Is this email difficult to read? View it in a web browser. ›

The Wall Street Journal ProThe Wall Street Journal Pro

CybersecurityCybersecurity

Sponsored by Zscaler logo.

IMF Warns That Evolving AI Threat Could Upend Financial Markets

By Kim S. Nash

 

Welcome back. The International Monetary Fund said extreme losses caused by a cyber incident could trigger funding strains, raise solvency concerns and disrupt broader markets.

Anthropic's Mythos and other powerful AI models give attackers the advantage over defenders because it is faster to find weak spots than it is to fix them, the IMF said. Read more from WSJ and here is the IMF's analysis.

More news:

  • General Motors fined $12.75 million over sale of driver data
  • Education platform Canvas restored after cyberattack
  • Identity-security firm SailPoint discloses hack
  • Water facilities under attack in Poland, Mexico
  • Cyber stocks booked big gains
  • And more
 

‏‏‎ ‎

CONTENT FROM: ZSCALER
Reduce Cyber Risk as AI Exposes Vulnerabilities

The recent “Claude Mythos” model is a reminder of what happens when frontier models can discover and exploit vulnerabilities at machine speed. Threat actors aren’t just using AI for better phishing anymore; they’re industrializing the entire attack lifecycle. In this special webinar, Zscaler CEO Jay Chaudhry and security executives share practical advice to reduce exposure and stay ahead.

Watch Webinar Now

 

Privacy & Surveillance

PHOTO: DESIREE RIOS FOR WSJ

The Trump administration has made border security and immigration enforcement its top priority, and vendors have been eager to secure funding and contracts before political winds shift. The rapid acceleration of AI in border-security tech is bringing new competitors into the industry and offering a new vision for border surveillance. (WSJ)

General Motors must pay a fine of $12.75 million to settle a 2023 California data-privacy case over its collection of driver information. The car maker sold data about drivers after saying it wouldn't, California Attorney General Rob Bonta said, including personal, behavioral and location information sold to two data brokers from 2020 to 2024. GM made about $20 million from the sales, according to Bonta.

  • GM must also delete driver data within 180 days of Friday's settlement and ask data brokers Lexis and Verisk to do so as well. 
 

More Cyber News

PHOTO: REBA SALDANHA/REUTERS

Restored: Canvas, one of the most widely used education apps, said it had restored services after pulling the plug in the middle of finals week at many colleges to deal with a cybersecurity incident. Instructure, which runs Canvas, said hackers accessed some customer data, including names, email addresses and student ID numbers, and messages between Canvas users. (WSJ)

  • The ShinyHunters hacking group claimed its attack affected 9,000 schools. (EdScoop)

Identity-security company SailPoint said it discovered on April 20 that one of its GitHub repositories was hacked through a vulnerability in an application from an unnamed third party. SailPoint has notified customers whose information was exposed, the company said Friday in a disclosure to the Securities and Exchange Commission.

Akamai saw big gains on Friday, ending the week up 40% after announcing a $1.8 billion computing deal with Anthropic. Fortinet also saw outsized gains for the week, surging 30% for the period after reporting fundamentals that outperformed analysts' expectations.

These jumps helped push WSJ Pro's CyberIndex up nearly 10.5%.

  • On the other end, Leidos suffered steady losses throughout the week. The defense-focused cyber firm declined 13% despite a strong demand outlook. Cloudflare also saw double-digit losses, falling 10% for the week.                                                                                               — Jon Leckie

Water hacks: Five water treatment facilities in Poland were hacked last year, the country's Internal Security Agency said in a new report. Hackers linked to Russia and Belarus exploited weak passwords and industrial systems open to the internet, the agency said. (SecurityWeek)

  • Hackers early this year used Anthropic's Claude AI tool for reconnaissance in an attempted cyberattack on a water facility in Mexico, according to industrial security company Dragos. (Cybersecurity Dive)

Complying with every cyber rule might be impossible: Facing an alphabet soup of increasingly complex cybersecurity and data privacy regulations, some companies are veering away from efforts to satisfy every requirement to the letter, and instead falling back on industry standards. “No company out there is complying with the law 100%,” said Nish Imthiyaz, global privacy and responsible AI counsel at telecom company Vodafone. Read more from Dow Jones Risk Journal. (gift link)

 

Enforcement

  • The former head of the hacking and surveillance tech unit of U.S. defense contractor L3Harris must pay $10 million to the company in restitution for stealing hacking tools and leaking them, likely to the Russian government. Australian national Peter Williams was sentenced to seven years in prison after pleading guilty in March in federal court in Washington, D.C. (TechCrunch)
 

About Us

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.

 
Share this email with a friend.
Forward ›
Forwarded this email by a friend?
Sign Up Here ›
 
Desktop, tablet and mobile. Desktop, tablet and mobile.
Access WSJ‌.com and our mobile apps. Subscribe
Apple app store icon. Google app store icon.
Unsubscribe   |    Newsletters & Alerts   |    Contact Us   |    Privacy Notice   |    Cookie Notice
Dow Jones & Company, Inc. 4300 U.S. Ro‌ute 1 No‌rth Monm‌outh Junc‌tion, N‌J 088‌52
You are currently subscribed as [email address suppressed]. For further assistance, please contact Customer Service at pro‌newsletter@dowjones.com or 1-87‌7-975-6246.
Copyright 2026 Dow Jones & Company, Inc.   |   All Rights Reserved.
Unsubscribe