency linked to a post from its official X account, a practice it adopted six years ago. But this time, many people reported they could not view the alert because they hit a screen that prevents users from seeing any content on X until they sign in to their account.

The California Highway Patrol told WIRED it was aware of the issue and had reached out to X for more information. “We’re looking into it,” Sergeant Dan Keane said. X did not respond to a request for comment.

Amber Alerts are issued by local law enforcement agencies to help locate children who are believed to have been abducted and are at risk of dying or serious injury. In California, the California Highway Patrol’s Emergency Notification and Tactical Alert Center is tasked with issuing the alerts. The law enforcement agency told WIRED it has used X (formerly Twitter) to push out the notifications since 2018 without any problems, at least until this incident.

On other social platforms, including Reddit, Threads, and Bluesky, local California residents vented their frustrations about being unable to receive the details of an emergency happening in their community. “This should be illegal and everyone should be upset about this. If that alert was for my child and tons of people couldn’t see it because they don’t have a stupid X account, I would be beyond infuriated,” one person wrote on Reddit. “Why the fuck should a social media platform benefit from people wanting to be good citizens and informed about missing kids?” another asked on Threads.

Some users reported they didn’t need to log in to see the California Highway Patrol’s X post, which was sent via a URL created using the Bitly link shortener service. It’s unclear what percentage of people who received the push notification were able to view the information about the missing girl and what percentage hit X’s log-in gate. Overall, only 21 percent of US adults say they ever use X, according to the Pew Research Center, not all of whom may have the app installed on their phones.

After Elon Musk took over Twitter more than two years ago, the billionaire rapidly laid off the majority of the social media site’s existing employees and instituted sweeping changes to its moderation and verification policies. The shifts spurred concerns that Twitter would become less reliable for emergency communications. The incident this week in California suggests at least some of these fears were founded.

“Requiring a login creates accessibility challenges and raises concerns about digital equity. Everyone should be able to access life-critical information, regardless of whether they use a specific platform,” says Amanda Lee Hughes, a professor of computer science at Brigham Young University who has studied digital emergency communications tools.

People in Missouri reported encountering a similar issue in July 2023, when the Missouri Highway Patrol sent out an Amber Alert push notification with a link to an X post. Local residents similarly spoke out about how they could not see the alert unless they logged on to the platform. “It was quite a change” from how the alerts used to work, says Missouri Highway Patrol lieutenant Eric Brown, who works in the public information and education department.

But the incident ultimately didn’t prompt the Missouri Highway Patrol to abandon X as its go-to platform for Amber Alert push notifications. According to Brown, when X verified the law enforcement agency's account as an official government entity, the log-in issue problem went away, and the public could once again access its posts.

Several of the California Highway Patrol’s official X accounts have the same verification badge as the Missouri Highway Patrol, including the one devoted specifically to disseminating active alerts statewide. However, not all of the California agency’s accounts appear to be verified, including what looks like the official channel for the CHP’s Southern Division, which includes Los Angeles county.

When it was known as Twitter, X was widely viewed as an essential part of global disaster and emergency communications infrastructure. Government officials and agencies around the world relied on the service as a way to broadcast information about hurricanes, mass shootings, and other crises. Before Musk took over the platform in 2022, anyone could view public tweets in their browser regardless of whether they had an account on the site or had installed Twitter’s mobile app. (In 2015, the company reported that more than 500 million people visited Twitter’s site per month without logging in.)

In June 2023, reports that X had started locking content behind a log-in screen began popping up online. At the time, Musk called the move a “temporary emergency measure” that was put in place because X was “getting data pillaged so much it was degrading the service.” It’s unclear exactly what Musk was referring to, but that same month he expressed concerns about AI companies like OpenAI allegedly scraping Twitter posts without prior authorization.

It now looks like the decision to turn X into a more closed platform stuck. According to tests conducted this week, X has continued to limit what people without accounts can see. WIRED looked at several of its staff reporters’ X accounts without logging in, for example, and was only able to view a sampling of their popular posts rather than a comprehensive chronological feed. It does appear that accounts run by government entities are not restricted in this way; all of the posts shared by the California Highway Patrol’s alerts account can be viewed without logging in.

Aside from allowing anyone to view content shared on the platform, another way Twitter previously helped emergency communicators was by giving them free access to its API, which Musk later revoked. That allowed organizations like the US National Tsunami Warning Center to send automatic alerts about potentially deadly natural disasters. Researchers and first responders could also use the API to monitor activity across Twitter and “extract key insights, such as identifying risk hot spots or combating misinformation,” says Hughes. “The platform’s role has shifted as policies and public usage evolve, so its effectiveness today may look quite different.”

Despite these drawbacks, X still remains an important platform for relaying information during emergency situations. In October, several government information officers emergency told PRWeek they planned to continue posting updates on X despite its diminished usefulness, because they had amassed large followings on the site and their priority ultimately remains ensuring that accurate information reaches as many people as possible. But the incident in California this week highlights how government agencies can run into problems when third-party services once considered reliable later change their policies in an unpredictable ways.

Californians Say X Blocked Them From Viewing Amber Alert About Missing 14-Year-Old

A network of Facebook pages has been advertising “fuel filters” that are actually meant to be used as silencers, which are heavily regulated by US law. Even US military officials are concerned.

Thousands of ads on Facebook and Instagram have promoted “fuel filters” using videos demonstrating how they can be easily modified into gun silencers—a process that, without federal approval, could lead to felony charges. Despite Meta’s policies banning ads for silencers on the company’s social networks, the promotions have persisted for years, driven by what appears to be a single network of more than 100 Facebook pages marketing “fuel filters” that can be easily turned into gun silencers, WIRED has found. The devices sell for as little as $50.

Silencers, also known as suppressors, are heavily regulated under United States federal law. Purchasing one legally requires submitting fingerprints, passing a background check, and paying a fee to the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Federal law allows people to build their own suppressors, provided they register the device with the ATF. But the ads don’t mention this key stipulation, marketing silencers to buyers who may not understand the legal risks.

“You know those things that are definitely not suppressors, even though they look just like suppressors,” a man says in a video that appears in many of the ads. “Well, but they’re still not suppressors, because they don’t have a hole in the other end. So, you can legally own one without going through the paperwork to own a suppressor, because it isn’t one.”

The ads often recycle the same text, referencing “light and durable air-grade aluminum,” and use videos stitched together from a handful of YouTube clips featuring firearms influencers and enthusiasts. The original creators of these videos are likely unaware their content is being used; one tells WIRED they had deleted the footage from YouTube years ago.

One ad features a suppressor engraved with the words Black Collar Arms. A co-owner of Black Collar Arms, who goes by Jeremy McSorely, tells WIRED his company has no connection to the ad. McSorely explains that the footage was taken from a blog and YouTube video he had uploaded years ago but has since removed. “The photos you saw were screenshots taken from my video,” he says, emphasizing that the suppressor was legally manufactured and engraved with their corporate information to comply with ATF regulations.

In November 2023, the ATF warned federal firearms licensees about marketing silencers as “solvent traps,” or contraptions purportedly used to collect gun oil and residue during cleaning. The agency clarified that legality depends on functionality, not what you call a product, and stressed that even incomplete parts intended for silencers are regulated under federal law.

“The test for whether an item is a silencer is not the label a manufacturer or retailer applies. Rather, it is the way the statute written by Congress applies to the item,” the ATF wrote, referring to definitions of suppressors in the Gun Control Act and the National Firearms Act.

A WIRED analysis of more than 2,800 ads revealed they are linked to a network of hundreds of ecommerce websites. These sites often reuse code, share IP addresses, and peddle the same low-quality knockoff products alongside the “fuel filters.” At least one of the sites was flagged by Google as a likely phishing scam.

Experts believe the operation is based in China and relies on a drop-shipping scheme. “It’s likely just a reshipper selling controversial or illegal products,” says Zach Edwards, a senior threat researcher at cybersecurity firm Silent Push who specializes in online data ecosystems.

Typically, Edwards explains, drop-shippers wait for a customer to place an order, then purchase the item from inexpensive online retailers, repackage it, and ship it to the customers. Edwards says that the operator behind the network is likely creating hundreds of websites, applying a moderate markup to the products, and spinning up Facebook pages to promote their items. “Even if some sites or ads get caught and taken down, others keep running,” Edwards says. “It’s a spray-and-pray method.”

Meta explicitly bans ads promoting weapons, silencers, and related modifications. According to Meta, ads are reviewed by an automated system with support from human moderators. However, enforcement has been inconsistent: While at least 74 of the ad campaigns in our analysis were removed for violating the platforms’ terms, the rest appeared to have run successfully.

After WIRED reached out to Meta, the company said that it removed the ads and associated advertising accounts. However, a quick search of Meta’s Ad Library revealed that nearly identical ones have since been published.

“Bad actors constantly evolve their tactics to avoid enforcement, which is why we continue to invest in tools and technology to help identify and remove prohibited content,” Meta spokesperson Daniel Roberts wrote in a statement.

Roberts says that many of the ads flagged by WIRED had little to no engagement, suggesting few people ever saw this content. However, at least two ads reviewed by WIRED had thousands of comments, including accusations that it was an ATF honeypot, complaints from self-identified buyers whose products never arrived, and even testimonials from others claiming the item worked as advertised. WIRED reached out to several commenters who said they had purchased the product—none responded.

The ads have also drawn the attention of US Department of Defense officials. An internal presentation to Pentagon staff, viewed by WIRED, claims that the targeted ad for a fuel filter had been served to US military personnel on a government computer at the Pentagon. The presentation, which a source says was delivered to high-ranking general officers, including the US Army’s chief information officer, raised flags over how social media algorithms are being used to target service members.

Meta’s Ad Library provides limited transparency, leaving it unclear exactly how these ads are targeted. Researchers suggest that Meta’s powerful ad tools, which allow advertisers to find niche audiences using granular targeting options, could be exploited to reach gun enthusiasts or military personnel. While Roberts confirmed that Meta did not detect any indication that these ads were targeting the military, WIRED found that advertisers can easily target users who list their job title as “US Army” or “military” on their profiles—an audience that Meta estimates includes up to 46,134 people.

Meta’s platforms have long struggled to prevent the sale of firearms and related products. An October 2024 joint report by the Tech Transparency Project found that more than 230 ads for rifles and ghost guns had run on Facebook and Instagram in nearly three months. Many of these ads directed buyers to third-party platforms like Telegram to complete transactions. In 2024, two Los Angeles County men were charged with operating an “unlicensed firearm dealing business” that used Instagram accounts to advertise and market the sale of more than 60 firearms, which included some untraceable ghost guns and weapons with scratched-off serial numbers. Both individuals have since pleaded guilty.

Silencers are rarely used in crimes, but their use is on the rise—nearly 5 million are registered in the United States, up from 1.3 million in 2017. Last month, 26-year-old software engineer Luigi Mangione allegedly used a 3D-printed gun equipped with a silencer to fatally shoot UnitedHealthcare CEO Brian Thompson on a street in midtown Manhattan.

Facebook and Instagram Ads Push Gun Silencers Disguised as Car Parts

Your messages going back years are likely still lurking online, potentially exposing sensitive information you forgot existed. But there's no time like the present to do some digital decluttering.

If you're worried about possible expansions of government surveillance and access to your information, or simply want to do some digital purging so you're not saddled with old data, there are a bunch of concrete steps you can take to protect your digital privacy. Just as archeologists study carefully preserved tombs and ancient trash heaps to gain insight into historic communities, your long-forgotten digital footprint could be more revealing and sensitive than you realize. And while you can't control everything—particularly information stolen in breaches or gathered by data brokers—you probably have a digital attic full of old data that you can delete or download and save offline. First stop? Old message histories.

Chats are a good place to start your digital decluttering. Their real-time nature makes it easy to forget that if you don't have auto-delete turned on for a chat (or if a platform doesn't offer it), all of those “be there in 10 minutes,” “wait, what color is this dress???” and “welp, I have covid” messages are still knocking around years later. If you sent them on an end-to-end encrypted platform like Signal or WhatsApp, they only exist on your device and the devices of the other person or people you were chatting with. That means that for governments or bad actors to read them, they would need direct control of your device—a good level of protection, though not foolproof.

Crucially, though, messages that you sent on regular web apps like Slack, Facebook Messenger for most of its history, and Google Chat/Hangouts/Gchat are sitting on a cloud server somewhere. And while they're probably stored in an encrypted form to protect against theft, the platform itself has the keys to decrypt your data and would be able to comply with government requests for it, no matter how old the information is. Sure, all of those “u up?"s may not seem significant now, but years and years of chat histories can paint a very detailed picture of your life, associations, political beliefs, and past movements and activity.

“Doing a good digital cleaning from time to time is a great habit, especially with social media and old chat messages,” says Kenn White, security principal at the database developer MongoDB and director of the Open Crypto Audit Project. “Who you were five or 10 years ago is probably very different than who you are today, so it's worth asking yourself, ‘Do I really need those seven-year-old inside jokes and sarcastic posts? Do I need to keep old group chat messages and carry them forward to every new phone I get?’”

Some programs like Apple's Messages make it easy to auto-delete your chat histories after a set period of time. On iOS, go to **Settings** > **Apps** > **Messages** and then scroll and tap **Keep Messages**. Then choose whether to keep messages forever, for one year, or for 30 days before auto-deleting.

On the free version of Slack, data older than a year is automatically deleted. The company keeps data forever on paid plans, unless the administrator sets up rolling deletion. This is useful if you have an active Slack with your friends, but most people who use Slack at work don't make decisions about administrative policies and can't control deletion. Keep this in mind for any communication you do on an employer's platforms. You may be able to go through and delete messages or files one by one, but you likely won't have the access to make policy decisions about automatic or batch deletion.

Similarly, you may want to go through your chats on Android or iOS and delete old SMS conversations. Meta's Messenger now offers auto-delete options, but for your existing chats, you have to go down the list on desktop or in the Messenger mobile app and delete chats one by one. Meta's other chat platforms, Instagram Chat and WhatsApp, are similar, except that WhatsApp has been end-to-end encrypted since 2016 instead of adding the protection recently.

Consider whether you've spent time chatting on other social platforms as well. X, for example, has been through a lot of changes since Elon Musk bought Twitter more than two years ago and took the company private again. Musk promised that he would add end-to-end encryption to DMs on X, and eventually debuted an opt-in encryption feature with the paid tier of the platform, but the company doesn't definitively say that the tool offers full end-to-end encryption and it isn't open source for vetting. You can delete individual messages or go through your chat list and delete whole DM conversations if you want to pare down the data you're keeping on the platform.

If you've had Gmail for a long time, the messenger service “Google Talk,” once colloquially known as “Gchat,” may have a special place in your heart. And perhaps, over the years, you went through the saga in which Gchat—which was once known for interoperability with platforms like AIM—became the siloed Google chat platform Hangouts, and then transformed again into what is now called Google Chat. Your chats on this platform through the years are still hanging around, but they're not all in the same place.

The crucial thing to understand is that Gchat was fully integrated with Gmail and wasn't a separate platform, so your chat histories all saved in your mail archive. To find them now, open Gmail and **search for the phrase in:chats** (using no quotation marks). Hundreds or thousands of chats from May 2013 and earlier may pop up. They must be deleted directly from Gmail. After May 2013, Google migrated Gchat users to Hangouts, and that history has come forward into what is now Google Chat, so you can delete whole chats or individual messages there.

“Messages sent and received with history on in Google Talk from before May 2013 (the time when Google Hangouts launched) are stored in Gmail under the ‘in:chats’ label. Those messages are not available in Google Chat and can be deleted directly from Gmail only,” Google spokesperson Ross Richendrfer tells WIRED. “In terms of Hangouts data—which was merged with Chat—core Chat controls (including deletion) will work.”

There are lots of other chat apps to consider, too, where old messages may still be lurking. Think about Skype chat or GroupMe. And there's one other complicating factor when you declutter your messages: Most deletion features only delete data from your account, and the messages live on in the accounts of the person or people you were chatting with. To do a total digital detox you need to recruit your community to delete their message archives as well.

Additionally, you may feel sentimental about burning your letters (aka deleting all of your old chats). If you're sad about hitting that trash icon, consider downloading chat histories with your closest friends or other loved ones and storing them on an encrypted external hard drive before deleting them from the cloud. This way, you don't have to give up that slice of life completely, but the data isn't controlled by other entities anymore.

“Some apps, including Signal, give one the ability to set a ‘self-destruct’ time on messages, perhaps in hours or weeks. This is worth considering to reduce your exposure, particularly if you travel outside the country, are politically active, or in any way have a higher public profile,” MongoDB's White says. “It's easy to dismiss the potential of attacks on our personal data and physical safety as something that's only a concern for some James Bond–type scenarios, but the hard truth is that threats exist in many forms, both online and in person.”

Hey, Maybe It's Time to Delete Some Old Chat Histories

Treasury says hackers accessed “certain unclassified documents” in a “major” breach, but experts believe the attack’s impacts could prove to be more significant as new details emerge.

A disclosure notice to the United States Congress on Monday revealed that the US Treasury Department suffered a breach earlier this month that allowed hackers to remotely access some Treasury computers and “certain unclassified documents.”

The attackers exploited vulnerabilities in remote tech support software provided by the identity and access management firm BeyondTrust, and Treasury said in its letter to lawmakers that “the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor.” Reuters first reported the disclosure and its contents.

In the notice, Treasury officials said that BeyondTrust notified the agency of the incident on December 8 after attackers were able to steal an authentication key and use it to bypass system defenses and gain access to Treasury workstations.

“The compromised BeyondTrust service has been taken offline and at this time there is no evidence indicating the threat actor has continued access to Treasury information,” Treasury assistant secretary for management Aditi Hardikar wrote the lawmakers. “In accordance with Treasury policy, intrusions attributable to an APT are considered a major cybersecurity incident.”

The disclosure says that Treasury has been collaborating with the FBI, the Cybersecurity and Infrastructure Security Agency, and the intelligence community broadly as well as private “forensic investigators” to evaluate the situation. The Treasury and FBI did not immediately return WIRED's request for additional information about the breach. CISA referred questions back to the Treasury Department. BeyondTrust was not immediately available for comment about the situation.

On December 8, BeyondTrust published an alert that it has continued to update about “a security incident that involved a limited number of Remote Support SaaS customers.” (SaaS stands for “software as a service.”) Though the notification does not say that the US Treasury was one of the impacted customers, the timeline and details appear to line up with the Treasury disclosure, including acknowledgment from BeyondTrust that attackers compromised an application programming interface key.

The BeyondTrust alert mentions two exploited vulnerabilities involved in the situation—the critical command injection vulnerability "CVE-2024-12356" and the medium-severity command injection vulnerability "CVE-2024-12686." CISA added the former CVE to its “Known Exploited Vulnerabilities Catalog” on December 19. Command injection vulnerabilities are common application flaws that can be easily exploited to gain access to a target's systems.

“I cannot believe that we're seeing command injection vulnerabilities in 2024 in any products, let alone a secure remote access product that's supposed to have additional vetting for use by the US government,” says Jake Williams, vice president of research and development at the cybersecurity consultancy Hunter Strategy and a former NSA hacker. “They are some of the easiest bugs to identify and remediate at this point.”

BeyondTrust is an accredited “Federal Risk and Authorization Management Program” vendor, but Williams speculates that it is possible that the Treasury was using a non-FedRAMP version of the company's Remote Support and Privileged Remote Access cloud products. If the breach actually affected FedRAMP-certified cloud infrastructure, though, Williams says, “it might be the first breach of one and almost certainly the first time FedRAMP cloud tools were abused to facilitate remote access to a customer's systems.”

The breach comes as US officials have been scrambling to address a massive espionage campaign compromising US telecoms that has been attributed to the China-backed hacking group known as Salt Typhoon. White House officials told reporters on Friday that Salt Typhoon breached nine US telecoms.

“We wouldn’t leave our homes, our offices, unlocked and yet our critical infrastructure—the private companies owning and operating our critical infrastructure—often do not have the basic cybersecurity practices in place that would make our infrastructure riskier, costlier, and harder for countries and criminals to attack,” Anne Neuberger, deputy national security adviser for cyber and emerging technology, said on Friday.

Treasury, CISA, and FBI officials did not respond to WIRED's questions about whether the actor that breached the Treasury was specifically Salt Typhoon. Treasury officials said in the disclosure to Congress that they would provide more information about the incident in the Department's mandated 30-day supplemental notification report. As details continue to emerge, Hunter Strategy's Williams says that the scale and scope of the breach may be even larger than it currently appears.

“I expect the impact to be more significant than access to just a few unclassified documents,” he says.

US Treasury Department Admits It Got Hacked by China

From Elon Musk and Donald Trump to state-sponsored hackers and crypto scammers, this was the year the online agents of chaos gained ground.

For its entire existence as a global medium, the internet's evolution has been caught in a tug of war, pulled by opposing forces: on one side, moderation and control; on the other, disruption and anarchy.

This year, the most prominent actors weighing in on the side of disruption were familiar faces: The reckless oligarchs, cybercriminals, scammers, and state-sponsored hackers who made the internet feel particularly dangerous in 2024 were, to some degree, the same forces destabilizing the online world in 2023. But perhaps more than in any other recent year, those agents of chaos seemed to persist in the face of opposition, to grow in their influence—and to win.

From Elon Musk's completed remake of X in his own tech-bro image to Trump's disinformation-fueled campaign, to Russia's ongoing cyberattacks against Ukraine, to China's relentless onslaught of digital intrusions and crypto scammers' global spread, the online experience of 2024 was messy, hazardous, and Hobbesian. And for the most part, the people who made it that way are poised to exert even more influence over the year to come.

As we do every year, WIRED has assembled a list of the most dangerous people, groups, and organizations on the internet. Here are our picks for 2024.

**Elon Musk**

After years of evolution from entrepreneur to edgelord, Musk seemed to reach his final form this year in the run-up to November's US election. Once a technologist with ambiguous politics who occasionally pursued public arguments against scuba divers, Musk now uses his megaphone of 200-million-plus followers on X, the social media platform he fully controls, to broadcast an unrelenting stream of anti-regulation, anti-immigrant, anti-transgender, anti-press, anti-progressive talking points. He's amplified and repeated disinformation, like claims after the disastrous damage done by Hurricanes Helene and Milton that the Federal Emergency Management Agency (FEMA) was hoarding supplies or had spent its budget on migrants instead of needy Americans. He's repeated debunked theories about voter fraud and immigrants swinging elections. In at least one case, he's even seemed to drop a reference that suggest support for the QAnon movement, which maintains bizarre theories about satanic pedophile rings that only Donald Trump can destroy.

Meanwhile, Musk continues to push his AI startup, xAI, toward one of the most no-holds-barred visions of what that technology can make possible, with little regard for safety or preventing its use for disinformation. The company this year launched new image-generation capabilities in its Grok tool that were immediately used to create images of copyrighted characters, celebrities, and political figures in compromising or sexual positions. Musk himself at one point posted an AI-generated deepfake of Kamala Harris that mocked her with her own voice—with no annotation that it was not authentic—that received 150 million views.

More than any particular political message or technology he's pushed, however, the danger Musk represents is simply that the richest man in the world can buy one of the internet's most vital media platforms, then use it, along with hundreds of millions of dollars in donations, to elect the president of his choosing and shape US policy. After Trump's election, Musk was rewarded with hundreds of billions more in net worth. The system, in other words, is working—for oligarchs like Elon Musk.

**Donald Trump**

For the next four years, Donald Trump will once again be the most powerful single person in the world. This year, he was just a very loud one. On social media platforms like X—where Musk reinstated Trump's account despite a 2021 ban following his incitement of the January 6 storming of the US Capitol—and Trump's own Truth Social, he lit fires with false claims that arguably helped fuel his path to political victory. Like Musk, he made and repeated falsehoods such as FEMA spending its budget on immigrants rather than hurricane victims, or that immigrants were stealing and eating pets. By converting Robert F. Kennedy Jr. from a third-party candidate to an endorsing ally, Trump also reciprocally endorsed RFK Jr.'s long-running stream of anti-vaccine misinformation, rhetoric that has led to childhood vaccine rates now dipping to a lower level than before the Covid-19 pandemic.

Once his second term in office begins, Trump is poised to use digital surveillance to carry out a highly disruptive and even vindictive agenda: He's promised mass deportations of millions of immigrants starting on day one of his administration, and he's vowed to target political opponents and journalists with prosecution. There's little doubt that Trump will top this list in 2025. But in 2024, his words alone represent a clear and present danger.

**Volt Typhoon**

In the cybersecurity world, the last months of 2024 have been dominated by warnings from public officials about a Chinese state-sponsored hacking group known as Salt Typhoon, which has penetrated at least eight telecoms, in some cases accessing the real-time calls and texts of Americans. But in the midst of that cyberespionage scandal, a different, far more dangerous digital threat from China still quietly looms: A Chinese state-sponsored group called Volt Typhoon spent much of 2024 continuing its stealthy campaign to breach US critical infrastructure facilities—not to spy on communications, but to prepare for a potential cyberattack. While headlines about Volt Typhoon have largely dissipated since it was first called out and named by Microsoft in May of 2023, officials warn that the group continues to “pre-position” itself inside of networks that appear to be chosen for maximum disruption, perhaps timed to a Chinese invasion of Taiwan. Given that Chinese head of state Xi Jinping has told his country's military to be prepared for that invasion by 2027, now is the time to head off the digital salient of what could be a world-shaking future war.

**Sandworm**

While Volt Typhoon prepares, Sandworm attacks. The Russian hacking group, a unit of the country's GRU military intelligence agency, has in fact carried out many of the most disruptive cyberattacks of the past decade. Those attacks—mostly in Ukraine—include at least three blackouts triggered by its hacking, the destructive NotPetya malware that spread around the globe and inflicted $10 billion in damage, and countless data-destroying breaches that the group has carried out since the beginning of Russia's full-scale invasion of Ukraine in 2022. In 2024, as Russia fought Ukraine to a stalemate or regained territory in the east of the country, Sandworm continued to project its power beyond that front: Security firm StrikeReady discovered Sandworm targeting Ukraine's energy sector again this fall, perhaps in preparation for another round of electrical utility hacking, either to carry out its own attacks or as reconnaissance for the Russian military's now-annual physical bombing of Ukraine's grid.

**Israeli Military and Intelligence**

Last year, WIRED named both the IDF and Hamas on this list, a nod to each side's use of the internet in its propaganda efforts in the war in Gaza following Hamas' October 7 attack. This year, with Israel's adversaries in that conflict like Hamas and Hezbollah significantly weakened and in retreat, it's the Israeli forces that remain on the offensive. Israel's military continues to use AI tooling to identify targets for bombs as its strikes have killed tens of thousands of Gazan civilians and leveled entire cities in the territory. Israeli missiles continue to intermittently knock out Gaza's communications infrastructure, destroying 80 percent of the country's top telecom's cell towers and leading to information blackouts amid the destruction and starvation of that now year-plus siege. Add to all of that a still-mysterious Israeli supply chain attack that hid lethal explosives in pagers and walkie-talkies in an effort to target Hezbollah operatives, which led to immediate distrust of all communications devices in the country, and Israel's government forces remain an internet apex predator by any definition.

**Black Cat/AlphV/RansomHub**

Ransomware in 2024 was, again, one of the most abhorrent forms of cybercrime to blight the internet. But few ransomware attacks in history have been quite as dangerous and damaging as the one that targeted UnitedHealthcare subsidiary Change Healthcare early this year, carried out by a ransomware group known as Black Cat or AlphV. Even after extracting a $22 million ransom from the company—a payment processor that handles around 40 percent of all health care insurance claims across the US—the hackers' disruption of Change's network continued to prevent the company from completing payments to pharmacies, clinics, health care practices, and hospitals across the country for weeks, causing some to even go out of business. Then, as if it hadn't inflicted enough chaos, AlphV ran off with Change's ransom money instead of sharing it with a group of hackers with whom it had partnered to infiltrate the company. That led the jilted hackers to share the data stolen from Change Healthcare with another, newer ransomware crew called RansomHub, which extorted the company a second time—an unprecedented health care cybersecurity debacle.

**The Com**

Even in an age of state-sponsored Chinese cyberspies, Russian hacker saboteurs, and ransomware gangs, nihilistic young hackers remain a constant in the darker corners of the internet. And few of those corners are as dark as the ones frequented by the Com. The loose movement of online trolls and criminals who operate under the Com banner in channels on Telegram and Discord, many just in their teens, engage in some of the most despicable digital crimes possible, from petty crypto theft and ransomware to sextortion, harassment, and the creation and trade of child sexual abuse material. This year, several members of a Com subgroup of ransomware hackers known as Scattered Spider were arrested, following their alleged high-profile 2023 attacks on companies including Caesar's Entertainment and MGM Resorts. But other members of the group are allegedly responsible for the serial breaches of well over a hundred customers of the cloud provider Snowflake. It's a safe bet that the Com will continue to serve as a haven for plenty more criminal acts to come.

**Data Brokers**

Once, privacy fears centered on government agencies like the FBI and NSA and their ability to carry out mass surveillance worldwide. Now, increasingly, we give away that same surveillance data en masse to companies you've never heard of. This year, it came to light that several data brokers collect and then sell access to Americans' highly granular location data pulled from their phones. Surveillance services like Babel Street's LocateX allegedly can—and do—track visitors to sensitive locations abortion clinic or mosques. A data broker called Near Intelligence left a vast cache of location data exposed online, revealing the movements of hundreds of visitors to sex trafficker Jeffrey Epstein's island in the Caribbean. Reporting on both companies has demonstrated how much private location data our devices leave behind as revelatory digital detritus, and how the possession of that data now extends far beyond government agencies to little-known firms with highly questionable privacy and security practices.

**Character.AI**

If 2023 was the year that AI tools future-shocked the internet with their seemingly abrupt rise to prominence, 2024 was the year that those tools became normalized, quietly settling into common use in spite of all their alleged flaws and ethical problems. Yet those issues are still there, and perhaps no startup better exemplifies them than Character.AI, an AI firm backed by $2.7 billion in investment from Google. According to lawsuits filed in Texas and Florida against the company, its chatbots have encouraged children to engage in self-harm and violence against their parents, and allegedly contributed to 14-year-old dying by suicide. Other chatbots hosted by the company have allegedly coached kids into developing eating disorders, role-playing as school shooters, and even seemed to be sexually grooming them. Despite repeatedly vowing to implement age restrictions, no meaningful age safeguards appear to have been added even now, according to news outlet Futurism. If this is the future of artificial intelligence, the AI era is going to be a dark age indeed.

**Crypto Scammers**

The crypto-based investment scams known as “pig butchering”—a term experts now say should be retired because it can further harm victims—pulled in a staggering $37 billion in 2023, and likely more in 2024. The victims of that explosively growing form of crimes aren't just those who fall for its scams and lose their life savings, but also many of the perpetrators of the scams themselves: As many as 200,000 people have been enslaved in compounds across Southeast Asia and forced to carry out the fraud schemes. In some cases, they've been kept in electrified shackles and faced threats of cattle prods and beatings from the gangs overseeing their work. This year, the dystopia those scammers have ushered in has begun to spread worldwide, with operations cropping up in the Middle East, Eastern Europe, Latin America, and West Africa. The targets of their fraud, of course, are even more global. Crypto scams have already become a top-tier form of cybercrime, and there's no end in sight to the expansion of this predatory underworld industry.

The Most Dangerous People on the Internet in 2024

Smartphones and face recognition are being combined to create new digital travel documents. The paper passport’s days are numbered—despite new privacy risks.

In a matter of years, no matter where you live or travel, your face will likely be your new passport.

For centuries, people have used some form of passport while moving from place to place. But the widespread standardization of passports as we know them today didn’t really begin until after World War 1, when passports were commonly used as a security measure and to deter spies entering a country. Even then, some considered passports to be an “anachronism in the modern world.”

But the use of paper passports—which were first digitized as “e-Passports” with NFC chips in 2006—is slowly undergoing one of its biggest transformations to date. The travel industry, airports, and governments are working to remove the need to show your passport while flying internationally. Eventually, you may not need to carry your passport at all.

Instead, face recognition technology and smartphones are increasingly being used to check and confirm your identity against travel details before you can fly. These systems, advocates claim, can reduce the amount of waiting time and “friction” you experience at airports. But privacy experts caution that there is little transparency about the technologies being deployed, and their proliferation could lead to data breaches and greater levels of surveillance.

The push to remove paper passports is happening worldwide. So far, airports in Finland, Canada, the Netherlands, the United Arab Emirates, the United Kingdom, Italy, the United States, India, and elsewhere have been trialing various levels of passport-free travel or the technology needed to make it happen. In October, officials in Singapore announced that its residents can fly to and from the country without using their documentation, and foreign visitors can “enjoy the convenience of passport-less clearance when they depart Singapore.” More than 1.5 million people have used the systems, officials claim.

“It’s probably going to become the mainstream way of traveling, as I understand, in the near future,” says Athina Ioannou, a lecturer in business analytics at the University of Surrey in the UK, who has researched the privacy implications that come with different types of travel. Ioannou says the Covid-19 pandemic accelerated contact-free travel, and many efforts are driven by trying to get passengers moving quickly through airports.

While trials around the world are at different stages and use different technical infrastructure, they broadly work in similar ways: Information historically stored in your passport’s NFC chip, including facial data, is instead stored digitally and linked to your phone. The EU is planning to build an official travel app for this. When you are at an airport, the phone can be shown, and a face recognition camera will try to match you to the passport photo.

One of the most commonly tested approaches is using a “digital travel credential.” A DTC, according to the United Nations’ International Civil Aviation Organization (ICAO), which is behind the approach, is made up of two parts: a virtual element, which represents the information stored on passports, and a physical part, the bit on your phone. The two are cryptographically linked to ensure they’re not forgeries. “The key feature of the ICAO DTC is that authorities can verify a digital representation of the passport data before the traveller’s arrival and confirm the data’s integrity and authenticity,” a description of the system says.

Three different approaches to the DTC exist, with two requiring you to carry (but not necessarily use) paper passports, while the third approach, which may be some years down the line, doesn’t require a passport to even be issued. Earlier this year, border officials in Finland held a small-scale trial of a DTC on 22 airline routes, using a mobile app that had been developed. While passengers still had to carry passports, the country’s Border Guard concluded that checks lasted for just eight seconds, with the technical processing happening in two seconds. “Speed is really essential here if we are talking about facilitating a huge number of people,” Mikko Väisänen, the head of the DTC pilot, says.

While ending frustrating airport lines would be welcome for many, the shift to digital travel document also raises concerns about how data is protected, a normalization of problematic surveillance technology such as face recognition, plus whether digital ID systems will be further rolled out to other parts of society and who ultimately controls or builds these pieces of infrastructure.

The ICAO’s documentation around the DTC identifies risks such as “look-alike fraud,” criminals collecting DTC data and duplicating parts of it, delays to journeys if systems face outages, and people being unable to travel if there is a “false rejection” in face-recognition systems and no fallback systems in place. Face-recognition systems have been highly controversial for years.

Multiple companies around the world are building verification systems to help people prove they are who they say, which can involve linking with official government databases or systems. Udbhav Tiwari, the director of global product policy at Mozilla, says there are “privacy by design” and data minimization efforts that are taking place with the development of these products and systems, but there are still a range of other risks.

“We don’t really know how secure these systems are,” Tiwari says, adding that there are generally concerns about the “fairness, accountability, and transparency” with AI systems that can be used. “The fact is that all of these companies develop these systems often do so in deeply proprietary manners,” Tiwari says.

On top of this, Tiwari says, countries can treat people differently. Different nations have data protection regimes of varying quality and may use different standards around how people’s information can be passed to government or law enforcement agencies or sold. “I, for example, would be much more comfortable using biometric-based travel in Germany than I would in many other countries in the world, because I trust the data-protection ecosystem and regulators in Germany and might not in other countries,” Tiwari says.

Adam Tsao, vice president of digital identity at security firm Entrust, says that people using any systems will want to know that their data is being used the way they expect it to be. For instance, he says, among other things people will want to know who has access to information, what purposes they can access it for, and what say they have in what happens to it. “You really want to get to the point where as we move in this digitized world, that you’re giving the exact right amount of information, for the exact right amount of time, for the right purpose to the right people,” Tsao says. And that may not be straightforward.

In India, the Digi Yatra face-recognition boarding system has faced multiple criticisms about how it has been introduced and how people have been signed up for the voluntary scheme, as Biometric Update has reported. “The way that it’s happening in India is no longer voluntary, and it’s no longer something we can hold the government or anybody else accountable for,” says Disha Verma, from the Internet Freedom Foundation.

The Digi Yatra system, which has been operating in 24 airports around the country, may be opening up to foreign citizens in 2025. Meanwhile, there are plans to roll out the identity technology to hotels and historical monuments. Your face could soon be your room key as well.

The Paper Passport Is Dying

From Chinese cyberspies breaching US telecoms to ruthless ransomware gangs disrupting health care for millions of people, 2024 saw some of the worst hacks, breaches, and data leaks ever.

Every year has its own mix of digital security debacles, from the absurd to the sinister, but 2024 was particularly marked by hacking sprees in which cybercriminals and state-backed espionage groups repeatedly exploited the same weakness or type of target to fuel their frenzy. For attackers, the approach is ruthlessly efficient, but for compromised institutions—and the individuals they serve—the malicious rampages had very real consequences for people's privacy, safety, and security.

As political turmoil and social unrest intensify around the world, 2025 will be a complicated—and potentially explosive—year in cyberspace. But first, here's WIRED's look back on this year's worst breaches, leaks, state-sponsored hacking campaigns, ransomware attacks, and digital extortion cases. Stay alert, and stay safe out there.

**China's Salt Typhoon Telecom Breaches**

Espionage operations are a fact of life, and relentless Chinese campaigns have been a constant in cyberspace for years now. But the China-linked espionage group Salt Typhoon carried out a particularly noteworthy operation this year, infiltrating a slew of US telecoms including Verizon and AT&T (plus others around the world) for months. And US officials told reporters earlier this month that many victim companies are still actively attempting to remove the hackers from their networks.

The attackers surveilled a small group of people—less than 150 by current count—but they include individuals who were already subject to US wiretap orders as well as state department officials and members of both the Trump and Harris presidential campaigns. Additionally, texts and calls from other people who interacted with the Salt Typhoon targets were inherently also caught up in the espionage scheme.

**Snowflake Customer Breaches**

Throughout the summer, attackers were on a tear, breaching prominent companies and organizations that were all customers of the cloud data storage company Snowflake. The spree barely qualifies as hacking, since cybercriminals were simply using stolen passwords to log in to Snowflake accounts that didn't have two-factor authentication turned on. The end result, though, was an extraordinary amount of data stolen from victims including Ticketmaster, Santander Bank, and Neiman Marcus. Another prominent victim, the telecom giant AT&T, said in July that “nearly all” records relating to its customers' calls and texts from a seven-month stretch in 2022 were stolen in a Snowflake-related intrusion. The security firm Mandiant, which is owned by Google, said in June that the rampage impacted roughly 165 victims.

In July, Snowflake added a feature so account administrators could make two-factor authentication mandatory for all of their users. In November, suspect Alexander “Connor” Moucka was arrested by Canadian law enforcement for allegedly leading the hacking spree. He was indicted by the US Department of Justice for the Snowflake tear and faces extradition to the US. John Erin Binns, who was arrested in Turkey for an indictment related to a 2021 breach of the telecom T-Mobile, was also indicted on charges related to the Snowflake customer breaches.

**Change Healthcare Ransomware Attack**

At the end of February, the medical billing and insurance processing company Change Healthcare was hit with a ransomware attack that caused disruptions at hospitals, doctor's offices, pharmacies, and other health care facilities around the US. The attack is one of the all-time largest breaches of medical data, impacting more than 100 million people. The company, which is owned by UnitedHealth, is a dominant medical billing processor in the US. It said days after the attack started that it believed ALPHV/BlackCat, a notorious Russian-speaking ransomware gang, was behind the assault.

Personal data stolen in the attack included patient phone numbers, addresses, banking and other financial information, and health records including diagnoses, prescriptions, and treatment details. The company paid a $22 million ransom to ALPHV/BlackCat at the beginning of March in an attempt to contain the situation. The payment seemingly emboldened attackers to hit health care targets at an even greater rate than usual. With ongoing, rolling notifications to more than 100 million victims—with more still being discovered—lawsuits and other blowback has been mounting. This month, for example, the state of Nebraska sued Change Healthcare, alleging that “failures to implement basic security protections” made the attack much worse than it should have been.

**Russia's Midnight Blizzard Hit Microsoft**

Microsoft said in January that it had been breached by Russia's “Midnight Blizzard” hackers in an incident that compromised company executives' email accounts. The group is tied to the Kremlin's SVR foreign intelligence agency and is specifically linked to SVR's APT 29, also known as Cozy Bear. After an initial intrusion in November 2023, the attackers targeted and compromised historic Microsoft system test accounts that then allowed them to access what the company said were “a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions.” From there, the group exfiltrated “some emails and attached documents.” Microsoft said that the attackers seemed to be looking for information about what the company knew about them—in other words, Midnight Blizzard doing reconnaissance on Microsoft's research into the group. Hewlett-Packard Enterprise (HPE) also said in January that it had suffered a corporate email breach attributed to Midnight Blizzard.

**National Public Data**

The background check company National Public Data suffered a breach in December 2023, and data from the incident started showing up for sale on cybercriminal forums in April 2024. Different configurations of the data cropped up again and again over the summer, culminating in public confirmation of the breach by the company in August. The stolen data included names, Social Security numbers, phone numbers, addresses, and dates of birth. Since National Public Data didn't confirm the breach until August, speculation about the situation grew for months and included theories that the data included tens or even hundreds of millions of Social Security numbers. Though the breach was significant, the true number of impacted individuals seems to be, mercifully, much lower. The company reported in a filing to officials in Maine that the breach affected 1.3 million people. In October, National Public Data's parent company, Jerico Pictures, filed for Chapter 11 bankruptcy reorganization in the Southern District of Florida, citing state and federal investigations into the breach as well as a number of lawsuits that the company is facing over the incident.

**Honorable Mention: North Korean Cryptocurrency Theft**

A lot of people steal a lot of cryptocurrency every year, including North Korean cybercriminals who have a mandate to help fund the hermit kingdom. A report from the cryptocurrency tracing firm Chainalysis released this month, though, underscores just how aggressive Pyongyang-backed hackers have become. The researchers found that in 2023, hackers affiliated with North Korea stole more than $660 million across 20 attacks. This year, they stole roughly $1.34 billion across 47 incidents. The 2024 figures represent 20 percent of total incidents Chainalysis tracked for the year and a whopping 61 percent of the total funds stolen by all actors.

The sheer domination is impressive, but the researchers emphasize the seriousness of the crimes. “US and international officials have assessed that Pyongyang uses the crypto it steals to finance its weapons of mass destruction and ballistic missiles programs, endangering international security,” Chainalysis wrote.

Source

Wired