Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Moldova Probes Possible Foreign State Involvement in Major Cyberattack Exposing Government Data

  The Moldovan authorities are looking into whether the large cyber attack, which caused sensitive personal data to be breached and dozens o...

All the recent news you need to know
Third-Party Security Risks
airline cybersecurity Amadeus Data Breach Aviation Cybersecurity Customer Information Leak Data protection Japan Airlines Data Breach Japan Cyber Attacks Passenger Data Exposure Third-Party Security Risks

Data Breach at Japan Airlines Adds to Japan's Mounting Cybersecurity Challenges


A data breach has been reported by Japan Airlines (JAL) involving approximately 92,000 customers following unauthorized access to its third-party technology provider, Amadeus IT Group, which exposed passenger reservation information. Due to several recent major cyber incidents reported by Japanese companies, this incident has raised further concerns about the security of customer data handled by external service providers. 

Japanese Airlines and Japan Transocean Air use Amadeus' passenger services systems for flight reservations, ticketing, and check-in operations. According to the airline, Amadeus informed them on October 23, 2026, that unauthorized access to their systems had occurred. This incident involved the breach of customer reservation records stored within the provider's environment. 

Passenger information included names, reservation codes, flight dates, routes, and travel classes of passengers that had been compromised. It is estimated that 90,000 customer information has been exposed. A second 2,000 passengers were also exposed with additional personal information contained in the compromised records, including passports, nationalities, frequent flyer numbers, email addresses, phone numbers, and flight, ticket, and seat numbers. 

According to reports, the unauthorized access occurred from August 10, 2023, to September 23, 2026, suggesting that the affected environment may have been exposed for an extended period of time. Although the method employed by the attackers to gain access has not been publicly disclosed, Japan Airlines has clarified that credit card information and passwords were not compromised in the incident. 

In addition, Amadeus has reportedly implemented security measures to address the issue, as the airline states there is no evidence that the exposed information has been misused and that flight operations have not been disrupted. According to JAL, affected passengers will be contacted individually and provided with necessary assistance. 

Customers were also warned against phishing emails, fraudulent phone calls and suspicious websites impersonating the JAL Group, since exposed travel and contact information might be used in targeted scams. In addition, this incident highlights the risk that third-party technology providers pose in the aviation industry. 

With its digital infrastructure providing airline, airport, hotel, and travel agency customers around the world, Amadeus makes security a critical concern for many organizations. Several airlines have reported possible exposures involving Amadeus systems, extending the impact beyond Japan Airlines. According to Korean Air and Asiana Airlines, unauthorized access to customer information managed by the same technology provider has been reported. 

It is reported that both airlines were notified of the incidents by Amadeus on October 20 and reported them on October 23. Based on their initial findings, it appears that reservation reference numbers belonging to some customers were exposed. Also pointed out was the unauthorized use of credentials related to an Amadeus system account. 

An incident similar to this one has also been reported by All Nippon Airways (ANA), another major Japanese airline. A notification of unauthorized access was received on October 29 by the airline and the provider is currently working to determine the extent of the exposure. As of now, ANA has not released the number of affected passengers or the specific categories of information affected. 

Once additional information has been confirmed, ANA will inform customers. These incidents have raised questions about the security of Amadeus's travel booking infrastructure as a result of their connection. As of October 1, the company disclosed a vulnerability in its travel booking display environment that may be exploited by ransomware actors. 

At that time, Amadeus stated that payment and other financial details had not been exploited by ransomware actors. Following the disclosures by multiple airlines, a closer examination of the earlier security issue has taken place. Amadeus provides technology services to more than 400 airlines, hotels, airport operators, and travel agents. 

In the event of a security vulnerability in a widely utilized platform, information could be exposed to several organizations, although it remains unclear how many airlines and passengers are affected. A person who has access to passenger names, travel schedules, and booking references may use these information to create convincing communications impersonating airlines using the exposed reservation information. This may also lead to opportunities for targeted phishing and identity fraud. 

It may be more credible for such attempts to possess additional information, such as passport numbers, email addresses, and telephone numbers. A broader cyber threat has prompted government intervention in Japan, as Prime Minister Sanae Takaichi called a cabinet meeting on October 26 to discuss the recent attacks and announced plans for emergency measures to strengthen cybersecurity protections for citizens and businesses. Her concern was expressed regarding the potential harm that might result from the misuse of personal information stolen. 

When Shinjiro Koizumi and U.S. Defense Secretary Pete Hegseth met in the Philippines on October 28, cyber security concerns of Japan were also discussed. Both sides agreed to intensify cooperation against malicious cyber activities that could adversely affect citizens, economic operations, and national security. 

Amadeus is still investigating these incidents, with the total number of passengers affected, the method by which the unauthorized access occurred, and the possibility of additional airline victims still being determined. It is evident from this incident that third-party technology providers in the aviation sector pose security risks. There remains an urgent need for stronger safeguards and a greater level of oversight in order to protect passengers' information as investigations continue to span multiple airlines.
Read more »
Ransomware
Data Breach energy company France GDPR Ransomware

French Energy Giant ENGIE Hit by Data Breach, Customer Records Accessed Through Partner Platform

 


ENGIE, one of the world's largest energy companies, has notified customers in France that an unauthorized third party accessed their personal data through a marketing platform used by the company's business partners, the company confirmed this week.

The breach notification letters, dated October 23, went to affected customers after ENGIE said it detected "unusual data access activity" on the partner tool. The company has not stated exactly when the intrusion took place or how long the attacker had access before it was caught.

According to the notifications, the data the intruder obtained includes customers' first and last names, mailing addresses, email addresses, and phone numbers. It also includes two types of energy infrastructure identifiers specific to the French grid: the Delivery Point identifier (PDL) and the Metering and Estimation Point identifier (PCE). Both codes are tied to a customer's physical connection to the gas and electricity supply network. Customer IDs and contract numbers were also taken.

ENGIE said no banking data was involved, and that the breach was confined to the partner-facing marketing platform rather than any of its internal systems. The scope of the incident is currently limited to its French customer base, though the company has not said how many customers received notifications.

"We have cut off the attacker's access to the platform, notified the relevant authorities, and are directly informing each affected customer," the company said in a statement.

Customers were advised to stay alert to unsolicited contact and potential phishing attempts in the wake of the exposure.

No ransomware group or extortion actor had publicly claimed responsibility for the breach at the time of publication.


A Company With a Recurring Target on Its Back

ENGIE operates across 30 countries, employs more than 90,000 people, and posted €71.9 billion in revenue last year. Its scale across utilities, renewables, and energy infrastructure makes it a high-value target for threat actors looking for customer data at volume.

This latest breach is not the first time attackers have made it inside ENGIE's wider corporate ecosystem. Approximately a year ago, the Scattered LAPSUS$ Hunters group claimed it had breached a Salesforce instance belonging to Engie Records, the retail energy subsidiary of ENGIE North America, and leaked records from the intrusion. Engie Records appeared on the group's leak site as the 27th of 39 organizations allegedly hit through the same Salesforce-related campaign, with around 3GB of data listed.

Before that, in August 2023, a separate incident affected roughly 110,000 French ENGIE customers. In that case, a hacker known online as "HommedeLombre" reportedly got into ENGIE's systems through an external contractor's network, a technique also used in the Pôle Emploi breach around the same period. That attacker exposed names, email addresses, and phone numbers, and later said the intrusion was meant to demonstrate that "nothing is ever secure," citing rising gas prices as a grievance. ENGIE filed a complaint with authorities following that incident and said it had brought the affected system under control.

If we look closer to understand the link here, the three incidents point to a recurring problem: ENGIE's data, whether held by internal systems, subsidiaries, or third-party partners, keeps ending up in attackers' hands.


Why Energy Sector Customer Data Is Valuable

The combination of contact information and energy-specific identifiers like PDL and PCE codes makes the stolen data more useful to attackers than a standard contact list. Those codes link a name and address to a specific gas or electricity metering point in the French national grid, which means the data could be used to convincingly impersonate ENGIE in phishing campaigns or to target customers with fraudulent offers around energy billing or contracts.

France's energy market also went through a turbulent period of price volatility in recent years, which means many customers have been actively comparing suppliers and receiving legitimate outreach about tariff changes. That context makes it easier for fraudsters to craft believable messages that reference contract numbers, delivery point details, and billing information, exactly the kind of data now in circulation.

ENGIE said it has notified the relevant authorities, as required under GDPR. French data protection rules mandate that breaches of personal data be reported to the CNIL, the national data protection authority, within 72 hours of detection, and that affected individuals be notified without undue delay when the breach poses a risk to their rights and freedoms.

As of now, ENGIE has not attributed the breach to any specific threat actor, and it is unclear whether the platform through which the data was accessed belonged to an external vendor or an internal partner system. The investigation appears to be ongoing.



Read more »
Healthcare Data
Cyber Networks Cyber Security Cyberattacks cybersecurity in healthcare Data protection data security Data Theft Healthcare Data

Cybersecurity Incident Disrupts New Mexico Hospital Network, Forcing Patient Diversions and Clinic Closures

 

A cybersecurity incident caused ambulance diversions, cancelled appointments and disruptions to medical facilities around the state on Monday October 26, leaving New Mexico with no emergency departments able to treat the most severe traumatic injuries. The University of New Mexico Health System provides the only level 1 trauma centre in the state. 

The health system advised patients not to attend the main hospital in Albuquerque and cancelled appointments at over 30 clinics whilst they tried to resolve the issue. Although officials did not immediately say what exactly had happened, later in the day it was announced that parts of the hospital and clinics were beginning to get back up and running. Presbyterian Healthcare Services and Lovelace Health System are also large healthcare providers in the state and worked with the network to prepare to take in extra patients. 

The University of New Mexico Health System sees around 900,000 outpatients and 100,000 emergency department patients per year (University of New Mexico Health System website), meaning this is a large part of the healthcare system. Multiple staff reported seeing messages on their computers late Monday morning stating that student, staff and patient data had been stolen. A spokesperson for the health system did not want to comment as they said there was an ongoing police investigation. 

An FBI spokesperson confirmed that they were assisting a partner organisation but did not give any further details. Attempts to comment were also sent to the Bernalillo County Sheriff’s Office and Albuquerque Police Department. This incident comes as there has been ongoing concerns about attacks on digital systems within essential services such as healthcare. Ransomware requests and other cyber incidents have been seen with hospitals for around a decade, however it is unusual for messages to be shown on computer systems due to the breach (Josephine Wolff, Professor of Cybersecurity Policy at Tufts University). 

This shows how difficult it can be for organisations to protect their networks. The impact could be seen throughout Albuquerque and surrounding areas. At the main hospital, staff in turquoise uniforms were directing patients away from the waiting area and advising they may have their appointments cancelled. Patients arriving at a medical centre in Rio Rancho were also told by security guards to rearrange their appointments. 

The University of New Mexico’s Health Sciences Centre, the largest academic medical centre in the state, cancelled Monday and Tuesday classes. Staff working in the hospital and medical group will be returning on Tuesday. It has not been confirmed what caused the incident, if data has been extracted or if there was a ransom request. The investigation is ongoing.
Read more »
Warp Breach
Agent Logs AI Security Data Breach Telemetry Exposure Warp Breach

Warp Breach Exposes AI Agent Logs and Telemetry

 

Warp has disclosed a security incident involving a third party infrastructure vendor that exposed AI agent decision logs and user telemetry. Chief executive Zach Lloyd estimated that approximately 1% of users could be affected, while emphasizing that the investigation remains ongoing. The disclosure identifies an exposure of operational records rather than establishing a compromise of every component in Warp’s development environment. The vendor, initial access mechanism, affected infrastructure components, and precise data boundaries have not been publicly identified, limiting independent assessment of the incident. 

Warp combines terminal functionality, a code editor, task orchestration, and agent activity review within an agentic development environment. Developers use its AI agents to generate code, execute tests, and deploy software. Consequently, agent traces and telemetry represent records associated with automated development workflows, although their exact contents vary with implementation. Warp reports at least 800,000 users, but its preliminary estimate of affected users does not establish the number of exposed records, compromised sessions, or affected organizations. Those measurements describe different dimensions of a security incident.

According to Lloyd, Warp detected what it believed was active, narrowly targeted exploitation of an infrastructure vendor on Friday and intervened within hours. The company described an attacker operation involving an “agent swarm,” sophisticated penetration techniques, and privilege escalation. However, the disclosure does not provide enough technical detail to reconstruct the attack chain or verify individual exploitation stages. No publicly identified vulnerability, authentication bypass, compromised identity, or execution mechanism has been specified. Claims about particular exploit classes would therefore exceed the available evidence. 

The exposed data categories were agent traces and telemetry. Warp has not established publicly whether these records included source code, user prompts, credentials, or other sensitive content. This uncertainty prevents a definitive assessment of confidentiality impact or potential secondary compromise. Exposure of operational logs should not automatically be equated with theft of API keys or unauthorized access to customer repositories. Warp notified identified affected users, informed the vendor, engaged CrowdStrike to assist with investigation, and contacted law enforcement. Further findings are needed to establish scope. 

A separate incident involving AI coding platform OpenCode illustrates why data classification matters when comparing breaches. That compromise exposed stored API keys for external providers, affected approximately 1.4% of users, and resulted in unauthorized charges reaching $1,700 for some victims. Equivalent credential exposure or financial abuse has not been established for Warp. The technical questions remain which records were accessible, what sensitive fields they contained, and how vendor access enabled their exposure. Until those details emerge, conclusions about downstream exploitation must remain provisional.
Read more »
Plausible Vulnerability
Brazilian Cybercrime Credit Card Theft Cyber Attacks e-commerce security Magecart Attack Online Payment Security Payment Card Skimming Plausible Vulnerability

Brazilian Magecart Group Exploits Plausible Installation to Steal Checkout


Data Magecart, a Brazilian group of hackers, compromised the analytics script used by e-commerce platform Convertr, potentially revealing payment information provided by customers to dozens of Brazilian fashion brands. During the attack, which was detected by cybersecurity firm Sansec on October 24, 2026, malicious code was injected into Convertr's Plausible analytics tracker. 

By modifying a JavaScript file loaded into Convertr's merchant checkouts, the attackers allowed the card skimmer to collect sensitive information during online purchases by modifying the JavaScript file. The data obtained was comprised of card numbers, expiration dates, CVV security codes, cardholder names, and Brazilian CPF taxpayer identification numbers. 

The information was transmitted to a server controlled by the attacker at 1x0.is. Online shopping and checkout services are provided by Convertr to dozens of Brazilian fashion retailers. According to the platform, its merchants have processed more than R$2 billion in sales. Due to the fact that the affected analytics tracker was distributed throughout its merchant network, compromising one file created a potential supply chain risk that extends beyond one individual online store. 

The malicious script was detected by Sansec after a clean version was captured earlier on October 24th. In October, the attackers modified the skimmer in order to target Convertr's payment API field names, making it more effective in capturing payment information. Researchers also reported that the compromised tracker continued to serve on October 26, despite efforts to notify Convertr. 

As Sansec has been tracking the Brazilian Magecart group since July 2024, the incident represents a significant development in its activities. The group has previously targeted individual online stores using Magento, OpenCart and WooCommerce, mainly in Brazil. With the Convertr compromise, Sansec has shifted from infecting individual stores to compromising a service shared by multiple businesses, resulting in the first supply chain attack attributed to the group. 

An unpatched installation of Plausible Community Edition, an open-source web analytics platform, is believed to have been the source of the attack. Versions 3.0.0 through 3.2.0 were affected by CVE-2026-8467, a critical vulnerability that could allow unauthenticated command execution through an exposed component of the /storybook component. 

Convertr reported installing version 3.0 in 2025 and not updating it prior to the incident. On May 15, 2026, Plausible released version 3.2.1 which fixed the vulnerability. Since researchers were not able to access the platform’s server logs, Sansec has not confirmed that the vulnerability was exploited to gain access. Therefore, it remains unclear what specific method was used to compromise the analytics server. Furthermore, the group has consistently targeted Brazilian payment systems as a focus for their methods. 

According to Sansec, its skimmers exhibit recurring characteristics, including the use of short-lived domains as recipients of stolen information, and endpoints containing Portuguese names related to card payments. Other variants have also been developed to attack payment services, including e.Rede, PagSeguro, Pagar.me and Mercado Pago. 

Another version is reported to replace genuine PIX payment QR codes with malicious codes. Convertr confirmed on October 27 that Plausible had been updated with a patched version following the discovery of the malicious script. In addition to notifying affected merchants, payment providers, and relevant authorities, the company also verified that the tracker hosted on Convertr's analytics server was free of infection. 

While it is important to remove malicious code, it does not necessarily eliminate all immediate risks for all shoppers. Sansec stated that browsers may retain cached copies of infected scripts for up to 24 hours following the server-side cleanup, potentially allowing the malicious code to remain active during that period. 

Payments made by Brazilian customers through checkout addresses containing checkout.convertr from October 24 onward should be blocked and replaced by their banks. It is also recommended to monitor transactions for suspicious activity involving CPF identification numbers in order to identify suspicious activity. 

A Sansec recommendation for organizations using Plausible Community Edition is to update the version to 3.2.1 or later and to review server access logs for requests to the exposed path of /storybook. Upon detecting evidence of exploitation, the affected server should be rebuilt, secrets rotated, tracker files checked against the official release, and a more thorough investigation conducted. The incident emphasizes the wider risks associated with shared web infrastructure. 

Multiple businesses can be affected by compromised analytics scripts without the attacker having to breach each merchant individually. To reduce the risk of similar attacks, it is vital that software be updated, scripts loaded on payment pages are monitored, and unauthorized outbound connections are restricted. 

This incident illustrates the dangers posed by compromised third-party scripts used on checkout pages. Preventing digital skimming attacks requires timely software updates, continuous script monitoring, and stronger protection of payment infrastructure.

Read more »
User security
Customer Data Cyber Attacks Data Leak Genesys User security

Genesys Hack Exposes Customer Data From Internal Systems

 

Genesys, a California-based provider of customer experience and call-center technology, has disclosed a cyberattack in which unauthorized actors accessed data from internal business systems. The company said the incident affected a learning management system and a customer relationship management environment, but stressed that its core customer-facing platforms were not compromised. 

According to Genesys, attackers likely downloaded business and account information used to manage relationships with current and prospective customers. The exposed information may include names, phone numbers, business email addresses, job titles, company and account details, and other customer-interaction data. While such records can be valuable for phishing and social-engineering schemes, Genesys has not said how many individuals or organizations were affected. 

The company said it acted quickly to contain the breach, including suspending the LMS platform. By October 23, Genesys announced that the incident had been fully contained, although its investigation into the scope and impact remains ongoing. It has promised further updates as it reviews the accessed information and confirms material facts. 

Importantly, Genesys stated that its Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected. It said there was no unauthorized access to those platforms, customer and partner environments, or the data stored and processed within them. That distinction is significant because the company’s core platforms handle sensitive communications and operational data for enterprise clients. 

Genesys has not identified the attacker, but a newly emerged group called ScarlettGroup has claimed responsibility on its leak site. The company is urging customers to stay alert for suspicious messages impersonating Genesys and emphasized that it will never request sensitive information, such as passwords, through unsolicited email or other channels. The episode is a reminder that even when primary production platforms remain secure, internal systems holding customer-relationship data can still create meaningful privacy and fraud risks.
Read more »
Subscribe to: Posts (Atom)

Featured