TeamUpdraft breach exposes UpdraftCentral keys to takeover
TeamUpdraft says its customer database was accessed on Oct 17–18, exposing UpdraftCentral connection keys that can push plugins to linked WordPress sites. Delete keys now.
Stories tagged: #breach
Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a cyberattack that disrupted websites, apps and deliveries across US and European brands. No actor has claimed it.
Nikkei breach exposes 1.83M records via a dev system
Nikkei says attackers used stolen credentials to reach a development system on October 7, exposing 1.83M personal records held in the cloud. No card data; no actor named.
Zeabur shuts down after second breach hits 321,810 accounts
PaaS Zeabur will wind down by Dec 31 after a second breach in two months exposed 321,810 accounts and 3.2M env-var records via plaintext internal credentials.
Stolen login exposes California student records at ETS
A compromised credential let an intruder copy California student files from an ETS SFTP site between May and September 2026. Names, birth dates, addresses, and state IDs were exposed.
GhostAction hides a credential stealer in a fake font file
A second-stage stealer disguised as fa-solid-400.woff2 was planted in 94 GitHub repos, harvesting AWS, npm, SSH, and Claude/Gemini keys via a VS Code tasks.json trigger.
OpenCode breach may have exposed users' AI provider keys
OpenCode says an intruder reached a legacy Console system and may have exposed OpenAI, Anthropic, and Google API keys for ~1.4% of Console users. Anthropic revoked affected Claude keys.
Anne Arundel County confirms breach; Rhysida claims 2.6TB
Anne Arundel County, Maryland confirmed an August breach in which an intruder copied files from county systems; the Rhysida gang claims 2.6 TB of data and demands a $2M ransom.
Burger King Japan breach exposes 11.18M app member records
Burger King Japan says an intruder accessed a server holding 11.18 million official-app member records — names, dates of birth, email and phone — between Oct 2 and Oct 7.
Russia reportedly detains DataSuckers extortion suspects
Russian and Kazakh media report four suspects tied to the DataSuckers extortion crew — behind breaches at Dodo Pizza, Tez Tour and Ukraine's ATB — three detained, one at large.
AOMEI Backupper update servers hijacked to push a backdoor
GTIG and ManageEngine say attackers tampered with AOMEI Backupper's update files in minutes-long windows from May to July 2026, delivering the SHINYROAD backdoor. No fixed version yet.
BAE security incident halts US bankruptcy court notices
A security incident at BAE Systems' Bankruptcy Noticing Center took federal court notice systems offline from October 9. The AOUSC says BAE is still investigating; no data loss confirmed.
UK Legal Aid breach wider than first said, records to 1978
A forensic review of the April 2025 Legal Aid Agency breach found stolen records dating to 1978 and ~250,000 predating 2007. Hackers claim data on 2M+ people.
Fake Arch AUR packages impersonate yay and paru, run as root
An AUR account uploaded typosquatted yay/paru packages whose install scripts fetched and ran a remote shell as root; the AUR team banned the account on October 13.
CenterPoint Energy breach hits 1M+ Texans, utility confirms
CenterPoint Energy told the Texas AG that 1,062,060 residents had names, addresses, SSNs and driver's license numbers exposed; a forum hacker claims 7.49 million records in all.
OLVX marketplace admin charged in North Macedonia
North Macedonia charged a 20-year-old alleged administrator of the OLVX cybercrime market, which the FBI says sold stolen data and phishing kits via 1,500+ seller accounts from 2023 to 2025.
DOJ charges 14 over North Korean IT-worker laptop farms
An Ohio indictment charges 14 over the North Korean IT-worker scheme: stolen identities used to land remote US jobs, ~$3M from 70+ companies, and 187 computers seized in Texas.
OpenAI engineer arrested over hidden office recording device
Abdulrahman Alfozan, an OpenAI engineer, was arrested after the company found a concealed audio recorder in an executive conference room and traced it to him. He faces up to five years.
Ahold Delhaize takes systems offline after cyberattack
Ahold Delhaize pulled systems offline on October 12 after a security incident, knocking out websites, apps and online grocery across Albert Heijn, Delhaize and US brands. Stores stayed open.
Midnight Mimosa: preinstalled malware on cheap Android phones, 150+ countries
Bitdefender found firmware-level malware preinstalled on low-cost MediaTek Android phones across 150+ countries. It runs ad fraud and can enrol devices as proxy relays. Removal needs a firmware fix.
Ledger confirms hardware implant in reseller-sold wallet amid theft reports
Ledger paused sales through Malaysian reseller CryptoBilis after confirming an unauthorized hardware implant in at least one device. On-chain investigators estimate $72M–$87M drained.
Contractor malware exposes 8.7M Daiichi Kosho karaoke records
Malware at Nippon Columbia Group, a Daiichi Kosho contractor, put about 8.7 million karaoke customer and employee records at risk. No leak confirmed yet.
iRhythm breach notices put patient data theft at 360,000+
iRhythm is filing state breach notices for a June social-engineering attack on third-party-hosted apps that exposed data on at least 360,000 cardiac-monitoring patients.
Krebs names ShinyHunters arrest as a ransomware negotiator
KrebsOnSecurity names the man the FBI arrested over the ShinyHunters probe as Edward Dubrovsky, co-founder of ransomware-negotiation firm Cypfer. The FBI has not confirmed the identification.
GhostAction supply-chain attack returns, hits 340+ repos
The GhostAction campaign is back: malicious GitHub Actions workflows pushed to 340+ repos via two hijacked maintainer accounts, exfiltrating secrets to a hard-coded IP over plain HTTP.
Engineer gets 32 months for locking out his own employer
Daniel Rhyne, a core infrastructure engineer, was sentenced to 32 months for deleting admin accounts and demanding 20 BTC from the New Jersey industrial firm that employed him.
South Korean banks breached with AI agents, CrowdStrike says
CrowdStrike says a single operator ran intrusions at South Korean banks — including Shinhan and KB Kookmin — using the open-source ARTEX agent driven by DeepSeek, Claude Code, GLM and Grok.
YMCO leader pleads guilty to running 15,000 money mules
Oleg Korniev, a principal of the 'Your Mule Cashout' service, pleaded guilty to laundering proceeds from compromised US bank accounts using more than 15,000 money mules.
FBI arrests another ShinyHunters suspect over FBIjobs breach
FBI Director Kash Patel says agents arrested another suspected ShinyHunters co-conspirator tied to the FBIjobs.gov breach. The New York Times reports a Canadian national held in Pennsylvania.
ASOS app hijacked to push Snowflake extortion message
On 6 October, ASOS customers got an in-app 'ASOS HACKED' push claiming a compromised Snowflake instance. Snowflake says its platform was not breached; the scope is unverified.
Denmark CPR register breach exposes 8.8 million people
Unauthorized parties abused a Danish company's lawful CPR lookup access to pull names, addresses and CPR numbers for 8.8 million people over roughly ten days in September.
FBI blames contractor's missed patch for ShinyHunters breach
The FBI says a contractor failed to apply a patch for the Oracle PeopleSoft flaw CVE-2026-35273, leading to the ShinyHunters theft of employee data. The contractor was removed.
Ukraine grocery giant ATB confirms breach; DataSuckers extorts
ATB, Ukraine's largest grocery chain, confirmed a cyberattack after DataSuckers posted a $400,000 extortion demand and claimed data on 7.9 million customers. ATB disputes any customer-data loss.
Denmark CPR register breach exposes 8.8 million people
Denmark says unauthorized searches of its Central Person Register exposed names, addresses and CPR numbers for 8.8 million people, via a private company's legitimate access.
DTU breach exposes CPR numbers on up to 200,000 people
Attackers used stolen credentials to raid DTU's DTUBasen identity system, exposing CPR numbers and personal data on up to 200,000 current and former users dating to 2003.
Proofpoint: TA419 phishes US AI policy circles via BitB OneDrive
Proofpoint ties China-aligned TA419 to credential phishing against US AI policy experts, using Frameless BitB to spoof Microsoft OneDrive logins and steal MFA-backed sessions.
ShinyHunters member 'Rey' detained in Jordan, aiding FBI
Reuters reports Jordanian authorities detained Saif al-Din Khader, alias 'Rey', who is cooperating with the FBI to locate other ShinyHunters members. He is a suspect, not charged.
Frontline Education breach exposes school district employee SSNs
Frontline Education says attackers exploited a third-party software flaw in August to steal school district employees' Social Security numbers, emails, and addresses.
Alleged Mabna hacker Amir Barati extradited to US from Montenegro
Amir Barati, named in a 14-count DOJ indictment over the Mabna Institute campaign against 144 US universities, was extradited from Montenegro. He is accused, not convicted.
Microsoft's X account hijacked in $Clippy crypto pump-and-dump
Microsoft confirmed unauthorized access to its 13M-follower official X account on Oct 2 after it promoted a fake $Clippy token. Posts were removed within about half an hour.
Vicksburg, Mississippi shuts down city systems after ransomware
Vicksburg mayor Willis Thompson says a ransomware incident forced the city to take systems offline on Oct 2. Emergency services are unaffected; utility payments are down. FBI and DHS are assisting.
Fakturownia breach exposes data on Polish invoicing platform
Polish invoicing provider Fakturownia says an attacker exploited a flaw to reach servers holding account data, password hashes, bank details and tokens; 'Fingerprint' claims 6 TB.
MetaMask exits Lido validators after staking-infrastructure incident
MetaMask is pulling its Lido-operated Ethereum validators after an 'ongoing security incident' hit part of its infrastructure. It says wallets face no immediate threat.
Pentagon DMDC breach exposes data on 3 million people
The Defense Manpower Data Center says unauthorized users held access to a file-sharing server for nine months, exposing SSNs and military records on more than 3 million people.
Talos: China-nexus UAT-11587 hits Asian governments with Antino
Cisco Talos ties China-nexus UAT-11587 to spear-phishing on 16 government and policy targets across 8 Asian countries, deploying the Rust 'Antino' backdoor via M365 dead drops.
Zammad zero-days (CVE-2026-102489/102490) chained to root; patch now
DIVD says two Zammad zero-days were chained for unauthenticated root RCE — and that its own network was breached by an autonomous AI agent. Fix is in version 7.
Bitget blames $387M crypto theft on zero-days in security appliances
Bitget says attackers stole roughly $387M by exploiting zero-days in two third-party security appliances, then spoofed its payout authorization; the exchange suspects North Korea.
France's DGFiP breach: 350k+ people hit via stolen passwords
ANSSI's report on the French tax administration breach: attackers used stolen staff credentials against password-only portals, exfiltrating data on 350k+ individuals over seven undetected weeks.
Estée Lauder confirms Oracle EBS zero-day breach in Cl0p campaign
Estée Lauder notified the California AG on July 21 that Cl0p exploited Oracle EBS CVE-2025-61882 to steal HR data — names, SSNs, passports, bank accounts, health records — starting August 2025.
Texas Parks & Wildlife vendor breach hits 3M license holders
TPWD says a third-party license vendor was breached, exposing driver's licenses, passport numbers, emails, phones and addresses for 3M+ hunting and fishing customers. SSNs and financials not affected.
FortiBleed dumps 73,932 Fortinet firewall creds; CISA orders resets
Researcher Bob Diachenko found an open attacker server holding plaintext admin and SSL VPN credentials for 73,932 FortiGate appliances across 194 countries. CISA issued reset guidance June 18.
Mastra npm scope hijacked: 142 packages backdoored via easy-day-js
Microsoft documents the @mastra npm takeover: 142 packages republished in 88 minutes on June 17 with the easy-day-js typosquat, dropping a cross-platform Node.js infostealer.
Canvas LMS breach: ShinyHunters claims 275M records; Instructure says it paid for deletion
ShinyHunters exfiltrated 3.65 TB from Instructure's Canvas LMS, defaced login pages at 330 schools, then accepted a payment in exchange for 'returning' the data. The data is still out there.