Showing posts with label Data Room. Show all posts
Showing posts with label Data Room. Show all posts

Friday, March 29, 2024

Adele vs. Taylor Swift, Covid, and Entertainment Industry Pandemic Insurance | naked capitalism

Adele vs. Taylor Swift, Covid, and Entertainment Industry Pandemic Insurance | naked capitalism

Adele vs. Taylor Swift, Covid, and Entertainment Industry Pandemic Insurance | naked capitalism

By Lambert Strether of Corrente

Intermittently over the last few years, I have seen the occasional tweet asserting, knowingly, that this or that entertainer was unable to cancel a performance because of Covid, because insurance — the business we know and love so much in health care — wouldn’t insure the loss. But there would never be a link! This week, fortuitously, information on Adele and Covid + information on “event cancellation” insurance came across my feed in close proximity, so I felt I finally had enough material for a writeup, and I went looking for material on Taylor Swift for a compare-and-contrast to Adele.

I’m going to have to issue even more caveats than usual. First, I know nothing of the mononymous Adele or Taylor Swift; I don’t listen to their music. Here are Adele’s statistics from Billboard:

And here are Swift’s:

As you can see, considered as show business “properties,” neither artist is a negligible figure, although Swift is the brighter star. (The chart pages also include potted bios.)

A second caveat: I know as much about insurance as I know about, say, surety bonds; that is to say, virtually nothing. So I hope readers will correct any errors I make, and add insights to the information I am able to present.

First I will look at how Adele is handling Covid, and then compare her to Swift. Then I will briefly describe the insurance situation during the pandemic. Now, while I am sure that insurance requirements bulk large in the minds of both artists’ business managers, their reasoning remains opaque to all of us. So that’s my third caveat: This post must be a bit dissociated, in that we cannot reason from insurance policies (or lack thereof) to the artist’s behavior (or the other way round). All we can do is speculate, and there are doubtless readers whose speculation is more informed than my own.

Now let’s turn to Adele and Swift. Contemporary popular music is really not my world, so my approach was to do cursory searches for each year of the pandemic, and aggregate the best Covid nuggets (along with information about the music business, and possible reveals of the artists, insofar as the efforts of publicists permit). And I might make a comment or two along the way. First, Adele.

Adele

2020

“Adele praises coronavirus heroes on her birthday: ‘Truly our angels'” Los Angeles Times:

“I hope you’re all staying safe and sane during this crazy time,” the singer posted Tuesday, along with a photo of herself smiling from home in a little black dress and heels.

“I’d like to thank all of our first responders and essential workers who are keeping us safe while risking their lives! You are truly our angels.”

That “us safe” and “their lives” is a little too on-the-nose. Remember “essential workers”? Good times.

‘Corona ain’t over, I’m quarantining’: Adele tells fan to be patient for new album (WION)

“Corona ain’t over. I’m quarantining. Wear a mask and be patient.” Although Adele didn`t offer up a timetable for her fans, they may only have a couple more months left to wait.

2021

Adele: Full COVID-19 vaccination and negative test required to attend singer’s Las Vegas shows (Sky News)

“Both proof of vaccination AND proof of a negative test within 48-hours of the event is required to enter the event,” according to the website.

It must have been at least 14 days since their second vaccine dose, and the negative test result must have been received within 48 hours of the event.

Back when everybody somehow had gotten the idea that the Covid vaccines were sterilizing and would prevent transmission. (These Vegas shows were cancelled in 2022.)

2022

Adele ‘will use £400,000 of special technology to protect her voice during her Las Vegas residency at Caesars Palace’ (Daily Mail)

‘The system works by combining dehumidifiers, purification units, water molecule dispersal and cooling fans in the preparation room and then guiding that air around the stage when she performs.

I’m betting not only her voice, but her lungs, from airborne pathogens.

Adele Announces Rescheduled Dates For Long-Delayed Las Vegas Residency (StereoGum)

Back in November, pop superstar Adele announced plans to play a four-month residency in Las Vegas. The idea was for Adele to spend the first four months of 2022 singing her hits at the Coliseum at Caesar’s Palace. But in January, shortly before those shows were set to start, Adele made a tearful video announcement that COVID-related production delays

2023

‘You should see the f***ing state of me!’: Adele warns fans her new concert special has her looking ‘insane’ with a ‘melted’ face due to the unbearable Las Vegas heat (Daily Mail)

My fans weren’t working on my stage. You can’t see them, but they’re built into my stage’

“Fans” in the sense of the ventilation system described above. Visible purifiers, big units, would have been an encouraging touch.

Adele no longer taking selfies during Las Vegas shows (Music News)

Throughout her [Vegas] residency, Adele has been filmed and photographed mingling with fans in the audience and posing for selfies, however, she has now put a stop to this.

“Normally I would absolutely stop and chat and all of that and hear all about your life and be the nosey person that I am,” the singer said during her most recent show. “However, I’m hanging on by a thread trying not to get COVID.”

Adele noted that her backing singer Amanda was recently forced to miss performances after testing positive for the virus.

“Everyone that I know that I work with has f**king COVID, so it’s a miracle that I haven’t had it yet,” she stated. “And I really do love chatting to you, but I don’t want to get sick, I’ll take selfies from a distance or shoot your vid.”

The Skyfall singer continued, “I might have symptoms and then I can’t do my show and I will be damned if I cancel any more of these shows. I refuse to cancel any shows. I just can’t risk getting ill. Honestly, my immune system is in the gutter and I want to be close to you and stuff like that, but I just can’t risk it.”

2024

Adele shows off the spoils of her £83M Las Vegas residency by sporting £875 jeans and a Dior bag as she enjoys a dinner date with husband Rich Paul in Beverly Hills (Daily Mail)

At least she’s masking in public. And now to Swift, whose timeline is similar in some ways to Adele’s, in some ways not.

Taylor Swift

2020

Taylor Swift broke all her rules with Folklore—and gave herself a much-needed escape (Entertainment Weekly)

[H]ow difficult has it been to see folks on Lower Broadway crowding the bars without masks?

I mean, you just immediately think of the health workers who are putting their lives on the line—and oftentimes losing their lives. If they make it out of this, if they see the other side of it, there’s going to be a lot of trauma that comes with that; there’s going to be things that they witnessed that they will never be able to un-see. And that was the connection that I drew. I did a lot of research on my grandfather [here] in the beginning of quarantine, and it hit me very quickly that we’ve got a version of that trauma happening right now in our hospitals. God, you hope people would respect it and would understand that going out for a night isn’t worth the ripple effect that it causes. But obviously we’re seeing that a lot of people don’t seem to have their eyes open to that—or if they do, a lot of people don’t care, which is upsetting.

Very acute; Adele said more or less the same thing. Not, perhaps, as “upsetting” now as then?

Taylor Swift Urges Fans to ‘Isolate’ Amid Coronavirus Outbreak: ‘We Need to Make Social Sacrifices’ (People)

I love you guys so much and need to express my concern that things aren’t being taken seriously enough right now. I’m seeing lots of get togethers and hangs and parties still happening,” wrote Swift. “This is the time to cancel plans, actually truly isolate as much as you can, and don’t assume that because you don’t feel sick that you aren’t possibly passing something on to someone elderly or vulnerable to this. It’s a really scary time but we need to make social sacrifices right now.”

Also acute (though “right now,” and since when is solidarity a sacrifice?).

Taylor Swift Gave Thousands of Dollars to Fans Affected by the Coronavirus Pandemic (Vogue)

The 30-year-old pop star has been sending fans individual payments online to help with financial burdens accrued due to COVID-19, with Billboard confirming that at least 10 such payments were made by Swift.

2021

The surprising allure of Taylor Swift in a pandemic world (Yahoo Finance!)

The artist released two new albums in 2020 and on Friday is re-releasing her 2008 album Fearless following a vicious dispute with her former label.

The decision to re-release the album could make her one of the most successful artists in the history of Billboard’s Hot 100.

However, according to AMP Capital chief economist Shane Oliver, the re-release is also an exercise in COVID-19 nostalgia and escapism.

The prominent economist and known Swifty said the two new albums Swift put out last year were made possible by COVID-19 isolation and an inability to tour. While he described those as a pleasant surprise, the broader popularity of her catalogue during COVID-19 had a simple explanation: people needed a break.

“It’s known that when you have economic downturns and people are feeling depressed, you do see an increase in escapism, people reading fantasy novels, gambling can sometimes see a boost and music may figure in that,” he told Yahoo Finance.

“People want to listen to it again.”

In fact, according to its analysis of Alexa streams, Taylor Swift and Adele music was more popular than even Donald Trump or COVID-19 news.

Taylor Swift Officially Cancels Tour Postponed Last Year Due To The COVID-19 Pandemic (CBS)

Taylor Swift announced Friday that her Lover Fest tour, which was postponed due to the COVID-19 pandemic, has officially been canceled.

The singer took to Twitter to share the cancelation saying, “I love coming on here to tell you good news, or to share a new project with you. It’s not my favorites thing in the world to have to tell you news I’m sad about. I’m so sorry but I cannot reschedule the shows that we postponed.”

She continued,” Although refunds have been available since we first postponed the Lover Fest shows, many of you hung onto your tickets and I too hung onto the idea that we could reschedule.”

“This is an unprecedented pandemic that has changed everyone’s plans and no one knows what the touring landscape is going to look like in the near future.”

“I’m so disappointed that I won’t be able to see you in person as soon as I wanted to. I miss you terribly and can’t wait til we can all safely be at shows together again.”

No refunds for those who hung on, then? And not all that unprecedented….

2022

The Return to Craft: Taylor Swift, Nostalgia, and Covid-19 (Popular Music and Society)

Why this turn to folklore and indie-folk esthetics in Swift’s work? I suggest that this single and, indeed, the album folklore provide a peak example of a societal search for foundations during the pandemic. What I term “the return to craft” can be read as a distillation of the nostalgic, folkloric mode of contemporary Western society, one that has arisen in response to the cultural issues raised in part by the Covid-19 pandemic, but also by neoliberalism, homogenization, austerity, and the anxiety brought on by climate change. As Swift found a life raft in songcraft (literally, in the music video), so too did craft and the handmade deliver a figurative life raft, a comfort and a solace, to many during lockdown. This construction of imagined authenticities, the focus on essentials, on first principles, reflects something deeper than superficial YouTube self-help or commodification; it has also become a genuine source of relief in such difficult circumstances and its artistic outputs provide culturally contingent insights.

Hmm. Readers?

YES TAYLOR SWIFT IS VAXXED AND THAT’S A GOOD THING (Conor Maynard)

In the wake of the COVID-19 pandemic, many celebrities have spoken out about the importance of vaccination. Among them is Taylor Swift, who recently announced that she has been vaccinated.

Welcome to ‘Swiftonomics’: What Taylor Swift reveals about the US economy (Sydney Morning Herald)

Taylor Swift’s upcoming US tour of 52 concerts has all the ingredients of a post-COVID demand shock. Some resellers reportedly asked $US40,000 ($60,000) or more for concert tickets following last week’s run on official sales, which left millions empty-handed and ready to pay whatever it takes to score a seat.

Swifties, as the popstar’s fans are known, aren’t necessarily your average American, but they capture the current moment in the post-COVID economy. Even as recession looms, many consumers are willing to splurge on what they missed at the height of the pandemic — whether it’s travel or live entertainment.

Swift’s fans represent an extreme version of that turbocharged consumer: millions of mostly Millennials and Gen Zs who waited at least four years to see the superstar live again and emerged from the pandemic with historically high rates of savings.

“Concerts are seen as an affordable luxury in times of crisis,” said Lisa Yang, a Goldman Sachs analyst who publishes the bank’s annual “Music in the Air” report on the global industry.

“Post-Covid”? In 2022? Really?

How it feels to be a Taylor Swift fan right now (Today)

Having been unable to tour her albums “Lover” (2019), “Folklore” (2020) and “Evermore” (2020) because of the COVID-19 pandemic, Swift’s forthcoming tour is her first in five years.

Swifties knew demand would be high.

Though it was his first time purchasing tickets for a Swift concert, Goodman headed to Ticketmaster ready for battle … aka armed with a color-coordinated priority map.

“Red is first priority in, green a second priority, and then blue is third priority,” he says. “I was prepared, but I was running it through with my friends, making sure we were on the same page about what we wanted with the budgets and seats.”

(This is the TicketMaster debacle). The whole red/green/blue paradigm reminds me of the “Swiss Cheese Model,” although with a different objective in mind….

2023

A Swiftie Redditor on risk at concerts:

Keep reduced/isolated/COVID safe activities before and after the concert. Given the size of the stadium and the fact that a concert involves a lot of singing/screaming, this is a high risk event for getting & spreading COVID. Before your trip, research and stick to outdoor venues for food and drinks (beer gardens, patios, etc.) and mask up when you are indoors in public places/museums/hotels/Ubers/Lyfts after the concert so you can avoid spreading anything afterwards too. Mask up on any planes/trains/buses you take to get back home. If you have vulnerable loved ones, let them know about your trip/concert and continue to mask around them or avoid in-person contact with them for 1-2 weeks.

Could Taylor Swift mania fuel a COVID cruel summer? What you need to know (Los Angeles Times)

“People have to be aware that it’s a potential venue [for infection], and riskier than most venues, given all the shouting, the singing, the fact that it’s three hours — even though it’s outdoors,” said Dr. Peter Chin-Hong, a UC San Francisco infectious-disease expert. “You’re just bringing people together from lots of different places … people are traveling all over the country to the city where they can get tickets. So it’s like a mega airport, or a mega transportation site, if you think about it.”

Lots of Swifties Are Saying They Got COVID After the LA Eras Tour Shows (Self)

And while most of the social media coverage has featured Swifties dancing and belting out bops like “Cruel Summer” and “Lavender Haze,” some attendees of last week’s SoFi Stadium shows in Los Angeles have been posting about a less joyful effect of their concert euphoria: a positive COVID-19 test….. The city (along with other parts of California as well as other areas of the country) has been experiencing an uptick in COVID as of last Thursday—to be more specific, an average of 333 new cases per day, according to the most recent data from the LA County Department of Public Health. “It’s impossible to say for certain if and how much the Taylor Swift concerts, or any other single large event, contributed to these increasing counts,” the department confirmed to SELF in an email. “We know large gatherings where thousands of people are in close proximity are higher risk events, however, it is very likely that increased rates of summer travel and other gatherings are also contributing to the increase.”

Swift wearing a (stylish, black) KN95 behind the scenes while making a music video:

2024

Taylor Swift Says She Was a ‘Lonely Millennial Woman’ During COVID Quarantine Despite Joe Alwyn Romance (Hollywood Reporter)

Despite the speculation about her former relationship, Taylor has never publicly spoken out about it, but she did admit she’s a lot more trusting in life now than she was back then, in an interview with TIME last year. “Life is short. Have adventures. Me locking myself away in my house for a lot of years — I’ll never get that time back,” she told the outlet after being named their “Person of the Year.” “I’m more trusting now than I was six years ago.”

Echoing GBD whinging about lockdowns. She wrote two albums, ffs. Does she really want that time back?

More superspreading events:

I paid close attention to the Swift-COVID connection. I had tickets & didn’t go bc infections ⬆️ in July. Each show fueled more infections & TikToks of sickened concertgoers. After the Aug 9 LA concerts, Tiktok was slammed with hundreds of “I’m in my COVID era” videos.

— mary orantejo 🦆 (@curiousdatacat) February 25, 2024

“Hundreds.” Looks like the best testing info we have, besides wastewater, is Tiktok videos, Twitter, and Reddit. What a farce.

Why Taylor Swift won’t meet with Aussie fans while Down Under (Yahoo Lifestyle)

Yet millions of fans across the country sadly won’t get the opportunity to see the superstar on stage following unprecedented ticket demand – meaning many are dreaming of catching a glimpse of Taylor taking in the sights whilst visiting Sydney and Melbourne instead.

However, a music industry source told Yahoo Lifestyle that Taylor has no plans to be seen anywhere but the stage whilst in Australia, nor does she intend on meeting any fans, due to one strict reason.

“When Taylor is on tour, strict measures are put into place to stop her interacting with anyone outside of her ‘bubble’. They can not risk her getting sick under any circumstances.

So Covid’s not “over,” then? More:

Even those in her bubble, including her dancers and managers, are restricted what they can do and where they can go during their downtime. Going on a world tour may sound exciting, but the reality of it is each day just consists of going from a hotel room to the venue and repeat,” the source says.

At Taylor’s first show at the Melbourne Cricket Ground on Friday, her publicist Tree Paine was even walking through the venue wearing a mask to reduce her chance of catching any illnesses as she is in direct contact with Taylor each day.

“Even!” Wouldn’t it be nice to live in a world where a fan’s life was as important as the star’s?

We might also remember that the concert venue is not the only place where crowds gather and superspreading takes place. The scene after Swift’s Sydney concert:

An excellent time-lapse of the crowds from two concerts at Olympic Park being taken home by train.

North Americans obsessed with stadium parking please take note pic.twitter.com/GsPPQJFftc

— Evan (@fictillius) February 24, 2024

And some data:

Last night's Taylor Swift concert. The trains before and afterwards were probably the main super spreading events, as much as close outdoor contact.@CO2RadicalAus pic.twitter.com/YjRXZ5vXKH

— Dr David Berger, aBsuRdiSTe cROnickLeR (@YouAreLobbyLud) February 25, 2024

Surely it would have been possible to make that situation safer? Readers?

The Pandemic and Entertainment Insurance

So as we can see, Covid had huge effects on both Adele and Swift; the social stresses of the pandemic created demand for their styles of music, but the pandemic also made touring difficult-to-impossible. Both artists ultimately took measures to protect themselves from infection by eliminating contact with fans (and, in Swift’s case at least, masking and “bubbling” during the tour). Both artists also had to cancel tours.

The cost of cancellations can be great. From Billboard, “Tour Cancellations Go Viral — Why the Risk May Be Too Great for Some Acts“:

The immediate cost of Edgar Winter‘s sore throat and minor congestion [uh huh] — followed by bandmate Steve Lukather‘s own symptoms — was roughly $11 million. When the “Free Ride” rocker and the Toto guitarist both tested positive for COVID-19 in June, Ringo Starr had to postpone 12 of his All-Starr Band’s shows; earlier dates had grossed more than $900,000 apiece, according to Billboard Boxscore.

The All-Starr Band moved the dozen canceled shows to this fall — they resumed touring earlier this month — but the stars’ positive tests demonstrate an ongoing problem for touring acts as they return to the road. Postponements are complicated; cancellations are devastating. This past summer, the Rolling Stones, Eric Clapton, the Doobie Brothers, Chris Stapleton, Alan Jackson, Blondie, Haim, Jenny Lewis, Bikini Kill and the Strokes were among the top stars who scrambled to reschedule dates when band members (including Mick Jagger) or crew came up positive.

“Obviously, people’s health is the most important, but the big thing is the financial implications. You’re making plans for ‘what if we have to cancel the tour one week in or two weeks in?'” says Ed Harris, manager of indie-rock band Cigarettes After Sex, which returned to international touring in late May and has, thus far, avoided positive tests. “Does it make sense to cancel halfway through, or three-quarters through? You have to make certain calculations.”

Of course, you can be careful:

Especially for smaller artists, the financial risk of touring is high. That’s why Andrew Bird and Iron & Wine were scrupulously careful during the summer co-headlining tour. They asked audience members to wear masks (most complied), played mostly outdoor venues and regularly tested crew and artists in their traveling bubble.

Now let’s look at whether it’s possible to insure against those costs. The CARES Act funded the Government Accountablity Office (GAO) to look into this question. In their December 2023 report (PDF), “Pandemic Risk: Federal Insurance Approaches Would Entail Costs to Taxpayers and Businesses Might Not Participate,” the GAO desribes two lines of business of relevance to the entertainment industry:

There have been event cancellation claims paid, but of course we have no data:

Insurers paid some claims on event cancellation insurance policies, although comprehensive U.S. data on event cancellation claims are not publicly available. According to specialty insurers, brokers, and businesses, before the COVID-19 pandemic insurers typically offered a virus endorsement—that is, an option providing coverage for communicable diseases or other specific risks. One example of large U.S. events covered by event cancellation insurance was the National Collegiate Athletic Association’s 2020 winter and spring championships. In March 2020, these events, including the annual men’s March Madness basketball tournament, were cancelled due to the COVID-19 pandemic. The tournament had been expected to bring in more than $800 million, and the association received a $270 million payout.

And the insurance companies are tightening up:

According to stakeholders, property/casualty insurers generally have taken steps to fully restrict or limit their exposures to future pandemic losses since the onset of the COVID-19 pandemic. As a result, some businesses have been operating with more uninsured risk than desired, because coverage is either unavailable or unaffordable… Endorsements covering communicable disease for some policies, such as event cancellation, generally were no longer available or were available at higher prices and with lowered coverage limits soon after the beginning of the pandemic, according to associations of brokers and policyholders we interviewed. Some large reinsurers still were offering explicit pandemic risk coverage for event cancellation, but the coverage was costly and insufficient to allow insurers to meet policyholder needs, according to brokers and policyholders. As a result, some policyholders were left holding more of the risk.

The insurance companies are also removing Covid protection from their policies entirely. From the law firm Hunton Andrews Kurth (PDF):

For instance, insurance companies have denied coverage for event cancellations during the COVID-19 pandemic arguing, in part, that the proximate cause of the policyholder’s loss was the pandemic — a communicable disease excluded by the policies — and not the government orders prohibiting large gatherings, a covered cause of loss under the policies. COVID-19 is now being excluded from new event cancellation insurance policies. Before the pandemic, event cancellation insurance policies generally contained explicit coverage buy-backs for losses from communicable disease. The policyholders paid an extra, specifically identified premium to remove any exclusion for communicable disease from these policies. Those policies typically covered a specified amount of net profit and included additional coverages for costs of remedial action, future marketing expenses, etc., beyond that specified amount of coverage. Nonetheless, because of COVID-19, policyholders who bought event cancellation coverage after April 2020 may be subject to broad exclusions for losses related to COVID-19.

Back to the GAO. One response has been to create “captive” insurance companies:

In response to the tightened insurance market, businesses increasingly have created captive insurance companies. For example, a major insurance broker reported a historic increase in the number of captives in 2020, which continued into 2021 and 2022. The growth occurred in multiple business sectors. The broker reported that existing captives also saw increased premium growth in this time frame, suggesting organizations were transferring more of their risk to the captive companies. Types of coverages purchased through captives included event cancelation, liability, and property coverage (which could include business interruption insurance). For instance, the National Collegiate Athletic Association formed a captive insurance company in March 2022 to cover risks typically covered by event cancellation and liability policies

I suppose a behemoth like K-Pop’s JYP could create a captive insurance company for its many acts. I doubt if Taylor Swift’s organization, smart and effective though it is, could, let alone Adele. Which explains, I suppose, why they’ve taken measures to avoid contact with fans. That’s the only way for them to minimize their risks.

Of course, there is always opportunity. The Insurer TV describes new products:

One of the steps taken by Alive Risk to adapt to changing product needs has been the creation of an affordable insurance product for freelance workers like audiovisual techs, lighting designers and stage managers, among others.

With clean air, the freelancers wouldn’t have to pay up….

Conclusion

Making those timelines — 2020, 2021, 2022, 2023, 2024 — really brought home to me how long this pandemic has been going on; I lost track in the daily grind (though the daily grind is also my form of coping). And it’s a bit discouraging to see the most solidarity our society seems capable of fizzle out after 2020, followed by a struggle to return to business as usual, a struggle that failed by 2024, in that a once-essential part of touring — contact with the fans — has now gone missing.

We can, of course, moralize about what how these artists have gone about their business:

No, It’s Not Hypocritical For A Pop Star To Protect Themselves From Infection By Their Audience While Letting Their Audience Happily Infect Each Other. pic.twitter.com/O4OlZWioKn

— The Vertlartnic (@TheVertlartnic) February 25, 2024

To be fair, though, when CDC Director Mandy Cohen is swanning about with no mask, modeling how to infect everybody she breathes on, what’s a poor celebrity to do? Restoring social norms that support non-pharmaceutical interventions will probably take a whole-of-society approach (which could happen when those Tiktokers start doing their research).

Here, however, are two small steps artists like Adele and Taylor Swift could do to improve the Covid pandemic situation.

First, big acts could really help out smaller acts by supporting organizations like this one:

Clean air shows in Chicago for the next 2 weeks!!

For those who don't know us, we loan free air purifiers to artists so their events are cóvid-safer. It's so easy when we all work together 🤍 pic.twitter.com/jPmrXNFbUW

— Clean Air Club (@Clean_Air_Club_) February 26, 2024

Second, sell N95s at your concerts and on your websites as branded merch. K-Pop powerhouse Twice already does this (though KN94s, not N95s):

And if, by some happy chance, some intern from either organization reads this post, please champion these ideas!

Oh, and champion clean air, too. Who could be against that? Miasma delenda est!

About Lambert Strether

Readers, I have had a correspondent characterize my views as realistic cynical. Let me briefly explain them. I believe in universal programs that provide concrete material benefits, especially to the working class. Medicare for All is the prime example, but tuition-free college and a Post Office Bank also fall under this heading. So do a Jobs Guarantee and a Debt Jubilee. Clearly, neither liberal Democrats nor conservative Republicans can deliver on such programs, because the two are different flavors of neoliberalism (“Because markets”). I don’t much care about the “ism” that delivers the benefits, although whichever one does have to put common humanity first, as opposed to markets. Could be a second FDR saving capitalism, democratic socialism leashing and collaring it, or communism razing it. I don’t much care, as long as the benefits are delivered. To me, the key issue — and this is why Medicare for All is always first with me — is the tens of thousands of excess “deaths from despair,” as described by the Case-Deaton study, and other recent studies. That enormous body count makes Medicare for All, at the very least, a moral and strategic imperative. And that level of suffering and organic damage makes the concerns of identity politics — even the worthy fight to help the refugees Bush, Obama, and Clinton’s wars created — bright shiny objects by comparison. Hence my frustration with the news flow — currently in my view the swirling intersection of two, separate Shock Doctrine campaigns, one by the Administration, and the other by out-of-power liberals and their allies in the State and in the press — a news flow that constantly forces me to focus on matters that I regard as of secondary importance to the excess deaths. What kind of political economy is it that halts or even reverses the increases in life expectancy that civilized societies have achieved? I am also very hopeful that the continuing destruction of both party establishments will open the space for voices supporting programs similar to those I have listed; let’s call such voices “the left.” Volatility creates opportunity, especially if the Democrat establishment, which puts markets first and opposes all such programs, isn’t allowed to get back into the saddle. Eyes on the prize! I love the tactical level, and secretly love even the horse race, since I’ve been blogging about it daily for fourteen years, but everything I write has this perspective at the back of it.

Post navigation

Fans have to enter venues and have tickets scanned and security. Why are the mega tours not handing out free K/N95s at the entrance and requiring their use?

Could it be fans have paid, their utility expended?

The music industry is bad, but this take strikes me as a bit too cynical. It’s an excellent suggestion, though. Indeed, why not free masks? They could even be branded merch, like the Twice mask. Perhaps this is not happening because people continue to associate masks with danger, ergo handling out masks might be perceived as saying the venue isn’t “safe” (though what are people thinking, anyway?).

In the current scheme of things, fandom often entails not only being a follower, but at times an almost cult-like devotion to the brand. Listen to how Adele speaks about her fans, how personal she makes the relationship with them sound. Of course there’s an insincere element in this, but appearances must be maintained.

Everybody knows stardom is fleeting. If the brand overtly treats fans as mere punters in a disposable transaction, many will simply move on.

Regarding the issue of people getting infected by piling into trains, the obvious solution would be more trains, opening all the windows, or crowd control to limit the number of passengers. Using a trusty Aranet4, I’ve actually measured CO2 on local trains and the numbers are indeed very high. I have made a routine of opening a window on any train that I enter, and have noticed that very often people look up from their cellphones quizzically, to try and understand what I’m doing. From this, I take it that the basic fact of #CovidIsAirborne simply hasn’t registered with the public in general, and for that we can thank our public health authorities.

A Swiftie or Adele logoware K/N95 mask would be a supreme badge of honor. Can you imagine how cool it would be to parade with such a mask with the official hologram? What is the resale value? Or knock offs? Or masks for the StoopidBowl, World Cup or Sweet 16? I guess that doesn’t fit in with eugenics.

Yes, cynical indeed! AFIK, COVID clean after multiple international flights since late February 2020, thanks to NC.

BTW, most passenger train windows i’m familiar with do not open (with very few exceptions) for good reasons.

Well, yeah, maybe I’m not cynical enough, but it seems like the eugenicists would be a different(?) group than the music and concert promoters/managers. [EDIT: reading Tom Stone’s comment, below, maybe I need to rethink this!] As for the latter, it does just look like a yuge missed opportunity, for all the reasons you mention, and more. Maybe just greed (decent masks will cost)? Dunno. Not a big concert-goer myself, but I have always seen branded “goods” for sale in the area outside the hall and fans are ready to splurge on them. Overpriced drinks are also a staple. Why not masks? People even hang onto their concert ticket stubs for years, so branded masks seem like a no-brainer.

As for trains, yes, should clarify that I haven’t frequented one in the US in some years, and what you say jibes with my memory. Where I live now in East Asia, most usual train cars have a couple of windows that can open and they were cracked during the epidemic as a matter of policy. However, it was the train company that opened them, not the passengers. Never saw any other passengers do this themselves. People may think the air inside is “okay” because there are several train doors opening automatically at every stop, but what I discovered is that this isn’t true. Even on local trains with three sets of doors opening, interior CO2 levels in the yellow and red zones (1000~1400, and 1400+ ppm) are really common when the train is crowded. Post-concert, those trains in the tweet are going to be in the red zone, for sure.

51 years earlier Mick, Keith, Bill and Charlie at Altamont. Who would have written a half-century term life insurance policy for Keith back then?

What were the precautions taken when Taylor Swift attended football games?

They didn’t wear masks in the skyboxes (except for Swift’s mother who is immuno-compromised with cancer). I assume the ventilation is good, since skyboxes are for the rich. My impression — fans will correct me — is that Swift is in her “small world” bubble wherever she goes. The star cannot be infected under any circumstances.

I’d pay a pretty penny to understand the truth depth of the layered strategy employed by those performers, such as Swift, that take this seriously, particularly any expensive or experimental mitigations that we rarely hear about.

She was also out on the field. She never wears a muzzle. She knows it’s bs.

Trolling here won’t last long especially with a no fact comment like this one. The “muzzle” is just so incredibly intelligent.

> She never wears a muzzle.

The amazing, and indicative, thing here is that our friend Jack is able to deny what is right before his eyes; the post includes a photo of Swift in a stylish black mask. So, not “never.”

I think Mr. JackG is referring to that saying, “Who you gonna believe, me or your lying eyes?”… Or, nothing to see here, move along…

When the “talent” gets sick on one of these big tours and cancels a show, the following people are out of work: Band Band techs (instrument maintainers) Stage crew Sound techs Lighting techs A/V techs Roadies/movers/cartage Merch staff Teamsters/truck drivers Bus drivers Admin staff and publicists Food service (sometimes, especially big touring festivals) Venue staff *** The “talent” and everyone on a tour knows that if the talent goes down sick, they all lose. It’s not necessarily vanity, although that’s often present in abundance. Big tours are logistical operations that require precision planning, so cancellations are quite expensive as the baseline costs remain constant.

Small(er) bands that tour in a van or bus without a giant set have more leverage to cancel shows if the venue doesn’t comply with conditions, or puts the band at unacceptable risk of not being able to complete the tour. But that’s another story.

> Small(er) bands that tour in a van or bus without a giant set have more leverage to cancel shows if the venue doesn’t comply with conditions, or puts the band at unacceptable risk of not being able to complete the tour. But that’s another story.

Off-topic, but if you want to read about that other story, or ever be in that kind of band, ‘Our Band Could be your Life’, Azerrad is a terrific read about a bunch of 80’s underground bands who did just that.

I concur with the book recommendation. Great book, a variety of travel styles for sure. I’ve (van) toured in a band myself back in the day. It’s not for the faint of heart, but I’m glad we did it.

The Grateful Dead pioneered the economics of big touring mostly because they didn’t make any money from recording and they carried a large family to support. It was all about the gigs. The graphic from this early newsletter is still one of the most concise models I’ve seen to illustrate the benefits and the pitfalls of scaling.

https://www.dead.net/archives/1973/clippings/gd-newsletter-10-page-5

The more things change…

A perfect and concise description.

> The Grateful Dead pioneered the economics of big touring

One more newsletter to subscribe to! (The writing in the archives is really, really good, the kind of California cool I wish that California still had:

Gigs offer the only means to earn more money when it is needed to maintain our operation in all its particulars. We cannot sell more records at will, but we can go on the road, with the limits of energy: so that we must play larger halls, with more equipment, and a bigger organization, requiring more gigs….

I just love “in all its particulars.”

Now that I think of it, I wonder if the Dead invented a form of “fan service” as practiced by K-Pop and the idol groups of Japan.

This would be a fascinating topic to look at, so perhaps I should post on it at some point. It would give me the excuse to play more YouTubes:

This is one of favorite versions of “Beat It On Down the Line” (by San Francisco’s Jesse Fuller), partly because it swings, but also because of Kreutzman’s “just a day at the office” demeanor when the camera includes him after Garcia’s solo (c. 2:17).

I’m going to see Abba – Voyage in london in June. Fans, especially with the party like post show atmosphere in the nearby hotels and in the stadium will definitely be at risk – especially considering the demographic. But Agnetha Fältskog, Björn Ulvaeus, Benny Andersson, and Anni-Frid Lyngstad? Not likely. Canny lot, they won’t even be there !

I hear KISS is entering a similar digital existence.

It does seem like Fukuyama was correct, but perhaps not in the way he meant it.

Though perhaps as NA and European cultural influence stagnates, Asia will rise in their stead? Then again, it seems the economic influence of USA is as broad as its cultural influence. The cultural output of Japan at least seem to be more and more under the US economic thumb.

Last summer, Pearl Jam had to postpone their concert just outside of Indianapolis due to a band member becoming sick, and then they rescheduled the concert one year later and offered full refunds to anyone that wanted one.

Just a week ago, Widespread Panic postponed concerts in Chicago for one week due to a band member health issue. Now they’ve had to cancel them. Ticketmaster will refund the ticket purchasers, but there’s a one month lag time.

My introduction to the Music Biz came about by being the first credit manager of Nady Systems, the first company to come out with workable cordless Mics and instrument pick ups. Calling that biz “Cut throat” is accurate, the only biz I worked in that had fewer decent people in it was banking.

It’s an odd combination of the nastiest scum of the earth and the nicest people ever. Sometimes both apply to the same person.

Considering that COVID has mutated into a cold virus with symptoms so mild most people don’t get tested, this is a joke.

If you are really concerned, go on low dose Ivermec and zinc a week before the event. But whatever you do, don’t take the death vax.

I can’t believe people are still wearing masks in blue States.

Good heavens. Are you serious? I do hope your first line was humour. Two thousand people dying from Coronavirus per week at present, just in the United states is not an average cold season. And, most people don’t get tested because it is now expensive and generally an ‘out of pocket’ expense. Plus, there’s more!, Long Covid is beginning to show it’s ‘ugly’ side. [Unless, of course, one is a Jackpot supporter.] Stay safe, and keep others safe too!

@JackG, sources, please, that support your claims, and engage with the current research, e.g.:

Long-term outcomes following hospital admission for COVID-19 versus seasonal influenza: a cohort study https://doi.org/10.1016/S1473-3099(23)00684-9

Over 18 months of follow-up, compared to seasonal influenza, the COVID-19 group had an increased risk of death (hazard ratio [HR] 1·51 [95% CI 1·45–1·58]), corresponding to an excess death rate of 8·62 (95% CI 7·55–9·44) per 100 persons in the COVID-19 group versus the influenza group. Comparative analyses of 94 prespecified health outcomes showed that COVID-19 had an increased risk of 68·1% (64 of 94) pre-specified health outcomes; seasonal influenza was associated with an increased risk of 6·4% (six of 94) pre-specified health outcomes, including three out of four pre-specified pulmonary outcomes. Analyses of organ systems showed that COVID-19 had a higher risk across all organ systems except for the pulmonary system, the risk of which was higher in seasonal influenza.

Hospital Outcomes of Community-Acquired SARS-CoV-2 Omicron Variant Infection Compared With Influenza Infection in Switzerland https://doi.org/10.1001%2Fjamanetworkopen.2022.55599

the SARS-CoV-2 Omicron variant was associated with an approximately 1.5-fold higher risk of in-hospital all-cause mortality up to day 30 compared with influenza

Outcomes of SARS-CoV-2 Omicron Variant Infections Compared With Seasonal Influenza and Respiratory Syncytial Virus Infections in Adults Attending the Emergency Department: A Multicenter Cohort Study https://doi.org/10.1093/cid/ciad660

The 30-day mortality was 7.9% (n = 381) in the Omicron, 2.5% (n = 28) in the influenza, and 6.0% (n = 27) in the RSV cohort. Patients with Omicron had an adjusted 30-day mortality odds ratio (OR) of 2.36 (95% confidence interval [CI] 1.60–3.62) compared with influenza and 1.42 (95% CI .94–2.21) compared with RSV.

There are many more studies, if you care to investigate.

Thank you.

> Considering that COVID has mutated into a cold virus with symptoms so mild most people don’t get tested, this is a joke.

I wish Covid denialists didn’t lie all the time. It’s tiring. The crazy thing is that he can’t possibly have read the post at all; if Taylor Swift and her entire entourage are terrified she’ll catch it, it’s not a “cold virus with symptoms.” Swift’s business people calculated the odds, and the answer they came up with is clearly not what Jack wishes so desperately and fearfully to believe).

But he’s saying what a lot of people believe. If COVID is so bad, why aren’t we taking it seriously anymore? Therefore, it must be a cold now. These same people ignore that the pressure to minimize the virus and the resulting disease was always there and now we’ve made it very difficult for people to protect themselves in public. It’s a tragic and bizarre cognitive dissonance loop. If COVID was bad, more people would protect themselves from it. No, you’re not allowed to protect yourself from COVID…

For most exhausted Americans, “living with it” = COVID is a cold. Has to be. Why else would we being saying that if it could result in disability? It’s like that old quip about Satan: “the best trick the devil ever did was convincing people he wasn’t real.” Well, now we’ve managed to convince all the official opinion havers(tm) and talking heads on TV that COVID isn’t real (and inflation too!).

I’m high risk, super cautious, and have changed my life considerably to avoid infection, but I found this comment helpful. A lot of people seem to think that way, and this might be the rationale.

I think the metric he’d need to see would be % bad outcomes vs people infected–which we can’t really tell because no data, but which wastewater numbers and (possibly disingenuous) anecdata suggest *might* be low. The sometimes terrible sequelae of “mild” infection may be sufficiently rare and/or obscured. And it’s too soon to see some of the really bad long-term stuff that could be happening (widespread permanent disability (though that seems to be starting), cardio epidemic, widespread AIDS-like disease etc).

So to people like Jack, the risk *looks* reasonably small. I disagree, of course, but this makes sense of something I’ve been wondering about.

> I think the metric he’d need to see

I think his metric — hard though this may be for the NC commentariat to get its collective head around — is what people around him are doing (Keynesian beauty contest; “nobody ever got fired for saying Covid was mild”).

I have yet to see an account given of how the very notion of public health, in particular non-pharmaceutical interventions during a pandemic, was chewed up and spat out by a meatgrinder of virtually universal social norming, and under a liberal Democrat administration. It’s an enormous and uncovered story, and it doesn’t bode well for democracy at all (though it does, I imagine, for “our democracy”).

New here eh?

Repeating from memory, but feel free to search the web or this site for relevant links on the following:

COVID is not merely a respiratory virus. That’s just the tip of the iceberg as it were. There are lots of horrible diseases that manifest respiratory symptoms while being capable of far worse harm. COVID is one of those.

• COVID is a respiratory disease yes, but no one should look at the erstwhile mild symptoms and think they’ve lucked out of harm’s way. COVID infects the epithelial (ciliated) cells that live in the deepest recesses of your nostrils, and unfortunately, that entry point acts like an express elevator to other parts of your body. Wearing a muzzle is still the best way to prevent infection to your epi-cil cells, but nasal sprays also help. • COVID is also a vascular disease. The spoke protein present in both the disease and the MRNA vaccine can have adverse effects due to the way it interacts with blood vessels and muscle tissue in the heart – a search for “covid myocarditis spike protein” should suffice here on the search engine of your choice. • COVID is a systemic disease – i.e. a disease that can affect multiple organs in the human body. Kidneys and livers are not safe from COVID just because someone has mild respiratory symptoms. A search for “COVID microclots organ damage” will yield good information here. Oh, and by the way, since the brain is also classified as an organ, we can sadly add the bonus here of COVID being a cognitive disability disease. • And finally, saving the worst for last, COVID is an immune system dysregulation disease. It still irks me immensely to hear people talk about “immunity” or “endemicity” when the disease in question can debilitate the immune system itself. COVID can disrupt and deplete the quantity of T-Cells. T-Cells are the cells in your body that that play a major part is fighting off infections, and without enough of them, you wouldn’t be able to fight off an otherwise “mild cold”, let alone have cancerous cells in your body garbage collected. Search for “covid t cells”.

Seriously, whatever your political or personal liberty views are, if you want to emerge from this pandemic with sufficient faculties to enjoy whatever life you think may be ahead of you, believing that “COVID is mild” is a sure way to shortchange yourself on your expectations.

Fellow Chris, I have no idea when this pandemic will be over, or when we will have the tools necessary to live as people clearly want to live: mask free and care free.

The current US administration is so concerned about bombing people in far off places that they seem to have halted any progress towards potentially sterilizing vaccines. The therapeutics we have on offer are such that they either have mutagenic effects, wreck your organs, or both! Commercial real estate is so close to collapse that absent a large public investment there is no budget for the massive HVAC upgrades needed to make buildings safer. Good masks are harder to get now. Our health care leaders and hospitals appear to be fighting over ways to kill more of their staff and patients. It’s a mad mad mad world out there.

I feel like unless and until we see direct effects on the MIC or several congresscritters fall over dead from symptoms that people can’t say they died “with” covid, we are not going to do what has to happen to manage this disaster. I believe that will be after we have lost millions of people to covid deaths in the US. Sometimes near the end of the next term for whichever dodering old fool we elect this November.

> mask free and care free.

Cleaning the air is the only real solution. The rich know that, which is why they do it for themselves (and I could have pointed this out for both Swift and Adele, but I got caught up in the detail of the music business (not such a bad thing for future posts)).

> they seem to have halted any progress towards potentially sterilizing vaccines.

There are two tracks for this one for nasal vaccines (several), the other for “universal” coronavirus vaccines (i.e., not just Covid; I think two. This is the approach Topol was hopeful about). Hilda Bastian tracks this; I have the link but could not get to it in today’s Water Cooler. Of course, the molasses-brained and genocidal Biden Administration hasn’t given these efforts the OWS treatment, as they obviously should have done, if public health was a consideration for them.

Even trolls have a value, if they provoke such reasoned responses!

> Repeating from memory,

Excellent precis. Thank you.

You’ve clearly never sang on stage before, let alone tried it night after night for weeks at a time. Let me explain: trying to perform with a cold usually makes for a poor performance. Going on stage with a high fever makes both the performer and the audience regret going to the show. Performing with an illness such as Covid that affects breathing and induces fatigue is impossible. Then there’s the effects of illness on rehearsal time (these big shows involve weeks to months of rehearsals) and the long-term effects on the body, especially vocal cords. Further, if the promoter or the artist wants to require masks as a condition of the performance contract, that’s their prerogative. If you don’t want to wear one, stay home.

On Kiss, this: KISS took Vancouver firm’s treatment to avoid COVID and cancelling world tour: manager Vancouver Sun:

Members of the band KISS used a little-known treatment created by a Vancouver biomedical company to avoid getting COVID-19 and cancelling their farewell world tour after lead singer Paul Stanley tested positive for the virus, their manager says.

“I started this with the rock band KISS when Paul Stanley became infected with the coronavirus in Pittsburgh on our tour. I had nowhere to turn. I called some friends of mine in Los Angeles in infectious disease. Nobody had an answer. Nobody had any idea what to do, except to call this company in Canada,” manager Doc McGhee said Monday at a news conference in Toronto.

“Without this, we wouldn’t be on the road. We couldn’t have done the extra 100 shows that we just did.”

The company McGhee called was Vancouver-based Ondine Biomedical, which created Steriwave, a technology that involves putting a disinfecting liquid into the nose and then activating it with lights attached to probes to kill viruses lurking in the respiratory system.

It has been used by Vancouver General Hospital to reduce infections in surgery patients for more than 11 years. A study released last Thursday showed the use of this “nasal photodisinfection” at Ottawa Hospital reduced the length of patients’ hospital stays, readmissions and antibiotic use.

We linked to this contemparaneosly. Not sure why Steriwave isn’t used a lot more.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Tip Jar

Friday, March 22, 2024

A Web Designer’s Accessibility Advocacy Toolkit — Smashing MagazineClear SearchBack to top

A Web Designer’s Accessibility Advocacy Toolkit — Smashing MagazineClear SearchBack to top

A Web Designer’s Accessibility Advocacy Toolkit — Smashing MagazineClear SearchBack to top

Yichan Wang is a visual designer based in New York City. She enjoys translating complex ideas into captivating stories. With a career spanning web, brand, and … More about Yichan ↬

Weekly tips on front-end & UX.Trusted by 200,000+ folks.

Web accessibility can be challenging, particularly for clients unfamiliar with tech or compliance with The Americans With Disabilities Act (ADA). My role as a digital designer often involves guiding clients toward ADA-compliant web designs. I’ve acquired many strategies over the years for encouraging clients to adopt accessible web practices and invest in accessible user interfaces. It’s something that comes up with nearly every new project, and I decided to develop a personal toolkit to help me make the case.

Now, I am opening up my toolkit for you to have and use. While some of the strategies may be specific to me and my work, there are plenty more that cast a wider net and are more universally applicable. I’ve considered different real-life scenarios where I have had to make a case for accessibility. You may even personally identify with a few of them!

Please enjoy. As you do, remember that there is no silver bullet for “selling” accessibility. We can’t win everyone over with cajoling or terse arguments. My hope is that you are able to use this collection to establish partnerships with your colleagues and clients alike. Accessibility is something that anyone can influence at various stages in a project, and “winning” an argument isn’t exactly the point. It’s a bigger picture we’re after, one that influences how teams work together, changes habits, and develops a new level of empathy and understanding.

I begin with general strategies for discussing accessibility with clients. Following that, I provide specific language and responses you can use to introduce accessibility practices to your team and clients and advocate its importance while addressing client skepticism and concerns. Use it as a starting point and build off of it so that it incorporates points and scenarios that are more specific to your work. I sincerely hope it helps you advance accessible practices.

General Strategies

We’ll start with a few ways you can position yourself when interacting with clients. By adopting a certain posture, we can set ourselves up to be the experts in the room, the ones with solutions rather than arguments.

Showcasing Expertise

I tend to establish my expertise and tailor the information to the client’s understanding of accessibility, which could be not very much. For those new to accessibility, I offer a concise overview of its definition, evaluation, and business impact. For clients with a better grasp of accessible practices, I like to use the WCAG as a point of reference for helping frame productive discussions based on substance and real requirements.

Aligning With Client Goals

I connect accessibility to the client’s goals instead of presenting accessibility as a moral imperative. No one loves being told what to do, and talking to clients on their terms establishes a nice bridge for helping them connect the dots between the inherent benefits of accessible practices and what they are trying to accomplish. The two aren’t mutually exclusive!

In fact, there are many clear benefits for apps that make accessibility a first-class feature. Refer to the “Accessibility Benefits” section to help describe those benefits to your colleagues and clients.

Defining Accessibility In The Project Scope

I outline accessibility goals early, typically when defining the project scope and requirements. Baking accessibility into the project scope ensures that it is at least considered at this crucial stage where decisions are being made for everything from expected outcomes to architectural requirements.

User stories and personas are common artifacts for which designers are often responsible. Use these as opportunities to define accessibility in the same breath as defining who the users are and how they interact with the app. Framing stories and outcomes as user interactions in an “as-when-then-so” format provides an opening to lead with accessibility:

Fill in the blanks. I think you’ll find that user’s expected outcomes are typically aligned with accessible experiences. Federico Francioni published his take on developing inclusive user personas, building off other excellent resources, including Microsoft’s Inclusive Design guidelines.

Meet Touch Design for Mobile Interfaces, Steven Hoober’s brand-new guide on designing for mobile with proven, universal, human-centric guidelines. 400 pages, jam-packed with in-depth user research and best practices.

Being Ready With Resources and Examples

I maintain a database of resources for clients interested in learning more about accessibility. Sharing anecdotes, such as clients who’ve seen benefits from accessibility or examples of companies penalized for non-compliance, can be very impactful.

Microsoft is helpful here once again with a collection of brief videos that cover a variety of uses, from informing your colleagues and clients on basic accessibility concepts to interviews with accessibility professionals and case studies involving real users.

There are a few go-to resources I’ve bookmarked to share with clients who are learning about accessibility for the first time. What I like about these is the approachable language and clarity. “Learn Accessibility” from web.dev is especially useful because it’s framed as a 21-part course. That may sound daunting, but it’s organized in small chunks that make it manageable, and sometimes I will simply point to the Glossary to help clients understand the concepts we discuss.

And where “Learn Accessibility” is focused on specific components of accessibility, I find that the Inclusive Design Principles site has a perfect presentation of the concepts and guiding principles of inclusion and accessibility on the web.

Meanwhile, I tend to sit beside a client to look at The A11Y Project. I pick a few resources to go through. Otherwise, the amount of information can be overwhelming. I like to offer this during a project’s planning phase because the site is focused on actionable strategies that help scope work.

Leveraging User Research

User research that is specific to the client’s target audience is more convincing than general statistics alone. When possible, I try to understand those user’s needs, including what they expect, what sort of technology they use to browse online, and where they are geographically. Painting a more complete picture of users — based on real-life factors and information — offers a more human perspective and plants the first seeds of empathy in the design process.

Web analytics are great for identifying who users are and how they currently interact with the app. At the same time, they are also wrought with caveats as far as accuracy goes, depending on the tool you use and how you collect your data. That said, I use the information to support my user persona decisions and the specific requirements I write. Analytics add nice brush strokes to the picture but do not paint the entire view. So, leverage it!

The big caveat with web analytics? There’s no way to identify traffic that uses assistive tech. That’s a good thing in general as far as privacy goes, but it does mean that researching the usability of your site is best done with real users — as it is with any user research, really. The A11Y Project has excellent resources for testing screen readers, including a link to this Smashing Magazine article about manual accessibility testing by Eric Bailey as well as a vast archive of links pointing to other research.

That said, web analytics can still be very useful to help accommodate other impairments, for example, segmenting traffic by age (for improving accessibility for low vision) and geography (for improving performance gaps for those on low-powered devices). WebAIM also provides insights in a report they produced from a 2018 survey of users who report having low vision.

Leaving Room For Improvements

Chances are that your project will fall at least somewhat short of your accessibility plans. It happens! I see plenty of situations where a late deadline translates into rushed work that sacrifices quality for speed, and accessibility typically falls victim to degraded quality.

I keep track of these during the project’s various stages and attempt to document them. This way, there’s already a roadmap for inclusive and accessible improvements in subsequent releases. It’s scoped, backlogged, and ready to drop into a sprint.

For projects involving large sites with numerous accessibility issues, I emphasize that partial accessibility compliance is not the same as actual compliance. I often propose phased solutions, starting with incremental changes that fit within the current scope and budget.

And remember, just because something passes a WCAG success criterion doesn’t necessarily mean it is accessible. Passing tests is a good sign, but there will always be room for improvement.

Commonly Asked Accessibility Questions

Accessibility is a broad topic, and we can’t assume that everyone knows what constitutes an “accessible” interface. Often, when I get pushback from a colleague or client, it’s because they simply do not have the same context that I do. That’s why I like to keep a handful of answers to commonly asked questions in my back pocket. It’s amazing how answering the “basics” leads to productive discussions filled with substance rather than ones grounded in opinion.

What Do We Mean By “Web Accessibility”?

When we say “web accessibility,” we’re generally talking about making online content available and usable for anyone with a disability, whether it’s a permanent impairment or a temporary one. It’s the practice of removing friction that excludes people from gaining access to content or from completing a task. That usually involves complying with a set of guidelines that are designed to remove those barriers.

Who Creates Accessibility Guidelines?

The Web Content Accessibility Guidelines (WCAG) are created by a working group of the World Wide Web Consortium (W3C) called the Web Accessibility Initiative (WAI). The W3C develops guidelines and principles to help designers, developers, and authors like us create web experiences based on a common set of standards, including those for HTML, CSS, internationalization, privacy, security, and yes, accessibility, among many, many other areas. The WAI working group maintains the accessibility standards we call WCAG.

Who Needs Web Accessibility?

Twenty-seven percent of the U.S. population has a disability, emphasizing the widespread need for accessible web design. WCAG primarily focuses on three groups:

When we make web experiences that solve these issues based on established guidelines, we’re not only doing good for those who are directly impacted by impairment but those who may be impaired in less direct ways as well, such as establishing large target sizes for those tapping a touchscreen phone with their hands full, or using proper color contrast for those navigating a screen in bright sunlight. Everyone needs — and benefits from — accessibility!

How Is Web Accessibility Regulated?

The Americans with Disabilities Act (ADA) is regulated by the Civil Rights Division of the U.S. Department of Justice, which was established by the Civil Rights Act of 1957. Even though there is a lot of bureaucracy in that last sentence, it’s reassuring to know the U.S. government not only believes in web accessibility but enforces it as well.

Non-compliance can result in legal action, with first-time ADA violations leading to fines of up to $75,000, increasing to $150,000 for subsequent violations. The number of lawsuits for alleged ADA breaches has surged in recent years, with more than 4,500 lawsuits filed in 2023 against sites that fail to comply with WCAG AA 2.1 alone — roughly 500 more lawsuits than 2022!

How Is Web Accessibility Evaluated?

Web accessibility is something we can test against. Many tools have been created to audit sites on the spot based on WCAG success criteria that specify accessible requirements. That would be a standards-based evaluation using WCAG as a reference point for auditing compliance.

WebAIM has an excellent page that compares different types of accessibility testing, reporting, and tooling. They are also quick to note that automated testing, while convenient, is not a comprehensive way to audit accessibility. Automated tools that scan websites may be able to pick up instances where mistakes in the HTML might contribute to accessibility issues and where color contrasts are insufficient. But they cannot replace or perfectly imitate a real-life person. Testing in real browsers with real people continues to be the most effective way to truly evaluate accessible web experiences.

This isn’t to say automated tools should not be part of an accessibility testing suite. In fact, they often highlight areas you may have overlooked. Even false positives are good in the sense that they force you to pause and look more closely at something. Some of the most widely used automated tools include the following:

These are just a few of the most frequent tools I use in my own testing, but there are many more, and the WAI maintains an extensive list of available tools that are worth considering. But again, remember that automated testing is not a one-to-one replacement for testing with real users.

Checklists can be handy for ensuring you are covering your bases:

Accessibility Benefits

When discussing accessibility, I find the most effective arguments are ones that are framed around the interests of clients and stakeholders. That way, the discussion stays within scope and helps everyone see that proper accessibility practices actually benefit business goals. Speaking in business terms is something I openly embrace because it typically supports my case.

The following are a few ways I would like to explain the positive impacts that accessibility has on business goals.

Case Studies

Sometimes, the most convincing approach is to offer examples of companies that have committed to accessible practices and come out better for it. And there are plenty of examples! I like to use case studies and reports in a similar industry or market for a more apples-to-apples comparison that stakeholders can identify with.

That said, there are great general cases involving widely respected companies and brands, including This American Life and Tesco, that demonstrate benefits such as increased organic search traffic, enhanced user engagement, and reduced site load times. For a comprehensive guide on framing these benefits, I refer to the W3C’s resource on building the business case for accessibility.

The Curb-Cut Effect

The “curb-cut effect” refers to how features originally designed for accessibility end up benefiting a broader audience. This concept helps move the conversation away from limiting accessibility as an issue that only affects the minority.

Features like voice control, auto-complete, and auto-captions — initially created to enhance accessibility — have become widely used and appreciated by all users. This effect also includes situational impairments, like using a phone in bright sunlight or with one hand, expanding the scope of who benefits from accessible design. Big companies have found that investing in accessibility can spur innovation.

SEO Benefits

I would like to highlight the SEO benefits that come with accessible best practices. Things like nicely structured sitemaps, a proper heading outline, image alt text, and unique link labels not only improve accessibility for humans but for search engines as well, giving search crawlers clear context about what is on the page. Stakeholders and clients care a lot about this stuff, and if they are able to come around on accessibility, then they’re effectively getting a two-for-one deal.

Better Brand Alignment

Incorporating accessibility into web design can significantly elevate how users perceive a brand’s image. The ease of use that comes with accessibility not only reflects a brand’s commitment to inclusivity and social responsibility but also differentiates it in competitive markets. By prioritizing accessibility, brands can convey a personality that is thoughtful and inclusive, appealing to a broader, more diverse customer base.

Cost Efficiency

I mentioned earlier how developing accessibility enhances SEO like a two-for-one package. However, there are additional cost savings that come with implementing accessibility during the initial stages of web development rather than retrofitting it later. A proactive approach to accessibility saves on the potential high costs of auditing and redesigning an existing site and helps avoid expensive legal repercussions associated with non-compliance.

Addressing Client Concerns

Still getting pushback? There are certain arguments I hear time and again, and I have started keeping a collection of responses to them. In some cases, I have left placeholder instructions for tailoring the responses to your project.

“Our users don’t need it.”

“Our competitors aren’t doing it.”

“We’ll do it later because it’s too expensive.”

“We’ve never had complaints.”

“It will affect the aesthetics of the site.”

Handling Common Client Requests

This section looks at frequent scenarios I’ve encountered in web projects where accessibility considerations come into play. Each situation requires carefully balancing the client’s needs/wants with accessibility standards. I’ll leave placeholder comments in the examples so you are able to address things that are specific to your project.

The Client Directly Requests An Inaccessible Feature

When clients request features they’ve seen online — like unfocusable carousels and complex auto-playing animations — it’s crucial to discuss them in terms that address accessibility concerns. In these situations, I acknowledge the appealing aspects of their inspirations but also highlight their accessibility limitations.

The Client Provides Inaccessible Content

This is where we deal with things like non-descriptive page titles, link names, form labels, and color contrasts for a better “reading” experience.

Sometimes, clients want page titles to be drastically different than the link in the navigation bar. Usually, this is because they want a more detailed page title while keeping navigation links succinct.

A common issue with web content provided by clients is the use of non-descriptive calls to action with phrases and link labels, like “Read More” or “Click Here.” Generic terms can be confusing for users, particularly for those using screen readers, as they don’t provide context about what the link leads to or the nature of the content on the other end.

Proper form labels are a critical aspect of accessible web design. Labels should clearly indicate the purpose of each input field, whether it’s required, and the expected format of the information. This clarity is essential for all users, especially for those using screen readers or other assistive technologies. Plus, there are accessible approaches to pairing labels and inputs that developers ought to be familiar with.

Clients will occasionally approach me with color palettes that produce too low of contrast when paired together. This happens when, for instance, on a website with a white background, a client wants to use their brand accent color for buttons, but that color simply blends into the background color, making it difficult to read. The solution is usually creating a slightly adjusted tint or shade that’s used specifically for digital interfaces — UI colors, if you will. Atul Varma’s “Accessible Color Palette Builder” is a great starting point, as is this UX Lift lander with alternatives.

Suggesting An Accessible Feature To Clients

Proactively suggesting features like sitemaps, pause buttons, and focus indicators is crucial. I’ll provide tips on how to effectively introduce these features to clients, emphasizing their importance and benefit.

Sitemaps play a crucial role in both accessibility and SEO, but clients sometimes hesitate to include them due to concerns about their visual appeal. The challenge is to demonstrate the value of site maps without compromising the site’s overall aesthetic.

Carousels are contentious design features. While some designers are against them and have legitimate reasons for it, I believe that with the right approach, they can be made accessible and effective. There are plenty of resources that provide guidance on creating accessible carousels.

When a client requests a home page carousel in a new site design, it’s worth considering alternative solutions that can avoid the common pitfalls of carousels, such as low click-through rates, increased load times, content being pushed below the fold, and potentially annoying auto-advancing features.

If we decide to use a carousel, I make a point of discussing the necessary accessibility features with the client right from the start. Many clients aren’t aware that elements like pause buttons are crucial for making auto-advancing carousels accessible. To illustrate this, I’ll show them examples of accessible carousel designs that incorporate these features effectively.

Further Reading

Any animation that starts automatically, lasts more than five seconds, and is presented in parallel with other content, needs a pause button per WCAG Success Criterion 2.2.2. A common scenario is when clients want a full-screen video on their homepage without a pause button. It’s important to explain the necessity of pause buttons for meeting accessibility standards and ensuring user comfort without compromising the website’s aesthetics.

Conclusion

That’s it! This is my complete toolkit for discussing web accessibility with colleagues and clients at the start of new projects. It’s not always easy to make a case, which is why I try to appeal from different angles, using a multitude of resources and research to support my case. But with practice, care, and true partnership, it’s possible to not only influence the project but also make accessibility a first-class feature in the process.

Please use the resources, strategies, and talking points I have provided. I share them to help you make your case to your own colleagues and clients. Together, incrementally, we can take steps toward a more accessible web that is inclusive to all people.

And when in doubt, remember the core principles we covered:

Tips on front-end & UX, delivered weekly in your inbox. Just the things you can actually use.

With practical takeaways, live sessions, video recordings and a friendly Q&A.

Everything TypeScript, with code walkthroughs and examples. And other printed books.

With a commitment to quality content for the design community.

Founded by Vitaly Friedman and Sven Lennartz. 2006–2024.

Smashing is proudly running on Netlify, TinaCMS and Swell.

Fonts by Latinotype.

Friday, March 15, 2024

A cyber attack hit Thyssenkrupp Automotive Body Solutions BU

A cyber attack hit Thyssenkrupp Automotive Body Solutions BU

A cyber attack hit Thyssenkrupp Automotive Body Solutions BU

XSS flaw in LiteSpeed Cache plugin exposes millions of WordPress sites at risk

US GOV OFFERS A REWARD OF UP TO $15M FOR INFO ON LOCKBIT GANG MEMBERS AND AFFILIATES

New Redis miner Migo uses novel system weakening techniques

Critical flaw found in deprecated VMware EAP. Uninstall it immediately

Microsoft Exchange flaw CVE-2024-21410 could impact up to 97,000 servers

ConnectWise fixed critical flaws in ScreenConnect remote access tool

More details about Operation Cronos that disrupted Lockbit operation

Cactus ransomware gang claims the theft of 1.5TB of data from Energy management and industrial automation firm Schneider Electric

Operation Cronos: law enforcement disrupted the LockBit operation

A Ukrainian Raccoon Infostealer operator is awaiting trial in the US

Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

How BRICS Got "Rug Pulled" – Cryptocurrency Counterfeiting is on the Rise

SolarWinds addressed critical RCEs in Access Rights Manager (ARM)

ESET fixed high-severity local privilege escalation bug in Windows products

Security Affairs newsletter Round 459 by Pierluigi Paganini – INTERNATIONAL EDITION

Ukrainian national faces up to 20 years in prison for his role in Zeus, IcedID malware schemes

CISA: Cisco ASA/FTD bug CVE-2020-3259 exploited in ransomware attacks

CISA adds Microsoft Exchange and Cisco ASA and FTD bugs to its Known Exploited Vulnerabilities catalog

US gov offers a reward of up to $10M for info on ALPHV/Blackcat gang leaders

U.S. CISA: hackers breached a state government organization

Russia-linked Turla APT uses new TinyTurla-NG backdoor to spy on Polish NGOs

US Gov dismantled the Moobot botnet controlled by Russia-linked APT28

A cyberattack halted operations at Varta production plants

North Korea-linked actors breached the emails of a Presidential Office member

CISA adds Microsoft Windows bugs to its Known Exploited Vulnerabilities catalog

Nation-state actors are using AI services and LLMs for cyberattacks

Abusing the Ubuntu 'command-not-found' utility to install malicious packages

Zoom fixed critical flaw CVE-2024-24691 in Windows software

Adobe Patch Tuesday fixed critical vulnerabilities in Magento, Acrobat and Reader

Microsoft Patch Tuesday for February 2024 fixed 2 actively exploited 0-days

A ransomware attack took 100 Romanian hospitals down

Bank of America customer data compromised after a third-party services provider data breach

Ransomfeed - Third Quarter Report 2023 is out!

Global Malicious Activity Targeting Elections is Skyrocketing

Researchers released a free decryption tool for the Rhysida Ransomware

Residential Proxies vs. Datacenter Proxies: Choosing the Right Option

CISA adds Roundcube Webmail Persistent XSS bug to its Known Exploited Vulnerabilities catalog

Canada Gov plans to ban the Flipper Zero to curb car thefts

9 Possible Ways Hackers Can Use Public Wi-Fi to Steal Your Sensitive Data

US Feds arrested two men involved in the Warzone RAT operation

Raspberry Robin spotted using two new 1-day LPE exploits

Security Affairs newsletter Round 458 by Pierluigi Paganini – INTERNATIONAL EDITION

CISA adds Fortinet FortiOS bug to its Known Exploited Vulnerabilities catalog

macOS Backdoor RustDoor likely linked to Alphv/BlackCat ransomware operations

Exploiting a vulnerable Minifilter Driver to create a process killer

Black Basta ransomware gang hacked Hyundai Motor Europe

Fortinet warns of a new actively exploited RCE flaw in FortiOS SSL VPN

Ivanti warns of a new auth bypass flaw in its Connect Secure, Policy Secure, and ZTA gateway devices

26 Cyber Security Stats Every User Should Be Aware Of in 2024

US offers $10 million reward for info on Hive ransomware group leaders

Unraveling the truth behind the DDoS attack from electric toothbrushes

China-linked APT Volt Typhoon remained undetected for years in US infrastructure

Cisco fixes critical Expressway Series CSRF vulnerabilities

CISA adds Google Chromium V8 Type Confusion bug to its Known Exploited Vulnerabilities catalog

Fortinet addressed two critical FortiSIEM vulnerabilities

Experts warn of a critical bug in JetBrains TeamCity On-Premises

Critical shim bug impacts every Linux boot loader signed in the past decade

China-linked APT deployed malware in a network of the Dutch Ministry of Defence

Commercial spyware vendors are behind most zero-day exploits discovered by Google TAG

Google fixed an Android critical remote code execution flaw

A man faces up to 25 years in prison for his role in operating unlicensed crypto exchange BTC-e

U.S. Gov imposes visa restrictions on individuals misusing Commercial Spyware

HPE is investigating claims of a new security breach

Experts warn of a surge of attacks targeting Ivanti SSRF flaw 

How to hack the Airbus NAVBLUE Flysmart+ Manager

Crooks stole $25.5 million from a multinational firm using a 'deepfake' video call

Software firm AnyDesk disclosed a security breach

The 'Mother of all Breaches': Navigating the Aftermath and Fortifying Your Data with DSPM

US government imposed sanctions on six Iranian intel officials

A cyberattack impacted operations at Lurie Children's Hospital

AnyDesk Incident: Customer Credentials Leaked and Published for Sale on the Dark Web

Security Affairs newsletter Round 457 by Pierluigi Paganini – INTERNATIONAL EDITION

Clorox estimates the costs of the August cyberattack will exceed $49 Million

Mastodon fixed a flaw that can allow the takeover of any account

Iranian hackers breached Albania’s Institute of Statistics (INSTAT)

Operation Synergia led to the arrest of 31 individuals

Ex CIA employee Joshua Adam Schulte sentenced to 40 years in prison

Cloudflare breached on Thanksgiving Day, but the attack was promptly contained

PurpleFox malware infected at least 2,000 computers in Ukraine

Man sentenced to six years in prison for stealing millions in cryptocurrency via SIM swapping

CISA orders federal agencies to disconnect Ivanti VPN instances by February 2

Multiple malware used in attacks exploiting Ivanti VPN flaws

Police seized 50,000 Bitcoin from operator of the now-defunct piracy site movie2k

Crooks stole around $112 million worth of XRP from Ripple’s co-founder

CISA adds Apple improper authentication bug to its Known Exploited Vulnerabilities catalog

Ivanti warns of a new actively exploited zero-day

Threat actors exploit Ivanti VPN bugs to deploy KrustyLoader Malware

Data leak at fintech giant Direct Trading Technologies

Root access vulnerability in GNU Library C (glibc) impacts many Linux distros

Italian data protection authority said that ChatGPT violated EU privacy laws

750 million Indian mobile subscribers' data offered for sale on dark web

Juniper Networks released out-of-band updates to fix high-severity flaws

Hundreds of network operators’ credentials found circulating in Dark Web

Cactus ransomware gang claims the Schneider Electric hack

Mercedes-Benz accidentally exposed sensitive data, including source code

Experts detailed Microsoft Outlook flaw that can leak NTLM v2 hashed passwords

NSA buys internet browsing records from data brokers without a warrant

Ukraine’s SBU arrested a member of Pro-Russia hackers group 'Cyber Army of Russia'

Multiple PoC exploits released for Jenkins flaw CVE-2024-23897

Medusa ransomware attack hit Kansas City Area Transportation Authority

Security Affairs newsletter Round 456 by Pierluigi Paganini – INTERNATIONAL EDITION

Pro-Ukraine hackers wiped 2 petabytes of data from Russian research center

Participants earned more than $1.3M at the Pwn2Own Automotive competition

A TrickBot malware developer sentenced to 64 months in prison

Russian Midnight Blizzard APT is targeting orgs worldwide, Microsoft warns

Watch out, experts warn of a critical flaw in Jenkins

Pwn2Own Automotive 2024 Day 2 - Tesla hacked again

Yearly Intel Trend Review: The 2023 RedSense report

Cisco warns of a critical bug in Unified Communications products, patch it now!

Russia-linked APT group Midnight Blizzard hacked Hewlett Packard Enterprise (HPE)

CISA adds Atlassian Confluence Data Center bug to its Known Exploited Vulnerabilities catalog

5379 GitLab servers vulnerable to zero-click account takeover attacks

Experts released PoC exploit for Fortra GoAnywhere MFT flaw CVE-2024-0204

Splunk fixed high-severity flaw impacting Windows versions

Watch out, a new critical flaw affects Fortra GoAnywhere MFT

Australian government announced sanctions for Medibank hacker

LoanDepot data breach impacted roughly 16.6 individuals

Black Basta gang claims the hack of the UK water utility Southern Water

CISA adds VMware vCenter Server bug to its Known Exploited Vulnerabilities catalog

Mother of all breaches - a historic data leak reveals 26 billion records: check what's exposed

Apple fixed actively exploited zero-day CVE-2024-23222

“My Slice”, an Italian adaptive phishing campaign

Threat actors exploit Apache ActiveMQ flaw to deliver the Godzilla Web Shell

Cybercriminals leaked massive volumes of stolen PII data from Thailand in Dark Web

Backdoored pirated applications targets Apple macOS users

LockBit ransomware gang claims the attack on the sandwich chain Subway

Security Affairs newsletter Round 455 by Pierluigi Paganini – INTERNATIONAL EDITION

Admin of the BreachForums hacking forum sentenced to 20 years supervised release

VF Corp December data breach impacts 35 million customers

China-linked APT UNC3886 exploits VMware zero-day since 2021

Ransomware attacks break records in 2023: the number of victims rose by 128%

U.S. CISA warns of actively exploited Ivanti EPMM flaw CVE-2023-35082

The Quantum Computing Cryptopocalypse – I’ll Know It When I See It

Kansas State University suffered a serious cybersecurity incident

CISA adds Chrome and Citrix NetScaler to its Known Exploited Vulnerabilities catalog

Google TAG warns that Russian COLDRIVER APT is using a custom backdoor

PixieFail: Nine flaws in UEFI open-source reference implementation could have severe impacts

iShutdown lightweight method allows to discover spyware infections on iPhones

Pro-Russia group hit Swiss govt sites after Zelensky visit in Davos

Github rotated credentials after the discovery of a vulnerability

FBI, CISA warn of AndroxGh0st botnet for victim identification and exploitation

Citrix warns admins to immediately patch NetScaler for actively exploited zero-days

Google fixed the first actively exploited Chrome zero-day of 2024

Atlassian fixed critical RCE in older Confluence versions

VMware fixed a critical flaw in Aria Automation. Patch it now!

Experts warn of mass exploitation of Ivanti Connect Secure VPN flaws

Experts warn of a vulnerability affecting Bosch BCC100 Thermostat

Over 178,000 SonicWall next-generation firewalls (NGFW) online exposed to hack

Phemedrone info stealer campaign exploits Windows smartScreen bypass

Balada Injector continues to infect thousands of WordPress sites

Attackers target Apache Hadoop and Flink to deliver cryptominers

Apple fixed a bug in Magic Keyboard that allows to monitor Bluetooth traffic

Security Affairs newsletter Round 454 by Pierluigi Paganini – INTERNATIONAL EDITION

GitLab fixed a critical zero-click account hijacking flaw

Juniper Networks fixed a critical RCE bug in its firewalls and switches

Vast Voter Data Leaks Cast Shadow Over Indonesia ’s 2024 Presidential Election

Researchers created a PoC for Apache OFBiz flaw CVE-2023-51467

Team Liquid’s wiki leak exposes 118K users

CISA adds Ivanti and Microsoft SharePoint bugs to its Known Exploited Vulnerabilities catalog

Two zero-day bugs in Ivanti Connect Secure actively exploited

X Account of leading cybersecurity firm Mandiant was hacked because not adequately protected

Cisco fixed critical Unity Connection vulnerability CVE-2024-20272

ShinyHunters member sentenced to three years in prison

HMG Healthcare disclosed a data breach

Threat actors hacked the X account of the Securities and Exchange Commission (SEC) and announced fake Bitcoin ETF approval

Decryptor for Tortilla variant of Babuk ransomware released

Microsoft Patch Tuesday for January 2024 fixed 2 critical flaws

CISA adds Apache Superset bug to its Known Exploited Vulnerabilities catalog

Syrian group Anonymous Arabic distributes stealthy malware Silver RAT

Swiss Air Force sensitive files stolen in the hack of Ultra Intelligence & Communications

DoJ charged 19 individuals in a transnational cybercrime investigation xDedic Marketplace

Long-existing Bandook RAT targets Windows machines

A cyber attack hit the Beirut International Airport

Iranian crypto exchange Bit24.cash leaks user passports and IDs

Security Affairs newsletter Round 453 by Pierluigi Paganini – INTERNATIONAL EDITION

Turkish Sea Turtle APT targets Dutch IT and Telecom firms

Experts spotted a new macOS Backdoor named SpectralBlur linked to North Korea

Merck settles with insurers regarding a $1.4 billion claim over NotPetya damages

The source code of Zeppelin Ransomware sold on a hacking forum

Russia-linked APT Sandworm was inside Ukraine telecoms giant Kyivstar for months

Ivanti fixed a critical EPM flaw that can result in remote code execution

MyEstatePoint Property Search Android app leaks user passwords

Hacker hijacked Orange Spain RIPE account causing internet outage to company customers

HealthEC data breach impacted more than 4.5 Million people

Experts found 3 malicious packages hiding crypto miners in PyPi repository

Crooks hacked Mandiant X account to push cryptocurrency scam

Cybercriminals Implemented Artificial Intelligence (AI) for Invoice Fraud

CISA ADDS CHROME AND PERL LIBRARY FLAWS TO ITS KNOWN EXPLOITED VULNERABILITIES CATALOG

Don’t trust links with known domains: BMW affected by redirect vulnerability

Hackers stole more than $81 million worth of crypto assets from Orbit Chain

Ukraine’s SBU said that Russia's intelligence hacked surveillance cameras to direct a missile strike on Kyiv

Experts warn of JinxLoader loader used to spread Formbook and XLoader

Terrapin attack allows to downgrade SSH protocol security

Multiple organizations in Iran were breached by a mysterious hacker

Top 2023 Security Affairs cybersecurity stories

Malware exploits undocumented Google OAuth endpoint to regenerate Google cookies

Cactus RANSOMWARE gang hit the Swedish retail and grocery provider Coop

Google agreed to settle a $5 billion privacy lawsuit

Security Affairs newsletter Round 452 by Pierluigi Paganini – INTERNATIONAL EDITION

INC RANSOM ransomware gang claims to have breached Xerox Corp

Spotify music converter TuneFab puts users at risk

Cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania

Russia-linked APT28 used new malware in a recent phishing campaign

Clash of Clans gamers at risk while using third-party app

New Version of Meduza Stealer Released in Dark Web

Operation Triangulation attacks relied on an undocumented hardware feature

Cybercriminals launched “Leaksmas” event in the Dark Web exposing massive volumes of leaked PII and compromised data

Lockbit ransomware attack interrupted medical emergencies gang at a German hospital network

Experts warn of critical Zero-Day in Apache OfBiz

Xamalicious Android malware distributed through the Play Store

Barracuda fixed a new ESG zero-day exploited by Chinese group UNC4841

Elections 2024, artificial intelligence could upset world balances

Experts analyzed attacks against poorly managed Linux SSH servers

A cyberattack hit Australian healthcare provider St Vincent’s Health Australia

Rhysida ransomware group hacked Abdali Hospital in Jordan

Carbanak malware returned in ransomware attacks

Resecurity Released a 2024 Cyber Threat Landscape Forecast

APT group UAC-0099 targets Ukraine exploiting a WinRAR flaw

Iran-linked APT33 targets Defense Industrial Base sector with FalseFont backdoor

Security Affairs newsletter Round 451 by Pierluigi Paganini – INTERNATIONAL EDITION

Europol and ENISA spotted 443 e-stores compromised with digital skimming

Video game giant Ubisoft investigates reports of a data breach

LockBit ransomware gang claims to have breached accountancy firm Xeinadin

Mobile virtual network operator Mint Mobile discloses a data breach

Akira ransomware gang claims the theft of sensitive data from Nissan Australia

Member of Lapsus$ gang sentenced to an indefinite hospital order

Real estate agency exposes details of 690k customers

ESET fixed a high-severity bug in the Secure Traffic Scanning Feature of several products

Phishing attacks use an old Microsoft Office flaw to spread Agent Tesla malware

Data leak exposes users of car-sharing service Blink Mobility

Google addressed a new actively exploited Chrome zero-day

German police seized the dark web marketplace Kingdom Market

Law enforcement Operation HAECHI IV led to the seizure of $300 Million

Sophisticated JaskaGO info stealer targets macOS and Windows

BMW dealer at risk of takeover by cybercriminals

Comcast’s Xfinity customer data exposed after CitrixBleed attack

FBI claims to have dismantled AlphV/Blackcat ransomware operation, but the group denies it

Smishing Triad: Cybercriminals Impersonate UAE Federal Authority for Identity and Citizenship on the Peak of Holidays Season

The ransomware attack on Westpole is disrupting digital services for Italian public administration

Info stealers and how to protect against them

Pro-Israel Predatory Sparrow hacker group disrupted services at around 70% of Iran’s fuel stations

Qakbot is back and targets the Hospitality industry

A supply chain attack on crypto hardware wallet Ledger led to the theft of $600K

MongoDB investigates a cyberattack, customer data exposed

InfectedSlurs botnet targets QNAP VioStor NVR vulnerability

Security Affairs newsletter Round 450 by Pierluigi Paganini – INTERNATIONAL EDITION

New NKAbuse malware abuses NKN decentralized P2P network protocol

Snatch ransomware gang claims the hack of the food giant Kraft Heinz

Multiple flaws in pfSense firewall can lead to arbitrary code execution

BianLian, White Rabbit, and Mario Ransomware Gangs Spotted in a Joint Campaign

Data of over a million users of the crypto exchange GokuMarket exposed

Idaho National Laboratory data breach impacted 45,047 individuals

Ubiquiti users claim to have access to other people’s devices

Russia-linked APT29 spotted targeting JetBrains TeamCity servers

Microsoft seized the US infrastructure of the Storm-1152 cybercrime group

French authorities arrested a Russian national for his role in the Hive ransomware operation

China-linked APT Volt Typhoon linked to KV-Botnet

UK Home Office is ignoring the risk of 'catastrophic ransomware attacks,' report warns

OAuth apps used in cryptocurrency mining, phishing campaigns, and BEC attacks

Sophos backports fix for CVE-2022-3236 for EOL firewall firmware versions due to ongoing attacks

December 2023 Microsoft Patch Tuesday fixed 4 critical flaws

Ukrainian military intelligence service hacked the Russian Federal Taxation Service

Kyivstar, Ukraine's largest mobile carrier brought down by a cyber attack

Dubai’s largest taxi app exposes 220K+ users

Operation Blacksmith: Lazarus exploits Log4j flaws to deploy DLang malware

Apple released iOS 17.2 to address a dozen of security flaws

Toyota Financial Services discloses a data breach

Apache fixed Critical RCE flaw CVE-2023-50164 in Struts 2

CISA adds Qlik Sense flaws to its Known Exploited Vulnerabilities catalog

CISA and ENISA signed a Working Arrangement to enhance cooperation

Researcher discovered a new lock screen bypass bug for Android 14 and 13

WordPress 6.4.2 fixed a Remote Code Execution (RCE) flaw

Security Affairs newsletter Round 449 by Pierluigi Paganini – INTERNATIONAL EDITION

Hacktivists hacked an Irish water utility and interrupted the water supply

5Ghoul flaws impact hundreds of 5G devices with Qualcomm, MediaTek chips

Norton Healthcare disclosed a data breach after a ransomware attack

Bypassing major EDRs using Pool Party process injection techniques

Founder of Bitzlato exchange has pleaded for unlicensed money transmitting

Android barcode scanner app exposes user passwords

UK and US expose Russia Callisto Group's activity and sanction members

A cyber attack hit Nissan Oceania

New Krasue Linux RAT targets telecom companies in Thailand

Atlassian addressed four new RCE flaws in its products

CISA adds Qualcomm flaws to its Known Exploited Vulnerabilities catalog

Experts demonstrate a post-exploitation tampering technique to display Fake Lockdown mode

GST Invoice Billing Inventory exposes sensitive data to threat actors

Threat actors breached US govt systems by exploiting Adobe ColdFusion flaw

ENISA published the ENISA Threat Landscape for DoS Attacks Report

Russia-linked APT28 group spotted exploiting Outlook flaw to hijack MS Exchange accounts

Google fixed critical zero-click RCE in Android

New P2PInfect bot targets routers and IoT devices

Malvertising attacks rely on DanaBot Trojan to spread CACTUS Ransomware

LockBit on a Roll - ICBC Ransomware Attack Strikes at the Heart of the Global Financial Order

Zyxel fixed tens of flaws in Firewalls, Access Points, and NAS devices

New Agent Raccoon malware targets the Middle East, Africa and the US

Security Affairs newsletter Round 448 by Pierluigi Paganini – INTERNATIONAL EDITION

Researchers devised an attack technique to extract ChatGPT training data

Fortune-telling website WeMystic exposes 13M+ user records

Expert warns of Turtle macOS ransomware

Black Basta Ransomware gang accumulated at least $107 million in Bitcoin ransom payments since early 2022

CISA adds ownCloud and Google Chrome bugs to its Known Exploited Vulnerabilities catalog

Apple addressed 2 new iOS zero-day vulnerabilities

Critical Zoom Room bug allowed to gain access to Zoom Tenants

Rhysida ransomware group hacked King Edward VII’s Hospital in London

Google addressed the sixth Chrome Zero-Day vulnerability in 2023

Okta reveals additional attackers' activities in October 2023 Breach

Thousands of secrets lurk in app images on Docker Hub

Threat actors started exploiting critical ownCloud flaw CVE-2023-49103

International police operation dismantled a prominent Ukraine-based Ransomware group

Daixin Team group claimed the hack of North Texas Municipal Water District

Healthcare provider Ardent Health Services disclosed a ransomware attack

Ukraine's intelligence service hacked Russia's Federal Air Transport Agency, Rosaviatsia

Iranian hacker group Cyber Av3ngers hacked the Municipal Water Authority of Aliquippa in Pennsylvania

The hack of MSP provider CTS potentially impacted hundreds of UK law firms

Security Affairs newsletter Round 447 by Pierluigi Paganini – INTERNATIONAL EDITION

Rhysida ransomware gang claimed China Energy hack

North Korea-linked APT Lazarus is using a MagicLine4NX zero-day flaw in supply chain attack

Hamas-linked APT uses Rust-based SysJoker backdoor against Israel

App used by hundreds of schools leaking children's data

Microsoft launched its new Microsoft Defender Bounty Program

Exposed Kubernetes configuration secrets can fuel supply chain attacks

North Korea-linked Konni APT uses Russian-language weaponized documents

ClearFake campaign spreads macOS AMOS information stealer

Welltok data breach impacted 8.5 million patients in the U.S.

North Korea-linked APT Diamond Sleet supply chain attack relies on CyberLink software

Automotive parts giant AutoZone disclosed data breach after MOVEit hack

New InfectedSlurs Mirai-based botnet exploits two zero-days

SiegedSec hacktivist group hacked Idaho National Laboratory (INL)

CISA adds Looney Tunables Linux bug to its Known Exploited Vulnerabilities catalog

Citrix provides additional measures to address Citrix Bleed

Tor Project removed several relays associated with a suspicious cryptocurrency scheme

Experts warn of a surge in NetSupport RAT attacks against education and government sectors

The Top 5 Reasons to Use an API Management Platform

Canadian government impacted by data breaches of two of its contractors

Rhysida ransomware gang is auctioning data stolen from the British Library

Russia-linked APT29 group exploited WinRAR 0day in attacks against embassies

DarkCasino joins the list of APT groups exploiting WinRAR zero-day

US teenager pleads guilty to his role in credential stuffing attack on a betting site

Security Affairs newsletter Round 446 by Pierluigi Paganini – INTERNATIONAL EDITION

8Base ransomware operators use a new variant of the Phobos ransomware

Russian APT Gamaredon uses USB worm LitterDrifter against Ukraine

The board of directors of OpenAI fired Sam Altman

Medusa ransomware gang claims the hack of Toyota Financial Services

CISA adds Sophos Web Appliance bug to its Known Exploited Vulnerabilities catalog

Zimbra zero-day exploited to steal government emails by four groups

Vietnam Post exposes 1.2TB of data, including email addresses

Samsung suffered a new data breach

FBI and CISA warn of attacks by Rhysida ransomware gang

Critical flaw fixed in SAP Business One product

Law enforcement agencies dismantled the illegal botnet proxy service IPStorm

Gamblers’ data compromised after casino giant Strendus fails to set password

VMware disclosed a critical and unpatched authentication bypass flaw in VMware Cloud Director Appliance

Danish critical infrastructure hit by the largest cyber attack in Denmark's history

Major Australian ports blocked after a cyber attack on DP World

Nuclear and Oil & Gas are Major Targets of Ransomware Groups in 2024

CISA adds five vulnerabilities in Juniper devices to its Known Exploited Vulnerabilities catalog

LockBit ransomware gang leaked data stolen from Boeing

North Korea-linked APT Sapphire Sleet targets IT job seekers with bogus skills assessment portals

The Lorenz ransomware group hit Texas-based Cogdell Memorial Hospital

The State of Maine disclosed a data breach that impacted 1.3M people

Security Affairs newsletter Round 445 by Pierluigi Paganini – INTERNATIONAL EDITION

Police seized BulletProftLink phishing-as-a-service (PhaaS) platform

Serbian pleads guilty to running ‘Monopoly’ dark web drug market

McLaren Health Care revealed that a data breach impacted 2.2 million people

After ChatGPT, Anonymous Sudan took down the Cloudflare website

Industrial and Commercial Bank of China (ICBC) suffered a ransomware attack

SysAid zero-day exploited by Clop ransomware group

Dolly.com pays ransom, attackers release data anyway

DDoS attack leads to significant disruption in ChatGPT services

Russian Sandworm disrupts power in Ukraine with a new OT attack

Veeam fixed multiple flaws in Veeam ONE, including critical issues

Pro-Palestinian hackers group 'Soldiers of Solomon' disrupted the production cycle of the biggest flour production plant in Israel

Iranian Agonizing Serpens APT is targeting Israeli entities with destructive cyber attacks

Critical Confluence flaw exploited in ransomware attacks

QNAP fixed two critical vulnerabilities in QTS OS and apps

Attackers use Google Calendar RAT to abuse Calendar service as C2 infrastructure

Socks5Systemz proxy service delivered via PrivateLoader and Amadey

US govt sanctioned a Russian woman for laundering virtual currency on behalf of threat actors

Security Affairs newsletter Round 444 by Pierluigi Paganini – INTERNATIONAL EDITION

Lazarus targets blockchain engineers with new KandyKorn macOS Malware

Kinsing threat actors probed the Looney Tunables flaws in recent attacks

ZDI discloses four zero-day flaws in Microsoft Exchange

Okta customer support system breach impacted 134 customers

Multiple WhatsApp mods spotted containing the CanesSpy Spyware

Russian FSB arrested Russian hackers who supported Ukrainian cyber operations

MuddyWater has been spotted targeting two Israeli entities

Clop group obtained access to the email addresses of about 632,000 US federal employees

Okta discloses a new data breach after a third-party vendor was hacked

Suspected exploitation of Apache ActiveMQ flaw CVE-2023-46604 to install HelloKitty ransomware

Boeing confirmed its services division suffered a cyberattack

Resecurity: Insecurity of 3rd-parties leads to Aadhaar data leaks in India

Who is behind the Mozi Botnet kill switch?

CISA adds two F5 BIG-IP flaws to its Known Exploited Vulnerabilities catalog

Threat actors actively exploit F5 BIG-IP flaws CVE-2023-46747 and CVE-2023-46748

Pro-Hamas hacktivist group targets Israel with BiBi-Linux wiper

British Library suffers major outage due to cyberattack

Critical Atlassian Confluence flaw can lead to significant data loss

WiHD leak exposes details of all torrent users

Experts released PoC exploit code for Cisco IOS XE flaw CVE-2023-20198

Canada bans WeChat and Kaspersky apps on government-issued mobile devices

Florida man sentenced to prison for SIM Swapping conspiracy that led to theft of $1M in cryptocurrency

Wiki-Slack attack allows redirecting business professionals to malicious websites

HackerOne awarded over $300 million bug hunters

StripedFly, a complex malware that infected one million devices without being noticed

IT Army of Ukraine disrupted internet providers in territories occupied by Russia

Security Affairs newsletter Round 443 by Pierluigi Paganini – INTERNATIONAL EDITION

Bug hunters earned $1,038,250 for 58 unique 0-days at Pwn2Own Toronto 2023

Lockbit ransomware gang claims to have stolen data from Boeing

How to Collect Market Intelligence with Residential Proxies?

F5 urges to address a critical flaw in BIG-IP

Hello Alfred app exposes user data

iLeakage attack exploits Safari to steal data from Apple devices

Cloudflare mitigated 89 hyper-volumetric HTTP distributed DDoS attacks exceeding 100 million rps

Seiko confirmed a data breach after BlackCat attack

Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks

Pwn2Own Toronto 2023 Day 1 - organizers awarded $438,750 in prizes

VMware addressed critical vCenter flaw also for End-of-Life products

Citrix warns admins to patch NetScaler CVE-2023-4966 bug immediately

New England Biolabs leak sensitive data

Former NSA employee pleads guilty to attempted selling classified documents to Russia

Experts released PoC exploit code for VMware Aria Operations for Logs flaw. Patch it now!

How did the Okta Support breach impact 1Password?

PII Belonging to Indian Citizens, Including their Aadhaar IDs, Offered for Sale on the Dark Web

Spain police dismantled a cybercriminal group who stole the data of 4 million individuals

CISA adds second Cisco IOS XE flaw to its Known Exploited Vulnerabilities catalog

Cisco warns of a second IOS XE zero-day used to infect devices worldwide

City of Philadelphia suffers a data breach

SolarWinds fixed three critical RCE flaws in its Access Rights Manager product

Don't use AI-based apps, Philippine defense ordered its personnel

Vietnamese threat actors linked to DarkGate malware campaign

MI5 chief warns of Chinese cyber espionage reached an unprecedented scale

The attack on the International Criminal Court was targeted and sophisticated

Security Affairs newsletter Round 442 by Pierluigi Paganini – INTERNATIONAL EDITION

A threat actor is selling access to Facebook and Instagram's Police Portal

Threat actors breached Okta support system and stole customers' data

US DoJ seized domains used by North Korean IT workers to defraud businesses worldwide

Alleged developer of the Ragnar Locker ransomware was arrested

CISA adds Cisco IOS XE flaw to its Known Exploited Vulnerabilities catalog

Tens of thousands Cisco IOS XE devices were hacked by exploiting CVE-2023-20198

Law enforcement operation seized Ragnar Locker group's infrastructure

THE 11TH EDITION OF THE ENISA THREAT LANDSCAPE REPORT IS OUT!

North Korea-linked APT groups actively exploit JetBrains TeamCity flaw

Multiple APT groups exploited WinRAR flaw CVE-2023-38831

Californian IT company DNA Micro leaks private mobile phone data

Threat actors have been exploiting CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices since August

A flaw in Synology DiskStation Manager allows admin account takeover

D-Link confirms data breach, but downplayed the impact

CVE-2023-20198 zero-day widely exploited to install implants on Cisco IOS XE systems

Russia-linked Sandworm APT compromised 11 Ukrainian telecommunications providers

Ransomware realities in 2023: one employee mistake can cost a company millions

Malware-laced 'RedAlert - Rocket Alerts' app targets Israeli users 

Cisco warns of active exploitation of IOS XE zero-day

Signal denies claims of an alleged zero-day flaw in its platform

Microsoft Defender thwarted Akira ransomware attack on an industrial engineering firm

DarkGate malware campaign abuses Skype and Teams

The Alphv ransomware gang stole 5TB of data from the Morrison Community Hospital

Security Affairs newsletter Round 441 by Pierluigi Paganini – INTERNATIONAL EDITION

Lockbit ransomware gang demanded an 80 million ransom to CDW

CISA warns of vulnerabilities and misconfigurations exploited in ransomware attacks

Stayin' Alive campaign targets high-profile Asian government and telecom entities. Is it linked to ToddyCat APT?

FBI and CISA published a new advisory on AvosLocker ransomware

More than 17,000 WordPress websites infected with the Balada Injector in September

Ransomlooker, a new tool to track and analyze ransomware groups' activities

Phishing, the campaigns that are targeting Italy

A new Magecart campaign hides the malicious code in 404 error page

CISA adds Adobe Acrobat Reader flaw to its Known Exploited Vulnerabilities catalog

Mirai-based DDoS botnet IZ1H9 added 13 payloads to target routers

Air Europa data breach exposed customers' credit cards

#OpIsrael, #FreePalestine & #OpSaudiArabia - How Cyber Actors Capitalize On War Actions Via Psy-Ops

Microsoft Patch Tuesday updates for October 2023 fixed three actively exploited zero-day flaws

New 'HTTP/2 Rapid Reset' technique behind record-breaking DDoS attacks

Exposed security cameras in Israel and Palestine pose significant risks

A flaw in libcue library impacts GNOME Linux systems

Hacktivists in Palestine and Israel after SCADA and other industrial control systems

Large-scale Citrix NetScaler Gateway credential harvesting campaign exploits CVE-2023-3519

The source code of the 2020 variant of HelloKitty ransomware was leaked on a cybercrime forum

Gaza-linked hackers and Pro-Russia groups are targeting Israel

Flagstar Bank suffered a data breach once again

Android devices shipped with backdoored firmware as part of the BADBOX network

Security Affairs newsletter Round 440 by Pierluigi Paganini – International edition

North Korea-linked Lazarus APT laundered over $900 million through cross-chain crime

QakBot threat actors are still operational after the August takedown

Ransomware attack on MGM Resorts costs $110 Million

Cybersecurity, why a hotline number could be important?

Multiple experts released exploits for Linux local privilege escalation flaw Looney Tunables

Cisco Emergency Responder is affected by a critical Static Credentials bug. Fix it immediately!

Belgian intelligence service VSSE accused Alibaba of ‘possible espionage’ at European hub in Liege

CISA adds JetBrains TeamCity and Windows flaws to its Known Exploited Vulnerabilities catalog

NATO is investigating a new cyber attack claimed by the SiegedSec group

Global CRM Provider Exposed Millions of Clients’ Files Online

Sony sent data breach notifications to about 6,800 individuals

Apple fixed the 17th zero-day flaw exploited in attacks

Atlassian Confluence zero-day CVE-2023-22515 actively exploited in attacks

A cyberattack disrupted Lyca Mobile services

Chipmaker Qualcomm warns of three actively exploited zero-days

DRM Report Q2 2023 - Ransomware threat landscape

Phishing campaign targeted US executives exploiting a flaw in Indeed job search platform

San Francisco’s transport agency exposes drivers’ parking permits and addresses

BunnyLoader, a new Malware-as-a-Service advertised in cybercrime forums

Exclusive: Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more)

Two hacker groups are back in the news, LockBit 3.0 Black and BlackCat/AlphV

European Telecommunications Standards Institute (ETSI) suffered a data breach

WS_FTP flaw CVE-2023-40044 actively exploited in the wild

National Logistics Portal (NLP) data leak: seaports in India were left vulnerable to takeover by hackers

North Korea-linked Lazarus targeted a Spanish aerospace company

Ransomware attack on Johnson Controls may have exposed sensitive DHS data

BlackCat gang claims they stole data of 2.5 million patients of McLaren Health Care

Security Affairs newsletter Round 439 by Pierluigi Paganini – International edition

ALPHV/BlackCat ransomware gang hacked the hotel chain Motel One

FBI warns of dual ransomware attacks

Progress Software fixed two critical severity flaws in WS_FTP Server

Child abuse site taken down, organized child exploitation crime suspected – exclusive

A still unpatched zero-day RCE impacts more than 3.5M Exim servers

Chinese threat actors stole around 60,000 emails from US State Department in Microsoft breach

Misconfigured WBSC server leaks thousands of passports

CISA adds JBoss RichFaces Framework flaw to its Known Exploited Vulnerabilities catalog

Cisco urges to patch actively exploited IOS zero-day CVE-2023-20109

Dark Angels Team ransomware group hit Johnson Controls

GOOGLE FIXED THE FIFTH CHROME ZERO-DAY OF 2023

Russian zero-day broker is willing to pay $20M for zero-day exploits for iPhones and Android devices

China-linked APT BlackTech was spotted hiding in Cisco router firmware

Watch out! CVE-2023-5129 in libwebp library affects millions applications

DarkBeam leaks billions of email and password combinations

'Ransomed.vc' in the Spotlight - What is Known About the Ransomware Group Targeting Sony and NTT Docomo

Top 5 Problems Solved by Data Lineage

Threat actors claim the hack of Sony, and the company investigates

Canadian Flair Airlines left user data leaking for months

The Rhysida ransomware group hit the Kuwait Ministry of Finance

BORN Ontario data breach impacted 3.4 million newborns and pregnancy care patients

Xenomorph malware is back after months of hiatus and expands the list of targets

Smishing Triad Stretches Its Tentacles into the United Arab Emirates

Crooks stole $200 million worth of assets from Mixin Network

A phishing campaign targets Ukrainian military entities with drone manual lures

Alert! Patch your TeamCity instance to avoid server hack

Is Gelsemium APT behind a targeted attack in Southeast Asian Government?

Nigerian National pleads guilty to participating in a millionaire BEC scheme

New variant of BBTok Trojan targets users of +40 banks in LATAM

Deadglyph, a very sophisticated and unknown backdoor targets the Middle East

Alphv group claims the hack of Clarion, a global manufacturer of audio and video equipment for cars

Security Affairs newsletter Round 438 by Pierluigi Paganini – International edition

National Student Clearinghouse data breach impacted approximately 900 US schools

Government of Bermuda blames Russian threat actors for the cyber attack

Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware

CISA adds Trend Micro Apex One and Worry-Free Business Security flaw to its Known Exploited Vulnerabilities catalog

Information of Air Canada employees exposed in recent cyberattack

Sandman APT targets telcos with LuaDream backdoor

Apple rolled out emergency updates to address 3 new actively exploited zero-day flaws

Ukrainian hackers are behind the Free Download Manager supply chain attack

Space and defense tech maker Exail Technologies exposes database access

Pro-Russia hacker group NoName launched a DDoS attack on Canadian airports causing severe disruptions

Experts found critical flaws in Nagios XI network monitoring software

The dark web drug marketplace PIILOPUOTI was dismantled by Finnish Customs

International Criminal Court hit with a cyber attack

GitLab addressed critical vulnerability CVE-2023-5009

Trend Micro addresses actively exploited zero-day in Apex One and other security Products

ShroudedSnooper threat actors target telecom companies in the Middle East

Recent cyber attack is causing Clorox products shortage

Earth Lusca expands its arsenal with SprySOCKS Linux malware

Microsoft AI research division accidentally exposed 38TB of sensitive data

German intelligence warns cyberattacks could target liquefied natural gas (LNG) terminals

Deepfake and smishing. How hackers compromised the accounts of 27 Retool customers in the crypto industry

FBI hacker USDoD leaks highly sensitive TransUnion data

North Korea's Lazarus APT stole almost $240 million in crypto assets since June

Clop gang stolen data from major North Carolina hospitals

CardX released a data leak notification impacting their customers in Thailand

Security Affairs newsletter Round 437 by Pierluigi Paganini – International edition

TikTok fined €345M by Irish DPC for violating children’s privacy

Dariy Pankov, the NLBrute malware author, pleads guilty

Dangerous permissions detected in top Android health apps

Caesars Entertainment paid a ransom to avoid stolen data leaks

Free Download Manager backdoored to serve Linux malware for more than 3 years

Lockbit ransomware gang hit the Carthage Area Hospital and the Clayton-Hepburn Medical Center in New York

The iPhone of a Russian journalist was infected with the Pegasus spyware

Kubernetes flaws could lead to remote code execution on Windows endpoints

Threat actor leaks sensitive data belonging to Airbus

A new ransomware family called 3AM appears in the threat landscape

Redfly group infiltrated an Asian national grid as long as six months

Mozilla fixed a critical zero-day in Firefox and Thunderbird

Microsoft September 2023 Patch Tuesday fixed 2 actively exploited zero-day flaws

Save the Children confirms it was hit by cyber attack

Adobe fixed actively exploited zero-day in Acrobat and Reader

A new Repojacking attack exposed over 4,000 GitHub repositories to hack

MGM Resorts hit by a cyber attack

Anonymous Sudan launched a DDoS attack against Telegram

Iranian Charming Kitten APT targets various entities in Brazil, Israel, and the U.A.E. using a new backdoor

GOOGLE FIXED THE FOURTH CHROME ZERO-DAY OF 2023

CISA adds recently discovered Apple zero-days to Known Exploited Vulnerabilities Catalog

UK and US sanctioned 11 members of the Russia-based TrickBot gang

New HijackLoader malware is rapidly growing in popularity in the cybercrime community

Some of TOP universities wouldn’t pass cybersecurity exam: left websites vulnerable

Evil Telegram campaign: Trojanized Telegram apps found on Google Play

Rhysida Ransomware gang claims to have hacked three more US hospitals

Akamai prevented the largest DDoS attack on a US financial company

Security Affairs newsletter Round 436 by Pierluigi Paganini – International edition

US CISA added critical Apache RocketMQ flaw to its Known Exploited Vulnerabilities catalog

Ragnar Locker gang leaks data stolen from the Israel's Mayanei Hayeshua hospital

North Korea-linked threat actors target cybersecurity experts with a zero-day

Zero-day in Cisco ASA and FTD is actively exploited in ransomware attacks

Zero-days fixed by Apple were used to deliver NSO Group’s Pegasus spyware

Apple discloses 2 new actively exploited zero-day flaws in iPhones, Macs

A malvertising campaign is delivering a new version of the macOS Atomic Stealer

Two flaws in Apache SuperSet allow to remotely hack servers

Chinese cyberspies obtained Microsoft signing key from Windows crash dump due to a mistake

Google addressed an actively exploited zero-day in Android

A zero-day in Atlas VPN Linux Client leaks users' IP address

MITRE and CISA release Caldera for OT attack emulation

ASUS routers are affected by three critical remote code execution flaws

Hackers stole $41M worth of crypto assets from crypto gambling firm Stake

Freecycle data breach impacted 7 Million users

Meta disrupted two influence campaigns from China and Russia

A massive DDoS attack took down the site of the German financial agency BaFin

"Smishing Triad" Targeted USPS and US Citizens for Data Theft

University of Sydney suffered a security breach caused by a third-party service provider

Cybercrime will cost Germany $224 billion in 2023

PoC exploit code released for CVE-2023-34039 bug in VMware Aria Operations for Networks

Security Affairs newsletter Round 435 by Pierluigi Paganini – International edition

LockBit ransomware gang hit the Commission des services electriques de Montréal (CSEM)

UNRAVELING EternalBlue: inside the WannaCry’s enabler

Researchers released a free decryptor for the Key Group ransomware

Fashion retailer Forever 21 data breach impacted +500,000 individuals

Russia-linked hackers target Ukrainian military with Infamous Chisel Android malware

Akira Ransomware gang targets Cisco ASA without Multi-Factor Authentication

Paramount Global disclosed a data breach

National Safety Council data leak: Credentials of NASA, Tesla, DoJ, Verizon, and 2K others leaked by workplace safety organization

Abusing Windows Container Isolation Framework to avoid detection by security products

Critical RCE flaw impacts VMware Aria Operations Networks

UNC4841 threat actors hacked US government email servers exploiting Barracuda ESG flaw

Hackers infiltrated Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) for months

FIN8-linked actor targets Citrix NetScaler systems

Japan's JPCERT warns of new 'MalDoc in PDF' attack technique

Attackers can discover IP address by sending a link over the Skype mobile app

Cisco fixes 3 high-severity DoS flaws in NX-OS and FXOS software

Cloud and hosting provider Leaseweb took down critical systems after a cyber attack

Crypto investor data exposed by a SIM swapping attack against a Kroll employee

China-linked Flax Typhoon APT targets Taiwan

Researchers released PoC exploit for Ivanti Sentry flaw CVE-2023-38035

Resecurity identified a zero-day vulnerability in Schneider Electric Accutech Manager

A cyber attack hit Thyssenkrupp Automotive Body Solutions business unit

Steel giant ThyssenKrupp disclosed a security breach that impacted its Automotive division last week. The company shut down IT systems in response to the attack. The news of the attack was reported by the Saarbrücker Zeitung. The attack hit a factory in Saarland employing around 1,000 employees. 

ThyssenKrupp AG is a German industrial engineering and steel production multinational conglomerate. 

ThyssenKrupp AG has an annual revenue of over $41 billion (2022) and employs over 103,000 personnel.

Company spokeswoman Evelin Veit confirmed that the attack only impacted Thyssenkrupp Automotive Body Solutions business unit. She confirmed that the company discovered an unauthorized access to the IT infrastructure.

“The IT security of Automotive Body Solutions recognized the incident early on and has now contained the danger with the IT security of the Thyssenkrupp Group ,” Veit told the website Golem.de.

The spokeswoman added that the situation is currently “under control” and the German industrial group is working on a “gradual return to normal operations.”

The company did not disclose details of the attack, however the decision to shut down the IT systems suggests it was the victim of a ransomware attack.

This isn’t the first time that the company was the victim of a cyber attack. In 2012, the company was targeted by another cyber attack that was classified as “heavy” and of “exceptional quality.”

In 2016, alleged Asian threat actors targeted ThyssenKrupp to steal company secrets. The investigators speculated the attack was carried out by a group of professional hackers from Southeast Asia that were interested in the technological know-how and research activities of the company.

On December 28, 2020, ThyssenKrupp Materials group of companies based in U.S. and Canada were breached by the NetWalker ransomware group. The hackers managed to access sensitive HR information and documents about the company’s current and former employees.

The confidential information accessed by the attackers included the SSN and bank account information of employees.

In August 2020, ThyssenKrupp System Engineering was hit by the Mount Locker ransomware group. In

In January 2021, a ThyssenKrupp subsidiary was a victim of a ransomware cyberattack that caused the encryption of its servers and employee workstations.

In December 2022, ThyssenKrupp AG announced that the Materials Services division and corporate headquarters were hit by a cyberattack.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, cyberattack)

Hacking / February 27, 2024

Cyber Crime / February 21, 2024

Malware / February 21, 2024

Security / February 21, 2024

Hacking / February 21, 2024

To contact me write an email to: Pierluigi Paganini : [email protected]

Copyright@securityaffairs 2023