Security Newsletter | 11/14/25

• 🗒️✅ Your Security Checklist
• 🏆🎖️ Test Your Security Skills
• 📰 Your Weekly Security Update
• 🤨 This Should Be on Your Radar 📡
• 🙈 Security Fail of the Week 👎
• 🍎📱 Security Updates from Apple 🍎

What should you do in the following scenario?

You receive an official-looking letter which states that your Social Security number has been suspended due to criminal activity. What should you do? 🤔

1. Call the number in the letter.
2. Trash the letter.
3. Visit the Social Security Administration’s website and log in to check on the validity of your account.

Scroll to the bottom to see how you did!

DoorDash Hit by Data Breach

DoorDash has been notifying users of an October data breach that included first and last names, physical addresses, email addresses, and phone numbers. The affected users are a mix of customers, Dashers, and merchants. In its response to the incident, DoorDash says that the breach originated from an employee who fell for a social engineering scam. Bleeping Computer has more details on the story.

The Bottom Line: DoorDash has already referred this incident to law enforcement. If you are affected by the breach, you should receive an email from DoorDash. With data breaches becoming more common, we strongly suggest freezing your credit, if possible. This makes it more difficult for your identity to be stolen, even if your personal information is leaked. You can unfreeze it at any time, either permanently or temporarily, if you need to open a new line of credit.

Age Verification by Facial Scanning

Live streaming platform Twitch has introduced facial scanning to verify user ages in the UK. Both new users and existing users logging in for the first time since the policy change will need to submit to a facial scan. Additionally, anyone who attempts to access a stream with specific adult content warnings will need to verify their age via facial scanning before they are allowed to watch. Rolling Out has a more detailed write-up about the changes, as well as how Twitch is being impacted by other age-related laws in the UK.

The Bottom Line: Age verification is a good idea in theory, but in practice, it often comes at the cost of privacy and security. To verify your age, you must trust third-party companies with your ID (or, in Twitch’s case, a scan of your face), which is then at risk of exposure in a data breach, as we saw recently at Discord. If you are in the UK, age verification is now required by law, which is why it’s so important to voice your concerns to lawmakers who may be swayed by public opinion.

Company Refuses to Bow to Hackers’ Demands

Checkout.com, a payment processing platform used by companies around the world, was recently targeted by the hacking group ShinyHunters. The group contacted Checkout.com and demanded a ransom in exchange for data that it had stolen. Checkout.com investigated and found that the data came from an old third-party cloud storage system that had not been properly decommissioned. Upon determining that ShinyHunters did not have access to merchant funds or card numbers, Checkout.com decided that it would not give in to the group’s ransom demands. Instead, the company is donating the ransom amount to fund cybercrime research. You can read Checkout.com’s statement here.

The Bottom Line: No practical advice here; just a really cool story about a company standing up to criminals and helping to advance cybersecurity research at the same time.

Did You Win the Lottery? (You Didn’t Win the Lottery)

This prolific scam is probably as old as time, but it’s still alive and flourishing. The scam itself is simple: You are contacted by someone who claims that you’ve won a prize in a lottery. To claim your prize, you’re told, you must pay a small fee. Of course, once you pay the fee, no prize will ever materialize. It seems like this scam wouldn’t work, but it does work. Scammers use time pressure language: “Act now!” and “Claim your prize before it’s gone” to encourage victims to make a bad decision quickly. If a scammer sends enough of these messages, they’re sure to catch someone who’s on their way home from the bar at 1 am, or someone who just took their meds before bed, or someone who is jetlagged, and before that person has had a chance to think better of it, they’ve pulled the trigger and sent the scammer some money.

The Bottom Line: No legitimate lottery will pay out rewards to someone who has not entered the lottery. No legitimate lottery will ask the winner to pay a fee of any kind before claiming a prize. No legitimate lottery or prize will ever pressure the winner to claim their prize immediately. Especially, no lottery will contact the winner over social media messenger or by email.

Children’s AI Teddy Bear Casually Explains Where to Find Knives and Matches

The US Public Interest Research Group recently released its yearly report on the safety of toys. This year, it highlighted a new set of toys coming to market: ones that include GenAI-driven speech functionality. The catch? Several of the toys they tested didn’t have adequate safeguards about what the toy could or could not say to a child. One teddy bear used its newfound powers of speech to explain how to light a match, where to find knives, and all about sexual roleplay, among other disturbing matters. That one was pulled from the market. Your digital security is one thing, but the digital domain is expanding into new territory here, with digital voices now appearing in new places, like a kid’s toy box.

This is not the only place where AI agency might be enabling new kinds of dangers: Microsoft is rolling out a so-called ‘agentic’ GenAI in Windows. Agentic means the GenAI would be capable not just of advising the user, but of actually taking actions itself. You could instruct it to make a budget for your house, and instead of just generating some text, it could go download a budgeting app, install it, and then use the app to make the budget. It could even install malware, warns Microsoft. Which would be bad. To use the teddy bear as an analogy, imagine if the AI-driven teddy bear, in addition to speaking with an AI voice, could also walk itself over to the knife drawer.

The Bottom Line: Generative AI systems are a brand-new technology. Practice caution in where and how you deploy that technology in your life. We haven’t developed legal, ethical, and technical frameworks to mitigate the harms of this new technology yet.

In case you missed it, be sure to check out our free class on cybersecurity for Apple enthusiasts.

Worried about viruses infecting your iPhone? Check out:

• Answered: Can iPhones Get Viruses?
• Get Rid of Fake Virus Alerts on iPhone