Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2222 articles
Chainalysis assesses that North Korean group TraderTraitor carried out unauthorized transfers of about $6.4 billion from Binance wallets. Investigators cite on-chain links to funds from a prior Bitget exploit; about $2.8 billion has been frozen.
A trojanized Claude Code extension update distributed through Cursor's marketplace attempted to add an SSH key, establish persistence and beacon host data. Cursor reported up to 5,000 potentially affected users; the update was removed.
Binance says attackers used its hot-wallet signing infrastructure to move an estimated $6.3 billion across about 10 blockchains on Oct. 29, 2026. The FBI attributed the theft to North Korea’s TraderTraitor; Binance says it found no evidence of leaked private keys.
TRM Labs estimates $6.36 billion was taken from Binance wallets across 10 blockchains on Oct. 29. Researchers point to North Korea’s TraderTraitor; Binance says its early investigation suggests a compromised employee laptop, with no evidence of leaked wallet keys.
Binance says a security incident affected about $6.3 billion in assets. Chainalysis estimates about $5.912 billion was stolen; nearly $3 billion has been frozen. Binance suspects a compromised DevOps laptop enabled unauthorized withdrawals.
Binance says its hack may have started with a DevOps laptop, while Teng says the attacker used EIP-7702 to approve a hot wallet outside normal controls. Binance later found additional breach points; attribution to TraderTraitor is unconfirmed.
A malicious Claude Code extension was available in Cursor's marketplace for 11 hours on Oct. 29. Cursor said up to 5,000 users may have been affected; the extension exfiltrated system information and attempted to establish persistent access.
Version 2.1.313 of a malicious Claude Code extension was distributed through Open VSX and Cursor for about 11 hours, adding an attacker SSH key and persistence on Windows and macOS. Cursor says at most 5,000 users were affected; the attacker server is offline.
Trezor is investigating a suspected crypto-theft implant found in a Safe 5 bought from reseller CryptoBilis. The device has not yet been examined, and no related fund theft is known. Trezor advises affected buyers to move assets to a new wallet.
Binance reported a $6.3 billion cryptocurrency theft and temporarily halted withdrawals. Analysts attributed the attack to North Korea-linked TraderTraitor; about $3 billion was frozen, while the investigation and service recovery continued.
Binance links about $6.36 billion in unauthorized withdrawals to a compromised DevOps laptop and service-container access. The exchange halted deposits and withdrawals; TRM and Chainalysis attribute the theft to TraderTraitor.
An actor using the handle “dmitryy” claims to have released about 1.7 million Buenos Aires student enrollment records for 2025. The listing and dataset’s authenticity, source, completeness and availability remain unverified.
BAE says the federal judiciary’s Bankruptcy Noticing Center is restored after an outage that began around October 9. The company says no data was extracted or PII breached; the incident’s cause remains undisclosed.
A hacker using the name Department of Peace claims to have leaked over 41,000 DHS employee records, including personal details and system-access information. Okta says it has no evidence its data or systems were compromised; DHS is addressing a potential breach.
Sony Network Communications confirmed data theft from So-net’s database, affecting nearly 2.6 million So-net and Plala subscriber records. The breach also exposed passwords for about 54,000 email accounts; So-net began resetting them.
Alpine Linux rebuilt its GitLab server after reported attempts to exploit CVE-2026-97229. It found no evidence of code execution but cannot rule it out. GitLab installations using separate Ruby must update Ruby to a fixed version.
HHS lists 8,179,772 people as affected by iRhythm’s June 2026 breach. The company said hackers targeted third-party business applications and attempted extortion; affected information reportedly included patient contact, birth-date, account, device, insurance, and care-
IntraCare says an investigation confirmed data was exfiltrated after unauthorized access in March 2026, and some was made available on the dark web. A group is suspected; a New Zealand High Court injunction has now been made permanent.
Icepick, a search tool for information on more than 41,000 DHS employees, briefly went offline after a registrar suspension and later returned under a different registrar. Hacktivists claimed the data came from a breached DHS database; DHS said it was investigating a “潜
Polymarket confirmed a third-party provider compromise that distributed JavaScript targeting users’ trading sessions and crypto assets. Trading briefly halted and resumed; the amount stolen and number of affected users remain undisclosed.
Japan Airlines says unauthorized access to Amadeus’s Passenger Service System exposed reservation and travel data for about 92,000 customers between August 2023 and September 2026; JAL reports no evidence of misuse.
Binance is investigating a potential security breach after billions were reportedly transferred from its hot wallets. Tether and Circle froze more than $2.3 billion in associated assets; Binance has not confirmed unauthorized transfers or losses.
The Department of Peace says it obtained 165 MB of DHS data identifying more than 41,000 employees. After a searchable tool appeared online, DHS reportedly used ZeroFox to seek takedowns; the data includes contact details and locations.
Hacktivists calling themselves Department of Peace say they obtained and published an Okta-sourced dataset listing over 41,000 DHS employees. DHS is investigating a potential breach; three employees confirmed their listed names and contact details.
