[Cyber Recap] Data leak at SFR, Disney abandons Slack, ServiceNow on alert

🌐 Data leak at SFR: On September 19, SFR announced that its RED subsidiary had been the victim of a data leak, exposing the surnames, first names, telephone numbers, postal addresses, but above all the IBANs and SIM numbers of numerous customers. No details on the exact number of people affected, and the attack has not been attributed to any particular cybercriminal group.

‍

🔒 ServiceNow sounds the alarm following a configuration error: On Tuesday September 17, AppOmni reported a major risk of sensitive data leakage from the ServiceNow platform. This threat was linked to the misconfiguration of access controls to knowledge bases (KBs), which could be publicly exposed, and with them the sensitive personal data of many companies using their services. AppOmni did not specify whether or not the exposed data had been exploited, and ServiceNow has since rectified the error.

‍

🎬 Disney stops using Slack internally after cyberattack: This summer, a malicious infiltration of Disney's communication systems had exposed nearly 1TB of data, including 44 million exchanged messages, but also thousands of files shared from the Slack platform. While this attack did not directly affect the firm's financial operations, sensitive technical information was stolen. Disney recently announced the migration of its internal communications by mid-2025, without specifying the replacement platform.

‍

🚀 Chinese engineer spies on NASA via spear phishing: Last week, the US Department ofJustice launched proceedings against Song Wu. He is accused of carrying out a succession of spear phishing attacks against several NASA employees, posing as a colleague, in order to obtain privileged access, confidential documents or sensitive information.

‍

And what cyber news has impressed you the most this week?

If you don't know me yet: every week, I select and present you with a recap of the world's cybersecurity highlights. Follow me on LinkedIn so you don't miss out!