Quick answer: This is the August 10, 2023 edition of Data Privacy Weekly. This week’s top story is the new “Inception” side channel attack, which can leak passwords and RSA encryption keys from every AMD Zen CPU at up to 39 bytes per second. Recommended action: enterprises running AMD Zen 3 or Zen 4 processors should apply AMD’s microcode updates now.
This week’s stories
- EvilProxy phishing as a service campaign compromises MFA protected Microsoft 365 accounts for 120,000 users.
- The Police Service of Northern Ireland accidentally exposes the identities of all 10,000 serving officers.
- UK Electoral Commission breach exposes eight years of voter registration data.
- Colorado Department of Education discloses a 16 year data breach affecting student Social Security numbers.
- The “Inception” side channel attack exposes password and RSA key data on all AMD Zen CPUs.
Published: August 2023. Updated: August 2026 (formatting and analysis refreshed; the news content below is an accurate historical record and has not been altered). Reviewed by Encryption Consulting’s Threat Intelligence team.
About this series: Data Privacy Weekly is Encryption Consulting’s recurring roundup of the data privacy and cybersecurity news that matters most to enterprise security teams, published on a rolling basis with each edition covering a specific week. This is the final edition in the current chronological chain of the series, following the previous edition (week of July 27, 2023). There is no later edition to link to yet; browse the rest of the series in the “More from Data Privacy Weekly” section below, or visit our blog for the newest coverage.
01. EvilProxy Phishing Targets 120K Microsoft 365 Users
The EvilProxy phishing campaign has targeted 120,000 Microsoft 365 users, focusing on MFA-protected accounts. Security firm Proofpoint discovered a surge in cloud account takeovers, impacting top executives. EvilProxy utilizes brand impersonation, bot evasion, and open redirections. This phishing-as-a-service platform steals authentication cookies from legitimate login forms, bypassing MFA.
Sold for $400/month, EvilProxy targets major accounts. A recent campaign by Proofpoint, using EvilProxy, impersonates brands like Adobe. The attack involves multiple redirections before a tailored EvilProxy phishing page. Notably, Turkish IPs are spared, possibly indicating a Turkish origin. VIP targets are prioritized, with breached accounts adding attacker-controlled MFA. Protection entails heightened security awareness, robust email filters, and FIDO-based keys.
Enterprise implication: EvilProxy shows that multi factor authentication (MFA) alone no longer stops account takeover, since stolen session cookies let attackers skip the login and MFA prompt entirely. Organizations relying only on push notification or SMS based MFA face the highest exposure.
Recommended action: Move privileged and executive accounts to phishing resistant centralized multi factor authentication, such as FIDO2 security keys, which cannot be bypassed by cookie theft.
02. Massive Data Breach Exposes Northern Ireland Police Officers’ Identities
A major data breach has exposed the names and ranks of all 10,000 serving police officers in Northern Ireland, causing serious concern for their safety. The Police Service of Northern Ireland (PSNI) accidentally shared this sensitive information in response to a Freedom of Information request. Given the ongoing threat to the police due to Northern Ireland-related terrorism, the breach is deemed disastrous. The breach occurred just months after a police officer was shot multiple times. The Federation representing officers demands urgent safeguards to prevent such breaches, emphasizing the high-security risks officers face in the region.
Enterprise implication: The breach was not caused by a hacker but by an internal Freedom of Information disclosure error, a reminder that data governance and release review processes are as critical to privacy as technical controls.
Recommended action: Apply mandatory data classification and dual sign off review to any dataset released externally, including responses to public records or Freedom of Information requests.
03. Massive UK Electoral Commission Data Breach Exposes 8 Years of Voter Data
A UK Electoral Commission breach revealed voter data from 2014 to 2022, detected a year later than the intrusion. Hackers accessed servers, including emails and electoral registers, prompting concerns over delayed reporting. Exposed details include names, addresses, emails, phone numbers, and images. Election processes remained unaffected, yet private data could be exploited for phishing and identity theft. Recipients are cautioned against suspicious emails, advising confirmation via phone instead of clicking links.
Enterprise implication: The intrusion went undetected for roughly a year, showing how attackers can persist inside a network long after initial access and quietly harvest personal data.
Recommended action: Deploy continuous log monitoring and anomaly detection on systems holding personal data, and set a target mean time to detect measured in days, not months.
04. Colorado Education Department Faces 16-Year Data Breach After Ransomware Attack
The Colorado Education Department has revealed a data breach spanning 16 years due to a ransomware attack in June. The attack exposed students’ personal data including names and social security numbers. The department is investigating the breach’s extent and plans to notify affected individuals via mail or email. Free credit monitoring and identity theft protection services are being offered. Ransomware attacks on educational institutions are on the rise, highlighting the need for improved cybersecurity efforts across schools, colleges, and universities.
Enterprise implication: A single ransomware attack exposed 16 years of retained student records, including Social Security numbers, illustrating how long data retention windows increase the impact of any breach.
Recommended action: Review data retention schedules for sensitive personal data such as Social Security numbers, and encrypt or tokenize archived records that no longer need to stay in plaintext.
05. New ‘Inception’ Attack Exposes Sensitive Data on All AMD Zen CPUs
A fresh security breach called ‘Inception’ targets all AMD Zen central processing units (CPUs), including the latest models, leaking sensitive data. Combining ‘Phantom speculation’ and ‘Training in Transient Execution’ techniques, researchers crafted this potent attack. It deceives CPUs into mishandling XOR instructions as recursive calls, allowing attackers to siphon off data from unprivileged processes. The leak rate is 39 bytes/sec, endangering passwords and RSA keys.
While Intel CPUs might also be affected by TTE variants, eIBRS mitigations hinder Phantom. Mitigation involves flushing the branch predictor state, but this hampers performance. AMD issued microcode updates for Zen 3 and Zen 4 CPUs to address this issue.
Enterprise implication: Because Inception can extract cryptographic material such as RSA keys directly from CPU memory, it threatens the key material that protects data at rest and in transit, not just application level secrets.
Recommended action: Apply AMD’s microcode updates for Zen 3 and Zen 4 CPUs immediately, and prioritize hardware backed key storage for RSA private keys on affected systems.
This Week’s Stories at a Glance
| Story | Category | Real World Impact |
|---|---|---|
| EvilProxy Phishing Campaign | Phishing / MFA Bypass | 120,000 Microsoft 365 accounts targeted; stolen cookies bypass MFA |
| PSNI Data Breach | Data Governance / Accidental Disclosure | Identities of 10,000 officers exposed; safety risk amid terrorism threat |
| UK Electoral Commission Breach | Data Breach / Persistent Access | 8 years of voter data exposed; intrusion undetected for about a year |
| Colorado Education Department Breach | Ransomware / Data Retention | 16 years of student records exposed, including Social Security numbers |
| Inception AMD CPU Attack | Hardware Side Channel / Cryptographic Key Exposure | Leaks data, including RSA keys, at up to 39 bytes per second on all Zen CPUs |
Limitations
- This edition summarizes third party reporting from bleepingcomputer.com, edition.cnn.com, techcrunch.com, and engadget.com as of August 2023; details may have been updated by the original outlets since publication.
- Enterprise implications and recommended actions reflect Encryption Consulting’s general guidance and are not a substitute for an organization’s own risk assessment.
- This is a historical news record; the underlying events are not being re-verified or re-reported as new incidents.
- Reference links are external and outside Encryption Consulting’s control; content on those pages may change or be removed over time.
Frequently Asked Questions
What made the EvilProxy phishing campaign able to bypass multi factor authentication?
EvilProxy is a phishing as a service platform, sold for about $400 per month, that impersonates trusted brands and routes victims through multiple redirects to a fake login page. Once a user enters credentials, EvilProxy captures the authentication session cookie in real time, letting attackers reuse that cookie to access the account without ever needing the MFA code itself.
How does the “Inception” attack threaten RSA encryption keys?
Inception combines two speculative execution techniques, Phantom speculation and Training in Transient Execution, to trick AMD Zen CPUs into leaking data from unprivileged processes at up to 39 bytes per second. Because private keys such as RSA keys are processed in CPU memory, a sustained attack can gradually reconstruct key material, which is why AMD released microcode updates for Zen 3 and Zen 4 processors.
Was the UK Electoral Commission breach caused by hackers or an internal error?
It was caused by external hackers who gained unauthorized access to Electoral Commission servers, not an internal disclosure error. Attackers accessed systems holding voter registration data from 2014 to 2022, including names, addresses, emails, phone numbers, and images. The intrusion was detected roughly a year after it began. Election processes and results were not affected by the breach.
How large was the Colorado Department of Education data breach?
The breach affected records going back 16 years and exposed students’ personal data, including names and Social Security numbers. It followed a ransomware attack in June 2023. The department offered free credit monitoring and identity theft protection to affected individuals while it continued investigating the full scope of exposed data.
More from Data Privacy Weekly
This edition is part of Encryption Consulting’s ongoing Data Privacy Weekly series and is the final edition in the current chronological chain. Browse the full series: week of June 18, 2023, week of July 1, 2023, week of July 12, 2023, and week of July 27, 2023, or visit the Encryption Consulting blog for the newest data privacy and cybersecurity coverage.
