Gardyn Security Incident

For Press

Press kit and on-the-record contact for journalists covering CISA advisory ICSA-26-055-03.

Direct contact

Press inquiries are typically answered within 24 hours.

Bio (third person, copy-pasteable)

Michael Groberman is an independent security researcher (handle: Gr0m) credited in CISA advisory ICSA-26-055-03 for the coordinated disclosure of ten CVEs affecting the Gardyn IoT platform. Per the researcher’s coordinated-disclosure repository, initial vendor outreach was on October 14, 2025; CISA published the initial advisory on February 24, 2026 and Update A on April 2, 2026. He maintains the public coordinated-disclosure repository.

Documented facts

On-record quotes

“Gardyn customers were entitled to accurate information about whether their data was exposed. The CISA advisory provides that information.” — Michael Groberman
“The technical findings are validated by CISA. The remaining question is the public record: what was said, when it was said, and how it compares to what an authoritative federal advisory documents.” — Michael Groberman
“Initial private notification to the vendor was on October 14, 2025. Public release came after federal coordination through CERT/CC and CISA.” — Michael Groberman

Source materials

Existing coverage

See the press coverage page. Outlets that have covered the advisory include SecurityWeek (Eduard Kovacs), Patrick Coyle, Cybersecurity News, Cyber Press, GBhackers, Cyber Technology Insights, BitNinja Security, and OpenText Cybersecurity Community.