Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Google DeepMind AI Agents Reduce the Cost of Attacking 1024-Bit RSA Encryption

Artificial intelligence (AI) agents developed by Google DeepMind have shown new ways to make attacks against legacy RSA-1024 encryption syst...

All the recent news you need to know
Information Security
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Healthcare Healthcare Breach Information Security

Amplifon Americas Data Breach Exposes Personal and Medical Information of 1.3 Million People

 

Hearing healthcare company Amplifon Americas has revealed a data breach which has led to personal information being exposed for around 1.33 million people across the United States. The records were reportedly stolen and include personal details, medical histories, health insurance information and in some cases Social Security numbers and financial information. 

The breach occurred at Amplifon Americas, the Minneapolis-based US branch of Amplifon, an Italian-based hearing healthcare company which has over 80 million members across thousands of clinics nationwide. A third party gained unauthorised access to Amplifon’s systems in January 2026 and stole data from specific systems between 18th January and 8th February. A response was made by Amplifon to limit the breach and investigate the incident. 

However, the company found it took a long time to establish how much information had been exposed. It took around eight months to complete its analysis. The investigation revealed a range of information had been stolen, including names, contact details, date of birth, drivers licence numbers and other government issued identification information. Medical information, including hearing information, other medical details, date of medical service and health insurance information had also been exposed. 

Those whose Social Security and financial information had been accessed are at greater risk of identity theft. This could increase their chances of being victims of financial fraud and other issues. Amplifon said they were not aware of any fraudulent activity using the stolen personal information but cannot rule out the possibility of future misuse. A filing was made with the Texas Attorney General’s Office by Amplifon and listed 1,332,826 individuals who had been affected by the data breach across the country. 

The company have not said any further information about who had accessed their information or how they had done so. This shows how at risk healthcare companies can be. They often hold large amounts of personal, medical and insurance information. This can be extremely valuable to cyber criminals as they will have access to a variety of different information which can be used for identity fraud.  

There is not much more information available about the breach. We contacted Amplifon to ask for more information about the breach and how many individuals were affected. More information will be available depending on their response.
Read more »
vpn
Cloud Breach Customer Data Data Breach data security Japan passwords sensitive information vpn

Japanese Homeware Giant Iris Ohyama Says Cloud Breach at Its Online Store May Have Exposed Data of Up to 7.7 Million Shoppers

 



Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its online shopping platform was accessed without authorization, potentially exposing personal data belonging to roughly 7.7 million people, including customers who never created an account.

The company, founded in 1971 and headquartered in Sendai, is best known for plastic storage solutions and home appliances sold across Asia, Europe, and North America. Its e-commerce platform, Iris Plaza, caters to millions of customers in Japan and handles a large volume of household product purchases. The scale of the breach puts it among the larger data security incidents Japan has seen this year, in a period when Japanese companies and government agencies have dealt with a string of serious intrusions.


How the Breach Was Detected

On October 28, 2026, Iris Ohyama staff detected suspicious files inside a cloud service that Iris Plaza relies on for its operations. The company did not name the cloud provider or describe the method the attacker used to get in. Within a day, the company suspended access to Iris Plaza and related systems, reported the incident to Japan's Personal Information Protection Commission, and filed a report with police.

A follow-up disclosure on November 5 gave a clearer picture of the scope: up to 5.8 million registered and former members may have had their data accessed, along with up to 1.9 million non-members, meaning people who had completed a guest checkout without registering. The fact that guest buyers are part of the exposure is insurmountable, since many people assume their data is not retained when they shop without creating an account. In Iris Plaza's case, it was.


What Data Was in the Affected System

The range of information potentially accessed varies depending on the type of account. For registered members, exposed fields can include full name, home address, phone number, email address, gender, and date of birth. Account passwords were also stored in the affected environment, though the company said they were encrypted. It did not specify which encryption method was used, leaving questions open about how resistant those passwords are to cracking.

Former members are in a slightly different position: Iris Ohyama said it does not retain passwords for accounts that have been closed, so that group faces a narrower exposure. For non-members who checked out as guests, the data stored was more limited.

One notable reassurance: the company confirmed that credit card information was not stored in the affected cloud environment, sparing customers from the most immediately damaging form of financial exposure.

As of November 5, Iris Ohyama said it had not received any communication from whoever carried out the intrusion, had not identified any perpetrators, and had not seen reports of fraudulent use or financial damage tied to the breach. The investigation into how many records were actually exfiltrated, as opposed to merely accessible, is still ongoing.


What Iris Plaza Customers Should Do Now

The company has urged customers to change their Iris Plaza passwords and, critically, to change passwords on any other service where they used the same credentials. Password reuse across sites remains one of the most common ways a single breach cascades into wider account takeovers. Anyone who shops with the same email and password combination across multiple retail or financial platforms is at elevated risk.

Iris Ohyama also warned customers to be on guard for phishing attempts. With names, addresses, phone numbers, and email addresses potentially in circulation, attackers have enough to craft convincing messages that appear to come from the company. Iris Ohyama said it will not send emails or SMS messages asking for passwords, PINs, authentication codes, or other sensitive information through links, and customers should treat any such request as fraudulent.


A Year of Costly Data Incidents in Japan

The Iris Ohyama breach lands in the middle of a rough stretch for data security in Japan. This year alone, cloud hosting provider Sakura Internet reported a hack affecting up to 1.36 million accounts, telecommunications giant KDDI disclosed a breach tied to a zero-day vulnerability in third-party software that hit around 12 million accounts across shared email platforms, and Japan's Digital Agency acknowledged that a VPN flaw exposed approximately 246,000 government personnel records. The common thread across several of these incidents is reliance on third-party services and cloud environments where access controls or vendor security fell short.

Iris Ohyama's breach fits that pattern. A third-party cloud provider, an intrusion the retailer only caught when suspicious files turned up, and millions of customer records sitting in an environment the company did not fully control. The investigation remains open, and the company has not said when it expects to restore Iris Plaza to service.



Read more »
Vulnerabilities and Exploits
Plex2Shell QNAP Security Patch Vulnerabilities and Exploits

QNAP Urges Immediate Plex2Shell Update and Remediation

 

QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later. 

Technical scope 

Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process. The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation.

Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again. 

Compromise assessment Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised. This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise. 

Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st. Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure. 

Secure reinstallation 

For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder. Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.
Read more »
Finance
AI Bank Banking Cyber Attacks Finance

Hackers Exploit Third-Party Provider to Steal $133 Million From French Bank


A major French banking group, Crédit Mutuel Arkéa, has suffered a sophisticated cyberattack that allowed hackers to carry out fraudulent financial transactions worth an estimated €118 million ($133 million). 

The attackers reportedly gained access to the bank's network through the platform of an external service provider.

The incident came to light on November 2, when blockchain investigator ZachXBT reported suspicious withdrawals involving several cryptocurrency exchange accounts. According to the investigator, the attackers had potentially stolen around €118 million and moved the funds through cryptocurrency platforms.

Crédit Mutuel Arkéa, one of France's major cooperative banking groups, officially acknowledged the cyberattack on November 4. The bank confirmed that attackers had gained unauthorized access to its systems and used an account belonging to the institution to initiate fraudulent transactions involving other banking organizations.

In a frequently asked questions section published after the incident, the bank explained that the attackers accessed its network directly through the platform of one of its service providers. However, the financial institution did not disclose the identity of the provider. It also clarified that its online banking subsidiary, Fortuneo, was not involved in the attack.

The attackers reportedly used the bank's own account rather than individual customer accounts to transfer the money. Blockchain investigators also tracked the movement of the stolen funds through cryptocurrency exchanges, where some of the money was reportedly converted into stablecoins such as USDC and USDT.

ZachXBT stated that approximately $30 million had already been laundered by November 3. Some of the stolen funds were reportedly blocked, although the complete amount recovered remains unclear. The bank has not independently confirmed the reported $133 million loss, describing the amount involved as significant while acknowledging that the final figure was still being assessed.

After the discovery, Crédit Mutuel Arkéa temporarily suspended certain operations as a precautionary measure while investigating the incident. The bank subsequently announced that the attack had been contained and that its operations were gradually returning to normal.

The financial institution reassured customers that their deposits and personal assets were not affected by the incident. However, some transfer transactions experienced delays because of the security measures introduced in response to the attack.

Arkéa also ruled out human error as the cause, describing the incident as a sophisticated external attack. It is now working with law enforcement agencies and judicial authorities to determine how the attackers gained access and carried out the fraudulent transactions.

Read more »
Hacker attack
Anti Malwares Cyber Security Developer Security GitHub GitHub malware Hacker attack

Hackers Infiltrate GitHub Projects to Infect Cybersecurity Developers With Advanced Malware

 

Cybercriminals are distributing malware through GitHub repositories designed to look like genuine development projects. Researchers at Doctor Web found malicious code in Microsoft Visual Studio projects, Python scripts and Go files. Over 2000 computers were reportedly infected with this malware. The campaign began around 2 years ago with the initial targets being cryptocurrency users. The repositories were themed around blockchain games, game bots and cheating tools. 

The repositories even included guidance for installing Visual Studio to make them seem more legitimate to less experienced developers. However the malware has now targeted information security professionals. The malicious code is hidden within repositories that claim to be for automated scanning, security testing and log analysis. The infected files have malicious code hidden in the configuration and source code of the repository. The malicious code is hidden with lots of white space. 

When the malicious project is downloaded, it runs PowerShell scripts that fetch further malicious files from external sources. This results in an archive being downloaded containing Microsoft.exe, which is a malware loader built with Electron. The malware has been identified as Trojan.Loader.3261. Once active, the malware gathers information about the system, creates persistence and downloads further payloads. It also tries to disable Windows Defender, User Account Control, alerts and recovery features. 

The malware uses various methods to avoid being monitored by security tools, hijack legitimate windows processes and avoid detection from endpoint detection systems. The malware includes payloads such as BackDoor.AsyncRAT.115 which allows the attacker to remotely access the infected computer. It also includes Trojan.InjectNET.14 which adds a cryptocurrency hijacker to the clipboard. This changes the copied wallet addresses to ones controlled by the attacker. 

It also takes screenshots of the infected system. The malware also includes JS.Stealer.191 which steals information from browsers, VPNs, messaging applications, gaming accounts, FileZilla and Discord. This information is zipped up and sent to the attacker via a Telegram bot. The malware tries to uninstall security tools from ESET, McAfee and Malwarebytes. It also changes the hosts file in windows to prevent access to certain anti virus domains. 

The researchers found multiple variations of how the malware was deployed. They also found other incomplete components which indicates that the malware is still being developed. Future features could include auto reinstall, better persistence, managing applications when they open and updating software. This shows that even information security professionals can be vulnerable to malicious resources. The researchers recommend checking any files you download, keeping anti virus databases up to date and being cautious when cloning unknown GitHub repositories.
Read more »
Supreme Court Of India
Data protection law Digital Personal Data Protection Act DNPA Petition Investigative Journalism Journalism Rights Press Freedom Privacy Right To Information Supreme Court Of India

Publishers Move Supreme Court Against Key Provisions of Data Protection Law

 


Digital News Publishers Association (DNPA), representing 21 prominent news organizations, has filed suit with the Supreme Court challenging provisions of India's Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025. As a result of the current data protection framework, journalists could be restricted in their activities, investigative reporting may become complex, and public access to information may be limited. 

Upon receiving notices from the Union Ministry of Law and Justice and Ministry of Electronics and Information Technology (MeitY) on October 27, 2026, the Supreme Court requested the Centre's response to the challenge. This case emphasizes the conflict between preserving the right to maintain an individual's digital privacy and preserving the right to investigate and report issues of public interest for the press. 

Indian Parliament passed the DPDP Act in August 2023, the first comprehensive law specifically designed to protect digital personal data. It establishes rules for organizations and other entities that collect and process personal information. Under the Act, these entities are considered Data Fiduciaries and are required to obtain the consent of individuals before processing personal data, except for certain permissible purposes listed below Section 7. 

A significant financial penalty is also introduced in the legislation, with data protection violations resulting in fines as high as Rs 250 crore. On November 13, 2025, MeitY notified the DPDP Rules for setting up the operational framework, with phased implementation over a period of 18 months. However, news publishers contend that the legislation does not specifically exempt journalistic activities from its provisions. 

A clear provision for news reporting is not provided by Section 7, which identifies legitimate purposes for processing personal information, nor by Section 17, which lists exemptions from the Act. According to the DNPA, this omission may pose significant challenges for reporters investigating individuals, institutions, or organizations. 

While investigating issues involving public accountability, journalists often obtain personal information from public records, interviews, documents, and other sources. A lack of a journalistic exemption may raise questions about whether consent is required before such information may be collected or used. Further, the association emphasized that earlier versions of data protection legislation, drafted in 2018, 2019, and 2021, included exemptions for journalistic purposes. They have been removed from the final framework and are a key part of the legal challenge. 

Moreover, the dispute also involves amendments to the Right to Information Act (RTI Act), which raise concerns regarding the impact of the new provisions on transparency and access to government information. DPDP Rule 23 also presents a challenge, which provides the Central Government with the authority to request information from Data Fiduciaries and intermediaries through an authorized agent. Moreover, the rule prohibits these entities from disclosing the fact that a request has been made.

News publishers have expressed concern over the possibility that the provision could affect the confidentiality of journalistic sources and create confusion regarding the handling of information obtained during investigations. Moreover, the association has questioned the amendment to Section 8(1)(j) of the Right to Information Act, which was implemented by Section 44(3) of the DPDP Act. 

A public authority previously had the option of withholding personal information that had no connection to public activities or that could cause an unwarranted invasion of privacy. If a larger public interest justified the disclosure, information could be released. Information related to personal information has been broadly exempted from the amended provision. 

Publishers argue that this change could make it more difficult for them to obtain government records required for investigations of matters such as conflicts of interest, public appointments and the use of public funds. Those seeking information about welfare programs, recruitment processes, and government services can also benefit from such information. However, the amendment does not remove every route for disclosure. 

Information may be released in accordance with Section 8(2) of the RTI Act when the public interest outweighs the potential harm to protected interests. Despite the government's assertion that stronger privacy safeguards are necessary for preventing misuse of personal information, the current provision pertaining to public interest continues to protect transparency as it does today. In addition, the legal dispute involves constitutional protections of privacy.

In its 2017 Justice K.S. Puttaswamy decision, the Supreme Court recognized privacy as a fundamental right under Article 21, albeit clarifying that the right is not absolute. This case raises the question as to how that protection should be applied simultaneously with freedom of speech and information access rights for the public. After issuing notice to the Centre, the Supreme Court declined to grant an interim stay on the challenged provisions before hearing the government's response. 

According to the bench, a blanket restriction on disclosure of digital personal information is not necessary, but a more proportionate approach is required. Additional hearings will be held on November 17, 2026 in regards to this matter. An examination by the court may have broader implications for how the privacy laws in India apply to news organizations, investigative reporting, and the public's right of access to public records.

It is expected that the Supreme Court's decision in this case will have a significant impact on the balance between individuals' rights to privacy, freedom of the press, and access to information for the general public. Its findings may also affect the way news organizations handle personal data when conducting investigations in India.
Read more »
Subscribe to: Posts (Atom)

Featured