FlashFeed

The hackers that stole a large cache of data from Madison Square Garden called a low level employee and tricked them into letting the hackers into MSG’s systems, according to the hackers and 404 Media’s review of the stolen data.The breach highlights the risk of social engineering over voice calls, sometimes called ‘vishing’. Whereas phishing, where hackers social engineer someone over email or send them a fake login page, has been common for decades, vishing has only become prevalent more recently, especially as young and native English speaking hackers have become a serious cybersecurity threat.💡Do you know anything else about this hack or others? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.“Employee vishing on their Microsoft Entra,” a member of the hacking group behind the MSG breach, called ShinyHunters, told 404 Media when asked to explain how the group got in. Microsoft Entra is Microsoft’s identity management product, similar to Okta, which lets employees log into whatever tools or services they need to at work.Last week 404 Media reported hackers had uploaded data stolen from MSG. A sample 404 Media reviewed at the time included files mentioning Knicks-related personalities, with fields such as “address,” “claim to fame,” and “cost of talent.” In some cases the data included a risk score for certain celebrities, with actor, director and Knicks fan Ben Stiller described as “Low Risk” and rapper Boogie with da Hoodie marked “High Risk.”Since then 404 Media downloaded the full 45GB data dump and found the contents of a specific MSG employee’s OneDrive. It included work documents, photos, screenshots, and other attachments. A folder called “Personal,” contained the employee’s W-2 form, which included their name and other personal information. This indicated that the breach may have originated from this specific employee. 404 Media found a LinkedIn profile under the same name showing this person worked at MSG. 404 Media is not naming the employee for their privacy.404 Media then asked a member of ShinyHunters how the group breached MSG. The member provided this employee’s name.When 404 Media asked the ShinyHunters member to elaborate on how the group compromised MSG, they pointed to a May blog post from Microsoft, which they said was “about us.” That post described what Microsoft called a “methodical, sophisticated, and multi-layered attack.” It details another attack—the blog post was published May 18 and the ShinyHunters member said the MSG hack happened on June 5—but there are similarities.The Microsoft blog post says hackers first targeted specific people to get their Microsoft Entra credentials. The hackers started the Self-Service Password Reset (SSPR) process, and then tricked users into completing the multifactor authentication prompts that appear legitimate, Microsoft said. “For example, the threat actor might impersonate an internal information technology (IT) support representative and contact the user claiming that their account requires urgent verification, instructing them to approve MFA prompts as part of a routine password reset procedure,” the blog post reads. Once in, the hackers can then pivot onto other apps or systems where data may be stored. In MSG’s case, the dump includes data taken from a SharePoint instance, Microsoft’s sharing and collaboration platform.The ShinyHunters member didn’t elaborate beyond the blog post, but told 404 Media: “​​We called the employee and had them do the SSPR process,” referring specifically to the MSG hack. Law firm Morgan and Morgan has filed a class action lawsuit related to the breach, arguing MSG’s surveillance of visitors led to it. When asked if ShinyHunters targeted MSG because of the venue’s surveillance practices, the member said, “Yes we thought they would pay for that reason but they surprisingly did not.”MSG did not respond to a request for comment.404 Media reported this week the data dump contained a dossier on activists who had opposed MSG’s facial recognition program.

Consulting giant Accenture is trying to figure out how to stop non-technical workers from blowing through companies’ AI token budget on trivial tasks like converting PDFs to presentation slides, according to leaked audio obtained by 404 Media. Across the industry Accenture is seeing “soaring token spend,” according to the audio.The news highlights a major shift in the tech industry and other companies that use AI: the wave of uninhibited AI growth is over. Some AI providers like GitHub are now charging customers per token rather than a flat subscription fee, leading some companies to burn through their tokens. Uber recently capped employees’ use of AI tools like Claude Code and Cursor; that came after Uber told employees to use AI as much as possible and Uber’s CTO said the company had blown its entire AI budget in four months. And Accenture itself reportedly started requiring senior staff to start using AI or risk losing out on promotions. It also undercuts the narrative that superpowered engineers generating mountains of code are behind the AI boom. In many cases it is non-technical staff burning through tokens for non-specialized tasks.💡Do you know anything else about token spend inside tech companies? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.“We’re seeing from some of the data internally at least that it’s actually not our engineers that are driving the token consumption. It’s a lot of the non-engineers that are doing some of those behaviors [...] you were talking about,” Justice Kwak, Accenture’s agentic AI strategy lead, said in a recent internal meeting, according to the audio obtained by 404 Media.At one point in the meeting, Kwak and Eduardo Salamanca de Diego, senior manager of product management at the company’s Center for Advanced AI, start presenting about what is described as “token ops.”Kwak says he knows people aren’t using slides these days, but he has some. As he appears to be preparing to present, Stuart Henderson, Accenture’s client group lead, interrupts. He jokes he hopes Kwak didn’t just convert a PDF into images and then into markdown files. “I’m learning that’s one of the big token chewers,” Henderson says. “Turning PDFs into markdown: is that right?”That’s when Kwak says that’s what Accenture’s own data shows. “What we’re seeing right now is just rapid escalation in AI token spend,” he says “As companies start to scale AI, moving from like simple chatbots into use cases that feature agentic workflows and automation and then enterprise-wide deployment of some of these tools like Copilot, Claude Code, and Codex, we’re hitting this inflection point where AI is becoming material to the cost structure; spend is becoming very unpredictable; and leadership, especially at the CFO, COO, and CIO level, are still asking the question of whether they’re getting value from what we’re spending on in the context of AI.” “It’s really not a niche problem. It is a problem that every enterprise will face if they are bullish on AI, if they haven’t already,” he adds. The amount of token spending is increasing “exponentially, as more and more people are starting to use AI.”Kwak says after Accenture tried to get enterprises to adopt AI as quickly as possible, AI has reached scale in most areas in both Accenture and its clients. But with that scale is a new opportunity for Accenture regarding its clients: “to really think about token economics.” The bill of the overall AI spend is visible, Kwok explains, but attributing that AI spend at the token level to the value outcomes on the projects where AI is being used is not visible. Finally, the “controls are just arriving too late.” Those are things that might stop someone spending a bunch of money on tokens, like budgeting or different tiers.Following the Financial Times’ reporting of Accenture’s policy to force AI adoption or risk missing promotions, an Accenture spokesperson told CNBC, “Our strategy is to be the reinvention partner of choice for our clients and to be the most client-focused, AI-enabled, great place to work. That requires the adoption of the latest tools and technologies to serve our clients most effectively.”Kwak says Accenture plans to formally launch a product called “Token IQ” soon. Accenture did not respond to a request for comment.As 404 Media has reported, some startups have bragged about how much they’ve spent on AI instead of human workers. Walmart also capped its staff’s use of AI tools following high demand.