Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2316 articles
A 14MB database allegedly belonging to Thai organization UPLUS was posted to a cybercrime forum. Reported contents include two CSVs with client and sales-lead personal information and internal business fields; the breach is not independently confirmed.
Advantest says unusual IT activity detected on February 15 led to a ransomware investigation. The company isolated affected systems and engaged cybersecurity experts; data impact and significant operational disruption remain unconfirmed.
GVM Technologies, operating as GradSmart, reportedly suffered unauthorized access to a misconfigured MongoDB database. An unnamed actor claims over 2,000 student records, including at least 205 passport numbers, were exfiltrated.
Optimizely says vishing attackers accessed internal systems and stole basic business contact information from CRM records and limited back-office documents. The company reports no evidence of access to sensitive customer data and warns of follow-up phishing; ShinyHunTER
Air Côte d’Ivoire confirmed a February 8 cyberattack that affected parts of its information systems and prompted business continuity measures. INC claims it stole 208 GB of data; authorities and experts are investigating.
A hacker-forum post claims a threat actor exfiltrated a 3.6 TB archive from an ANSI internal vault, including more than 25,200 documents and committee records. The article provides no independent confirmation of the claim.
StepSecurity reports that cline 2.3.0, published on npm on Feb. 17, contained a post-install script that silently installed OpenClaw. About 4,000 downloads were recorded before maintainers deprecated it roughly eight hours later.
Bourg-Achard says a cyberattack on its municipal IT services on January 29 caused a data leak. The town strengthened security, notified authorities and urged residents to watch for fraudulent calls, texts and emails.
Wiz says a misconfigured Supabase database exposed Moltbook agent tokens, email addresses, private messages and write access. The team secured the database after coordinated disclosure; Wiz says data accessed during research and verification was deleted.
Office Peeps reported an unauthorized actor accessed and acquired files during an October–November 2025 intrusion. Names were confirmed exposed; other data elements and the number affected were not disclosed. The company says it secured its network and offered identity-
Chonnam National University Hospital said a ransomware-classified cyberattack disrupted remote access to imaging results. It restored its network the same day; no disruption to surgery or treatment, or patient data leak, was reported.
Attackers used valid RDP credentials to enter a network, create privileged accounts, exfiltrate files, and deploy Lynx ransomware on backup and file servers over a nine-day intrusion.
A Hunt IO investigation found attackers exploited React2Shell (CVE-2025-55182) on a production Next.js app, confirmed command execution, and attempted to deploy malware and persistence. Container restrictions blocked much of the activity, but logs showed integrity alert
Darktrace describes a manufacturing customer attack involving scanning, credential brute-forcing, data exfiltration over SSH, and file encryption over SMB. The ransom note claimed DragonForce affiliation, which the case study says is unconfirmed.
Huntress observed more than 100 SonicWall SSLVPN accounts compromised across 16 customer environments, with activity beginning October 4. Some intrusions included network scanning and attempts to access local Windows accounts.
Darktrace describes a suspected Akira intrusion at a US customer involving a SonicWall VPN, credential abuse, lateral movement, and about 2 GB of data exfiltration. MDR and automated response helped contain activity before further escalation.
Malicious Nx package versions published August 26, 2025, harvested developer secrets and exposed data in public GitHub repositories. Stolen tokens were later used to publish more than 5,500 private repositories; Wiz recommends removing affected versions and rotating at‑
CloudSEK reports that a vendor’s publicly accessible .git repository exposed over 20 GB of source code, credentials, customer and merchant PII, and financial documents linked to automotive services in India.
An unauthenticated API endpoint issued overprivileged Microsoft Graph tokens, making data associated with more than 50,000 Azure AD users—including executive information—accessible.
Darktrace detected a customer device connecting to suspected AsyncRAT infrastructure in late 2024 and blocked suspicious connections, halting the compromise before sensitive data was exfiltrated.
4chan went offline in April 2025 after a hacker reportedly accessed its backend. Reports described leaked source code, staff information, archived posts and 4chan Pass user data; the site later returned with apparent security changes.
CloudSEK reports that exposed database credentials in a publicly accessible .env file enabled root-level access to BWSSB’s database, compromising more than 290,000 applicant records. The credentials were later invalidated; a claimed backdoor was unverified.
CloudSEK’s BeVigil scanner found unauthenticated API endpoints at an unnamed technology service provider, exposing more than 33,000 employee records and internal asset and project information.
A security assessment found a publicly accessible backup file containing bank customer data, credentials, authentication tokens, cryptographic keys, logs and decompiled source code. The article recommends securing backups and rotating exposed credentials.
