Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2226 articles
Attackers compromised LiteLLM’s release pipeline and distributed malicious PyPI 1.107.0 wheels and Docker images for Windows, Linux, and macOS. The payload stole credentials and secrets; affected users are advised to isolate systems and rotate exposed secrets.
Capcom confirmed unauthorized access to its CAPCOM ID service, exposing email addresses and associated account data from more than 11.7 million customers. Payment details and most account passwords were unaffected; the access method remains undisclosed.
Railway says an investigation indicates an unauthorized party may have accessed customer environment variables, with some decrypted contents potentially exposed. It urges users to rotate credentials; deployments remain delayed as the investigation continues.
Cyberattacks reportedly manipulated refrigeration controllers, spoiling food at more than 700 French grocery and retail stores. The attacker remains unknown; a Sekoia analyst also reported impacts in other European countries.
Richmond Public Schools shut off internet access after confirming a cyber incident, disrupting digital tools while schools remained open. Employees reported threats to leak allegedly stolen data, which the district has not confirmed.
COMAPA Victoria’s general manager said attackers tried to block files and demand a ransom. The utility restored data from backups without paying, and said services continued and customer payment data was not exposed.
TAKKT says a cyberattack affected IT systems in its European Industrial & Packaging and North American Foodservices businesses. Precautionary shutdowns have significantly restricted order processing, customer service, and deliveries; the damage remains unclear.
A report says ransomware disrupted systems at Ford/Lincoln dealer Sunin Motors and Audi dealer Gojin Motors. Sunin says it cannot determine what customer data may have been exposed; service reservation records were lost.
TeamUpdraft reported unauthorized access to its website and suspected exposure of customer connection keys. Attackers used valid UpdraftCentral keys to install backdoors on connected WordPress sites; the company reset credentials and released updates.
SBI says it identified 3,897 customer records in a dark-web dataset of about 375,000, but authenticity and origin are unknown. The bank is investigating; sample checks supported some records but did not verify the full dataset.
OVHcloud says a hijacked developer GitHub account was used to replace CLI release files with a secret-stealing binary. Versions 0.11.0–0.15.0 were affected; the company blocked them and enabled release immutability.
A network security incident disrupted several Columbia, South Carolina, online services. City technology staff detected suspicious activity; authorities are investigating and restoration is underway. Officials have not said whether personal information was compromised.
Petersburg Borough says a July 11 ransomware attack affected utility-billing software. Customer names and account numbers were accessible, but the borough has not confirmed they were viewed or copied; banking and credit card data was not stored on the network.
美食-KY's Taiwan subsidiary, 美食達人股份有限公司, reported a cyberattack on some information systems on Oct. 21, 2026. It activated response measures and is investigating and repairing systems; its initial assessment found no material impact on consolidated operations or finances.
GMO confirmed unauthorized access to Onamae Desktop Cloud and malware installation on some customer servers, potentially affecting up to 26,739. The service was shut down; stored data may be exposed, but no misuse or leakage is confirmed.
PingCAP said attackers used stolen service account credentials to access its systems and copy data and source code. It found no evidence customer databases were accessed; FulcrumSec made broader unverified claims, raising concerns about customer data held by providers.
Microsoft attributes attacks on ConnectWise Cloud Backup customers’ Microsoft 365 environments to Storm-0940, which allegedly used ARTEX for password spraying and OAuth abuse. ConnectWise is restoring services; the number of compromised customers is unknown.
Attackers used a compromised developer GitHub account to replace OVHcloud CLI release binaries with malware that sought secrets. The files were available for 1 hour 33 minutes and downloaded about 250 times; researchers linked the attack to GlassWorm, with caveats.
An actor using the handle ChimeraZ claims to sell a 48 GB dataset linked to French cat registry LOOF, allegedly containing about 654,000 lines and personal and pedigree data. The dataset, source and availability are unverified.
A researcher observed criminal operators using autonomous AI agents to attack more than 1,200 sites. Reuters identified over 100 affected companies; confirmed damage and data access vary, and exposed control panels also contained secrets.
A cyberattack disrupted Ahold Delhaize services across Europe and the US. The company is restoring systems and says it has no evidence that customer, associate, or partner data was stolen.
Citizen Lab confirmed with high confidence that University of Belgrade rector Vladan Đokić’s iPhone was infected with Pegasus via a zero-click exploit. The attacker is unknown, and the investigation is ongoing.
Prosecutors say former OpenAI engineer Abdulrahman Alfozan secretly installed a recording device in an executive conference room. A judge denied his request for home confinement; he is charged with intercepting oral communications.
ConnectWise says unauthorized access to Cloud Backup application identities prompted credential resets and other mitigations. Huntress observed post-compromise activity in two tenants, including new application secrets; ConnectWise says Cloud Backup remains offline.
