https://getsoc2.ca/brief A free weekly email for Canadian companies buying a SOC 2 audit: the week's vendor, breach and audit stories, with a plain take on each. en-CA https://getsoc2.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms https://getsoc2.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms Tue, 29 Sep 2026 13:00:00 +0000 Your AI agents are logging in as humans and SOC 2 cannot tell. A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. https://getsoc2.ca/brief/7-fake-government-requests-real-ai-attacks https://getsoc2.ca/brief/7-fake-government-requests-real-ai-attacks Tue, 22 Sep 2026 13:00:00 +0000 Revolut handed over customer data to someone pretending to be a government. Revolut confirmed that an unauthorized party obtained customer information by submitting a fraudulent data request from a legitimate government email domain. https://getsoc2.ca/brief/6-revolut-handed-data-to-a-fake-government-request https://getsoc2.ca/brief/6-revolut-handed-data-to-a-fake-government-request Tue, 15 Sep 2026 13:00:00 +0000 Trezor's supplier breach keeps growing, and it was never Trezor's system. Trezor says a breach at its supplier ShipMonk is considerably worse than first reported, now affecting around 81,000 customers. Revolut gave customer data to someone posing as a government agency. Revolut disclosed a breach after sharing customer data with a threat actor impersonating a government agency. https://getsoc2.ca/brief/5-court-records-drivers-licences-and-an-ftc-bill https://getsoc2.ca/brief/5-court-records-drivers-licences-and-an-ftc-bill Tue, 08 Sep 2026 13:00:00 +0000 McKesson tells the SEC it was hit through third-party applications. McKesson disclosed a cybersecurity incident in which attackers got into third-party applications and stole data, with the intrusion detected on August 25, 2026. An ID verification vendor appears to be the source of 153 million licence scans. A new dark web identity theft service is selling digital scans of more than 153 million driver's licences belonging to people in the United States and Canada. https://getsoc2.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 https://getsoc2.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 Tue, 01 Sep 2026 13:00:00 +0000 McKesson breach came through third-party applications. McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft. JFrog Artifactory flaw lands in the KEV catalogue. CISA added three actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalogue: an ownCloud authentication flaw, an unspecified Linux kernel issue, and a path traversal issue in JFrog Artifactory. https://getsoc2.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold https://getsoc2.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold Tue, 25 Aug 2026 13:00:00 +0000 Defence contractors do not believe their own CMMC scores. US defence contractors are reporting doubts about the accuracy of their own self-assessment scores under CMMC Phase I. SickKids gets hit through somebody else's software. Toronto's Hospital for Sick Children disclosed a security incident that exposed personal information belonging to some current and former employees and job applicants. https://getsoc2.ca/brief/2-secrets-in-build-artifacts-and-who-gets-blamed https://getsoc2.ca/brief/2-secrets-in-build-artifacts-and-who-gets-blamed Tue, 18 Aug 2026 13:00:00 +0000 A year-long campaign is quietly draining Salesforce and ServiceNow tenants. Dark Reading reports on a campaign tracked as City-Forum, active since at least March 2025, that has been stealing data from Salesforce and ServiceNow tenants using custom tooling. https://getsoc2.ca/brief/1-a-250-000-penalty-and-a-vendor-that-went-dark https://getsoc2.ca/brief/1-a-250-000-penalty-and-a-vendor-that-went-dark Tue, 11 Aug 2026 13:00:00 +0000 LexisNexis pulled products offline over a third-party vendor incident. LexisNexis took several services offline, including Diligence and the Metabase API, in response to unusual activity on servers hosted and managed by a third-party vendor it has not named.