The Information Commissioner’s Office said LastPass had “failed to implement sufficiently robust technical and security measures” to protect its data.
The Record from Recorded Future News – Read More
Most of it was flattery, but there was one bit of advice that I immediately decided to turn into a New Year’s resolution.
Latest news – Read More
Eleven companies took part in the evaluations and several have boasted 100% detection and coverage rates.
The post MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations appeared first on SecurityWeek.
SecurityWeek – Read More
Road Town, British Virgin Islands, 11th December 2025, CyberNewsWire
Hackread – Cybersecurity News, Data Breaches, AI, and More – Read More
Germany is taking decisive steps to strengthen its cybersecurity framework following the rise of digital threats. Last month, the Bundestag adopted the NIS-2 Implementation Act, translating the EU NIS-2 Directive (Directive (EU) 2022/2555) into national law. Published in the Federal Law Gazette on 5 December 2025 and in force since 6 December 2025, the Act modernizes the country’s IT security legislation and broadens the range of entities subject to regulatory oversight.
The Federal Office for Information Security (BSI) is tasked with supervision and enforcement under the Act, coordinating cybersecurity across federal agencies in its role as the CISO Bund. The law applies to industrial production, including electronics, machinery, vehicles, and other transport systems. Obligations generally target companies with at least 50 employees or that meet specific revenue and balance sheet thresholds.
Certain sensitive sectors, such as telecommunications and digital services, are covered regardless of size. As a result, the number of regulated entities in Germany rises dramatically, from around 4,500 under previous frameworks to roughly 30,000, including many mid-sized companies that were previously outside critical infrastructure regulations.
Entities within scope must register within three months with the BSI and the Federal Office for Civil Protection and Disaster Assistance (BBK). Registration requires providing company master data, designated contact points, and internal reporting structures.
The law establishes a three-step incident reporting process: an initial notification within 24 hours of becoming aware of a cybersecurity incident, an update within 72 hours, and a final report within 30 days, with additional interim reports if requested.
The NIS-2 Implementation Act sets binding, verifiable minimum requirements, including risk management, vulnerability and patch management, incident response planning, end-to-end logging, multi-factor authentication, and supply chain security. Industrial operators must secure control systems, manage distributed device fleets, and document supplier components.
Management is explicitly responsible for oversight, decision-making, and training, embedding cybersecurity accountability at the executive level.
Violations carry severe penalties. “Particularly important entities” can face fines of up to €10 million or 2% of global annual turnover, while “important entities” may incur fines up to €7 million or 1.4% of turnover. The BSI is empowered to issue binding orders, and management members may be held personally liable for failures to implement or supervise required measures.
Section 38 of the Act effectively obliges management to implement cybersecurity measures, not just approve them. Section 2(13) defines “members of management bodies” as executives appointed by law, articles of association, or partnership agreements, covering executive functions but excluding supervisory board roles in two-tier structures.
The NIS-2 Directive establishes EU-wide requirements for risk management, incident reporting, and operational resilience. It applies to essential entities and mandates an “all-hazards” approach to protect against cyberattacks, technical failures, sabotage, and natural disasters.
Germany’s NIS-2 Implementation Act integrates these obligations with sector-specific legislation, including the Digital Operational Resilience Act (DORA) for financial services, the Cyber Resilience Act for digital products, and the Critical Entities Resilience Directive (CER). Sector-specific laws generally take precedence where requirements overlap, ensuring legal clarity under the lex specialis principle.
The EU Cyber Solidarity Act complements NIS-2 by providing operational frameworks for cross-border emergency response, including the Cybersecurity Emergency Mechanism and the European Cybersecurity Alert System. Coordination through the NIS Cooperation Group and networks such as EU-CyCLONe supports strategic and operational collaboration for large-scale incidents.
With the NIS-2 Implementation Act now active, organizations have until April 2026 to register with the BSI and establish governance, risk-management, and reporting structures. The law raises accountability to both operational teams and executive leadership, creating a more unified, EU-aligned cybersecurity framework across Germany.
As regulatory expectations tighten, organizations will need faster threat visibility and stronger security operations. Cyble, ranked the #1 Cyber Threat Intelligence Technology by Gartner Peer Insights, offers AI-native tools that help companies identify vulnerabilities, monitor new cyber threats, and strengthen resilience, critical capabilities under NIS-2.
Organizations preparing for NIS-2 compliance can benefit from Cyble’s AI-powered security ecosystem and are encouraged to explore its free external threat assessment and personalized demo to understand how these capabilities support stronger, regulation-ready defenses.
The post New NIS-2 Law in Germany Expands Cybersecurity Oversight and Introduces Heavy Fines appeared first on Cyble.
Cyble – Read More
Phishing campaign: Scammers sent over 40,000 spoofed SharePoint, DocuSign and e-sign emails to companies, hiding malicious links behind trusted redirect services.
Hackread – Cybersecurity News, Data Breaches, AI, and More – Read More
In April 2025, hackers stole personal information belonging to patrons and employees and their family members.
The post Pierce County Library Data Breach Impacts 340,000 appeared first on SecurityWeek.
SecurityWeek – Read More
The exploited flaw allows attackers to overwrite files outside the repository, leading to remote code execution.
The post Unpatched Gogs Zero-Day Exploited for Months appeared first on SecurityWeek.
SecurityWeek – Read More
A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz.
The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in the
The Hacker News – Read More
We’ve tested and ranked the best cloud hosting services available to help you choose the right option for your business or side project.
Latest news – Read More