Marc David

[Marc David @marc_david]

Niantic Spatial confirms the scans trained an "early version" of the model. Vantor denies it'll use the data ... but won't say if the deployed model already was.

A privacy-policy line ≠ consent to power weapons-adjacent AI. That's consent laundering. #Privacy #InfoSec

[Marc David @marc_david]

Pokémon Go players spent years scanning streets for in-game rewards.

Those ~30 billion scans now train a 3D model a U.S. defense contractor is feeding into drone navigation for GPS-denied combat zones.

A thread on consent 🧵👇

[Marc David @marc_david]

The kits doing this ... Tycoon 2FA, Storm-2372 device code phishing ... capture session cookies and refresh tokens directly.

A password reset doesn't kill them. You have to revoke the session AND audit for newly-registered devices on the account.

[Marc David @marc_david]

Phishing in 2026 isn't about your password.

It's about the session cookie that gets issued AFTER you log in.

86% of Fortune 100 firms had employee data exposed last year ... and most playbooks still stop at "reset the password."

Full breakdown ↓

#CyberSecurity #InfoSec

[Marc David @marc_david]

Today:

1. Inventory third-party SaaS with PHI access
2. Phishing-resistant MFA on patient data systems
3. Help-desk caller verification

Full breakdown: https://t.co/NhcIhYJCic

#InfoSec

[Marc David @marc_david]

BREAKING: iRhythm Holdings disclosed a healthcare data breach via SEC 8-K this week.

Attackers used social engineering against third-party business apps, exfiltrated patient PHI, and demanded a ransom on June 9.

Thread:

[Marc David @marc_david]

The initial access vector? Social engineering. Again.

Not zero-days. Not unpatched VPNs. People tricked into approving access to third-party SaaS apps holding patient data.

This is the dominant healthcare-breach pattern of 2026.

[Marc David @marc_david]

Aligned with NIST NICE, CSF, RMF, AI RMF, OWASP, and DoD 8140.

No paywall. No sign-up.

https://t.co/zz1V6Hw4Ty

Like & repost so more people see this.

#ByteSizedSecurity #CyberCareers

[Marc David @marc_david]

Found one of the best free cybersecurity career resources out there.

Okurrrr by Moe B. includes:
• 627 certifications
• 759 free resources
• Career Pathfinder
• DEF CON Media archive
• 10,000+ NIST terms

#CyberSecurity #InfoSec

[Ran Geva @rangeva]

This is excellent proactive advice! Beyond freezing credit, consider enabling MFA on all accounts, rotating critical passwords, and monitoring financial statements. Identity theft can be a long game, so staying vigilant is key. https://t.co/NOHP4uFNNz #DataBreach #IdentityTheft

[Marc David @marc_david]

What to do right now:

1. Request your free LexisNexis report
2. Review it for anything unfamiliar
3. Freeze credit at Equifax, Experian, TransUnion

Free. 15 minutes. Don't wait for breach number three.

#ByteSizedSecurity #CyberSecurity #DataBreach

[Marc David @marc_david]

BREAKING: LexisNexis confirmed hackers breached their AWS servers and stole 2GB of data.

3.9M database records. 21K+ customer accounts. 400K cloud user profiles. 45 employee password hashes.

This company holds consumer files on nearly every adult in the US.

[Marc David @marc_david]

Textbook least privilege violation.

A single ECS task role should never access every secret in production. One compromised container gave attackers keys to the entire environment.

Patch your apps. Scope your IAM roles. Rotate your secrets.

[Marc David @marc_david]

Have kids? Freeze their credit too.

Thieves target children because no one checks for years. They won't find out until they're 18 and applying for their first loan.

15 minutes of your time prevents years of damage.

[Marc David @marc_david]

Someone is using your identity right now and you'd never know.

LexisNexis keeps a consumer file on you with property records, liens, judgments, licenses, and address history.

Request your free report: https://t.co/9eTZ7wAmbm

#ByteSizedSecurity

[Marc David @marc_david]

Review your report. Look for addresses or records you don't recognize.

Then freeze your credit at all 3 bureaus:
- Equifax
- Experian
- TransUnion

It's free, takes minutes, and blocks most new account fraud.

#CyberSecurity #IdentityTheft

[Marc David @marc_david]

7/ What you should do: request your data and its deletion at [email protected]. Object to AI training at [email protected].

Source: https://t.co/2yVAgABnRq

#ByteSizedSecurity #Privacy

[Marc David @marc_david]

You scanned your passport for a LinkedIn checkmark.

Here's where your data went:

A US company called Persona collected your face, passport, and biometrics. Shared it with 17 companies, including OpenAI and Anthropic.

Liability if it leaks? $50.

#ByteSizedSecurity #InfoSec

[Marc David @marc_david]

6/ If your biometric data leaks? Persona's terms cap liability at $50. No court, no jury, no class action. Mandatory arbitration only.