Schneier on Security

Clive Robinson • October 12, 2026 12:19 PM

@ ALL,

It’s interesting to note in the article it’s claimed the FBI is blaming a third party.

Further that,

“That contractor worked for Accenture, Reuters earlier reported.”

But then goes on to say,

“The bureau has “removed the contractor and taken all necessary steps to both mitigate any further risk and protect our work force”.

Note they say the contractor not Accenture had been removed…

But also “protect the work force” which any half aware person would know means squat-diddly…

Realistically what can the FBI do, give them a couple of years credit checking?

There are two issues to consider,

1, Any breach of personal or private data by an employers lack of performance, will almost always cause more harm than can be compensated for.

2, The way AI agentic attacks have ramped up means that nearly every employer who has their HR systems directly or indirectly connected to a public network is now in the “lack of performance” category[1].

To be blunt it does not matter if it was Current AI LLM Systems or it was going to be some other way… The speed of gaining unauthorised access to “Confidential Internal use only” systems has been increasing.

And no the solution was never going to be the equivalent of “fire insurance” or similar. Nor is it nabbing those allegedly doing it and putting them in prison.

Because the “risk reward” balance has never really been on the side of Guard Labour.

But another point to consider is that,

3, Data-Brokers almost certainly knew who these employees were before the records were exfiltrated.

Such is the fun of “private surveillance systems where the data is fairly freely available for a moderate price.

[1] Yes for years now I’ve been beating the drum of,

“The “Only way is mitigation by segregation.”

Can people now understand why?

Clive Robinson • October 13, 2026 11:11 AM

@ K.S., ALL,

The article notes under his photograph,

“cybersecurity executive who negotiates with ransomware hackers”

It’s not exactly a secret but many in the “security industry” that have acted as “file decryption experts” were actually acting as “middle men” between those encrypting an organisations files and the organisation.

It was a way of getting around “Don’t pay ransomware” legislation or to dodge around certain insurance companies rules. As such this type of middlemen usually does not work for people in their jurisdiction.

So in theory those acting as middle men are in effect guilty of one or more crimes in another jurisdiction.

The FBI have a long history of making arrests for cyber-crimes when people are in the US because,

1, They can not get an extradition.
2, The FBI can play a series of effectively unlawful games to force a plea deal.

I’m not saying this is the case, but lets be honest the FBI try it on where ever they can… And FBI Director Kash Patel is a political appointee of low repute when it comes to common sense (people are taking bets on who has more sense, him or his master).

So I’d keep an open mind untill more information becomes available.