Researchers uncover flaws that let hackers take control of cars

Baker Tilly has informed clients that personal data, including Social Security numbers, was stolen from a platform operated by one of its service providers. The intrusion occurred in early September and also affected clients’ dependants, including children. The firm has not disclosed the vendor or total affected, but regulator filings cited more than 10,000 victims in Texas alone. SecurityWeek reports that the breach is being disclosed by Baker Tilly to clients and regulators as part of ongoing investigations.

Separately, researchers Sam Curry and Shubham Shah disclosed flaws in ForgeRock deployments used by unnamed automakers that could allow account takeovers and remote commands on connected cars, including unlocking doors and starting engines. In one chain, a WAF bypass led to access of an Apache Felix console that still accepted default admin credentials; two automakers reportedly fixed the issue within roughly two hours of disclosure, according to SecurityWeek. The report highlights the rapid impact on vehicle security and the importance of hardened identity deployments in the automotive domain.

Other notable items in the briefing include: Vanderbilt University advising a shutdown of devices amid a cybersecurity incident; ex-FBI agent Patrick Yaroch pleading guilty to crypto theft involving roughly $2.47 million, with transfers tied to investigations; and Palantir CISO Michael LoSapio being nominated by President Trump to lead CISA, per Nextgov. SecurityWeek attributes each of these updates to the respective organisations or outlets reporting them.