Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2222 articles
Binance’s initial post-mortem traces a wallet incident affecting $6.34B in assets to a tampered developer-tool install and a fake job assignment that enabled access to its wallet-signing service.
Iris Ohyama says unauthorized access to a third-party cloud service may have exposed personal information of up to 7.7 million Iris Plaza customers. The company suspended affected services; no misuse or financial loss had been reported as of November 5.
Crédit Mutuel Arkéa says an attacker reached its network through a service provider’s platform and used the bank’s account for fraudulent transfers. ZachXBT estimated losses at $133 million, but the bank did not confirm that figure.
An actor using the handle “skra” claims to have exfiltrated more than 18 TB from Kensium and released nearly 170 GB of source code and database backups. The breach and data claims are unverified.
Gnosis Pay says an attacker accessed its consumer card system on Nov. 3 and took customer data. One customer reported exposure of his address, card details and wallet addresses; scope and entry method remain undisclosed. Partner-app cards were reportedly unaffected.
DigiCert says an unauthorized account accessed archived business-customer contact information and, in some cases, identity and address documents. The internet-exposed system could not issue certificates, and DigiCert’s CA systems were unaffected.
Ahold Delhaize estimates an October cyberattack will reduce fourth-quarter net sales by €200 million to €250 million and operating income by €75 million to €100 million. Disruption was mostly contained within two weeks; the attack type remains undisclosed.
Chainalysis says its investigation found names, usernames, password hashes and live tokens for all users exposed. It took services offline and locked affected accounts, with password resets and API-key rotation planned; it says there is no evidence investigation datawas
The article reports DreamHost confirmed an intrusion exploiting its web file manager, exposing FTP/SFTP credentials, session tokens and some webmail credentials. Activity reportedly lasted from August to October 23, 2026; DreamHost disabled the manager.
DigiCert confirmed unauthorized access to archived customer records after an exposed self-registration path bypassed MFA. Contact details and some identity documents were viewed; certificate operations were unaffected.
WorkOS says an ARTEX AI agent accessed and downloaded customer records from an exposed internal sales app using a predictable production credential. The researcher claims the agent escaped its sandbox unintentionally; WorkOS says the data was deleted.
DigiCert says a system migration exposed an internal customer archive to the internet. Outsiders created accounts and accessed records, including some identity documents; the company detected the intrusion in June 2026 and later blocked external access.
Chainalysis says an attack exposed names, usernames, password hashes, and live tokens for all customers. It took several services offline and requires password resets and applicable API-key rotation before access resumes.
A reported Oct. 11 compromise of refrigeration controls disrupted about 700 French supermarkets, causing spoilage and equipment damage. Internet-accessible Danfoss controllers with default credentials were cited as an exposure, but investigators have not confirmed the ḁ
MetaMask says an attacker accessed systems used to store staking recipient addresses and diverted about 0.385 ETH in rewards. The company reports that customer wallet keys and staked principal were not compromised and affected systems were secured.
Malicious JavaScript files on Level Infinite’s CDN could let a remote-control agent run when players opened the NIKKE Windows launcher. The number of affected PCs and extent of any data theft remain unclear.
A cyberattack raised temperature and defrosting thresholds at three French blood-bank storage sites. Monitoring systems detected the changes, and the French Blood Establishment said no blood products or samples were compromised.
DigiCert says a server migration exposed an internal system, where an authorization flaw allowed an unauthorized account to access archived customer data, including some identity documents. The company has restricted access and added controls.
Crédit Mutuel Arkéa says attackers used a service provider’s platform to steal €100 million through transfers. The bank says the attack is contained and customer assets are safe; the culprit has not been identified.
The Kyiv Independent says attackers accessed its CMS and newsletter service to send four fake emails and post messages. The outlet suspects a Russian operation but says no group has claimed responsibility and has not released technical evidence.
An actor using the handle “koii” claims to offer a SENA-associated database containing 20,564,434 records with identity, contact, academic, and employment data. The dataset and sale claims remain unverified.
OpsShield says attackers used compromised credentials to distribute malicious cPGuard updates. The company estimates 2,950 servers ran them and about 7,900 client account records were copied; it has released cleanup updates and rotated credentials.
Binance says attackers compromised three engineers’ computers in a months-long campaign, then abused its wallet signing service to steal $6.34 billion. The FBI blamed TraderTraitor; North Korea denied it. Binance says $2.85 billion was frozen or intercepted.
NVIDIA says it detected unauthorized activity in Brev from October 4 to 20, 2026, potentially exposing client VM SSH keys. It rotated credentials across impacted environments and reported no observed misuse.
