Password Manager Research, Figure Breach and Exposed SSN Database

Summary

Security Now discusses password manager research, Figure Technology’s social-engineering breach, an exposed database of Social Security number records, and changes to certificate validation.

Key points

• ETH Zurich examined three password managers under a scenario involving compromised provider infrastructure. The hosts say the identified issues have been fixed.
• Figure Technology confirmed that an employee was tricked in a social-engineering attack. Shiny Hunters claimed responsibility and said it published stolen data after a ransom was refused.
• The hosts report that Have I Been Pwned examined exposed Figure data associated with 967,200 people, including names, contact details and dates of birth.
• UpGuard found an exposed database containing 2.7 billion records with Social Security numbers. Researchers verified some entries, but reported substantial duplication and incorrect data; public access was removed.
• A certificate-authority notice warned that shorter domain-validation reuse periods could delay certificate issuance unless affected domains were revalidated.
• The hosts say Firefox security updates for Windows 7 and 8 will end in February 2026.

Industries