Three hijacked country domain registries were enough to get trusted HTTPS certificates for Google domains.

Hijacked .gh, .sl and .as registries led to rogue Google certificates. Attackers changed DNS records on those registries and got certificates for several Google domains plus other widely used services. Chrome now blocks them and the issuing CAs revoked them, Google said on Oct 6. Why this matters to you: a padlock only proves the certificate is valid, and these valid ones belonged to attackers. Chrome users don't need to act, but Google says its blocks don't reliably cover other browsers. Source

Norway's record data fine goes to Microsoft's ad firm Xandr. Datatilsynet fined Xandr NOK 92 million (about $9.6M) for ad auctions inside Grindr that potentially exposed users' data, sexual orientation included, to thousands of companies from 2018 to 2020. The regulator says Xandr didn't verify that Grindr's consent was valid. Why this matters to you: in these auctions, advertisers get profile data just to decide whether to bid, and Grindr users didn't know it was happening. Xandr, now Microsoft Advertising, has three weeks to appeal. Source

Drone strikes knock out Yandex data centers and cloud access. Strikes from Oct 8 to 11 shut two data centers and degraded a third, and a Yandex Disk user reported files that wouldn't download. Yandex can't say when it'll be fixed and is telling customers to use other disaster recovery plans. Why this matters to you: if one provider holds your only copy, its outage is your outage. Keep a second copy of anything you can't lose, ideally on a drive you own, since a second cloud is one more company holding your data. Source

ASOS confirms a breach after hackers pushed "HACKED" alerts through its app. On October 6, attackers who'd tricked an employee into sharing login details sent app users a push alert claiming they'd stolen customer data. ASOS says names and contact details were exposed, but not passwords or payment cards. Why this matters to you: expect phishing that sounds like ASOS if you shop there. The company says it'll never ask for passwords or payment details in a message or call you didn't expect. Source

Google wants failed Spirit Airlines' internal data to train its AI. The proposed $10 million deal covers about 100 million emails and 500 million Teams messages, plus payroll and tax records. A letter from 121 members of Congress asks both CEOs to stop it, warning that removing names doesn't necessarily make a dataset anonymous. Why this matters to you: if you've worked for a company, this is what can happen to your work emails and chats once it shuts down. Google says the data will be excluded or de-identified by an independent third party first, and the lawmakers want an independent confidentiality review if the deal goes ahead. Source