Carnival Data Breach Exposes Data of Nearly 6 Million Customers

 May 29th, 2026

Carnival’s latest cyber breach lands with an uncomfortable sense of déjà vu, as the world’s biggest cruise operator again finds itself explaining how customer data slipped into criminal hands.

The company has confirmed a cyber incident affecting its systems that has exposed personal information belonging to nearly 6 million customers. The disclosure follows claims by the ShinyHunters group that it stole millions of records and terabytes of corporate data in an April intrusion.

For Carnival, the incident adds to a growing number of cybersecurity incidents the company has suffered. That backdrop matters because it raises questions about whether lessons from repeated cyber incidents are translating into stronger defenses or if threat actors are simply getting smarter.

Click here to read the article

Medicare fraud affects everyone, so here’s what to know and do

 Medicare losses due to fraud, errors, and abuse cost taxpayers about $60 billion every year. Providers might double bill Medicare for a single treatment, charge for things like a back brace you didn’t get (or need); a company might offer you a fake Medicare drug plan; or a scammer might ask you to confirm your Medicare number ­— which they then use to commit hospice fraud.

Medicare fraud, abuse, and unintentional errors can also contribute to medical identity theft, losing your benefits, and paying higher medical costs. So, what can you do to help fight Medicare fraud while protecting yourself and your community?

Click here to read the article.

From the US Treasury - Recognizing Imposter Scams

FinCEN is a bureau of the U.S. Department of the Treasury. The Director of FinCEN is appointed by the Secretary of the Treasury and reports to the Treasury Under Secretary for Terrorism and Financial Intelligence. FinCEN’s mission is to safeguard the financial system from illicit activity, counter money laundering and the financing of terrorism, and promote national security through strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.

Scammers often pretend to be contacting you on behalf of the U.S. government. They may contact you through phone calls, text messages, emails, U.S. Mail, or social media. They may say they work for FinCEN, including using the names of current or former FinCEN employees, or send you something claiming it is from FinCEN. Scammers will pressure you into sending money or personal information. They may demand payment for alleged anti-money laundering violations and outstanding debts.

Click here to read the article.

If you use MS365 - The FBI has issued a warning - Please read

 The FBI issued a warning on May 21, as a new AI-powered attack enables "threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user's credentials.”

Dubbed Kali365, this phishing-as-a-service threat was first discovered last month. The FBI released its public service announcement “to warn the public" that these attacks use Microsoft’s authentication infrastructure to steal user credentials.

Click here to read the article.

Update Chrome now: Critical bugs could let attackers take advantage of your Computer

 Google has issued updates for the Chrome browser patching a number of high‑severity vulnerabilities. 

The update includes fixes for two critical vulnerabilities that can be used for remote code execution just by visiting a malicious website.

The stable channel has been updated to 148.0.7778.178/179 for Windows/Mac and 148.0.7778.178 for Linux, which will roll out over the coming weeks.

How to update Chrome

If you don’t want to wait for the rollout to reach you, manually updating is easy.

The easiest way to update is to allow Chrome to update automatically. But you can end up lagging behind if you never close your browser or if something goes wrong, such as an extension preventing the update.

To update manually, click the More menu (three dots), then go to Settings > About Chrome. If an update is available, Chrome will start downloading it. Restart Chrome to complete the update, and you’ll be protected against these vulnerabilities.

Click here to read the article.

VIDEO - Warning signs your computer has been hacked and how to protect yourself

 Your device could be hacked, and you wouldn’t know until it’s too late. All while doing serious damage, including hackers accessing your personal information. 

Click here to watch the video.

VIDEO - Ghost tapping: The scam charging your card without you knowing

 Ghost tapping: The scam charging your card without you knowing.

Click here to watch the video.

VIDEO - Here’s what to do instead of texting “STOP” back to spam messages

When you get a notification in your pocket that you've missed a package, but the message is vague, it's a universal annoyance for most Americans. The Federal Communications Commission (FCC) cautions that the first inclination you may have is to send a text message "STOP" to put an end to the madness, but it may end up proving you have an active number. The offhand answer may encourage even more junk, and a stealth response may be more effective.

Click here to watch the video.

These 5 critical Windows Defender settings are off by default - turn them on ASAP.

Windows Defender has several security settings, including some you need to switch on to get the utmost protection. Here's why.

ZDNET's key takeaways

• Windows Defender offers several optional protections.
• Some security settings are disabled by default.
• Enable extra settings one at a time to avoid conflicts.

---

Protecting your Windows PC against security threats is critical. You want to make sure your personal files aren't vulnerable to viruses, malware, and other threats. But how do you best defend yourself, your computer, and your data?

Third-party security tools are always an option. Some are free; others are paid. Some offer basic protection; others provide additional features to tackle more advanced threats. Alternatively, Microsoft's own built-in Windows Defender can track down viruses and other dangers.

Click here to read the article.

Mobile phishing is a bigger threat than email now - how to stay protected

 

ZDNET's key takeaways

• Verizon's recent report reveals top business security trends. 
• Mobile phishing is outpacing email-based attacks. 
• Companies need mobile-focused phishing training.

---

Mobile attack vectors are outstripping email threats as we become more able to detect traditional phishing attempts, Verizon said in a new report exploring the data breach landscape and the impact on businesses worldwide.

Click here to read the entire article

Another post about the CHROME vulnerability - Critical Chrome flaw could secretly turn your phone into a Botnet

 There's a critical vulnerability in Chrome and almost every browser that uses the Chromium engine that can turn your phone, laptop, or PC into a botnet, Android Authority reports. And the wildest part is that this thing has been reported years ago and remains unpatched to this day.

Click here to read the article.

Google publishes exploit code threatening millions of Chromium users,

 Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens millions of people using Chrome, Microsoft Edge, and virtually all other Chromium-based browsers.

The proof-of-concept code exploits the Browser Fetch programming interface, a standard that allows long videos and other large files to be downloaded in the background. An attacker can use the exploit to create a connection for monitoring some aspects of a user’s browser usage and as a proxy for viewing sites and launching denial-of-service attacks. Depending on the browser, the connections either reopen or remain open even after it or the device running it has rebooted.

Click here to read the article.

FTC Consumer Alert - How are SCAMMERS trying to reach you?

Consumer Alert

How are scammers trying to reach you?

By

 

BCP Staff

May 21, 2026

Scams often start with a text, call, or an ad or message on social media. So, if you have a phone or you’re on social media, chances are you’ve heard from a scammer recently. 

Scammers love sending texts — so much so that last year’s fraud reports to the FTC show more people reporting that a scammer contacted them by text than any other way. Scammers often send texts pretending to be businesses or the government (think fake notices about package deliveries, loan applications, or unpaid tolls).

Phone calls are another common way scammers reach people. Scammers call to say things like “you’ve won a prize” or “you need to move your money to protect it.” Unfortunately, people reported losing a lot of money to these scammers last year.

But the highest reported losses overall last year came from scammers on social media, pushing things like scammy job offers and investment opportunities — which sometimes started with a romantic connection.

If you get an unexpected text, call, or message on social media, know that it could be a scam designed to steal your money or personal info.

To help you avoid scams:

• Report and delete unwanted texts. Use your phone’s “report junk” option or forward unwanted texts to 7726 (SPAM). Then delete the message.
• Report unwanted calls. If you didn’t lose any money but want to report a call, visit DoNotCall.gov. If you’ve lost money to a phone scam or have information about the scammer who called you, tell the FTC at ReportFraud.ftc.gov.
• Spot scammers on social media. If you get a job offer on social media, or get promised “guaranteed” returns on investments, stop. Check it out. And learn to spot people using fake profiles to make a connection.

Follow the FTC on Facebook, Instagram, and X at @FTC for more on avoiding scams.

Topics

 

Unwanted Emails, Texts, and Mail

Scams

 

Job Scams

 

Prize and Grant Scams

 

Government Impersonators

 

Romance Scams

 

Fake Claude search results lure Mac users into ClickFix attack

by Pieter Arntz | May 12, 2026

Researchers found that cybercriminals are using sponsored search results and shared Claude chats to lure victims into a typical ClickFix attack to install malware on macOS devices.

ClickFix is a social engineering method that tricks users into infecting their own device with malware. Users are instructed to run specific commands that will download malware, usually an infostealer.

The researchers found that when users search for terms like “Claude Mac download,” they may see sponsored Google results that appear to go to the legitimate claude.ai domain.

In reality, the ads resolve to real Claude shared chats, set up to look like official “Claude Code on Mac” or Apple Support guides. Independent research by BleepingComputer found another chat serving the same purpose. The chat instructs victims to open Terminal and paste a base64‑encoded command, which pulls a loader shell script from attacker‑controlled infrastructure and runs it in memory.

The script then profiles the system, pulls down a second-stage payload and runs it through osascript, macOS’s built-in scripting engine. This gives the attacker remote code execution (RCE) without ever dropping a traditional application or binary.

This results in a MacSync‑style payload that harvests browser credentials, cookies, Keychain contents, and crypto wallet data, bundles it, and sends all that information over HTTP to attacker servers.

How to stay safe

Users running macOS Tahoe 26.4 and later will see warnings about possible ClickFix attacks, but other users still have to rely on common sense.

With ClickFix running rampant and inventing new methods all the time, it’s important to stay aware, cautious, and protected.

• Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy and paste code. Attackers rely on urgency to bypass your critical thinking, so be cautious of pages urging immediate action. Sophisticated ClickFix pages add countdowns, user counters, or other pressure tactics to make you act quickly.
• Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand what the action does. 
• Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding.
• Limit copy and paste for commands. Manually typing commands instead of copy and paste can reduce the risk of unknowingly running malicious payloads hidden in copied text.
• Secure your devices. Use an up-to-date, real-time anti-malware solution with web protection. Malwarebytes blocks connections to unsafe sites like these. 
  
  
• Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected places helps maintain vigilance. Keep reading our blog!
• Stay away from sponsored ads in search results. Anyone can buy them and make them look legitimate.

Click here to read the article.

FTC.GOV Warning - How to spot and avoid business coaching scams

 May 18, 2026

Have you seen ads promising that a training or coaching program will help you build a thriving business or make significant money investing in markets like crypto, forex, or precious metals? Offers like these might sound exciting, but could be coaching scams in disguise. Do you know how to spot them?

Scammers promote training programs that claim to teach you how to succeed by investing in ecommerce businesses, financial markets, or real estate. They make it sound easy to make money and say, for a fee, they can show you how. But if they promise guaranteed income, large returns for little work, or say they have a “proven system to make money,” it’s likely a scam.

If you or someone you know is trying to start their own business and considering a coaching program, here are some things to keep in mind.

Be wary of promises that you’ll make quick money. No one can guarantee you’ll make lots of money with little to no risk. Anyone who does is a scammer.

Take your time and talk to someone you trust. Scammers will pressure you to get involved now or “risk losing out.” Ask questions and get a second opinion about the business offer or coaching program from someone who has your best interests in mind.

Do some research. Check with your state attorney general for complaints. If you don’t find any complaints it doesn’t guarantee that a company is honest, but complaints might tip you off to possible problems.

Read success stories and testimonials with skepticism. Glowing stories of success could be fake or misleading, and positive online reviews may have come from made-up profiles.

Have you spotted a business you think is a coaching scam? Tell the FTC at ReportFraud.ftc.gov.

The NSA issues an urgent warning to all phone users about a setting most people leave on.

 Walk into any airport terminal, hotel lobby, or coffee shop and glance at your phone. Odds are Wi-Fi and Bluetooth are both on, quietly scanning for networks and devices. You probably toggled them on months ago and never thought about it again. The National Security Agency says that habit is a problem, and it published a formal cybersecurity advisory telling every smartphone owner to do something about it.

Click here to read the remainder of the article.

NSA Guidance - REBOOT YOUR ROUTER NOW!!

 

The NSA Just Warned Everyone To Reboot Their Routers – What To Do Right Now.

NLINE SAFETY AND PRIVACY

APR 23, 2026

|

4

MIN READ

The NSA Just Warned Everyone To Reboot Their Routers – What To Do Right Now

Your home internet router is probably the most important device you never think about. A new memo from the United States government now suggests it’s a prime target for hackers.

But with some quick action and maintaining good habits, you can stay safe online.  

New guidance from the National Security Agency (NSA) and the FBI urges Americans to take simple but critical steps to secure their routers following a major cyber operation linked to Russian intelligence. 

Even if your router was provided by your ISP (Internet Service Provider), such as your cable company, you should still unplug it, wait 30 seconds to a minute, then plug it back in to reboot it.  

The biggest takeaway? If you haven’t updated your router in the past week, reboot now!

Why the NSA is sounding the alarm

 U.S. cybersecurity agencies recently disrupted a network of compromised home and small-office routers (the NSA classifies these as SOHO) used by a Russian military intelligence unit known as the GRU. These attackers, sometimes called APT28, Fancy Bear, or Forest Blizzard, have been exploiting outdated and poorly secured routers to: 

• Steal login credentials 

• Intercept internet traffic 

• Target sensitive data tied to government, military, and critical infrastructure 

Importantly, these hacks don't just impact the big boys. You're a possible target even if you don't go online at home for work! The criminals often start with everyday home routers. One system the NSA said GRU targeted was TP-Link routers using CVE-2023-50224, but the government is encouraging everyone to reboot their routers. Also, if your router is listed on this TP-Link webpage, it’s time to unplug and replace it.   

Your router is a big deal

Think of your router as the front door to your digital life. If it’s not secure, attackers may be able to access: 

• Personal accounts 

• Work-related systems, especially if you work remotely 

• Smart home devices (i.e., your Internet of Things) 

• Your communications 

And unlike your phone or laptop, it's really easy to forget to update your router or to leave its default password… 

4 ACTIONS TO DO RIGHT NOW TO SECURE YOUR ROUTER 

Protecting yourself doesn’t require technical expertise. The NSA and FBI recommend a few simple steps. 

1. Update your router 

Router updates fix security flaws that criminals seek to exploit. Rebooting your router might be as simple as unplugging it from power, waiting 30 seconds, and plugging it back in, but you should check your router’s app, software settings, or official website for a more thorough reboot.  

• Log in to your router settings 

• Check for firmware updates 

• Turn on automatic updates if available 

If you take away one to-do item from this article, this is the most important!  

2. Change the default username and password 

Many routers still use factory logins like “admin" or "default." You guessed it: that’s an easy win for attackers. In some cases, the list of router default login info might be published online, like in digital copies of manuals! 

Your router password needs to be strong: at least 16 characters long, not reused anywhere, and a random mix of letters, numbers, and symbols. Store your router password securely in a password manager!  

3. Disable remote management 

Some routers allow access from anywhere on the internet, but this convenience comes with risks. 

In your router settings menu, turn off “remote access” or “remote management.” 

Only allow access from devices inside your home network. 

4. Replace outdated routers 

If your router is no longer supported by the manufacturer, it may not receive security updates. 

That makes it a sitting target.

Sorry to say, it's time to get a new router: 

• Check if your device is “end-of-life” 

• Upgrade if it no longer gets updates 

Of course, now you can get a shiny new router from a trusted manufacturer with excellent security! Check online review sources like Consumer Reports or Tom's Guide for recommendations.  

RESTART YOUR ROUTER FOR ROBUST RESILIENCE! 

Restarting your router is a simple habit that helps. We recommend rebooting your router periodically—monthly is a good place to start. Also, turn on "automatic updates" in your router settings if possible. Rebooting matters because it can disrupt certain types of malware and clear temporary connections that attackers exploit. While rebooting isn't a silver bullet for cybersecurity, it's a great habit.  

Everyone should reboot their routers! 

Hackers don't just target big corporations. Nowadays, criminals are:

• Using home routers and devices as entry points 

• Exploiting basic security gaps in old software 

• Blending into everyday internet traffic 

The 10-15 minutes it takes to restart, reboot, and update your router is well worth the peace of mind. For more cybersecurity tips, sign up for our email newsletter! 

FAQS 

How do I know if my router needs an update? 

Log in to your router’s admin panel and check for firmware updates. If you’re unsure how, search online for your router model + firmware update. Only trust information available from the router manufacturer's website! You can reboot your router even if an update isn't available.  

How often should I update my router? 

We recommend turning on automatic updates if you can. Otherwise, check for updates every month.  

What happens if I don’t secure my router? 

Criminals may intercept your data, steal credentials, or use your network for malicious activity. 

Is restarting my router enough to stay safe?

No. Restarting helps, but you still need to update firmware and change default passwords.  

Click here to read the article.