Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2309 articles
ShinyHunters claims it breached Cisco systems, citing screenshots of access to an AWS console and storage volumes. The group alleges it has over 3 million Salesforce records and threatens a public leak if Cisco does not respond by April 3, 2026.
Mercor says it was among thousands of companies affected by malicious code in a LiteLLM package. The incident is linked to TeamPCP, while Lapsus$ separately claimed access to Mercor data; the scope and any exposure remain unclear.
Two malicious Axios versions containing a post-install RAT dropper were published to NPM after attackers compromised the maintainer’s account. Google attributes the attack to suspected North Korean actor UNC1069; the releases were removed about three hours later.
The article reports that a packaging utility inadvertently exposed Claude Code source code. Anthropic’s DMCA request led GitHub to remove more than 8,100 repositories, while copies reportedly remain elsewhere.
Iran-linked Handala Hack Team claimed it breached FBI Director Kash Patel’s personal email and released photos and a sample of 300+ emails from 2010–2019. The FBI said it was aware of targeting and that the material was historical, with no government information.
Threat firms attribute the malicious plain-crypto-js dependency in axios npm versions 1.14.1 and 0.30.4 to Lazarus/UNC1069. Its postinstall dropper deployed WAVESHAPER.V2; Huntress found about 135 compromised devices, while total impact remains unclear.
The article says actor “swag” is advertising allegedly stolen email credentials for Israeli government agencies and organizations, the Quebec Central Board of Education, and Yahoo accounts. The claims are not independently confirmed.
A threat actor identified as xorcat allegedly posted a dataset of 900,000 Canva user records, including bcrypt password hashes, OAuth links, account identifiers, and usage metadata. The article says a 20-record sample was provided; the exposure is unverified.
Officials in several Massachusetts towns say a cyberattack discovered March 31 disrupted Patriot Regional Emergency Communications Center and local non-emergency/business phone lines. 911 remained operational; officials reported no evidence private information was share
The company reported a cyberattack on systems at its Suzhou Gem Opto-Electronics Terminal and Vietnam Gem Electronic and Metal subsidiaries. Restoration is underway, and the company currently assesses no material operational impact.
BleepingComputer reports that attackers used credentials stolen in the Trivy supply-chain compromise to access Cisco’s development environment and clone 300+ GitHub repositories. Cisco isolated systems and began reimaging and credential rotation; Cisco had not responded
After detecting a breach on March 19, the Dutch Finance Ministry took systems including its treasury portal offline. About 1,600 public institutions cannot view balances online, but funds and payments remain accessible.
A seller on a cybercrime forum claims a database linked to Abacel SA contains about 345,000 email addresses and 510,000 WhatsApp-verified phone numbers, among other personal data, and is offered for $450. The breach is unconfirmed.
Nasir Security claims it accessed Dubai International Airport’s classified intelligence systems for months and took internal documents and passport images. The claims are unverified in the supplied article.
The article reports that an unknown actor hijacked an Axios maintainer’s npm account and published two releases with a malicious dependency. Its obfuscated postinstall script allegedly drops cross-platform RAT payloads and may expose developer and CI/CD secrets.
A report says source maps published with Claude Code on the public npm registry enabled reconstruction of Anthropic’s TypeScript source. Anthropic secured the registry, but reconstructed copies are reportedly circulating publicly.
A reported March 20 cyberattack on Berlin’s Fernheizwerk Neukölln disrupted accounting and internal communications. Police confirmed the attack was known to them; the plant’s technical systems and heat supply were unaffected.
CareCloud reported temporary unauthorized access to one EHR environment on March 16, with access restored the same day after about eight hours. The company is investigating whether patient information was accessed or exfiltrated.
CareCloud reported that a March 16 intrusion affected one of its six EHR environments and disrupted network access for about eight hours. The company restored systems; the scope of accessed or exfiltrated patient data remains under investigation.
A reported cyberattack encrypted Häpo’s IT in Winterthur, blocking access to inventory and customer data for 15,000 wheels. The company reportedly faces daily losses of tens of thousands of francs, and attackers are demanding a ransom.
Italy’s Data Protection Authority fined Intesa Sanpaolo €31.8 million after finding an employee accessed 3,573 customers’ banking data without authorization from February 2022 to April 2024, while internal controls failed to detect the activity.
The European Commission says it contained an incident on public Europa[.]eu sites and found no evidence of internal-system compromise. ShinyHunters claims it stole over 350 GB; the data and any personal-information impact remain under investigation.
CareCloud told the SEC that a March 16 cyber incident disrupted one electronic health record environment for about eight hours. The company is investigating whether patient or other data was accessed or exfiltrated; systems have been restored.
A database claiming about 300,000 records from Ukraine’s Inclusive Resource Center was advertised on a hacker forum. A sample reportedly contains sensitive information about children and guardians; the breach remains alleged.
