The LinkedIn breach that surfaced yesterday turns out to be a continuation of the breach the business-focused social network suffered in 2012. Back then it was thought that 6.5 million hashed passwords were compromised, but this week 117 million turned up for sale in a criminal market (where they’re selling for peanuts.) LinkedIn is so far responding with selective password resets for affected users, which is what it did in 2012.

ESET reports finding a surveillance campaign tracking separatists, journalists, self-proclaimed governments, and so on in the Donbass region of eastern Ukraine. They detected it as the Win32/Prikormka information-stealing Trojan. The campaign is being called “Operation Groundbait” because the phishing emails that distributed the malware posed as price lists for groundbait. (“Groundbait” is what American meat fishermen call “chum.”)

“Phineas Phisher,” the hacktivist to whom the Gamma Group and Hacking Team capers are generally attributed, has stolen €10K in Bitcoin and donated it to Kurdish “anti-capitalists” in Rojava, a region in the north of Syria. He hints he’s got more thefts planned.

The US Securities and Exchange Commission had harsh words for the financial sector. SEC testimony before Congress called out trading and financial clearinghouses for what it characterized as a “reckless” cyber security posture.

In industry news, Cisco surprised the markets yesterday as it reported better than expected results and optimistic guidance. Its positive results were driven largely by its security and collaboration lines of business, which fall squarely in the cyber sector.

KEYW moves closer to selling Hexis.