Cyberattack on a Car Breathalyzer Firm Leaves Drivers Stuck

United States law enforcement this week took down the Aisuru, Kimwolf, JackSkid, and Mossad botnets, a slate of cybercriminal tools that have infected more than 3 million devices around the world, including many inside home networks, and have been used to carry out record-breaking cyberattacks. Meanwhile, hundreds of millions of iPhones are currently vulnerable to takeover by a new tool called DarkSword that Russian hackers used to steal victims’ data.

Customer service calls and chats with the Sears Home Services AI bot Samantha were exposed and publicly accessible until a researcher reported the situation—revealing personal details from calls and chats, including, in some cases, hours of extra audio seemingly recorded after customers thought a call had ended. And WIRED reviewed dozens of Telegram channels containing job listings for “AI face models.” The people who land the jobs are mostly women and are likely being used as the face of AI scams to steal victims’ money.

Meta recently announced that it will eliminate end-to-end encryption protections for Instagram Direct Messages on May 8, citing low adoption of the feature. The company had long promised the protection as a default for Instagram chat, and experts fear that the bait and switch could set a dangerous precedent in the tech industry. In other Meta encryption news, though, Signal creator Moxie Marlinspike announced this week that he will collaborate with the tech giant to integrate his encrypted AI platform Confer into Meta AI in some form.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Imagine trying to explain this one to your boss: You can’t get to work because your court-mandated breathalyzer won’t let you start the vehicle—not because you’ve been drinking, you swear, but because that alcohol-vapor-detecting device has been disabled by a cyberattack on the company that makes it.

Intoxalock, an automotive breathalyzer maker that says it’s used daily by 150,000 drivers across the US, this week reported that it had been the target of a cyberattack, resulting in its “systems currently experiencing downtime,” according to an announcement posted to its website. Meanwhile, drivers that use the breathalyzers have reported being stranded due to the devices’ inability to connect to the company’s services. “Our vehicles are giant paperweights right now through no fault of ours,” one wrote on Reddit. “I’m being held accountable at work and feel completely helpless.”

The lockouts appear to be the result of Intoxalock’s breathalyzers needing periodic calibrations that require a connection to the company’s servers. Drivers who are due for a calibration and can’t perform one due to the company’s downtime have been stuck, though the company now states on its website that it’s offering 10-day extensions on those calibrations due to its cybersecurity disruption, as well as towing services in some cases. In the meantime, Intoxalock hasn’t explained what sort of cyberattack it’s facing or whether hackers have obtained any of the company’s user data.

Back in March 2023, FBI director Christopher Wray confirmed, for the first time, that the agency had purchased US phone location data. While the FBI had previously paid for phone data from commercial data brokers—instead of seeking a warrant—it had stopped doing so, Wray said. “That’s not been active for some time,” Wray claimed. Fast-forward three years, and the FBI is once again purchasing location data that can be used to track Americans.

At a Senate hearing on Wednesday, FBI director Kash Patel confirmed that the agency is buying “commercially available information” that he claimed was “consistent with the Constitution” and other laws. “It has led to some valuable intelligence for us,” Patel said. The practice involves the FBI buying information from commercial data brokers, which sell huge volumes of data, including phone location information, that is collected by advertising technology baked into apps.

In 2018, the US Supreme Court strengthened Fourth Amendment protections by ruling the government would need to obtain a warrant to track Americans’ phones. However, since then, government agencies have increasingly used commercial data brokers to source information that can be used to monitor people’s movements. “Doing that without a warrant is an outrageous end run around the Fourth Amendment. It’s particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information,” US senator Ron Wyden said at the hearing on Wednesday. Last week, Wyden and Senator Mike Lee introduced a bipartisan bill to Congress that would stop government agencies turning to commercial data brokers.

Hospitals and emergency medical services in Maryland were impacted by the Iranian-linked hack on medical technology firm Stryker, court documents published in the District of Maryland said this week. An FBI affidavit, used to seize four domains used by the Handala hacking group, says that the group’s early March cyberattack against Stryker saw “some hospitals” suspend connections to unnamed medical systems. “Clinicians were instructed to rely on radio consultation and verbal description,” say redacted documents, which do not name specific systems or hospitals impacted. “This disruption to required clinical communication systems demonstrates that the cyberattack … in some cases interfered with the delivery of emergency medical care in Maryland hospitals."

Since the US-Israel war on Iran started at the end of February, the Handala hacking group’s attack on Stryker has been the most high-profile retaliatory cyberattack spotted by researchers, reportedly disabling thousands of devices. In response, the FBI and Justice Department announced on Thursday that it has seized four domains used by the group and detailed how the group had been emailing “death threats to Iranian dissidents and journalists” in the US.

Agentic AI tools have the potential to transform companies’ efficiency—or make costly and dangerous errors. Tech news outlet The Information this week reported that one AI agent used by a Meta employee caused a security incident that exposed company and user data to staff who weren’t meant to have access to it. An employee had assigned the agent to analyze a technical question posted to an internal forum by another staffer. But the agent also posted an answer to that question—with its user’s approval—that included erroneous information. The employee who had posted the question then reportedly followed that incorrect advice, leading to a breach of the company’s data protection protocols, exposing “large amounts” of the company’s data to unauthorized users. The incident was reportedly serious enough to warrant a “Sev1” alert, the second-highest category of severity that Meta uses to label security incidents.