Cyberattacks are Everywhere 

If I have cyberattacks on the brain this morning, it's because I was hacked yesterday, falling victim to a phishing campaign. I received a suspicious looking email which mentioned an RFP that I opened, but did not click on anything, yet, my email account proceeded to launch a mass email to my contacts promoting an RFP as well. So, if you received an email from me titled "You are Invited!", please delete it. This edition focuses on three other cyberattack stories: a chicken restaurant victimized by stuffing attacks(!), the surprising real cause of the Hugging Face and hackers getting the keys to SharePoint. And consider registering for tomorrow's webcast below!

Stuffed Chicken

Couldn't resist. ;-) Fast food restaurant chain Chick-fil-A is notifying an undisclosed number of customers of a data breach after their accounts were hacked in a wave of recent credential stuffing attacks. The company revealed in data breach notification letters sent to affected individuals and filed with multiple Attorney General offices that it detected the attacks after identifying suspicious login activity to certain Chick-fil-A One accounts. They previously had a similar wave of credential stuffing attacks between December 2022 and February 2023. Sometimes, the sky really is falling (think about it!). Sergiu Gatlan discusses it in Bleeping Computer here: Chick-fil-A discloses data breach after credential stuffing attacks

Face the Music

Ah, the plot thickens on the Hugging Face cyberattack that I reported on yesterday. Turns out the culprit was (drum roll, please!) OpenAI! OpenAI says its AI models, including GPT?5.6 Sol and a pre-release model, hacked into the Hugging Face artificial intelligence repository while being tested in a sandboxed testing environment. Apparently, instead of focusing on finding a solution for the ExploitGym public AI cybersecurity benchmark on their own, the AI models tried to cheat by stealing the test solutions by hacking Hugging Face after inferring that they could get the test solutions directly from its production database. We may have to put OpenAI on "double-secret probation" after this. ;-) Sergiu Gatlan discusses it here in Bleeping Computer: OpenAI says its AI models hacked Hugging Face during testing 

Giving Hackers the Keys

Rob Robinson reported on this issue last week, and it's apparently still happening via another vulnerability. Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched. An attacker obtaining them can create valid authentication tokens to impersonate users and access available resources such as SharePoint sites and documents with the privileges of the forged identity. Sigh. Bill Toulas discusses it in Bleeping Computer here: Critical SharePoint RCE flaw exploited to steal machine keys

Webcast Tomorrow: Rethinking the Outside Counsel RFP: What Drives Better Decisions

Many legal departments still rely on familiar firms and established relationships when selecting outside counsel, but that approach doesn’t always provide the structure needed to compare firms effectively. While RFPs can support more informed, value-driven decisions, many legal teams struggle to build a process that delivers meaningful results.

Jason Winmill, Managing Partner at Argopoint and Chair of The Buying Legal® Council, joins Onit’s Jeffrey Solomon to discuss practical strategies for using RFPs to improve outside counsel selection. The session explores how legal teams can gather more comparable information, evaluate firms on value and fit rather than cost alone and build a more consistent process that delivers lasting results.

Presented by Onit

Thursday, July 23 I 1 - 2 PM ET (1 hr)

Register here.

Images created by Bing. Get well ASAP, Jeff!

-Doug Austin

---

Jeffrey Brandt, Editor

Connect with me on LinkedIn Jeffrey Brandt
Follow all the PinHawk highlights @PinHawkHappens
Website:PinHawk.com | Blog: PinHawkBlog.com