Week of December 29, 2025: Coupang's $1.2 Billion Payout and a New MongoDB KEV Entry

Security leaders heading into the new year watched Coupang detail a $1.2 billion customer voucher program tied to a cybersecurity incident disclosed to the SEC, while CISA added a MongoDB flaw to its Known Exploited Vulnerabilities Catalog and issued two new ICS advisories. Covenant Health raised its breach count to 478,000 individuals, San Francisco opened a public health CISO recruitment with a salary change effective January 3, and new research flagged hybrid infrastructure and machine identity sprawl as rising priorities.

CISA Adds MongoDB Vulnerability to Known Exploited Vulnerabilities Catalog

CISA added CVE-2025-14847, an improper handling of length parameter inconsistency vulnerability affecting MongoDB and MongoDB Server, to its Known Exploited Vulnerabilities Catalog on December 29, 2025. The agency said the addition reflected evidence of active exploitation. Binding Operational Directive 22-01 requires federal civilian executive branch agencies to remediate catalog entries by set deadlines, and CISA urged all organizations, not only federal agencies, to prioritize remediation of catalog vulnerabilities as part of routine vulnerability management practice heading into the new year. (CISA)

CISA Issues Two Industrial Control Systems Advisories

CISA released two Industrial Control Systems advisories on December 30, 2025, covering WHILL C2 wheelchairs and an updated advisory for AzeoTech DAQFactory. The advisories were intended to give asset owners and operators technical detail on current vulnerabilities affecting the named products. CISA encouraged users and administrators to review the advisories for mitigations as part of ongoing ICS vulnerability management, continuing a steady cadence of ICS advisory releases that followed earlier batches issued in the preceding weeks of December. (CISA)

Covenant Health Raises Ransomware Breach Count to 478,000

Covenant Health told the Maine Attorney General's Office on December 31, 2025 that a data breach discovered in May had affected 478,188 individuals, far above the 7,800 figure it first reported in July. The Massachusetts-based healthcare provider said hackers obtained names, dates of birth, addresses, Social Security numbers, medical record numbers, health insurance information, and treatment details. The Qilin ransomware group claimed credit for the intrusion and later published stolen files, indicating that a ransom had not been paid. (SecurityWeek)

San Francisco Opens Public Health CISO Recruitment

San Francisco's Department of Public Health published a Manager V recruitment for a Chief Information Security Officer on December 30, 2025, with filing set to close on or after January 9, 2026. The posted salary range took effect January 3, 2026 at $183,144 to $233,766 annually. The role reports to the department's Chief Information Officer and requires five years of healthcare information security experience, including oversight of risk management, incident response, and compliance with HIPAA, NIST, and PCI-DSS requirements. (City and County of San Francisco)

Trellix Survey Finds Hybrid Infrastructure Now the CISO Default

A global Trellix study published December 29, 2025 found that hybrid infrastructure combining cloud, on-premises, and isolated systems had become the standard setup for continuity and risk management among surveyed organizations. CISOs cited business continuity, cybersecurity, and supply chain stability as top drivers, while also reporting strain from limited visibility, identity management gaps, and slow cross-platform investigations. Respondents said cybersecurity ranked as their top investment area for the coming year, ahead of cloud expansion and operational technology convergence. (Help Net Security)

Veza Report Finds Machine Identities Outnumber Humans 17 to 1

A Veza report published December 30, 2025 measured more than 230 billion permissions across its dataset and found that service accounts, API keys, tokens, and other automation credentials outnumbered human users by a ratio of 17 to 1. The study also counted roughly 3.8 million dormant accounts and 824,000 orphaned identities with no owner in HR systems. Just 2,188 machine identities controlled 80% of cloud resources, a concentration the report said left security teams struggling to enforce least privilege. (Help Net Security)