Labcorp Settles with 44 Attorneys General, Bitget Loses $388 Million, and Citrix Zero-Days Reach Mass Exploitation

Welcome back to the InfoSec GRC Brief from SaltyCloud, your go-to source for curated insights on governance, risk, and compliance (GRC) in information security. This edition covers the infosec GRC news worth sharing from the second half of September.

Let’s get into it.

Regulatory & Compliance Updates

Labcorp Settles with 44 Attorneys General Over Vendor Breach

On September 24, a bipartisan coalition of 44 attorneys general announced an Assurance of Voluntary Compliance with national clinical laboratory company Labcorp over a vendor breach.

The incident, which began in 2019 at American Medical Collection Agency, a third-party debt collector for Labcorp, affected about 10.2 million customers. In addition to a $2,287,455 payment, Labcorp now faces injunctive relief in the form of a third-party risk management program. That includes:

• An Information Security Program overseen by a CISO, reviewed and updated annually.
• Security awareness and privacy training for employees who handle consumer personal information or protected health information.
• An incident response plan that covers the handling, investigation, and reporting of Vendor Security Events that expose data on at least 500 consumers.
• A Vendor Risk Management Program and a Vendor Risk Management Team that reports to the CISO at least quarterly.
• Risk-rated vendor assessment and monitoring via questionnaires, third-party audits, certifications, and on-site visits to corroborate responses.
• Debt collector contracts that require an industry-recognized security framework such as the NIST Cybersecurity Framework, along with data segmentation, minimum necessary use, data disposal under NIST Special Publication 800-88, cryptographic key protection, vulnerability remediation, annual risk assessments, penetration tests, and SOC 2 Type 2 audits.

The Assurance takes effect October 1. From there, Labcorp has 12 months to amend its existing debt collector contracts, and 18 months to obtain a compliance assessment from a CISSP-certified third party who reports to the Connecticut attorney general.

Read more →

Federal Cyber Rules Cause Conflicts and Duplication, GAO Reports

On September 28, the Government Accountability Office (GAO) published its third report on federal cybersecurity regulatory harmonization. In a companion GAO review, it counted 117 cybersecurity regulations issued by 37 federal agencies across 9 critical infrastructure sectors.

The full report summarizes conversations that took place during a three-hour panel on July 16. Participants included executive and specialist industry representatives from energy, financial services, and healthcare and public health.

Across sectors, most participants said harmonization made some progress over the past year. Still, half the panel said progress on the duplication and conflicts that already exist has been limited.

Each sector also named the rules it treats as duplicative or conflicting. Two appear on every list:

• CISA’s Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).
• The SEC’s Cybersecurity Disclosure Rules.

The rest break down by sector.

In conclusion, the report lists three requests issued by participants:

1. Reporting time frames, thresholds, and definitions defined substantially the same way across agencies.
2. One agency to receive incident reports and distribute them, with CISA as the named candidate.
3. Continued engagement between agencies and industry.

A mechanism for the first item already exists but has yet to take effect. 6 U.S.C. 681b(a)(5)(B) excuses covered entities from reporting to CISA when law, regulation, or contract requires substantially similar information to reach another federal agency on a substantially similar timeline.

According to the proposed rule, however, that exemption takes effect only after a CIRCIA Agreement exists. Until then, existing sector reporting obligations are the only ones in force.

Read more →

CIRCIA Final Rule Deadline Slips Again

Originally, the statutory deadline for a final CIRCIA rule was October 2025, 18 months after the proposal appeared on April 4, 2024.

After moving its initial October target to May 2026, CISA again pushed the date to September 2026. As of September 30, 2026, however, CISA has not published a final CIRCIA rule.

The most recent slip has a documented cause. CISA scheduled seven town hall meetings for March and April 2026 to take further input on the proposal’s scope and burden.

A lapse in Department of Homeland Security appropriations from February 14 to April 30 cancelled all of them, and the sessions ran June 15 through 18 instead.

During those sessions, CISA considered:

• Modifying or removing the sized-based criterion for critical infrastructure entities that exceed a small-business size standard, whether or not it meets a sector-based test.
• Rewriting sector-based criteria for commercial facilities, dams, and food and agriculture if the size threshold changes.
• Adding criteria for managed service providers and cloud service providers, and for open-source code and code repositories, and whether its published examples of a substantial cyber incident are accurate.

Nothing binds covered entities until a final rule takes effect. Experts say enforcement is expected late 2026 or 2027.

In the meantime, keep a close eye on docket CISA-2022-0010. Whether an organization is covered at all is still subject to change.

Read more →

AI Supervisory Framework for Examiners of Bank and Nonbank Institutions

On September 16, the Conference of State Bank Supervisors (CSBS) released its AI Supervisory Framework Core Examiner Guide. It offers guidance for examiners to identify whether and how bank and nonbank institutions use AI.

Instead of creating new legal obligations or supervisory requirements, it’s based on existing public materials, including the NIST AI Risk Management Framework, the Cyber Risk Institute’s Financial Services AI Risk Management Framework, and Treasury’s AI Lexicon.

The guide opens with initial scoping questions, beginning with whether the institution uses AI at all. Once AI use is identified, examiners may request:

• AI policies, standards, and procedures, plus the governance reporting that reaches management and the board.
• An AI inventory, with a business purpose, a business owner, and a risk tier for each use case.
• A list of vendor products and services with known or potential embedded AI capabilities.
• Contract terms addressing the use, retention, sharing, or training of AI systems on customer or institutional data.
• Samples of recent AI-generated consumer-facing output, including notices and chatbot transcripts.
• Internal audit reports, compliance reviews, or independent assessments of AI use.

CSBS also notes that existing model risk resources may not fully cover generative or agentic AI. Where an AI system can act with limited human direction, examiners can review how the institution defines the actions it may take, its human checkpoints, its logging, whether those actions are reversible, and whether the institution can halt it.

But ultimately, each state agency will decide how much of the guide to adopt.

Read more →

EDPB Sets a Five-Step Test for When to Fine

On September 17, the European Data Protection Board (EDPB) adopted its Guidelines on the Application of the Power to Impose Administrative Fines in Relation to Other Corrective Powers Under the GDPR. As a result:

• A minor GDPR infringement will generally draw a reprimand rather than a fine.
• Anything above minor carries the strong presumption that a fine will follow.

The guidelines complement the EDPB’s existing Calculation Guidelines and replace the WP29 guidance that preceded both. They govern whether to fine rather than how much with five steps to decide that question:

1. Whether the infringement can be fined at all, with support in the GDPR or in national law.
2. Whether the party under investigation can be fined, which turns on whether the breached provision binds the controller or the processor.
3. Whether the infringement was intentional or negligent, since a culpable infringement is a condition of any fine.
4. Whether the aggravating and mitigating factors in Article 83(2)(a) through (k) indicate the infringement is minor.
5. Whether a fine would be effective, proportionate and dissuasive under Article 83(1).

Consultation runs until November 13. Whether an infringement counts as minor rests with the supervisory authority, which weighs the Article 83(2) factors case by case under Recital 148.

Read more →

GRC Strategies

NIST Finalizes IR 8587 to Protect Federal Access

On September 15, NIST finalized IR 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse.” Published with CISA and drawing on input from a Joint Cyber Defense Collaborative workshop, it covers single sign-on, federation, and application programming interface (API) access at federal agencies and the cloud service providers they rely on.

Much of its guidance concerns signing keys for tokens, which attackers can use to bypass multi-factor authentication (MFA) if stolen or forged. More specifically:

• Moderate and low-impact systems: A signing key should stay in active use for under one year.
• High-impact systems: A signing key should stay in active use for no more than 90 days.

Additionally, all keys must be generated inside modules validated under FIPS 140. Automated rotation should begin ahead of expiration so that old and new keys are accepted in parallel. And every token and assertion must also carry at least eight elements consistent with SP 800-63C. That includes:

• An audience identifier naming the party intended to consume it.
• A unique identifier or nonce that prevents replay.
• A signature covering the entire assertion.

Conformance is voluntary unless a policy or binding agreement requires it. For procurement teams, that makes one section especially relevant. Under NIST IR 8587, providers are now responsible for notifying all suspected incidents promptly and with enough detail for the agency to assess impact and meet reporting obligations.

Read more →

CISA’s First Decoy Guide Separates Honeytokens From Honeypots

On September 16, CISA published Using Cyber Decoys to Strengthen Detection and Response, an introductory guide to decoy operations for small and medium-sized critical infrastructure organizations. Its most useful distinction is between two techniques that often get grouped together.

• A honeypot is a decoy system or service, often with intentional vulnerabilities, which CISA rates as medium to high in complexity and suited to organizations with high security maturity.
• A honeytoken is a data element with no legitimate business use, such as a fake record, credential, or file, and it rates low on both counts.

Because no legitimate user should ever touch a honeytoken, any interaction strongly suggests unauthorized activity and produces a high-fidelity alert. Common honeytoken types include:

• Files and documents that alert when opened, copied, or modified
• Fake data records placed alongside real ones
• Disabled or unused user or service accounts
• Fake passwords, API keys, or tokens
• Decoy email addresses placed in directories or applications
• Decoy URLs or links

From there, CISA recommends MITRE Engage‘s three goals of Expose, Affect, and Elicit. Start by establishing Expose, which detects adversaries operating in the environment, along with selected Affect activities where appropriate, before considering Elicit. CISA also suggests keeping documentation of decoy locations outside the production environment, testing each decoy to confirm it generates alerts, and following deployment with red or purple team exercises that use relevant ATT&CK techniques.

Read more →

Cyber Insurers Condition Coverage on Documented Controls

In 2024, about 3/4 of the roughly 38,500 cyber claims closed without a payout, according to National Association of Insurance Commissioners data cited in a client alert from Shumaker, Loop & Kendrick.

Because carriers condition both the binding of coverage and the honoring of claims on specific, verifiable controls, a single gap can support denial, trigger policy limitation, or, where an application answer proves materially inaccurate, justify rescission. Most carriers ask for some combination of the following:

• MFA across remote access, email, and privileged accounts
• Endpoint detection and response (EDR) on every managed endpoint
• Immutable and offline backups, with recurring restoration tests
• A written incident response plan rehearsed in tabletop exercises
• External vulnerability scanning before binding or renewal
• Privileged access management (PAM) enforcing least privilege
• DMARC, DKIM, and SPF, with the DMARC policy set to quarantine or reject
• Security awareness training with simulated phishing tests
• Network segmentation
• Patch management with a documented deadline for critical vulnerabilities

As an example, consider Travelers Property Casualty Co. of America v. International Control Services, filed in the Central District of Illinois in 2022. Here, the insured’s application represented that it used MFA for administrative and privileged access. After a May 2022 ransomware attack, however, Travelers found that MFA was protecting only the firewall. Eventually, the parties agreed to a court order rescinding the policy as void from its inception.

What the case illustrates is how courts may permit rescission for an application misstatement made negligently or even in good faith, provided it materially affected the risk. One remedy is to have the person who manages each system verify the corresponding answer, identify its scope and exceptions, and disclose whether a rollout is partial.

Read more →

CISA and FBI Publish Critical Infrastructure Fact Sheet

On September 23, CISA and the FBI published a joint fact sheet for critical infrastructure operators. It recommends requirements for third-party industrial control system (ICS) integrators, the firms that handle control system design, installation, operations, data analysis, and device support.

Before making its recommendations to assess risk, the fact sheet offers examples of risk and exploitation. More specifically, it describes how, between March and April 2025, foreign actors breached the network of a U.S. industrial automation company serving power utilities and transportation entities, searched for terms including “customers” and “SCADA,” and created nine zip files holding roughly 800 files of customer SCADA information, ICS device details, and schematics for presumed exfiltration.

To help critical infrastructure owners and operators safeguard the security of their operational systems, the fact sheet frames the risk assessment around four questions:

1. What organizational data can the integrator store or access?
2. Where is that data stored?
3. Does the integrator hold remote access for operational support?
4. Can the operator keep running if the integrator is compromised?

For a foreign-owned integrator, the agencies also advise asking whether that data lives in the United States. Even when integrators operate as U.S. subsidiaries, data stored abroad may be governed by that country’s laws.

To reduce risk, contracts and service agreements should address data storage locations, remote access capabilities, the integrator’s own cybersecurity program, change and patch management, the steps taken to secure deployed components, and a list of personnel authorized to access systems.

Operationally, the agencies recommend disconnecting integrator-supplied devices from the public internet, routing integrator access through paths the operator can monitor, and keeping secure offline backups of all software required to operate the equipment.

Read more →

Cyber Incidents & Risk Implications

NetScaler Zero-Days Reach Mass Exploitation

On September 27, CISA disclosed eight NetScaler vulnerabilities, adding two to the Known Exploited Vulnerabilities catalog. Both score 9.5 under CVSS 4.0.

• CVE-2026-88771 lets an unauthenticated attacker execute arbitrary commands through improper input validation. It affects every NetScaler ADC and Gateway deployment, including those in the default configuration.
• CVE-2026-88772 is a memory overflow reached through Datagram Transport Layer Security (DTLS) enabled by default on VPN virtual servers. It makes a NetScaler Gateway vulnerable unless DTLS is explicitly disabled.

On September 24, GreyNoise recorded an attempt against a NetScaler Gateway sensor. By September 29, researcher Kevin Beaumont, who assesses the initial campaign as espionage, reported tracking more than 100 victim organizations, each with a unique web shell that cannot be scanned for remotely.

On September 28, watchTowr Labs published a root-cause analysis and proof-of-concept exploit for CVE-2026-88771, Lupovis told Help Net Security it recorded opportunistic exploitation attempts within minutes, and Censys counted42,735 NetScaler hosts. The following day, Beaumont’s firmware scans put the patched share below 10%.

Under BOD 26-04, Prioritizing Security Updates Based on Risk, federal agencies must remediate both catalogued flaws by September 30. CISA also urges operators to check for indicators of compromise before patching, since updates can destroy forensic visibility. All exposed appliances still need a forensic review, even after patching.

Citrix also published security bulletin CTX697096 with indicators of compromise that customers can check via NetScaler Console. But it also warns they “might fail to identify actual compromises.”

Read more →

Bitget Loses $388 Million to Third-Party Security Tool

On September 24, cryptocurrency exchange Bitget detected unauthorized transfers totaling roughly $388 million across 12 hot and warm wallet addresses. According to Bitget’s own account, the attackers exploited a zero-day in a third-party security product to steal internal network access credentials.

Because the credentials were valid, the system recognized the logins as normal user activity. With that access, the attackers wrote forged withdrawal commands directly into the wallet system, which processed them as ordinary withdrawals, bypassing the risk control verification that runs before withdrawal records are generated. Private keys were not compromised and cold wallets were unaffected, Bitget says.

North Korean involvement is very likely, according to CEO Gracy Chen. Blockchain analytics firm TRM Labs also found multiple overlaps with wallets used to launder earlier North Korean thefts, without making a firm attribution.

Bitget suspended withdrawals while it verified its infrastructure and began restoring them in phases on September 28. Since the incident, the company says it has:

• Patched the vulnerability
• Reset all internal credentials
• Tightened access to highly sensitive permissions
• Notified third-party vendors
• Disabled the relevant features
• Strengthened independent withdrawal verification

Bitget also promises a formal report with fuller technical detail to come.

Read more →

Hijacked Azure Service Principals Wipe Storage Accounts

On September 25, Microsoft detailed an intrusion by JADEPUFFER carried out through two compromised Azure service principals, the machine identities that applications use to authenticate, belonging to the same tenant.

Microsoft, which tracks the intrusion as Storm-3168, says it is unclear how the principals were compromised. In one case, a principal’s client ID, client secret, and tenant ID had earlier been posted in plaintext to a public GitHub issue by an employee. Although the issue was edited to remove the secret, it remained accessible through the public edit history. Microsoft could not confirm whether the leaked secret was used, and it advises that any exposed secret be revoked or rotated.

After roughly 15 and a half hours of reconnaissance, the destructive sequence lasted just about seven minutes. It included:

• More than 100 attempts to delete storage accounts, most of which succeeded,
• the deletion of a Key Vault, a Function App, and an App Service plan, and
• unsuccessful attempts to remove Azure Site Recovery and Azure Backup protection locks.

Resource locks and storage-account deletion protection saved a few accounts. And, because the attacker used an unsupported API version, every attempt to delete Azure SQL databases failed. About 30 minutes later, the same identity retrieved access keys from more than 30 storage accounts, including some tied to Azure Site Recovery.

In July, Sysdig described JADEPUFFER as the first documented agentic ransomware operation. Although no ransom note was observed, Microsoft says the destruction, the interference with recovery, and the key collection together are consistent with tactics that support ransomware and extortion.

But Microsoft titles the activity “agentic-driven.” More specifically, the timing and division of work across the two identities “strongly indicates automated or scripted execution.”

Read more →

Pentagon Breach Affects 3 Million People

On July 16, the Defense Manpower Data Center (DMDC), the Defense Department’s central source for identifying, authenticating, and authorizing personnel, discovered a vulnerability in a file-sharing system that allowed unauthorized users to access files.

According to the notification letter, a small number of unauthorized users had been accessing files on a server containing unencrypted personal information since October 2025, roughly nine months.

The letter, which is dated September 18 (64 days after discovery), does not name the product, describe the vulnerability, or say how many people are affected. However, when Military Times first reported the breach on September 24, two people familiar with the incident estimated that approximately four million personnel may be affected.

On September 28, a U.S. defense official told ABC News the breach affects 2.76 million living and 294,000 deceased individuals. Exposed data varies by individual and includes:

• Social Security numbers
• Names,
• Dates of birth
• Contact details
• Demographic data
• Military occupational specialties

No known group has claimed the intrusion, and the department says it has no indication of misuse. DMDC says it patched the vulnerability immediately after discovery and is offering one year of credit monitoring and identity restoration through IDX.

Still, the access that flaw allowed went unnoticed for nine months on a server holding unencrypted data. That’s why file-transfer systems need monitoring for anomalous access as well as prompt patching.

Read more →

Revolut Releases Customer Data to Fake Government Requests

British multinational neobank and financial technology company Revolut recently confirmed it released customer data to an unauthorized third party. In what the company calls a sophisticated external impersonation scam, attackers used a legitimate government agency domain email to submit fraudulent requests for information. The released data includes:

• Customers’ birth dates
• Postal and email addresses
• Phone numbers
• Copies of identity documents such as passports and driver’s licenses

ZachXBT, the on-chain investigator who first surfaced the notification, also lists IBANs, withdrawal records, and full transaction history. It may also have included verification selfies and account statements.

Revolut says it blocked the email address, contacted affected customers directly, and alerted the government agency, law enforcement, and relevant regulators. It has also declined to name the agency or disclose how many customers were affected. But the company maintains its systems and customer funds are unaffected.

The FBI warns about a closely related technique in private industry notification 20241104-001, which describes compromised U.S. and foreign government email addresses being used to send fraudulent emergency data requests. In defense, it advises reviewers to look for doctored signatures or logos, to check that cited legal codes match what the originating authority would use, and to contact both the sender and the originating authority when a request needs validation.

Read more →

SaltyCloud Research

CIS Controls v8: Complete Guide [2026]

A walkthrough of the 18 Controls and 153 Safeguards in the CIS Critical Security Controls, useful as a practical baseline for prioritizing security work.

Read the Guide →

CMMC 2.0, Rule & Timeline: Complete Guide [2026]

A guide to the CMMC model, the rules behind it and the timeline contractors are working against.

Read the Guide →

Resource

TPRM Maturity Checklist

Score your third-party risk program against a 5×5 maturity matrix, find the dimension holding it back, and see what the next stage requires.

Access the Checklist →

Wrapping Up

Almost every story in this edition comes down to a document — a settlement agreement, an examiner’s request list, an insurance application, a token specification, or a notification letter.

Regulators, insurers, and attackers are all testing whether those artifacts match what is deployed. The organizations that can produce evidence of what their controls actually cover will be the ones to respond the fastest.

If you’re on LinkedIn, follow SaltyCloud for more insights and updates between newsletters. And, as always, feel free to reply to this email with comments, questions, concerns, ideas, or memes. We’re always listening.

Thanks for being part of our community and for letting us be part of your day. We’ll keep doing our part to deliver content that’s as essential as salt itself.

Wishing you resilience and security,

The SaltyCloud Research Team

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.