In a concerning revelation for users of older Nest Learning Thermostats, even after Google discontinued remote control functions and support for first and second generation devices, these thermostats continue to upload detailed sensor data to Google. This information, which encompasses a range of metrics from temperature changes to motion activity, raises significant privacy concerns as users believed their devices had been fully disconnected. Researcher Cody Kociemba uncovered this ongoing data flow while working on a project to restore smart features for the aging thermostats, highlighting the complexities of consumer data and corporate transparency.

Researcher finds unexpected data uploads from old Nest devices

Security researcher Cody Kociemba made this surprising discovery while investigating the backend of Nest Learning Thermostats as part of a repair challenge initiated by FULU, a right-to-repair group. The challenge was aimed at reviving smart features for devices no longer supported by their manufacturers. Collaborating with the open-source community, Kociemba developed software named No Longer Evil to restore lost functionality. During this process, he unexpectedly received a torrent of logs from users’ devices, alerting him to the ongoing data transmission between these old thermostats and Google.

This data flow persisted despite Google’s announcement of discontinued support, raising questions regarding the company’s data handling practices. Kociemba‘s investigation revealed that these older models were still active in the data-sharing ecosystem, something that many users were completely unaware of. As part of his work, Kociemba began to dig deeper into the nature and specifics of the data that was still being sent to Google, uncovering a significant amount of information not previously disclosed to consumers.

What Nest thermostats keep sending to Google

Although remote control features have ceased to function, older Nest Learning Thermostats persist in sending a variety of sensor data to Google. The types of data that continue to be transmitted include:

• Manual temperature changes
• Occupancy detection (whether someone is present in the room)
• Sunlight impact (tracking when sunlight shines on the device)
• Temperature readings
• Humidity levels
• Motion activity
• Ambient light data

The volume of logs being sent was substantial, leading Kociemba to deactivate the incoming data stream. He initially had not anticipated that the devices would remain connected to Google following the discontinuation of their smart functionalities. Despite Google’s prior assertions that unsupported models would “continue to report logs for issue diagnostics,” the reality appears much more complicated.

Without active support or utility, the ongoing data flow raises ethical concerns regarding consumer privacy and device transparency. Users are left questioning what data is being collected by Google and for what purposes, especially since the company can no longer assist in troubleshooting or offering support for these outdated models.

Why this discovery matters

The implications of this revelation are far-reaching, as many users had assumed the disconnection from Google servers due to the end of support meant they would also regain a degree of privacy. The fact that these devices continue to send data creates a unilateral stream of information that benefits the corporation much more than the users. The lack of clarity surrounding what data is transmitted and the inability for users to effectively manage this outflow heightens concerns about corporate governance and user autonomy.

With modern consumers increasingly prioritizing data privacy, the persistence of data-sharing even after support has ceased contradicts expectations about technology and ownership. Users who believed they had severed ties with the service may find themselves still indirectly contributing to Google’s data ecosystem without their knowledge or consent. This signifies a problematic precedent when it comes to consumer electronics and user expectations.

The FULU bounty that sparked the discovery

The discovery of the ongoing data uploads was fueled by FULU’s bounty program, which encourages developers to restore functionality to obsolete devices. This initiative aims to empower users and innovators alike in finding viable solutions for older technology. In recognition of the effort involved, FULU rewarded Kociemba and another contributor known as Team Dinosaur with the top bounty of $14,772. Their work not only demonstrates the potential of community-driven repair but also raises critical questions regarding how companies maintain control over data from devices they have abandoned.

This bounty program showcases the importance of sustainable technology practices and highlights a growing trend in the right-to-repair movement. By empowering developers and consumers alike to reclaim agency over their devices, such initiatives play a key role in encouraging more responsible corporate behavior and enhancing transparency regarding user data.

Ways to stay safe if you still use an old Nest thermostat

For users who continue to utilize these older Nest thermostats, a range of measures can be taken to safeguard personal privacy. To minimize exposure and protect against unwanted data sharing, here are some practical suggestions:

Review your Google account activity

Begin by inspecting what Google has tied to your home devices. By visiting myactivity.google.com, you can check thermostat logs or events that may seem unexpected. This proactive step aids in understanding data flows from your devices.

Place the device on a separate Wi-Fi network

Creating a guest network can keep the thermostat segregated from your main devices. This measure limits the thermostat’s ability to reach other devices on your network, thus enhancing your overall security.

Block outbound traffic when possible

Certain routers offer the option to cut off individual devices from sending data to the internet. By implementing this feature, you can halt log uploads while still allowing the thermostat to manage heating and cooling functions.

Disable any remaining cloud features

If the thermostat’s settings menu provides options for cloud features, ensure that remote access and online diagnostics are disabled. Even basic controls can significantly reduce the flow of data.

Remove old device associations from your Google account

Regularly verify your connected devices in Google settings. Removing any outdated Nest entries that no longer serve a purpose prevents leftover links that may still be transmitting data.

Adjust router settings that report device analytics

Some routers may collect analytics from connected devices. Turn off any analytics reporting to the router manufacturer, minimizing your virtual footprint with unsupported smart products.

Plan your replacement

Given the loss of security updates for unsupported devices, consider upgrading to a model that continues to receive updates and support. This not only enhances functionality but also secures your home network.

Summary

The revelation that older Nest Learning Thermostats continue to send data to Google, despite the loss of support, has sparked significant concern among consumers. This situation brings to light key issues surrounding corporate responsibility, transparency, and consumer rights in an increasingly digital world. Users are urged to take immediate steps to protect their privacy and be more informed about the technology they employ in their homes.

Frequently Asked Questions

Question: Why do older Nest devices still send data after losing support?

Despite ceasing support, older Nest Learning Thermostats continue to upload diagnostic logs to Google. This occurs without direct user consent and raises privacy concerns.

Question: What kind of data do these devices transmit?

The devices share various information, including manual temperature changes, occupancy status, sunlight exposure, and environmental metrics such as humidity and motion data.

Question: How can users stop data from being sent to Google?

Users can disconnect their devices from Wi-Fi, place them on a separate network, or disable cloud features to limit the data being sent to Google.

©2025 News Journos. All rights reserved.

Google has issued a warning to Android users regarding an increasing number of counterfeit Virtual Private Network (VPN) applications that are infiltrating phones and tablets with malware. These malicious apps, disguised as privacy-enhancing tools, are designed to steal personal information, including passwords and banking details. As the demand for VPNs continues to grow, cybercriminals are increasingly using deceptive tactics to lure users into downloading their harmful software, raising serious concerns for mobile device security.

Understanding the Threat of Fake VPN Apps

Fake VPN applications pose a significant threat by masquerading as legitimate tools intended to protect user privacy. These applications often request excessive permissions that allow them to operate covertly, frequently running in the background while collecting sensitive data. As reported by Google, these apps can extract details such as browsing history, cryptocurrency wallet information, and even private messages. The primary aim of such malicious apps is to compromise users’ personal information and exploit it for various forms of financial or identity theft.

The rise in popularity of VPNs has garnered considerable attention from users who seek to secure their online connections, especially on public Wi-Fi networks. As more individuals turn to VPNs for enhanced privacy, malicious entities are strategically developing counterfeit apps to exploit this increased demand. Cybercriminals employ a range of methods to lure users into downloading these apps, raising crucial awareness about the potential dangers that lurk within.

Tactics Used by Cybercriminals

Cybercriminals deploy a variety of strategies to attract unsuspecting users to their fake VPN applications. One common tactic involves the use of eye-catching advertisements that employ sensational claims, including promises of improved online privacy and security. These ads may falsely assert that users are already compromised or need immediate protection, leveraging fear to encourage quick downloads. Many apps imitate popular VPN services, utilizing logos and branding that closely mimic those of established companies, thereby reinforcing a sense of legitimacy.

Additionally, cybercriminals are increasingly harnessing artificial intelligence to create sophisticated advertisements and phishing campaigns that target a broader audience. This technology allows them to generate misleading promotional content with alarming efficiency. Many campaigns are also prevalent across various app stores and dubious websites, contributing to the circulation of these harmful applications.

“Many of these campaigns run across app stores and shady websites.”

Once installed, these fake VPNs commence their malicious activities, often to the detriment of the user’s personal data. Instances of account hijacking, identity theft, financial fraud, and the deployment of ransomware have been observed in cases involving these counterfeit applications. The situation serves as a stark reminder of the importance of discerning legitimate software from harmful alternatives.

Identifying Legitimate VPN Applications

Google has recommended several strategies for identifying genuine VPN applications to mitigate the risk posed by scammers. One of the primary indicators of a legitimate VPN is the presence of a verified VPN badge on its Google Play store listing. This badge signifies that the app has undergone a thorough authenticity check and meets specific guidelines set by Google.

A legitimate VPN will also refrain from requesting unnecessary permissions, such as access to contact lists or personal media. Users should remain vigilant in denying permissions that appear excessive or unrelated to the functionality of the VPN. Additionally, they should be cautious of free VPN offerings that frequently fail to safeguard privacy and can expose users to aggressive data collection practices.

Best Practices to Avoid Fake VPNs

The most effective method for safeguarding against malicious applications relies on establishing prudent downloading habits. Users are advised to limit downloads to official app stores, such as Google Play, and avoid links found in unsolicited advertisements, emails, or pop-up messages that attempt to induce urgency. Many counterfeit VPN applications are unable to pass the Play Store’s strict security checks and rely on users sideloading applications from less secure sources.

It is also crucial to utilize services that provide a data removal mechanism to mitigate the impact of any compromised information already available online. Scammers can retrieve sensitive personal information from publicly available data, thus reducing the potential for exploitation. By employing data removal services, users can effectively minimize the footprint of their personal data across the internet.

Additional measures for bolstering security include enabling built-in malware protection, such as Google Play Protect, to detect and eliminate known threats. This feature acts as a first layer of defense but should not be solely relied upon, hence the necessity of installing robust antivirus software capable of identifying and countering hidden malware.

The Importance of Staying Informed

Education remains a pivotal aspect of combating the rise of fake VPN applications. Staying abreast of recent cybersecurity developments and being informed about common tactics employed by cybercriminals equip users with the knowledge required to navigate the digital landscape safely. Regularly reviewing app permissions and remaining vigilant against aggressive advertising tactics can further enhance user protection.

In conclusion, as the prevalence of fake VPNs escalates, users must prioritize security and exercise vigilance when downloading and installing apps on their devices. Establishing healthy digital behaviors and maintaining a skeptical attitude toward offers that seem “too good to be true” are vital steps in ensuring personal data remains secure.

Summary

In an era where privacy concerns are paramount, the proliferation of fake VPN applications poses significant risks for Android users. Cybercriminals exploit the growing demand for privacy tools by creating counterfeit applications that aim to steal sensitive information, underscoring the need for user vigilance. By adopting effective safety practices and maintaining awareness of potential threats, users can reduce the risk posed by these malicious apps and safeguard their personal data.

Frequently Asked Questions

Question: How can I tell if a VPN application is safe to use?

Legitimate VPN applications often include verified badges on their app store listings. They should not request unnecessary permissions like access to contacts or personal media.

Question: What steps should I take if I suspect I have downloaded a fake VPN app?

If you suspect a VPN app is fake, immediately uninstall it from your device and consider running a malware scan using reliable antivirus software.

Question: Why are free VPN services risky?

Many free VPN services engage in aggressive data collection practices or may contain hidden malware, which can compromise user privacy.

©2025 News Journos. All rights reserved.

©2025 News Journos. All rights reserved.

©2025 News Journos. All rights reserved.

In recent months, multiple high-profile companies—including Google, Dior, and Allianz—have reported data breaches, many of which are linked to Salesforce. Rather than attacking the company’s core software directly, hackers exploited vulnerabilities in surrounding tools and manipulated employees to gain unauthorized access. The repercussions of these breaches are significant, with nearly a billion records stolen across various organizations, leading to extortion attempts as cybercriminals threaten to publish sensitive data unless hefty ransoms are paid. This report delves into the implications of these incidents and how they unfold in today’s cybersecurity landscape.

Nature of Salesforce as a Target

Salesforce isn’t merely a cloud platform; it serves as the foundational system that thousands of businesses rely on to manage their customer relationships. The extensive use of this platform spans various functions, including sales pipelines, marketing initiatives, support ticket tracking, and even partnerships. Critical organizations, such as banks and airlines, depend on Salesforce for everything from account management to customer loyalty programs. Because of its centrality in a typical firm’s daily operations, Salesforce encapsulates a wealth of sensitive information from multiple departments.

This concentration of data makes Salesforce a prime target. A successful infiltration can allow cybercriminals unprecedented access to not just client information, but also internal strategies and communication pathways. Therefore, the implications of a breach extend well beyond immediate data loss; they can seriously compromise the integrity and confidentiality of a company as a whole.

Recent High-Profile Incidents

Numerous businesses have reported breaches pertaining to Salesforce, creating a ripple effect through several sectors. Prominent examples include attacks against Adidas, Allianz, and Qantas, where hackers used social engineering techniques such as voice-phishing to manipulate Salesforce administrators into granting malicious access. By slanting their methods toward human interactions, attackers found that exploiting administrative privileges could yield substantial rewards.

One notable incident involved a chatbot tool known as Drift. Hackers compromised the available tokens, enabling them to gain unauthorized access to Salesforce instances across multiple organizations. The fallout has been severe—companies like Coca-Cola saw the loss of over 23 million customer relationship management (CRM) records, and Farmers Insurance documented breaches affecting more than a million individuals. Even tech giants like Google acknowledged that their Salesforce databases were infiltrated during these cyberattacks.

Exploiting Human Factors

Navigating through firewalls and technical defenses typically requires considerable skill, making human behavior a significantly easier avenue to exploit. Cybercriminals have adeptly shifted their focus toward manipulating employees and the less-secure fringe of cloud ecosystems. Often, individuals blessed with administrative privileges have been tricked into approving harmful applications, enabling them to operate unnoticed due to broad default permission settings.

Once the attackers have accessed sensitive data, they do not simply attempt to sell it; they leverage it for extortion. Recently, a loosely organized group of hackers, known by various names such as Lapsus$ and ShinyHunters, established a dark web leak site that aims to publish sensitive information unless companies succumb to extortion demands. The site has claimed several victims, including major brands such as FedEx and Toyota Motors. Many companies are left uncertain about whether they’ve paid ransoms to keep their data secure.

Response and Investigation

In response to the growing concerns surrounding these extortion attempts, Salesforce has acknowledged the situation. The company asserted, “

We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities.

” They stated that current findings show no indications that the Salesforce platform has been breached and downplayed the rumors as linked to unverified incidents. Salesforce added that they continuously coordinate with affected clients to provide support during this challenging period.

Despite this reassurance, the recurring nature of these attacks illustrates a pressing need for further inquiry into the cybersecurity measures that platforms like Salesforce can implement to protect users. Companies across various sectors must remain vigilant and proactive in their threat assessments, especially as cybercriminals adapt their methods.

Steps for Personal Data Protection

While data breaches might seem like a corporate issue, the reality is that they profoundly affect individuals as well. When attackers infiltrate cloud platforms, they often seek personal user information, including contact details, transaction histories, and private communications. Therefore, it becomes crucial for individuals to take preventive measures to safeguard their information.

To begin, if you suspect that your data might have been compromised, it is imperative to change your passwords across all related services immediately. Utilizing a password manager can help you generate robust, unique passwords tailored to each service. A good password manager also alerts users if their credentials have surfaced in any known data leaks.

Moreover, turning on two-factor authentication (2FA) adds a significant layer of security. This simple step ensures that even if a password is misappropriated, access remains difficult without a secondary form of verification. Individuals should also consider using personal data removal services, which actively monitor and delete their personal information from data broker websites.

Being vigilant in spotting targeted phishing schemes is another critical preventive measure. Attackers armed with CRM data may deploy messages tailored to appear credible, referencing prior transactions or communications to ensnare unsuspecting victims. Therefore, users must remain skeptical of unfamiliar emails or requests for sensitive information, employing trusted antivirus software as added protection.

Lastly, consumers should understand their rights concerning data protection. Companies are generally obligated to notify individuals of data exposure. Those affected should reach out to relevant organizations for clarity on what data was accessed and what they are doing to mitigate further risks.

Summary

The recent surge in Salesforce-linked data breaches highlights the persistent threat posed by cybercriminals today. By targeting human vulnerabilities and leveraging sensitive data, attackers can extort victims and threaten their operational integrity. While Salesforce continues to assert the safety of their platform, the incidents reveal the need for enhanced cybersecurity measures across business environments. For individuals, taking proactive steps to protect personal information is paramount in an increasingly interconnected digital world.

Frequently Asked Questions

Question: What should I do if I believe my data has been compromised?

If you suspect your data has been exposed, the first step is to change your passwords across relevant platforms. It’s also wise to enable two-factor authentication and monitor for unusual activity on your accounts.

Question: How can I detect if my personal information is being misused?

Utilizing identity monitoring services can alert you if your personal data appears on the dark web or is being used in unauthorized ways. Regularly reviewing your financial statements can also help you identify suspicious activities.

Question: Are companies legally required to inform me if my data is breached?

Yes, companies are generally obligated to notify affected individuals if their data has been compromised, depending on regional laws. It’s advisable to contact the company for specifics regarding the breach and its impacts on you.

©2025 News Journos. All rights reserved.

©2025 News Journos. All rights reserved.