Security Squawk - The Business of Cybersecurity

About Security Squawk - The Business of Cybersecurity

Security Squawk is a business podcast dedicated to helping business people fight the war against cyber criminals.

Publisher

Bryan Hornung Reginald Andre & Randy Bryan

Category

business · news · technology

Language

en

Explicit

No

First episode

10 Dec 2020

Latest episode

2 Oct 2026

Latest episodes

293 episodes in the feed.

1. 

   2 Oct 2026

   1.3M Social Security Numbers Exposed, Microsoft Sounds the Alarm, Walmart Dragged Into a Breach

   One click on one email exposed 1.3 million Social Security numbers. If it can happen to a state Supreme Court, it can happen to the business you run. This week, the stories involve the Arizona courts, Microsoft, Walmart, Baxter, and Cardinal Health. *Your biggest cyber risk is the people and vendors you already trust.* Bryan Hornung, Randy Bryan, and Reginald Andre break down the cyber news executives, owners, and operators can't afford to miss. First, the Arizona Supreme Court. Attackers copied names and Social Security numbers for roughly 1.3 million people from debt records going back 30 years. It started when one employee opened a phishing email. IT shut the intrusion down in under two hours, but the attackers had already reached a backup server instead of the live system. An earlier wave of the disclosure was even worse: more than 150,000 reports on children in foster care. Your backups may be the least-watched copy of your most sensitive data. That's where these attackers went. Next, Microsoft's brand-new 2026 Digital Defense Report, built on more than 165 trillion security signals a day. One number should stop every owner: 97 percent of identity attacks still come down to a stolen password. AI has made phishing emails four to five times more effective. The "spot the typo" advice you've been giving your team is dead. And ransomware isn't just about locked files anymore. Almost two-thirds of break-ins now involve stolen data. Paying to unlock your systems does nothing about the copy that's already out the door. Finally, a vendor breach that should worry every company with suppliers. A Jacksonville freight company called TrailerBridge landed on the BrainCipher ransomware gang's leak site. The gang claims 76,200 files that name Walmart, Baxter, and Cardinal Health. Those giants did nothing wrong on their own systems. Their data was exposed because a mid-size partner holds their shipping and customs paperwork. One caution: the listing is unverified. A name on a leak site is an accusation, not proof. Verify the claim before you panic or dismiss it. • The Arizona Supreme Court breach that exposed 1.3 million Social Security numbers from one phishing email • Microsoft's 2026 report and why 97 percent of attacks still ride on a stolen password • The TrailerBridge leak that pulled Walmart, Baxter, and Cardinal Health into a ransomware gang's claims • Why your biggest risk is the people and vendors you already trust • How to protect your backups the way you protect your live systems • What to actually do when a vendor shows up on a leak site Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk (https://www.youtube.com/hashtag/securitysquawk) #CyberSecurity (https://www.youtube.com/hashtag/cybersecurity) #DataBreach (https://www.youtube.com/hashtag/databreach) #Ransomware (https://www.youtube.com/hashtag/ransomware) #Microsoft (https://www.youtube.com/hashtag/microsoft) #Walmart (https://www.youtube.com/hashtag/walmart) #VendorRisk (https://www.youtube.com/hashtag/vendorrisk) #Phishing (https://www.youtube.com/hashtag/phishing) #BusinessRisk (https://www.youtube.com/hashtag/businessrisk) #MSP (https://www.youtube.com/hashtag/msp) #SmallBusiness (https://www.youtube.com/hashtag/smallbusiness) #IdentityTheft (https://www.youtube.com/hashtag/identitytheft)

2. 

   29 Sept 2026

   FBI Breached, AI Malware Hijacks Servers, Defense Supplier Hit by Ransomware

   FBI Breached, AI Malware Hijacks Servers, Defense Supplier Hit by Ransomware Hackers Claim They Breached the FBI and Stole Data on Nearly Every Agent A criminal crew says it stole data on nearly every FBI agent and job applicant through the bureau's hiring system. The reported way in was the kind of business software your company might run. "We're too small to be a target" doesn't hold up. *The tools you trust are now the attacker's way in.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to track cyber news but can't afford to be blindsided by it. First, the FBI. The extortion group ShinyHunters claims it stole more than two terabytes of data on almost every agent and job applicant. The bureau has confirmed it's investigating. The reported way in was a flaw in Oracle's PeopleSoft HR software, the kind thousands of mid-size companies run. From there, the attackers reportedly jumped into the FBI's cloud. That flaw has been disclosed since June and used all year. Any company still running an unpatched box faces the same risk. Leaked HR and applicant data could give the next attacker a ready-made kit for targeting people and their families. Next, malware that brings its own AI. Researchers found a botnet called Carbonato that hijacks Docker servers left exposed to the internet. It installs an AI agent on the machine and lets that agent decide what to do next. The attackers didn't build the AI. They took an open-source tool and rewrote a single 39-line instruction file to turn it hostile. Running an adaptive attack now takes little more than editing a text file. Its number-one target is your AI keys. The crew uses stolen keys to run its own bootleg AI service, so a leak costs you data and funds the attacker. The way in wasn't a nation-state exploit. It was a server left open with no password. Finally, a defense supplier on a ransomware leak site. A group calling itself Storm posted Applied Composites, a California company that makes composite parts for aircraft, missiles, and satellites. There's no ransom number yet and no list of stolen files. Posting the name first puts pressure on the victim; details can follow if it stays quiet. A 500-to-1,000-person manufacturer deep in the defense supply chain is an attractive target: pressure to pay, without a Fortune 500 security budget. For a supplier, a leak-site listing isn't just downtime. It's a customer-trust and compliance event that can cost contracts. None of these started with a genius hack. Trusted software left unpatched, a server left open, a supplier left under-protected. The attackers walked through the door. • How ShinyHunters claims it breached the FBI and what data is at risk • Why the software running your HR and cloud is now the front line • Carbonato: the malware that installs its own AI agent to hack for it • Why stolen AI keys are the new top prize for attackers • How a small defense manufacturer ended up on a ransomware leak site • Why attackers target the small supplier to reach the big customer • What business owners should do before their name is the one on the list Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk (https://www.youtube.com/hashtag/securitysquawk) #CyberSecurity (https://www.youtube.com/hashtag/cybersecurity) #FBI (https://www.youtube.com/hashtag/fbi) #ShinyHunters (https://www.youtube.com/hashtag/shinyhunters) #Ransomware (https://www.youtube.com/hashtag/ransomware) #DataBreach (https://www.youtube.com/hashtag/databreach) #AI (https://www.youtube.com/hashtag/ai) #Docker (https://www.youtube.com/hashtag/docker) #VendorRisk (https://www.youtube.com/hashtag/vendorrisk) #SupplyChainSecurity (https://www.youtube.com/hashtag/supplychainsecurity) #MSP (https://www.youtube.com/hashtag/msp) #BusinessRisk (https://www.youtube.com/hashtag/businessrisk)

3. 

   23 Sept 2026

   AECOM Hit by Two Gangs at Once, CenterPoint Leaks 7.5M Records, Ransomware Sets a Record

   Two ransomware crews are claiming the same Fortune 500 company at the same time. It's the second week in a row this has happened. If you still think your business is too small to be worth a hacker's time, this is the week that idea dies. *You're not facing one attacker anymore, you're facing a market of them.* Bryan Hornung, Randy Bryan, and Reginald Andre break down this week's stories for executives, owners, and operators who don't have time to follow cyber news but can't afford to be blindsided. First up: AECOM, a sixteen-billion-dollar engineering giant, is being claimed by two ransomware gangs in the same week. One lists 1.22 terabytes of stolen data. The other lists about 670 gigabytes. Same victim, side by side. More than 27,000 company email accounts are alleged to be floating around the dark web, and class-action lawyers filed before AECOM confirmed anything. For now, it all remains alleged. When a company this size gets picked over by two crews at once, budget and size aren't the shields many assumed they were. Then Randy takes CenterPoint Energy, the Houston utility serving about seven million customers across four states. A hacker walked off with 7.49 million customer records, including names, addresses, account numbers, and partial Social Security numbers. The wild part: there was no sophisticated break-in. The attacker simply counted upward through the ID numbers on CenterPoint's public website because nobody limited how many records it would return. Any business with a customer-facing app can have this exact hole. The lawsuits arrived before the company even disclosed the breach. Reginald closes with the number tying it all together. August 2026 was the worst month for ransomware ever recorded: 997 attacks, an all-time high averaging thirty-two a day. Business targets took the brunt, with law firms, tech companies, and finance firms rising fastest. Attacks on utilities doubled in a single month. Zoom out, and the picture gets worse: more than 7,500 victims over the past year, up nearly 25 percent, with over 60 brand-new gangs appearing. That's better than one a week. This flood of new crews is exactly why one victim now gets claimed by two of them. Here's the takeaway for owners: the boring basics still win. Turn on that second login code everywhere, quickly patch anything facing the internet, and keep backups you have actually tested. None of that requires a big budget. It stops the large majority of what we cover. • A Fortune 500 engineering firm gets claimed by two ransomware gangs in the same week • A utility leaks 7.5 million customer records through a wide-open public website • August 2026 becomes the worst month for ransomware ever recorded • Why you're now up against a whole market of attackers, not just one • The cheap, boring defenses that still stop most attacks • Why "we're too small to be a target" no longer holds up Security Squawk is a weekly podcast and live stream for business owners and executives. Support the show: buymeacoffee.com/securitysquawk Subscribe | Like | Share #SecuritySquawk (https://www.youtube.com/hashtag/securitysquawk) #CyberSecurity (https://www.youtube.com/hashtag/cybersecurity) #AECOM (https://www.youtube.com/hashtag/aecom) #CenterPointEnergy (https://www.youtube.com/hashtag/centerpointenergy) #Ransomware (https://www.youtube.com/hashtag/ransomware) #DataBreach (https://www.youtube.com/hashtag/databreach) #BusinessRisk (https://www.youtube.com/hashtag/businessrisk) #SmallBusiness (https://www.youtube.com/hashtag/smallbusiness) #MSP (https://www.youtube.com/hashtag/msp) #Utilities (https://www.youtube.com/hashtag/utilities) #Infosec (https://www.youtube.com/hashtag/infosec) #CyberRisk (https://www.youtube.com/hashtag/cyberrisk)

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

5 ratings

Spotify

4.2 / 5

5 ratings

Podcast Authority Score: 60 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

92

Social presence

0

YouTube

0

Engagement

68

Contact Security Squawk - The Business of Cybersecurity

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Questions about Security Squawk - The Business of Cybersecurity