EP 260.5 Deep Dive. The Mistake before the Break. The IT PRivacy and Security Weekly Update for te week ending September 16th. 2025

Executive OverviewThe week’s events illustrate escalating risks at the intersection of industrial operations, national security, personal privacy, and emerging technology. Major cyber incidents demonstrate how fragile digital infrastructure has become, while privacy erosion continues through corporate data monetization and state surveillance. Human error persists as a dominant threat vector, and rapid technological advancement remains both a shield and a source of risk.I. Systemic Infrastructure & Supply Chain VulnerabilitiesThe cyberattack on Jaguar Land Rover (JLR) exemplifies cascading industrial risks. A phishing entry point forced JLR to halt global production, costing up to £100M and threatening thousands of suppliers with collapse. The UK government faces mounting pressure to intervene. Meanwhile, the U.S. Federal Highway Administration uncovered hidden radios in foreign-made power systems—likely Chinese—used in traffic signs, EV chargers, and weather stations. These undocumented components could enable remote disruption or espionage, underscoring critical supply chain insecurity.II. Privacy Erosion & Data CommercializationPersonal data is increasingly commodified:Airlines (via ARC) sold five billion passenger records to agencies like FBI and ICE for warrantless surveillance, skirting legal oversight. Senator Wyden is pushing legislation to close this loophole.Verizon was fined $46.9M for unlawfully selling location data, setting legal precedent that Section 222 protects customer location.UK employers are rapidly adopting “bossware,” with one-third monitoring staff emails, browsing, or screens. While justified as productivity or insider threat control, critics warn of eroded trust and pervasive surveillance culture.III. The Human Factor in Cyber BreachesHumans remain the weak link:Schools: Over half of insider data breaches stemmed from students, mostly using stolen or guessed credentials. Motivated by curiosity, some exposed thousands of records.Global theft rings: A single stolen iPhone exposed a transnational phishing and resale network spanning six countries. The scheme used fake iCloud links to bypass Apple’s protections.Russia’s “Max” app: Marketed as secure, it is exploited by fraudsters renting accounts for scams. With nearly 10% of scam calls traced to Max, new laws now criminalize account transfers.IV. Technology’s Dual EdgeInnovation provides stronger defenses but also reckless failures:Apple launched Memory Integrity Enforcement, a silicon-level protection against buffer overflows and side-channel exploits, deployed on iPhone 17 and iPhone Air.Google’s VaultGemma, a 1B-parameter model trained with differential privacy, promises competitive performance without exposing sensitive data—an advance in privacy-preserving AI.AI Darwin Awards highlight failures from poor oversight: Taco Bell’s misfiring AI drive-thru, McDonald’s compromised recruiting chatbot, Replit’s database-wiping AI, and even the satirical awards site itself.