This Week in Cybersecurity | April 4, 2025

Welcome to This Week in Cybersecurity, our new weekly series where we break down the latest threats, trends, and takeaways you need to know to keep your business safe.

Top Threats This Week

1. Major Alleged Data Breach Hits Elon Musk’s X (Formerly Twitter)

This week, cybersecurity researchers uncovered what may be one of the largest social media data breaches to date involving Elon Musk’s X (formerly Twitter). A hacker posted a 34 GB file containing data on over 201 million X users, including email addresses and detailed account metadata like creation dates, display names, and locations. While no passwords were leaked, the combination of previously exposed emails and current metadata could make users vulnerable to phishing and social engineering attacks. X has yet to acknowledge the breach, raising further concern.

Takeaway: If you have an X account, be cautious of suspicious emails, enable multi-factor authentication, and consider updating your email privacy settings.

(MSN.com)

2. Microsoft Removes Windows 11 Bypass

Microsoft has removed the 'BypassNRO.cmd' script from the latest Windows 11 Insider Dev preview build, a tool previously used to bypass the mandatory Microsoft Account and internet connection during setup. The move is part of Microsoft's ongoing push to ensure all users connect to its cloud services for a more integrated experience, including syncing settings and storing recovery keys. While users can still manually tweak the Registry to bypass this requirement, that workaround may also be eliminated in future updates.

Takeaway: If you prefer using a local account and avoiding cloud integration, be aware that Microsoft is steadily limiting those options—now is the time to consider your setup strategy before these workarounds are fully blocked.

(bleepingcomputer)

3. Baltimore alerted of $1.5 fraud incident by fradulent vendor.

Baltimore City is investigating a $1.5 million fraud incident after payments intended for a legitimate city vendor were redirected to a fraudulent bank account. The scammer, posing as the vendor, spent months communicating with city officials and successfully submitted convincing documentation to change the vendor's payment details. While one of the two payments was reversed, over $800,000 remains unrecovered. The FBI and the city’s inspector general are now involved, and officials are reviewing and strengthening internal controls.

Takeaway: Even when verification protocols are followed, sophisticated fraudsters can slip through—organizations should continuously evolve their security practices and ensure vendors do the same.

(CBS.com)

Cyber Tip of the Week

"Think Before You Click" is More Than a Slogan

Phishing is still the #1 way cybercriminals breach networks. Train employees to pause and inspect emails. Hover over links. Double-check senders. And when in doubt—don’t click.

Stat of the Week

48% of SMBs experienced a cybersecurity incident in the past year. Yet only 27% have a formal incident response plan in place.

Is your plan ready? If not, now’s the time to prepare—not after an attack.

Final Thoughts

Cyber threats evolve fast. But with layered defenses, informed users, and a trusted IT partner, you can stay ahead of the bad guys.

Have questions about your cybersecurity posture? Let’s talk.