🤖 AI Bots Hack Retailers for $25 Each + 16,000 Databases Left Wide Open 💧

Cybercrime just got cheaper and sloppier setups got more expensive. Today's two biggest stories show how AI is turning hacking into a bargain-bin operation, and how simple configuration mistakes are leaking personal data for millions.

AI Hackers Are Raiding Online Stores on Autopilot

A criminal pointed three off-the-shelf, open-source AI "agents" at hundreds of online retailers from July to mid-September and let them do the hacking. The total bill for the AI was roughly $12,000–$18,000, which works out to about $25 per company targeted. The haul: more than 600,000 valid credit card records from just two victims, card-skimming code planted on at least 27 websites, and access to systems at a Fortune 500 hospitality company and a major US airline. In some cases the AI even wiped the databases after stealing from them, deleting backups along with everything else. The so what: attacks that once needed skilled humans can now be run at scale by anyone with a credit card, so small and mid-sized businesses can no longer assume they're "too small to target." If you shop online, keep an eye on your card statements.

Read more

16,000 Databases Spilling Personal Data onto the Open Web

Researchers at UpGuard found about 16,000 databases hosted on Supabase, a popular platform developers use to build apps quickly, that anyone on the internet could read. They exposed names, addresses, phone numbers, and in some cases passwords and login tokens. The leaked data ranged from US valet license plates and immigration-service contacts to a consulate's records and private chats on an adult website. Supabase says its platform is secure by default and that customers misconfigured their own projects. The so what: the tools that let startups ship apps in a weekend also make it easy to skip security basics, and your data may be sitting in one of those apps. If your business builds on platforms like this, double-check who can actually read your data.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.