Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2317 articles
A security assessment found a publicly accessible backup file containing bank customer data, credentials, authentication tokens, cryptographic keys, logs and decompiled source code. The article recommends securing backups and rotating exposed credentials.
An unauthenticated Apache Superset dashboard at a financial institution’s vendor exposed sensitive lending data, including records for over 2.6 million allocated accounts and $110 million in outstanding loans.
Darktrace reports that email bombing and fake Microsoft Teams calls led a customer employee to disclose credentials via Quick Assist. The attacker then performed network reconnaissance and attempted SMB/NTLM access; security teams intervened.
CloudSEK reported that an unauthenticated Jenkins instance exposed multiple servers, credentials, and a production database containing customer and employee PII. The organization isolated servers, revoked exposed credentials, and strengthened access controls.
CloudSEK says exposed supplier credentials enabled access to a communications portal, 32 cloud accounts, call recordings and transcripts, and tools to message over 50,000 users. The company reports that its discovery enabled mitigation.
CloudSEK says a 10,000-line sample and other evidence support claims that Oracle Cloud customer data was stolen, affecting 1,500+ organizations. Oracle denied a breach; CloudSEK recommends credential rotation and investigation.
A compromised tj-actions/changed-files action ran malicious code in affected workflows, exposing secrets in logs. Wiz identified dozens of impacted public repositories; maintainers reverted the malicious commits, but exposed credentials may still require rotation.
Wiz found an unauthenticated DeepSeek ClickHouse database exposing over a million log entries, including chat history and secrets. Wiz disclosed the exposure, and DeepSeek secured it.
The Reich 5 gang used Svpeng Android malware to steal banking credentials and intercept SMS codes, taking more than 50 million rubles from over 30,000 bank clients before Russian authorities arrested four members in 2015.
Attackers reportedly used a maintainer’s stolen token to inject malicious code into lottie-player 2.0.5–2.0.7, prompting wallet connections on affected sites. The versions were removed; sites should update to 2.0.8 or revert to 2.0.4.
A hospitality customer confirmed an attacker used caller-ID spoofing to trick a remote employee into approving MFA, then accessed the network through the VPN. Darktrace detected reconnaissance and attempted lateral movement and applied containment actions.
Group-IB describes how the PhishEye group used banking Trojans, phishing pages, and phone scams to steal from thousands of Russian bank customers before its leaders and accomplices were arrested and sentenced.
Leak-Lookup said a misconfigured server exposed its database of previously leaked records, prompting the “Mother of All Breaches” report. The company said it secured the server and that registered-user information did not appear compromised.
AnastasiaDate suffered DDoS extortion attacks in 2015 and 2016. Group-IB and Qrator Labs helped identify two Ukrainian perpetrators, who pleaded guilty and received suspended sentences in 2018.
Dark-web sellers and forum users claimed to offer and share 23andMe data, including personal and genetic details. 23andMe said the data was obtained through credential stuffing and reported no evidence of a breach of its IT systems.
Wiz says a Microsoft AI research SAS token exposed 38TB of private data, including workstation backups, credentials and Teams messages. Microsoft invalidated the token in June 2023.
Attackers used two compromised vendor email accounts to redirect a roughly $103,000 payment. Huntress stopped the transfer by calling to verify new bank details, and the vendor’s IT team investigated the compromise.
SATS ASA says new indications may mean an earlier incident involving unauthorized access to part of its IT environment is more extensive than first assessed. The investigation continues; member-system involvement and data exposure have not been indicated.
Huntress reported three Microsoft 365 compromises across one MSP’s clients in 72 hours, involving malicious inbox rules. In one case, an attacker abused administrative permissions to access multiple mailboxes.
St James’ Anglican School says unauthorized access to its systems involved personal information about members of its community. The school contained the incident, notified families and reported it to Australian authorities; its investigation is ongoing.
Catalan officials say Ransom Home demanded $4.5 million to prevent publication of information accessed in an attack on Hospital Clínic de Barcelona. The hospital will not pay; medical services were disrupted, with recovery underway.
Huntress says attackers exploited Log4Shell to target VMware Horizon servers, affecting a Blue Tree Technology machine despite prior server patching. Its ThreatOps team identified malicious commands and helped partners remediate the threat that day.
Huntress reported an unknown actor brute-forced an orphaned Windows QA VM using weak RDP credentials. The company said its investigation found no access to customer data or production systems and that it rebuilt the environment with security changes.
A REvil spokesperson said the group’s Tor services were hijacked using keys held by former representative Unknown. The report describes the group’s disputed return and growing distrust among darknet forum users.
