The opinions expressed are those of the show
hosts and may not necessarily be of any company
in which the show hosts may represent. Hello,
folks! Welcome to SANS, episode number 38. This...
will be the podcast for SANS. This is the News
Bites. This is annotated news update from the
leader in information, security, training, certification,
and research. This program will cover the newsletter
from January 13th, 2026. So, how is everybody
doing? We had a bit of a mild setback when it
came to my health, and I know that I appreciate
each and every one of you who might drop by and
listen to these programs along Jared's Technology
Podcast Network. is Volume 28, Number 3. So,
this is going to be a very interesting newsletter.
And as we always do, if we feel it's necessary,
we will take from the editors. But, we know that
sometimes we can just do it by ourselves. Beast!
off of the content itself. But we also tell you
who is writing so that you know the difference
between me talking and the newsletter. So I wrote,
we've got interesting news coming out of this
episode of SANS. It covers the newsletter that
was issued on January 13th, 2026. We've got a
group. that seems to be back in the news. And,
of course, it can't be good since it's item one
of the section of the newsletter that is titled
Top of the News. Since I'm giving you that much,
what is that group? You don't have long to guess
because it'll be in the table of contents, which
is part of this file. We've got LLM news, especially
when it comes to healthcare, as well as LLM news
when it comes to it being attacked. We saw an
Instagram story we decided. not to blog, that
they'll cover, and there's plenty more. This
file is transcribed by Jared Reimer in Woodland
Hills, California. If you want a copy, email
tech, that's T -E -C -H, at M -E -N -V -I dot
org, and I'll take care of it. Let me know what
format and size of file you want. Per usual,
we break up each section on a new Braille page
and number each item both in the table of contents
and the items themselves so you can find them
easily. So we go back to numbering each item
one through whatever. And, of course, after the
particulars of top of the news, it will go to
a new Braille page regardless of code and give
you the rest of the week's news. We are using
the new UEB page numbering for chapter and page
as seen in some books, although I never saw that
on any book until... the Unified English Braille
course book itself, but I'm using this format
for podcast number, and I will use it as a podcast
number and a page number. So, there. You go.
Now your time is up in regards to the answer
for today's trivia. The table of contents now
follows. Top of the news. Item number one. Salt
Typhoon threat actors. Reportedly responsible
for new congressional email breach. Alright,
so number one is Salt Typhoon for the threat
actor's name. Who would have thought that one?
I'm curious. You can email or iMessage, text
or WhatsApp. That's 804 -442 -6975. Or call and
leave a comment on the comment line at 888 -405
-7524 or 818 -527 -4754. If you do get me, please
talk to me. And do leave a voicemail. Leaving
a blank voicemail may not yield any response.
Because I don't know who you are or what specifically
the number calling wants. So please make sure
that you do leave a verbal voicemail. Okay? Number
two, Spanish energy company and supplier discloses
data breach. And number three, LLMs and healthcare.
ChatGPT, Claude, and Google Overviews. And maybe
it might be imperative in that file to talk very
specifically about my use of ChatGPT because
I have been a little bit... Under the weather,
although I'm doing a lot better at the time I'm
recording this, and I'm sure that I will be fine.
I'm sure it was either a stomach bug or a combination
of stress and fatty foods like a burger and fries
and other combinations like ChatGPT said it could
be. We just don't know. But... I'll talk about
that then. And of course, you'll probably hear
me talk about it on various other places, including
TSB and on the RCL program if they want, if they
happen to bring up AI. But, more importantly,
we'll talk about it on the Throwback Saturday
Night program. So, do make sure you check that
out. It'll also be on the Saturday show of the
Independent Artist Spotlight, which we are broadcasting
at the same time I'm taping this, which is Saturday,
January 24th. Speaking of LLMs, we're going to
move now to the rest of the table of contents
with item one, as there's more LLMs. LLM APIs
targeted by threat actors and gray hat hackers.
Number two, Instagram password reset emails are
unrelated to... alleged data breach. I saw this
in their newsletter and I decided not to blog
it. There's really nothing there. I know. Number
three, breach forum's member data leaked. That's
always great news. I love that. Number four,
California Privacy Protection Agency finds Texas
firm for failing to register as a data broker
with the state. And this goes back to last episode.
I forget the exact item number of this one. I
think it was item one of that particular podcast
where we talked about this idea where Californians
can register. with this particular entity, and
that should, in theory, stop our data from being
collected. Item 5. Spanish authorities arrest
34 in connection with Cybercrime Network. 6.
Printing error. prompts recall of nearly 13 ,000
recent Irish passports, and that's not good.
And finally, number seven, CISA retires 10 emergency
directives, and that is a good sign because they're
not needed anymore, notating that they were emergency
directives So that is the table of contents.
That's the answer to your trivia question. It
is Salt Typhoon. If you guessed it, great. If
you didn't, learn along. We will continue in
just a moment with the newsletter as we start
with item number one of Top of the News. This
will be program number 38 of SANS, a Jared Reimer
Network podcast. Since we played trivia earlier,
let's go ahead and start with our top of the
news item. And, uh... This is item number one.
It looks like I didn't put item number one here.
But that is okay. You can follow along if you
have Braille. Assault Typhoon. They have never
been good. We've talked about them since the
very beginning on the security box. Well before
I thought of this sans news... news thing as
a full podcast set could have done this with
all of that coverage then because they talked
about it then too but they are back assault typhoon
threat actors reportedly responsible for new
congressional email breach and I think before
I really get into this, I want to ask a question.
And I really think that this is a serious question.
If this was Congress, what were they using? Or
are they using? I don't... exactly understand
why we're still having issues with getting into
email. I don't have anybody getting into mine
that I am aware of, and I say that loosely because
email can be gotten into. So I'm not going to
say that it doesn't happen. But if you don't
use the right tools, then of course you're going
to get hacked into. But I'm wondering what's
being used. Because email's gotta be saved for...
What is it? Many, many years? Like... OMG. Not
necessary. Once you respond to something, delete
it. There's no need to keep it around. Here's
what is... and we'll go through this together,
ladies and gents. Cyber threat actors with ties
to China's government have once again infiltrated
email systems, compromising U .S. congressional
staff members' communications. The intrusion
was detected in December 2025 and was first reported
reported by the Financial Times, which said the
perpetrators are Salt Typhoon, a threat actor
group that gained notoriety for breaching telecommunications
systems around the world in 2024. As I said,
we covered them on TSB. And they were on Sands
then, too. Unfortunately, I did not do Sands
then, so this can be looked into. I'm sure you
can contact Sands and ask them, you know, hey,
what newsletters did you guys cover Salt Typhoon
in? I bet they could help you out. Officials
are investigating the breach, which reportedly
affects email systems used by congressional staff
working on House National Security Committees.
Oh, great. So, uh, this can't necessarily be
good. Is that right? So, Salt Typhoon is back
again. Is anyone who is hearing this surprised
by this news? Especially those who participate
on TSB? Dukes writes, It's not surprising that
the U .S. Congress is and continues to be a target
of nation states. What's left to be determined
is whether the Attack used existing Salt Typhoon
TTPs or changed them up? And that, of course,
we don't know. And I suppose if I do spot something,
I can write something up. If they were known
TTPs, then that's a black eye for Congress and
their security team. What security team? Hopefully,
that information becomes available soon to protect
other organizations. Our guy, Neely, writes,
These accounts are targeted as they are typically
less hardened environments. While truly... email
is not present, there is enough supporting information
which rounds out open source investigations nicely.
Make sure that you are considering the security
of not only your mainstream email systems, but
also of staff, contractor, and supporting services.
An incident can quickly offset the cost of not
providing someone with a corporate email account.
Email security options to ensure protections
are in place. Commensurate with the operation
processed. As I wrote, tell me if you've seen
this before, and yes, I did number everything
else. I guess I forgot to item number one. That's
okay. Folks, this is a huge problem. I still
want to know what they're using. Outlook? Microsoft
365? I mean, this is absolutely crazy. I don't...
I don't quite get what they're doing here. This
can't necessarily be good. And this isn't going
to be the first time. So, time for them to go
figure that crap out. Because... That is enough
of that. Coming up, ladies and gents, we're going
to move on to our next item. Spanish Energy Company
and Supplier Disclose Data Breach. Well, you
know... They come a dime a dozen these days,
data breaches do. Let's see what this one covers
as the newsletter continues. I'm Jared Reimer.
This is Jared's Technology Podcast Network. Alright
folks, welcome back to the program. I'm Jared
Reimer. Well, I know some time has passed and
people are probably wondering, what happened?
Short version, I got sick. But I'm feeling a
lot better now, and we are going to push on.
We're just going to go the best we can, and I
can't rush it. As a doctor would say, don't push
yourself too hard. Just do what you can, even
if it's just one AI tool. I bet my doctor would
say the same thing, too, if I was telling him,
yeah, I'm feeling better today, but I want to
do all of this stuff. He'd probably say, no,
probably not a good idea to do all of that at
once, unless you're up to it. So I guess we'll
see how this goes. No judgment, right? Item two
of the particular SANS News Bites we are working
on is this. Spanish energy company and supplier
disclose data breach. Spanish energy company
Endesa and its supplier, NRJ XXI, I don't want
to say 21 because I don't want to assume that
they mean a number, so I'll just read it as letters,
are notifying customers that account information
was compromised in a cybersecurity incident.
is one of Spain's largest energy utilities, providing
gas and electricity services to more than 10
million customers in Spain and Portugal. Well,
that's quite a very large amount of people. It,
quote, detected a security incident that has
allowed unauthorized and illegitimate access
to its commercial platform. That ends the quote.
The compromised information includes, with Endesa
Energe and possibly payment details. And that
ends that quote. Endesa has notified Spain's
data protection agency and other relevant authorities.
Sacks. A once -in -a -while contributor and who
was mentioned in several newsletters writes,
This looks like a customer data breach, but from
a utility engineering perspective, it is also
a reminder that the commercial platform is part
of the operational ecosystem. The grid can be
stable and well operated, yet attackers who gain
access to IT systems can still degrade utility
operations without ever touching control systems.
The stolen data has follow -on consequences.
and enables convincing impersonation of customers
contractors and even internal staff that credibility
is exactly what adversaries need to move from
fraud into deeper access especially in environments
where remote support and vendor connectivity
are normal. This is not evidence that grid operations
were directly at risk. It is evidence that an
attacker reached a system boundary that should
be treated as reliability relevant. Engineers
should view incidents like this as a prompt to
strengthen segmentation, identity controls, and
vendor access governance. Those are not just
IT best practices. They are part of resilience
engineering. that I did not deal with the IT
aspects of things, but you'll understand it.
As I write in the next paragraph, stop me if
Neely's comments may be somewhat familiar. It
may be written a bit differently, but he writes,
the breach didn't impact service, in parentheses,
gas power. delivery to customers, and Endesa
is notifying affected customers directly. While
Endesa is claiming there is no attempted use
of the purloined data, threat actors appear to
have 20 million records, 1 TB, by the way, that's
in parentheses, of Endesa customer database data
for sale to a single exclusive buyer. Expect
Endesa to implement enhanced security measures
after admitting existing security fell short
of expectations. And, oh boy, what do I think?
If this is the only thing I record today, which
I think it may not be, because I'm actually doing
quite well, thank you very much, I'll say this.
Endesa, you better... come clean. And you better
tell your customers exactly what went wrong when
you know it. Not six months to a year from now,
but as soon as it's feasible for you to do it.
Since you're already starting the process, if
it were me and I find out new information, I
would continue to send out notices so that your
customers are aware of what is going on before
it hits the press. Now that would be what I would
do. But I'm not Endesa. And I'm not any other
company who's been targeted in this list. I think
if I were ever breached, and it got out, and
it hit sans news bites, the way that I would
do things is notify people as soon as possible.
If I got pushed back by police, I would say,
the problem is that if I don't notify my customers,
then it gets out six months to a year later,
and that's bad practice. This is what we must
do, and we can do it in such a way where it won't
hurt the investigation. I .e., your information
was taken, we don't know by whom, there's an
ongoing investigation, but you need to know that
this is what's happening. When it's safe for
us to give you more information about what specifically
was taken, then we'll do that. At least start
there. Then when you are released from the police
and their investigation, you can then come clean
to say what was taken and how you are going to
prevent it. But at least giving a heads up that
information was taken from you is a first start.
And the fact that an ongoing investigation is
preventing you from giving details, you can mention
that. But be as forthcoming as you can and continue
to provide updates. We've got two LLM stories
coming up. One before the rest of the news, and
one after we start the rest of the news. And
as we do, and we've started to do in these podcasts,
we'll play a track between each. But first, we
will start with our first of two LLM stories.
Email iMessageTech, that's T -E -C -H, at M -E
-N -V -I dot O -R -G. Text or WhatsApp, 804 -442
-6975. Thank you so much for listening, and do
make it a great day. We will continue in just
a moment. All right, folks, here comes item three.
And this is one of two LLM stories. And when
we merge the podcast, we will put a song in between
these items. Email iMessageTech, that's T -E
-C -H at M -E -N -V -I dot O -R -G. Thank you
so much for listening to today's program. I hope
that you all will be enjoying it as much as I
am when it finally gets released. Again, we're
sorry for the delay. The first LLM story is LLMs
and Healthcare. ChatGPT, Claude, and Google Overviews.
This is probably important and this may be a
little bit of a longer segment because it leads
to something that I actually am now gaining experience
on. And this is chat GPT and health. And I think
it's worth discussing it as part of this particular
item. It will also be discussed in the next TSB,
which will be recorded next Wednesday, not this
coming Wednesday the 28th, but the Wednesday
afterward. API for use in healthcare, followed
three days later by Anthropic's announcement
of a healthcare -focused implementation of the
Claude LLM. OpenAI's stated aim is to provide
specific versions of tools that are already in
use in the healthcare sector. Quote, giving organizations
a secure enterprise grade foundation while supporting
HIPAA compliance. I'll say bull. Now, I can surely
give ChatGPT the link and say, analyze the article
from this link. Titled this. And it could in
theory. Give me a logical perspective. But. Granted.
I'm relatively new. To this. And I'll talk about
my use. As it regards to healthcare. As soon
as we're done reading this. And any comments.
I may have decided to pull. Notably. Sharing
medical data with ChatGPT Health removes the
HIPAA protection from those records, according
to Sarah Gustafson, Senior Counsel at the Electronic
Privacy Information Center. The healthcare models
of ChatGPT will be trained with healthcare workflows
and promise transparent citations as well as
integration with institutional software policies,
access controls, and user management through
SAML, SSO, and SCIM, and support for HIPAA compliance.
Quote, patient data and PHI remain under an organization's
control with options for data residency, audit
logs, customer managed encryption keys, associate
agreement BAA with OpenAI to support HIPAA -compliant
use. The final paragraph of ChatGPT's Terms of
Service states, Our services are not intended
for use in the diagnosis or treatment of any
health condition. Anthropic characterized Claude
for healthcare as HIPAA ready and says it is
set up to connect to the Centers for Medicare
and Medicaid Services CMS coverage database.
The International Classification of Disease 10th
Revision ICD -10, and the National Provider Identifier
Registry. Certain subscription plans allow Quad
secure access to patient lab results and health
records. Meanwhile, Google has removed AI Overview
results. From a few specific search queries after
investigation by The Guardian revealed the site
offering false and dangerously decontextualized
medical advice. Examples include harmful diet
recommendations for pancreatic cancer, and misinformation
about test results for liver function and cancer.
Kim Commando mentions not to upload health data
to these chatbots. I've heard that on her minutes.
If you do, try to block out any personal info
tied to you as it can have that. I'll also add
here that you could probably use temporary chat,
which does not allow ChatGPT to remember anything.
Neely and Murray have great points here. Read
what they have to say. And you can find a link
in our show notes. That completes Top of the
News. And we will continue with my thoughts now
on what I've learned. So... On Saturday, one
day after I fell sick, I decided, as a free user,
to subscribe. Not as a paid customer, but to
keep everything in one place. On Friday, I told
JetGPT very specific symptoms that I was having,
and said, What could cause this? It gave me some
ideas, and I read them carefully. I asked what
to do. It said, I think it would be best to do
this, i .e., maybe rest, maybe... Take light
sips of water. Maybe it's dehydration. Maybe
it's, you know, various other things. It didn't
say it was. It never insinuated anything. Then,
on Saturday, I thought I was getting better.
But I decided I think I want an account. And
we'll talk more about ChatGPT specifically on
Throwback Saturday Night and our next TSB. I'm
not going to read the technical aspects of the
notes as I did on Saturday's Independent Artist
Spotlight Show. But I can tell you that I asked
the AI to give me a podcast summary. That I could
use as a technical reason to use the bot. Well,
I replaced my doctor. Not permanently, mind you.
But as a, this isn't a bad sign. You can treat
this at home. If you have these things. And you
have this food. you do these things okay so bread
food rice food you know eggs food applesauce
food unspiced food like chicken turkey when i
screwed up having barbecue from wingstop which
Messed me up pretty bad. It turned into a long
Sunday. And I also used ChatGPT as a log tool.
Mainly, if it ever became a problem, I could
hand my phone to a doctor with the right chat
log and say, go through that. tell it to give
you a doctor's diagnosis, a doctor's write -up,
which it says it can do, and then they would
know exactly what to do. And that's the technological
responsibility, I think, of using a tool. I'm
not replacing my doctor. I'm not saying, okay,
doc, I want to come in, but I'm pooping really
bad, as an example. This is an example, and I
don't know if I'm going to be able to make it
in, because you want me to come in, but I'm pooping
pretty bad. He may just say, you'll have to go
to the hospital, and you're going to need to
get treated there, and I'll come and see you.
That's the worst they'd say. Maybe you could
order these items from the local store, i .e.
an antacid or some other medication, and try
those. I'm not going into any detail of what
I had or didn't have, but I continue to log until
I feel stabilized enough. Although I am feeling
better as I said. But it's important to know
what to disclose instead. What causes this? Or
what should I eat? My stomach is still whatever.
I still have these symptoms. But I'm hungry.
And that's perfectly fine. whole health history.
Okay? That's the goal, right? I didn't upload
my whole health history, then give it something
new. I'm dealing with something in the moment.
It's giving me advice of what it could be and
says, if this gets worse, i .e., if... it's diarrhea,
if it gets worse and you're going more often,
you start throwing up, you start feeling lightheaded,
you're dizzy, you're this, you're that, then
I would seek medical help. You can treat this
at home by resting, eating bread, rice, applesauce,
you know, things that are, you know, eggs. I'll
tell you what, folks. It felt so good to eat.
I ended up eating four eggs and not have any
symptoms. And the day I'm recording, I am actually
feeling so much better. I had a half a meal this
afternoon, a recording date, which included fish,
rice, and some salad. I ate the entire fish.
I still have some rice, some salad, and the pita
left. But I tell you what, I feel pretty good.
I've got a hot chocolate here to help with any
throat issues because there are times that I
start coughing or want to clear my throat, and
the warm liquid will assist with that. Or I could
have some sort of water, whether bottled or canned.
But the point I'm trying to make here is that
it's telling me, that I made the right call.
I did not force anything. I did not give it more
than it needs to know. And it was giving me simple
advice. So, I think now I will actually read
the document. that I titled, AI Use for Diagnosing
Health Concerns from a Tech Perspective. And
we will actually dive into this as part of a
deeper discussion on AI later on. The tech angle.
AI as a thinking partner, not a doctor. What
this experiment shows isn't that AI replaces
doctors. It's that it can act as a real -time
thinking partner. So I asked it, what do you
think I should do? Should I go to the doctor?
Is this urgent? Can I treat this at home? What
would I need? Right? You had a... mild, but uncomfortable
health issue. So it's not even telling you publicly
what I had, and I'm not telling you publicly
what I had. I used diarrhea or stomach issue
as an example in the talk. I'm not saying publicly
whether that's what I had or not. As an emergency,
not as something that clearly required urgent
care, just enough to make you unsure. So again,
you had a mild uncomfortable health issue, not
an emergency, not something that clearly required
urgent care, just enough to make you unsure.
That's the gray zone where people usually panic
over Google. Worst case scenario or ignore symptoms
entirely. I didn't ignore those symptoms, ladies
and gentlemen. I was purely saying, this is what
I have. Is this urgent? Is there something I
can do? What's going on here? Instead, you use
the conversational AI to... Talk through symptoms
in plain language. Sanity check decisions. What
to eat. What to avoid. That's in parentheses.
Slow yourself down enough to make measured choices.
From a tech perspective, that's important. AI
lowered the cognitive load. That's important.
It didn't... Make me overthink. People probably
overthink and probably would overreact. Oh God,
I gotta go to the doctor. I've got diarrhea.
Or I've gotta go to the doctor. I've got whatever.
Sometimes you can just treat this stuff at home.
Again, I'm not publishing any medical anything.
Those who may know what happened to me are close.
friends, and people I trust. I'm using these
as an example as part of talking on a podcast.
It didn't diagnose. It helped you organize your
thinking. And I wasn't saying I was ever diagnosed
by AI. It knew it was potentially GI because
it knows by its models that it's stomach -related
because one of the symptoms was diarrhea, right?
So if that was the case, then it knew it was
GI? I didn't know what all that meant, but it
does. That's its job. Why that matters technologically.
AI is always available. unlike doctors, friends,
or hotlines. And that's important. You can't
call a hotline. Some friends you trust may not
be available or may not have the knowledge to
know or advise you what to do. And hotlines,
I don't know if I would call a hotline to get
advice like that. It's non -judgmental, which
makes... people more honest. It didn't judge
me. It said, this sounds like a GI problem. I
would recommend rest right now. Don't eat anything.
Just relax. Take it easy. Turn on Nature Space.
Turn on SiriusXM Yoga or any of the other channels
I told it that I listen to on a regular basis.
to keep myself calm, relaxed, and in the frame
of mind as part of my everyday life these days.
It can respond dynamically as conditions change.
Diarrhea is gone. Burps remain. So... if the
condition was that I had acid burps, but the
diarrhea was gone at one point, then it could
advise me, okay, if this is consistent, maybe
you should get some type of medication. And it
named the type of medications to get. And it
said, get one, don't get all. That's important.
That loop, Observe, reflect, adjust is basically
a feedback system. You were running a human -in
-the -loop health model. The subtle win. The
healing didn't come from advice alone. It came
from thoughtful planning. Okay? So, eating small
portions. avoiding known irritants, soda. So
I bought a soda one day, but I didn't touch it.
And even when I did touch it, I took slow, deliberate
sips, put it down, and left it there. Monitoring
changes instead of reacting emotionally. So for
example, okay, it's 10 o 'clock at night. I'm
done with the diarrhea. I still have this issue
or that issue. What's next? Try and get some
sleep. See how you feel in the morning. If you
have anything overnight, let me know and we'll
reevaluate. If it seems like you need to go get
medical care, I'll advise that. Otherwise, I'm
here for you. A, I didn't replace intuition.
Amplified it. The responsible take. AI works
best in low -risk situations as a support tool,
not as a replacement for medical care. And I
think that's the very important thing. If it
said, this sounds like urgent care, you need
to do this, then that's exactly what I would
do. I hope it never comes to that. But now I
have the tools to assist me, i .e., if my symptoms
were. I'm coughing. I can't breathe. This feels
to me like an upper respiratory infection. I
get them regularly. I've tried to rest, but I
can't rest. I can't sleep. When I cough, it hurts.
That type of thing. Then it would probably say,
go get medical care. It's great for reassurance,
decision scaffolding, knowing when to wait versus
when to escalate. And that's a very defensible,
forward -thinking tech use case. So that's that
file. And that, I think, is important. Because
if we take nothing else out of this, then what
would AI be used for? I did use it for finding
out when an artist is an independent. I've used
it more recently. and discussed vending machines
and other accessibility stuff. I even had it
generate an email which I submitted because there
was a serious issue in the ChatGPT app itself
as I was learning it. So it can be very useful
in the right situations. You've just got to be
smart and not share every little detail. Or maybe,
if that's what you're going to do, switch off
the item to let it learn from your account so
that it can be trained based on everything you
have. cause problems and i'm not going to say
hallucinate because we'll talk about that more
on tsb there's a lot i want to get into when
it comes to the aspect of this whole ai thing
because the hallucination topic was very fascinating
when i was talking to it about that specifically
Now, it could say, I don't hallucinate, I make
up stuff. Well, maybe in the tech press's mind,
that's hallucination. And that I understand.
But that's because it's just fed a lot. And we'll
discuss all of that later. But in the context
of whether I would use it in, like, a hospital
as part of clinician work? Maybe in the right
circumstances, i .e., a chat for each client,
the account not being in the I'll share everything
so that the models learn from what I'm doing
option. I forget exactly what it's called at
the moment, but we'll dive into all of that when
we do our AI chat. Suffice it to say, I've got
a lot of ideas coming for that podcast, and I'll
start work on that very soon. In the meantime,
as I said, I wanted to include this as part of
this discussion so that you are aware of how
I used it. And yes, I did give a couple of symptoms,
but I'm not giving every little detail because
it honestly doesn't matter. I'm good now. It
may take me another day to get this particular
podcast out because I had several days off and
I'm doing this mid -afternoon and I don't know
if I want to stay and do this all night. In the
meantime, I do want to play the track which will
be coming up next. I'm not going to tell you
what it is do this on the fly and I don't know
what I'm going to pick. We will continue with
the rest of the news right after this track.
This is Sands episode 38 covering the newsletter
for January 13th, 2026. back to sans 38 and you're
probably saying you should have released this
a long time ago yes this is absolutely true but
after i started recording this program all hell
broke loose i got sick I got better. The computer
actually had technical problems that needed resolving.
I got sick again. The 40 cell display I normally
use ended up having dot issues. Where now it's
out for repair. My. 32 cell braille sense. Is
having issues. And then I had to. Bite the bullet.
And get the e -reader from humanware. So there's
been lots of technical debt. So that's really
been. the real reason why this podcast has been
delayed. But I'm hoping to get back into things.
Number one, the orbit arrived to get repaired.
I have an e -reader that I can use. And between
everything, I can, in theory, now try and get
back into things. And everything is going to
be... All well and good. So we're going to start
the rest of the week's news for this newsletter
that we started covering way back in January.
Item number one in this segment is LLM APIs targeted
by threat actors and gray hat hackers. And this
could still be going on today in different situations.
So even though this podcast is going to be out
In April, because of all of the issues that we've
had going on, some of this news that you're going
to be hearing may still apply. So, as I say,
better late than never, because I tried to get
this out before the computer actually died. So,
I at least tried. Threat research from a grain
noise honeypot shows two recent campaigns probing
the security of LLM APIs by way of misconfigured
proxy servers. The first campaign spanned from
an October 2025 To January 2026. Exploiting server
-side. Request forgery. Vulnerabilities. To target.
L. L. A. M. A. Or. Actually this is. Olama. Sorry.
So to target. Olama. Model. Poll functionality.
And Twilio. SMS webhook integrations. The attackers
used Project Discovery's OAST out -of -band application
security testing infrastructure to confirm successful
SSRF exploitation, leading Gray Noise to believe
the attackers were likely researchers or bug
bounty hunters. The second campaign, however,
was most likely a professional threat actor conducting
reconnaissance by methodically probing at least
73 LLM model endpoints over 11 days starting
December 28, 2025. Again, I want to just make
sure that while the podcast is going to be released
well after this was published, and the link is
going to be in the show notes, this type of thing
could possibly have gone from research to a possible
problem. Now, I haven't heard of this happening
yet, and because we're so late, I want to make
it known that this could, in theory, be happening.
Yes, I did that on purpose. The attackers generated
over 80 ,000... in that time, hunting for misconfigured
proxy servers that might leak access to commercial
APIs. Every major model family appeared in the
probe list. Data associates the attacker's IPs
with extensive previous CVE exploitation, and
the researchers posit that the threat actor is
building target lists as part, of a larger pipeline.
Groenoise recommends users configure Ollama to
only accept models from trusted registries. Set
up alerts for rapid -fire requests and fingerprinting
queries. Block OAST at DNS, rate limit suspicious
ASNs, and monitor jabbled fingerprints. The blog
post contains network fingerprints, OAST callback
domains, and IP addresses to block as part of
defending LLM infrastructure. Dukes writes, API
security continues to be a concern and misconfigurations
are the leading cause. Software developers should
reference the OWASP API security project's top
10 list as a guide when building the API. And
while you're at it, fund the OWASP nonprofit.
They do great work. Neely, who was first, writes,
the action here is to make sure your threat hunters
Are incorporating. IOC's. And. That you're taking
steps. To protect. Your LLMs. Including. Gray
noises. Suggestions. Of. only allowing models
from trusted repositories watching for enumeration
patterns and rate -limiting blocking suspicious
networks and domains. And all I'm going to say
is this. While I understand this is late, and
later than I really wanted, because we really
tried to get Sans Newsbytes out within one week
of it hitting my inbox, and all the trouble that
I discussed in my introduction to this segment,
we've really got to still be aware of this research
in case you've noticed that things have changed.
It's not necessarily about the fact that it's
late news. Well, Jared, you shouldn't even be
covering this because it's months old. Yes, you're
absolutely right. But the problem is that I started
recording this when this was actually first put
out as a newsletter. So now all I'm going to
do is finish the work that should have been done
in the first place if it wasn't all of the issues
I was trying to deal with that I stated above.
And part of that delay was getting sick. And
I'll tell you what. What I was going through
wasn't all that fun. It wasn't necessarily COVID
or a cold or anything. It could have been a stomach
bug or two because I had that happen to me twice
in the matter of several months since I first
started recording this program. All we're saying
here, folks, is that This is something that still
should be at least read. Understand it, because
once this really gets out in the public, while
we may not know about it now, it could be part
of some arsenal later on. And I think that's
really one of the reasons why I still want to
cover this because, yes, it's late now. I understand
that. But could this become a future reality
problem? Hmm. Something to think about. Instagram
is in the news, and we always know that Instagram
has always hit some kind of news. So, since we're
still in January for this newsletter, it wouldn't
surprise me if other Instagram stuff has come
out, but we've got something interesting coming
up next. As we're going to talk about password
reset emails. And I think this is still appropriate.
Again, even though this is months afterward,
which was never my intent. But we always hear
about issues where password reset emails... could
trigger things that you're not expecting. I'm
Jared Reimer. You've got Sans 38. We will continue
in just a moment. Let's talk a little bit about
passwords. In this story from the Sans News Bites
that we have been delayed on, this one's titled,
Instagram password reset emails are unrelated
to alleged... data breach so again this is going
to be covered late because we want to finish
this before we move into other sans content and
i feel that that's more appropriate because we've
had this here for a while So, let's do this by
reading it. On January 9th, 2026, Malwarebytes
warned that cybercriminals stole the sensitive
information of 17 .5 million Instagram accounts,
including usernames, physical addresses, phone
numbers, email addresses, and more, and posted
a screenshot showing an Instagram password reset
email. However, the data in question and recent
reports of unsolicited Instagram password reset
requests are not related despite surfacing online
simultaneously. Instagram announced via social
media on January 10th that while there was no
breach of their systems, the company has now
fixed A vulnerability that had allowed a third
party to trigger password reset emails and directs
users to disregard the emails. Well, even as
late as this is, that's always good news. Well,
we did have an issue, but it's unrelated to what...
was actually going on. So, that's always great
news. And as late as this is, I do want to say
that overall, this is great news, right? There
wasn't a known breach that claimed to reset emails,
but a similar issue that could be unrelated.
And I'm not saying back then that there was an
issue with Instagram. Remember, it's a Facebook
product. No recent data breach has been confirmed
by Meta, but Malwarebytes was likely referring
to a dataset recently published in a hacking
forum and listed on Troy Hunt's site, Have I
Been Pwned? And that is still a great site, and
TSB has not been really keeping up with Have
I Been Pwned in recent times. Not because we
don't want to, but because there's so much happening.
And I think people just need to find time to
really check these things out on their own instead
of me just saying, okay, this is what they're
reporting. Because honestly, we don't see a lot
of stories like they do. And... Everything else.
So... That is... Where we are. So in parentheses,
H -I -B -P. So if you haven't been there, have
I been? P -W -N -E -D dot com. Find a link at
emailhostsecurity .com under our resources. Our
resources can be gotten to directly at emailhostsecurity
.net. H -I -B -P is one of two websites that
we actually recommend. The other is ExposedOrNot,
X -P -O -S -E -D -OrNot .com, which you can also
find on our website. The data allegedly contain
user information obtained via API scraping. Some
cybersecurity researchers speculate that the
breach happened in 2022, but the data's provenance,
authenticity, and age have not been publicly
corroborated. bleeping computer posits that the
data may be a compilation of previously scraped
information about multiple sources over several
years. And we know by default that There could
be a breach, okay? But actors may not use anything
from it. But then, there could be another breach.
Let's say you're not in the original, right?
So, if Instagram was breached, you don't have
an Instagram account. But all of a sudden, your
information comes out because some other breach
happened. But yet, it's tied, for example, to
a story like this one, where you could get an
email saying that your account was compromised,
yet you have no Instagram account. So they could
package a dataset, call it an Instagram breach,
even though Instagram, in its right, could say,
no, that's not our breach. So, that's that. I
did see the Malwarebytes story in their newsletter.
A combination of things is what I figure, and
I did not post the article. So, back then, I
decided not to publish it, because it seemed
to me That there was a whole combination of things
going on here. And this could happen even now.
We covered this in our last TSB program in passing.
So if you listen to TSB in January. You will
hear us talk about this particular story because
Nick mentioned it, and yes, I still think this
is going on today. Neely writes, It's a good
time to check the HIBP website for all your email
addresses, as well as make sure that your password
practices are up to snuff. You know the drill.
Use good passwords, don't reuse them, and enable
MFA and passkeys for, I'm sorry, wherever supported.
If you have any doubts about the security of
a password for a service, update it using their
password changing mechanism. Disabled accounts
for services you are no longer using. I'm sorry,
it says disabled, not disabled. And I think that
is a great idea. if the service allows you to
do that. Keep a record of that action. Sometimes
it takes a bit to close an account. You can also
check exposed or not whose link is on our website.
at emailhostsecurity .net. The short link to
the resources page, as I talked about in this
segment. Let's continue now with Breach Forums.
And even though this is late, I always love stories
like this because we know Breach Forums was never
meant to be good. And if we can get a couple
of stories, even though this is going to be months
late, I win completely. Right, so... Item number
three in the rest of the news says, breach forum
member data leaked. ReSecurity has analyzed a
database of 323 ,986 forum members' records alleged
to identify... administrators, moderators, and
users of the latest incarnation of a cybercrime
forum called Breach Forums. Let me make this
very clear that at this time, I do not know if
they are still around or not. Any incarnation
of this forum, not good the company's threat
intelligence team believes the database and associated
leaked data contain information that may be useful
to law enforcement pursuing cyber criminals some
of the records Identified. In the database. Are
definitely. Authentic. And can. Be. Cross checked.
With other sources. Regarding specific. Actors.
However. Some records. Have been edited. Removed
or contain. Non. For example, replaced on IP
127 .0 .0 .9, which is likely an OPSEC measure
taken by the actors administering it. The last
registration date in the newly leaked user database
is from August 11th, 2025, which is the same
day the previous breachforums .hn was closed.
Hmm. Race security contrasts this breach with
previous examples of information released by
threat actors asserting that the events Involving
the compromised. Breach forums database. Are.
Different. From this activity. And contain. The
meta data. Of many. Notable bad. Actors. So.
This. Is a taste. Of. Their own. They think they're
untouchable. But are they? I don't know. And
the fact that we haven't seen anything that...
Terry Ring, Preston Gaylor, Nicholas Jackson,
or others that might end up sending me things
about this type of thing. They haven't seen anything.
Hmm. I wonder. I write, this is always good news
in my book. If we can catch some. We can slow
down the services, or have them stopped too.
Neely, the face of the newsletter it seems, writes,
It seems the tables have turned. In this case,
the breach forum is itself breached. That said,
releasing the database is not without risks.
The database was released by James. And Resecurity
hints they know who that is. If they can figure
it out, so can others. If you want to analyze
the data, obtain a clean copy from Resecurity.
as there are other copies which contain malware
yes mr neely the tables have turned and this
i think we can agree is good Here comes our next
item. California Privacy Protection Agency finds
Texas firm for failing to register as a data
broker with the state. California's Privacy Protection
Agency is finding Rickenbacker Data, DBA, Data
Masters for failing to register as a data broker
in the state of California. The decision asserts
that Data Masters bought, repackaged, and resold
contact data of people with a variety of medical
conditions, so the information could be used
for targeted advertising. The action from CPPA
finds Datamasters $45 ,000 and orders the company
to stop selling data belonging to California
residents. Data Masters was also ordered to delete
all Californians' personal information it holds
by the end of December 2025. In a separate action,
see PPA, find S. NP Global $62 ,000 for failing
to register with the state as a data broker.
The issue was due to an administrative error.
Neely writes, An indicator That's consequences
for failing to follow CCPA are real. Double check
the applicability of CCPA to your datasets. Datamasters
claimed they were exempt from CCPA because they
didn't operate. California but it's the processing
obtaining of data that belongs to Californians
without deleting it within 24 hours which brings
CCPA into play if you are a data broker for the
California, if you are a data broker for Californian
data, make sure that you register. The California
Delete Act expects more enforcement as single
point opt out is implemented in the new drop.
platform dukes start this whole thing off with
californians consumer privacy act ccpa is pretty
specific regarding data brokers one of the main
requirements is To register within the state.
And BTW. That's an annual requirement. Looks
like California is getting serious about getting
out. I'm sorry. Of ferreting out data brokers.
operating illegally in the state. Murray also
has a great point. Given how lucrative the data
broker business is, these fines are not likely
to be effective. The orders may B. Kudos to California,
its law, and its agency. What do you say? Well,
I haven't seen any more about this, at least
in public circles. whether in podcasts or even
brought to my attention. But companies should
be ashamed of themselves for collecting data
because that's what they do. They collect it.
They sell it. And frankly, we don't even know
who the they are. I'm sorry, but when I initially
read this section of the newsletter, I was happy
to see that they got fined. Yes, it's probably
a small drop in the bucket. And they'll just
pay them and say, go away. They may delete the
data. Then they'll go back and collect it until
they get caught again. But the fact that they
got caught and they had to pay makes them slow
down. Whether it stops the whole thing, I don't
know. I'm not ready to go that far. But, I still
want to hear what you have to say. Send me an
email or iMessage at tech, that's T -E -C -H,
at M as in Mike, E -N as in November, V as in
Victor, I as in India, dot org. Text or WhatsApp
804 -442 -6975. And of course, you can leave
your comment on the phone line at 888 -405 -7524.
Because this is going to get very interesting.
I assume that this is going to be probably one
of the biggest stories of the year. as we'll
be approaching mid -year soon. And we haven't
seen anything new, but yet again, I haven't been
reading sans on a regular due to the aforementioned
issues I've told you about in segment four of
this podcast, which is why it's been delayed
so long. Suffice it to say, it wouldn't surprise
me if other SANS news bites that we have not
been able to cover and will not cover because
of how far we're behind has covered this. Starting
with the next podcast of SANS, we're going to
just move forward instead of trying to catch
up completely. Please understand that we're trying
the best we can. And with everything going on
in the various podcasts we have, there's only
so much we can do. So what do you say about this?
Yay? Nay? I don't care? F you? Go ahead. You
can say F you. I try not to make this a swearing
program. At least on sands I don't. I try and
make it my own without getting my emotions caught
up in everything. I try. But you tell me. Yay,
nay, what? Spanish authorities arrest 34 in connection
with Cybercrime Network. And again, we are very,
very happy to see things like this because we
don't see a lot of it. And I know one of the
things that I want to see more of is news just
like this. We always talk about ransomware, you
know, and all of the bad things. And we don't
see good things. Now, will it lead to any time?
I don't know. But the fact that people are arrested
and charged with things slows things down. Is
that a good thing? Overall, I believe it is.
The write -up for this says, Authorities in Spain
have arrested 34 individuals in connection with
cyber fraud conducted by an international criminal
group. According to investigators, the group
is responsible for fraud losses of more than
five Kaba 93 million euros. I believe that's
a comma. I don't know what exactly this is. It
may be 5 .93 million. I'm not 100 % sure. Because
I see a dot. It's not a period in either braille
code. So, I'm not exactly sure. But anyway, let's
just say it's $5 .93 million, which is quite
high. Law enforcement recovered a small portion
of that amount by freezing bank accounts and
seizing cash. Well, seizing cash is probably
easy. Bank accounts, I don't know how law enforcement
would seize that. I would assume that would be
up to the bank. Cash, you could take and say,
that's not yours. Not until we prove you earned
it. Business email compromise attacks. Illegal
vehicle trafficking through shell companies and
other fraudulent activities. The law enforcement
action was conducted by the Spanish National
Police. national in cooperation with the Bavarian
state criminal police office and this word is
bear chess and the next word is Bendis criminal
it's a criminal lemt so or no it's landis criminal
lemt uh so it's gonna be b -a -y -e -r -i -s
-c -h -e -s and then l -a -n -d -e -s -k -r -i
-m -i -n -a -l and then AMT and support from
Europol. Europol writes that the cross -border
collaboration between Germany and Spain included
Spanish investigators receiving analytical support,
the exchange of intelligence, and the deployment
of two German officers on site during the action
day. Europol supported the action through a range
of services including information analysis, a
data sprint held in Madrid, and on -the -spot
support. Neely writes, it is nice to see cross
-border cooperation continue to shut down criminal
operations. This group has a global presence
operating in Nigeria and abroad. Spread over
about 60 zones with 200 members each. and has
a total membership of about 30 ,000. They were
known for recruiting money mules from impoverished
areas with high unemployment rates. I agree,
I write. I love great news like this. Keep it
coming. And yes, Money Mules. That was actually
talked about in recent episodes of a podcast
that deals with crime. More specifically, different
types of crime. But they do talk about bank crime
and what's happening. And the podcast, in theory,
is mainly meant for people who don't understand
a lot of what's happening recently. This podcast.
was talking about business email compromise,
and they made it known that they didn't know
what it was. And while I can't necessarily blame
the hosts per se, when a host brings something
up, it's a good idea if you don't know what something
is, to just indicate that you don't know what
it is. It's okay to read and give your thoughts
about what you're about to talk about, and then
say, we want to look this up, we don't really
know what this is. But to come out and just say,
we don't know what this is, but we're going to
talk about it anyway, makes it look bad, in my
opinion. Now, I'm not going to sit here and bash
podcasts. That's not who I am. We here at the
Jared Reimer Network want all podcasts to succeed,
and we definitely think that there is an important
need for a podcast that is simple, talks about
various types of scams and crime, It's pretty
much what scams are. It's a form of crime. The
podcast itself is titled Scam Squad. It's ran
by two individuals. And, you know, if you find
it of value, go ahead and check it out. I'm not
going to say publicly that they should go because
people... probably would say that this podcast
set needs to go. And that's not what I'm about
to do. I'm not going to do that publicly. You
know, what we might say privately could stay
that way. But I really think that education is
key. And each podcast is going to do it differently.
So, let's just leave it at that. And we'll go
from there. If you've heard of the podcast and
you find it of value, let me know. Because I
want to make sure that people are educated the
best way that they can be. When we will continue
with the podcast, Or better yet, when we continue
with this podcast, we're going to talk about
a printing error. And this printing error has
got to probably be the worst I've ever seen.
So let's see what this is. I'm Jared Reimer.
This is SANS 38. Printing error prompts recall
of nearly 13 ,000 recent Irish passports. Talk
about a problem much? A software update appears
to have caused Irish passports issued between
December 23rd 2025 and January 6th, 2026 to be
printed incorrectly, rendering them invalid.
Ireland's Passport Service says that in order
to mitigate against any possible travel issues,
they have notified border authorities worldwide
through the International Civil Aviation Organization,
ICAO, as well as Irish Border Management. The
documents in question are missing the letters
IRL. which means they are not compliant with
border control and e -gates requirements. The
Passport Service has contacted all 12 ,900...
for affected customers asking them to return
their incorrectly printed passport books and
cards, informing them that they will be issued
new documents with new numbers. What a costly
mistake! For that many, there will be some Upset
people, and that's putting it mildly. Neely writes,
Use caution with move fast and break things and
have a plan for rolling back or fixing what you
break. In this case, physical replacement of
passports is a bit... higher impact than a case
where you may have had to update data and possibly
send a notification. When things do go sideways,
make sure that someone has the customers back.
In this case, the Irish Passport Service has
been emailing affected customers, updating their
website, and setting up a dedicated customer
service team for those traveling immediately
as well as covering any costs of reissued passports
or visas. The good news is that the customer,
by the way this reads, doesn't have to pay a
dime. I guess that is a good thing. I could see
them being outraged if they did. What a costly
printing mistake, even months later and reading
it now. I don't think I've seen anything as bad
as this, even though I've not read Sans since
on a regular. But I know that my sources haven't
reported anything, but that definitely doesn't
mean anything. If you've seen something, even
if it's late, I'd like to at least review it.
I believe this is our last item of this program
and we can finally get old news out the door.
Again, I completely apologize for the fact that
this took so long. And now that I think we're
stabilized, we'll be able to do more of these
on a regular basis. So, let's cover our illustrious
government now, because this is a CISA item,
and we know that CISA itself has been under fire
with funding and other things, and remember that
this is the company that says, quote, you need
to do, end quote, but, quote, we don't have to.
End quote. Meaning, do as I say, not as I do.
This item says CISA retires 10 emergency directives.
And this is probably a good thing because if
they're not needed, then that is the right thing
to do. But again, this is the same company who
is tasked by the government to keep everyone
as secure as possible, yet they themselves, meaning
the government as a whole, I'm not saying CISA
doesn't, I'm saying the government doesn't. And
to be honest, I'm not attacking just the U .S.
government, I'm attacking government in general
when I say that they don't update. On Thursday,
January 8th, 2026, the U .S. Cybersecurity and
Infrastructure Security Agency, CISA, retired
10 emergency directives issued between 2019 and
2024. In a press release, CISA writes that a
comprehensive review of all active directives
determined that required actions have been successfully
implemented or are now encompassed through binding
operational Directive BOD 2201, reducing the
significant risk of known exploited vulnerabilities.
The retired emergency directives include one
directive from 2019 instructing FCEBs to mitigate
DNS infrastructure, tampering three directives
from 2020 regarding a variety of Windows vulnerabilities,
four directives from 2021 including the SolarWinds
Orion code compromise, Pulse Connect, Microsoft
Exchange On -Premises, and Windows Print Spooler.
One from 2022 regarding VMware vulnerabilities,
and one from 2024 regarding the nation -state
compromise of Microsoft corporate email systems.
I write, I was almost going to write that this
was a bad idea, but reading Neely's response
seems quite fair to me. He writes, the emergencies
have passed. Countermeasures and updates are
in place for those specific flaws. The focus
needs to be on keeping things secure slash updated.
CISA slash DHS's continuous diagnostics and mitigation
program is designed to do this across the federal
government. It boils down... to keeping an eye
on the ball and identifying and addressing issues
before a directive is issued to do so, ideally
with a dashboard for management to review in
lieu of another meeting or report. Or and report.
Dukes also writes, the key word is action. emergency,
end quotes. And yes, directives issued in the
last six years should have been implemented in
that time frame. The bulk of the now retired
directives were issued to mandate patching of
specific vulnerabilities that have been around
for a year or more. I'd like to believe they
were all patched. So would I, guys. So would
I. And I guess we're just going to have to see
what happens overall. The editorial board of
SANS Brian Honan. Kurt Dukes. Chris LG. David
Holzer. Ed Skoudis. Gal Spitzner. Jake Williams.
Dr. Johannes Ulrich. John Peskitor, Josh Wright,
Kathy Bradford, Lance Spitzner, Lee Neely, Mark
Weatherford, Moses Frost, Suzanne Voltronaut,
William Hugh Murray, and Sands Institute is located
at 11200 Rockview Pike, Suite 200, North Bethesda,
Maryland, 20852. Email support at sans .org or
call 301 -654 -7267 for assistance. Well, ladies
and gentlemen, I am so happy that you were able
to trust us in trying to get the news out because
we definitely want to get that news to you. And
we can't do it alone. Unfortunately, do... To
other. Things. We were not able to do this. As
fast as we normally do. And. We. Definitely.
Want. The. Particulars. Of. Making sure we're
accurate. and doing everything we can. Speaking
of which, I have enabled the ability for transcripts,
and we're going to try this again. And starting
with our next podcast of A Day in the Life, we
are also enabling the transcripts. And hopefully
that might help some people because accessibility
is something that I want to try and do. And since
it's available to me, we're putting it on the
highest quality possible. And hopefully it is
good enough. The transcripts may not be fully
accurate, but it should be accurate enough. So,
we'll just have to see how it goes. And yes,
if we end up playing music that's vocal on the
security box, it'll more than likely transcribe
the lyrics of the tracks. I've seen it. It's
quite interesting. But you could ignore that
if you want. I don't know which programs support
it, but we are going to try it anyway and see
how it goes. So, we'll catch up with you all
next SANS episode, and we are going to go ahead
and just move forward and go to the most recent
episode available. Catch up with you all next
time.