Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2254 articles
CloudSEK says an unauthenticated MCP server exposed a customer’s internal tools, allowing an audio proxy to access AWS metadata and read local files, exposing IAM credentials and database secrets.
Researchers say 32 Red Hat npm packages were backdoored with Miasma, a Shai-Hulud variant targeting developer credentials and cloud secrets. Red Hat removed the packages and reported no identified impact to customer or production environments.
Dashlane said an external party targeted user accounts with brute-force login attempts, triggering temporary suspensions. The company unsuspended affected accounts and reported no evidence its systems were compromised, though some users continued to report login issues.
An actor using the alias 2019 claims to have leaked a database allegedly linked to Australian workplace catering platform Hampr, reportedly containing more than 360,000 records. The claim is unverified.
Carnival confirmed an April cyberattack in which an attacker copied personal data after compromising an employee account. A Maine filing suggests nearly 6 million people may be affected; Carnival has not attributed the attack to ShinyHunters.
ChimeraZ claims to have leaked a database allegedly tied to French real-estate platform Amepi. The report says it may contain about 6,000 records, but does not confirm the database’s authenticity or connection to Amepi.
Moelester claims to be selling a dataset allegedly tied to Argentine healthcare provider Swiss Medical, involving about 458,000 member records and a possible exposure of sensitive information.
The Rhineland-Palatinate Center for Political Education and Memorials isolated its websites after a cyberattack, leaving them inaccessible. It is investigating whether subscriber or customer data was exposed; none has been confirmed stolen.
ShinyHunters published data it says was stolen from Charter, claiming 42 million records. Have I Been Pwned identified 4.9 million unique email addresses. Charter said sales tools were affected and denied CPNI or sensitive personal information was released.
Threat actor xMetah claims to be selling a database allegedly tied to Resana, a French government collaboration platform; the purported dump reportedly contains 990,000 user records. The report does not independently verify exposure.
ChimeraZ claims to have leaked a database allegedly tied to French real-estate platform Figaro Immobilier / Explorimmo, reportedly containing about 100,000 invoices. The leak and potential exposure of sensitive information are unverified.
Have I Been Pwned says leaked data affected 4.9 million Charter accounts. ShinyHunters claimed a vishing attack led to theft from Salesforce; Charter confirmed a breach but said no sensitive personal information or CPNI was exfiltrated.
Weil said a threat actor uploaded a limited number of client documents to external storage, while its investigation found no network access or disruption. The Insurer reported an $18M–$20M payment, which Weil has not confirmed.
ChimeraZ claims to have leaked a database allegedly belonging to EnVisite, a French real-estate virtual tour platform. The claimed exposure involves 138,000 records, but the article provides no independent confirmation.
An actor using the alias bacen claims to hold 43,847,219 iFood customer records, including CPF IDs, contact details and credit-card data, and is allegedly seeking extortion. The article provides no independent confirmation.
Carnival says attackers used social engineering to access an employee account and steal files containing personal information. The company reported 5,995,277 affected people; ShinyHunters separately claimed 8.7 million records and published data.
A cyberattack on Portraitbox reportedly stole children’s photos and families’ email addresses, delivery addresses, and passwords. Authorities say attackers are threatening to publish the photos; none had appeared in the Darknet at the time of reporting.
Grafana Labs said a poisoned TanStack npm package led to read-only access to its GitHub repositories and theft of source code and business contact data. It said production and Grafana Cloud were unaffected and has rotated tokens and strengthened controls.
GitHub confirmed about 3,800 internal repositories were exfiltrated after a compromised VS Code extension harvested credentials. The company removed the extension, isolated an endpoint, rotated keys and tokens, and is preparing a technical report.
Carnival says a social engineering attack led to unauthorized access and the theft of personal information affecting 5,995,277 people. ShinyHunters claimed responsibility, but Carnival has not attributed the breach.
Serpa Municipality says an external cyberattack affected its IT infrastructure. It reported the incident to authorities and said municipal services remain operational despite disruptions to fixed and mobile communications.
Databasehooligan claims to be selling a dataset allegedly taken from Saudi portal Nitaqat, comprising about 437,000 records with contacts, support tickets, booking history and business details.
MagoSpeak claims to have leaked a student database allegedly belonging to Instituto Tecnológico de Zacatepec, a public institute in Morelos, Mexico. The article provides no independent confirmation.
ChimeraZ claims a database linked to FNHPA was leaked, allegedly containing about 9,000 member records and invoice data. The claimed exposure has not been independently confirmed.
