Your Dashboard Has New Roommates

# Your Dashboard Has New Roommates Your car just became a proxy botnet node. That's what would page me at 3am. While every CISO is staring at their AI agents and worrying about prompt injection, attackers are moving into the hardware you use to find the nearest Starbucks. We're seeing Android-based car head units infected with malware that turns them into proxy botnet relays. This isn't a sophisticated state-sponsored operation using some zero-day in the CAN bus. It's simpler. The industry decided to jam unhardened Android tablets into dashboards, connect them to the internet, and then forget they exist from a patching perspective. Now we have high-performance mobile devices sitting in parking lots acting as anonymizers for other criminals. The second-order effect here is the corporate guest network. Imagine a fleet of company cars parked in a lot, all connected to the office Wi-Fi, serving as an external proxy for an attacker trying to mask their origin while probing your internal perimeter. The common defense is that these systems are isolated from the car's critical driving functions. That might keep the brakes working, but it does nothing for the network. We've priced in the risk of a stolen laptop. We haven't priced in the risk of a 2026 SUV acting as a jump box. Speaking of things that should have been secured years ago, let's look at Italy. A threat actor calling themselves xpl0itrs claims to have exfiltrated 6.1 TB of data from just under 3,000 Italian schools. The point of entry wasn't the school districts individually. It was Spaggiari. This is a textbook case of vendor consolidation risk. By centralizing student and administrative data into one proprietary cloud for thousands of institutions, Spaggiari didn't create efficiency; they created a gold mine with one lock on the front door. Once xpl0itrs got in, they didn't have to fight 3,000 separate battles. They just had to walk through the warehouse. The argument from vendors is always the same: centralization allows for better security standards than letting every individual school run their own archaic server in a broom closet. That sounds great in a sales pitch. It fails in practice when those "better standards" still result in 6.1 TB of data walking out the door. The downstream fallout here isn't just about leaked grades or teacher emails. We're talking about the PII of an entire generation of students. That data is permanent. You can rotate a password, but you can't rotate a child's date of birth or home address once it's on a leak site. Then we have the SFR hack in France. North of 2.1 million customer records stolen. Telcos are always an attractive target because they hold the keys to MFA via SMS. If you're managing a fleet of employees using SMS-based two-factor authentication, this breach just increased your risk profile across every single one of your accounts. The wire is heavy on data breaches today—30 stories in the last 24 hours alone. The technology sector remains the primary target, with 190 stories hitting that vertical this week. It's a predictable pattern. Attackers follow the density of data and the weakness of the implementation. But there's a difference between a corporate breach and systemic negligence. Look at the Afghan allies who served alongside British troops. They’ve just been hit by another personal data breach. This is the 50th time in five years their information has been exposed. At this point, calling it a "breach" is a euphemism. A breach is an event. Fifty breaches over five years is a policy of failure. When you are dealing with individuals whose lives are actively at risk because of the data being leaked, the standard for security shouldn't be "industry average." It should be absolute. The habitual nature of these leaks suggests that the data is either stored in an environment with zero egress filtering or handled by third parties who treat PII like scrap paper. There is no scenario where a competent security team allows the same high-risk dataset to leak fifty times without fundamentally rearchitecting how that data is stored and accessed. It's not a lack of tools. It's a lack of will. If you're looking at your dashboard today, don't get distracted by the noise. We had 309 data breach reports this week. Most are just the cost of doing business in 2026. But keep an eye on the proxy botnets. When the attack surface shifts from your laptop to your car's infotainment system, the traditional perimeter doesn't just shrink—it disappears. I'm curious if anyone is actually auditing the outbound traffic from their corporate parking lots. I suspect not. It's a lot easier to buy another firewall than it is to figure out why your fleet of vehicles is talking to a command-and-control server in Eastern Europe.