Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breach. Show all posts
Voice Phishing Attacks
Data Breach Identity-Based Breaches Microsoft Entra Security Okta SSO Compromise Phishing-Resistant MFA Single Sign-On Security Voice Phishing Attacks

ShinyHunters Targets Okta and Microsoft SSO in Data Breach


 

Several voice-based social engineering attacks have prompted renewed scrutiny of single sign-on ecosystem security assumptions. The cybercrime collective ShinyHunters has publicly announced that it has carried out an extensive campaign to harvest SSO credentials from approximately 100 organizations, signaling an intentional shift toward identity-centered intrusion methods. 

As a result of the early disclosures, substantial amounts of data have already been exposed, as leaks have been confirmed to platforms such as SoundCloud, Crunchbase, and Betterment, which have affected tens of millions of user records. 

Moreover, the intrusions were not the result of software malfunctions or misconfigurations, but rather carefully executed voice phishing attacks that took advantage of human trust in modern authentication workflows to achieve success. 

A growing reality for enterprises is underscored by this tactic. As authentication becomes more centralized via single sign-on providers, compromises of individual identities can result in systemic access to entire SaaS environments, amplifying the scale and impact of these breaches. 

Once an employee's single sign-on credentials have been successfully accessed, the impact is extensive beyond the initial account compromise. By gaining access to a single sign-on identity, attackers will gain access to the organization's broader application ecosystem. 

Various SSO platforms, including Okta, Microsoft Entra, and Google, streamline authentication by federating access to a variety of internal and third-party services under a single login, which facilitates streamlining authentication. As a result of this architecture, usability and administrative control are improved, but risk is also concentrated, as a single breached identity can unlock multiple downstream systems.

The SSO dashboard provides authenticated users with an integrated view of all enterprise applications connected to it, transforming a compromised account into a digital footprint map of the organization. A number of business-critical applications are commonly integrated into platforms, including Microsoft 365, Google Workspace, Salesforce, SAP, Slack, Atlassian, Dropbox, Adobe, Zendesk, and other software as a service applications. 

ShinyHunters and associated actors have exploited this model through targeted voice phishing campaigns, impersonating internal IT personnel, and guiding victims through credential entry and multi-factor authentication challenges on convincingly replicated login portals. 

Following authentication, the attackers systematically enumerate all available applications within the SSO environment, and then begin extracting data from each platform, enabling massive data thefts and lateral expansion across interconnected services before security teams may detect any abnormal activity. 

In the aftermath of initial access, attackers began targeting cloud-based software-as-a-service environments, which are systematically targeting systems for storing corporate data and internal documents. The objective goes beyond data theft, with stolen information increasingly being utilized for subsequent extortion campaigns following the initial data theft. 

Various designations are being tracked by Google Threat Intelligence Group (GTIG), including UNC6661, UNC6671, and UNC6240, reflecting a loosely coordinated but tactically aligned group of operators employing a similar approach to intrusions and monetizations. 

The GTIG and Mandiant investigations indicate that activity associated with UNC6661 intensified in mid-January, when attackers posed as internal IT personnel to contact employees within targeted organizations. In addition to being told that multifactor authentication settings would soon be updated, victims were directed to convincingly branded credentials harvesting portals.

It was designed to capture both single-sign-on credentials and MFA codes in real-time, thereby enabling immediate account control. Mandiant confirmed that, in multiple instances, the compromised credentials came from Okta customers, as mentioned in an Okta blog posting describing a campaign employing advanced phishing kits in response to the compromised credentials. 

In a subsequent study, researchers attributed follow-up extortion efforts to UNC6240, citing overlapping operational artifacts including the reuse of a common Tox account during negotiations, among others. In late January, a newly established leak site listing alleged victims was published, which described the nature of the stolen information and imposed payment deadlines of 72 hours. 

Researchers have previously reported that allegations of compromise have been made against at least five organizations. UNC6671 is exhibiting similar tradecraft in parallel activities. Throughout the past week, operators connected to this cluster have conducted vishing attacks involving impersonation of IT personnel and real-time credential harvesting.

In spite of the underlying domain infrastructure being similar to that of UNC6661, researchers observed differences in domain registration services, suggesting that operations are separate despite common tools and techniques. It is believed that these groups are collectively associated with ShinyHunters, which operates under alternative banners such as Scattered Lapsus$ Hunters at times. 

The collective is derived from an ecosystem of loosely affiliated cybercriminals known as The Com, whose members have proven to be skilled at telephone social engineering. An increasingly sophisticated phishing toolkit is at the core of these operations, designed to manage the complete lifecycle of an attack. 

The latest kits are capable of generating phishing emails and hosting replicate login pages, as well as relaying captured credentials in real time to attackers—an essential feature of multifactor authentication. 

A growing number of advanced frameworks now support voice-enabled phishing, which allows attackers to coordinate live phone calls in conjunction with dynamic manipulations of the victim's browser session Okta researchers have observed that these toolkits can be adjusted on the fly, enabling callers to control which pages are presented to victims according to their scripts as well as with legitimate MFA challenges encountered during the login process. 

With this level of orchestration, attackers are able to neutralize most multi-factor authentication (MFA) mechanisms that are not explicitly phishing-resistant. These campaigns are known to target identity platforms, cryptocurrencies, and Okta's own identity and access management services, which serve as authentication hubs for extensive corporate application portfolios, including Google and Microsoft Entra. 

It has been demonstrated that phishing pages are closely modeled after legitimate sign-in interfaces, ensuring a seamless experience for victims. According to Okta threat researcher Moussa Diallo, attackers can coordinate on-screen instructions with spoken instructions, even advising victims that they will receive MFA push notifications in advance, thus lending credibility to what would otherwise appear to be an unsolicited authentication request. 

However, phishing-resistant MFA technology such as smartcards, FIDO security keys, cryptographic passkeys, and Okta FastPass introduces cryptographic binding between the service and the user, thus reducing the effectiveness of real-time social engineering attacks. 

Ultimately, the campaign reinforces the critical lesson that defenders should take away: identity has become the primary attack surface, and human interaction has become one of its most vulnerable components. 

Threat actors have refined their abilities to manipulate trust by engaging in real-time voice engagements, challenging traditional assumptions about authentication strength. In addition to considering the fact that even well-implemented SSO and MFA controls can be undermined when users are persuaded to actively participate in an attack chain, security teams must change both technical and operational strategies to address this risk. 

By adopting cryptographically bound authentication mechanisms that are phishing-resistant, organizations can reduce the probability of credential replay in real-time. Furthermore, sustained employee awareness training that recognizes voice phishing as a major threat, rather than a niche variant of email-based scams, is equally important. 

The use of clear internal IT communication processes, along with monitoring for anomalous SSO behavior and rapid response playbooks, can further limit the blast radius in the event of compromise. In order to increase resilience against identity-driven attacks, layered controls will need to remain effective even when social engineering is successfully employed.
Read more »
Ransomware
cyber attack Data Breach Hacking Information Security IT Security Italy Law Enforcement Ransomware

La Sapienza University’s Digital Systems Remain Shut After Cyber Intrusion Disrupts Services

 




Rome’s La Sapienza University is continuing to experience major operational disruption after a cyber intrusion forced administrators to take its digital infrastructure offline as a safety measure. The shutdown began on February 2 and has affected core online services used by students, faculty, and administrative staff.

Since the incident, students have been unable to complete basic academic and administrative tasks such as registering for examinations, viewing tuition-related records, or accessing official contact information for teaching staff. With internal platforms unavailable, the university has relied mainly on its social media channels to share updates. These notices have acknowledged the disruption but have not provided detailed technical explanations or a confirmed date for when full access will be restored.

University officials confirmed that their systems were deliberately powered down to contain the threat and to prevent malicious software from spreading to other parts of the network. Emergency shutdowns of this kind are typically used when there is a risk that an attack could compromise additional servers, user accounts, or stored data. This response suggests that the incident involved harmful software capable of moving across connected systems.

According to publicly available reporting, the disruption was caused by ransomware, a category of cyber attack in which criminals attempt to lock organizations out of their own systems or data. Some media sources have claimed that a newly observed cybercrime group may be linked to the breach and that a ransomware variant referred to in security research as Bablock, also known as Rorschach, may have been involved. These attributions are part of ongoing assessments and have not been formally confirmed by authorities.

Technical analyses cited in public reporting describe this malware family as drawing components from previously leaked cybercrime tools, allowing attackers to combine multiple techniques into a single, highly disruptive program. Such ransomware is designed to operate rapidly and can spread across large digital environments, which helps explain the scale of the disruption experienced by one of Europe’s largest universities by student enrollment.

The university has formally reported the incident to Italian law enforcement and to the National Cybersecurity Agency, both of which are now involved in the investigation and response. Administrators have stated that emergency management is being coordinated across academic offices, administrative departments, and student representatives, with discussions underway to introduce deadline extensions and flexible arrangements to limit academic harm.

Due to the ongoing shutdown of internal systems, campus information desks are currently unable to access digital records that would normally support student inquiries. Updates about service availability and office hours are being shared through official faculty social media pages.

Meanwhile, technical teams are examining the full scope of the breach before restoring systems from backups. This step is necessary to ensure that no malicious code remains active. It is still unclear whether all stored data can be fully recovered or whether some information may remain inaccessible following the attack.


Read more »
Romania National Oil Pipeline
Cybersecurity Attack Data Breach data threat Romania National Oil Pipeline

Romania’s National Oil Pipeline Joins a Growing Cyberattack list

Romania’s national oil pipeline operator, Conpet, has disclosed that it suffered a cyberattack that disrupted its corporate IT systems and temporarily knocked its website offline, adding to a growing series of digital incidents affecting the country’s critical infrastructure. 

In a statement issued on Wednesday, the company said the attack affected its business information systems but did not interfere with pipeline operations or its ability to meet contractual obligations. 

Conpet operates almost 4,000 kilometres of pipelines, transporting domestically produced and imported crude oil, gasoline and other petroleum derivatives to refineries across Romania, making it a key component of the country’s energy infrastructure. 

The firm sought to reassure customers and authorities that its core operational technologies were not compromised. Systems responsible for supervising and controlling pipeline flows, as well as telecommunications networks, continued to function normally throughout the incident. 

As a result, the transport of crude oil and fuel through the national pipeline system was not disrupted. Conpet’s public website, however, remained inaccessible as recovery efforts were under way. 

Conpet said it is investigating the breach in cooperation with national cybersecurity authorities and has notified Romania’s Directorate for Investigating Organised Crime and Terrorism, filing a formal criminal complaint. 

The company has not provided details on how the attackers gained access or the specific techniques used, citing the ongoing investigation. Despite this lack of official confirmation, the ransomware group Qilin has claimed responsibility for the attack. 

The group has listed Conpet on its dark web leak site and alleges it exfiltrated close to one terabyte of data from the company’s systems. 

To support its claim, Qilin published a selection of images said to show internal documents, including financial information and scans of passports. Qilin emerged in 2022 as a ransomware-as-a-service operation, initially operating under the name Agenda. 

Since then, it has built a long list of alleged victims across the world, targeting private companies and public institutions alike. Such groups typically combine data theft with extortion, threatening to publish stolen material unless a ransom is paid. 

The attack on Conpet follows a spate of ransomware incidents in Romania over the past year. Water authorities, major energy producers, electricity distributors and dozens of hospitals have all reported disruptive cyberattacks. 

Together, these cases underline a persistent weakness in the corporate IT systems that support essential services, even when industrial control networks are kept separate. 


Read more »
State-Sponsored Cyber Espionage
Advanced Persistent Threats Critical Infrastructure Cyberattack Data Breach Global Cybersecurity Threats Linux Rootkit Malware nation-state hackers Palo Alto Unit 42 State-Sponsored Cyber Espionage

Widespread Cyber Espionage Campaign Breaches Infrastructure in 37 Countries


 

Research over the past year indicates that a newly identified cyberespionage threat actor operating in Asia has been conducting a sustained and methodical cyberespionage campaign that is characterized both by its operational scale and technical proficiency. 

A fully adaptive and mature toolchain has been utilized by this group to successfully compromise 70 government and critical infrastructure institutions spanning 37 countries. The group's operations utilize a range of classic intrusion vectors, including targeted phishing, advanced exploitation frameworks, along with custom malware, Linux-based rootkits, persistent web shells, tunneling and proxying mechanisms to hide command-and-control traffic and maintain long-term access. 

According to the analysis of the campaign, these intrusions represent only a portion of the group's overall activities. There appears to be an increase in reconnaissance efforts, indicating a strategic expansion beyond confirmed victims, according to security researchers. 

During November and December of 2025, the actor was observed conducting active scanning and reconnaissance against government-linked infrastructures located in 155 countries, indicating that an intelligence collection operation had a global perspective rather than an opportunistic approach. 

A previously unknown cyberespionage actor identified as TGR-STA-1030, also known as UNC6619, has been attributed to the activity by researchers at Palo Alto Networks' Unit 42. Based on a combination of technical artifacts, operational behavior, and targeting patterns, Unit 42 assesses with high confidence that the group is state-aligned and operating from Asia. 

A 12-month period during which the actor compromised government and critical infrastructure organizations across 37 countries puts nearly one fifth of the world's countries within the campaign's verified impact zone. 

A sharp increase in reconnaissance activity was observed by Unit 42 in parallel with these intrusions between November and December 2025, as the group actively scanned government-linked infrastructure associated with 155 countries, signaling a shift toward a broader collection of intelligence. 

Based on the analysis conducted by Unit 42, the group was first discovered during an investigation into coordinated phishing operations targeting European government entities in early 2025. 

Eventually, as the actor refined its access methods, these campaigns, which were part of the initial phase of the Shadow Campaigns, evolved into more direct exploitation-driven intrusions based on exploitation. In light of the assessment that the activity aligns with state interests but has not yet been conclusively linked to a particular sponsoring organization, the designation TGR-STA-1030 is serving as a temporary tracking label while attribution efforts are continued.

Over time, the group demonstrated increasing technical maturity by deploying persistence mechanisms capable of providing extended access to exposed services beyond email-based lures, and exploiting exposed services. To date, a wide range of sensitive government and infrastructure sectors have been identified as victims, including interior affairs, foreign relations, finance, trade, economic policy, immigration, mining, justice, and energy ministries and departments. 

Despite confirmed compromises, researchers from Unit 42 believe that the breadth of reconnaissance activity offers insight into the actor's global priorities, while confirmed scanning efforts indicate that scanning efforts can be translated into operational access. 

There were at least 70 successful breaches during the period under review, and attackers maintained footholds in several environments for several months at a time. Although the campaign appears to be primarily geared toward espionage, Unit 42 has cautioned that the scale, persistence, and alignment of the activity with real-world geopolitical events raise concerns about potential long-term consequences for national security and critical service resilience. 

According to an in-depth analysis of the campaign, a pattern of targeting closely tracked sensitive geopolitical and commercial developments. Unit 42 documented the compromise of one of the largest suppliers in Taiwan's power equipment industry among the confirmed intrusions, which underscores the group's interest in energy-related industrial ecosystems. 

The actors also breached an Indonesian airline's network during the active procurement process with a U.S.-based aircraft manufacturer in a separate incident. Researchers noted that the intrusion coincided with a significant increase in the promotion of competing aircraft products from a manufacturer based in Southeast Asia, suggesting that the operation was not limited to passive intelligence gathering, but extended to strategic economic interests. 

It is important to note that several intrusion waves corresponded directly with diplomatic and political flashpoints involving China. After a high-profile meeting between the country’s president and the Dalai Lama, scanning activity was observed against the Czech military, national police, parliamentary systems, and multiple government bureaus in the Czech Republic. 

A month prior to Honduras' presidential election, during which both of the leading candidates indicated their willingness to reestablish diplomatic relations with Taiwan, the group launched a targeted attack against Honduran government infrastructure on October 31, approximately one month before the election. 

At least 200 government-associated IP addresses were targeted during this period by Unit 42, marking one of the largest concentrations of activity recorded by the group to date, which resulted in reconnaissance attempts and intrusion attempts. From a technical standpoint, the actor's tooling exhibits a high level of sophistication and operational discipline. 

As a part of initial access, phishing campaigns were frequently used to deliver custom malware loaders known as DiaoYu. DiaoYu is the Chinese word for fishing. Upon execution, the malware loader performed antivirus checks before deploying follow-on payloads, including command-and-control beacons known as Cobalt Strike beacons.

Additionally, the group exploited various enterprise-facing vulnerabilities, including Microsoft Exchange Server, SAP Solution Manager, as well as more than a dozen other widely deployed platforms and services, attempting to exploit these vulnerabilities in parallel. By utilizing a previously undocumented Linux rootkit known as ShadowGuard, Palo Alto Networks enhanced persistence and stealth. 

Rootkits operate within Linux kernel virtual machines referred to as Extended Berkeley Packet Filters (eBPF), allowing malicious logic to be executed entirely within highly trusted kernel space. According to researchers from Unit 42, eBPF-based backdoors pose a particular challenge for detection, because they are capable of intercepting and manipulating core system functions and auditing data before host-based security tools or monitoring platforms are aware of them. 

A similar approach has been documented in recent research on advanced Chinese-linked threat actors. However, certain operational artifacts also emerged in spite of the group's multi-tiered infrastructure strategy designed to obscure command-and-control pathways and impede attribution. 

Several cases involved investigators observing connections to victims' environments originating from IP address ranges associated with China Mobile Communications Group, a major backbone telecommunications provider. 

According to Palo Alto Networks, based on infrastructure analysis and historical telemetry, this group has been active since at least January 2024 and continues to pose a threat to the company. According to Unit 42, TGR-STA-1030 remains an active and evolving threat to critical infrastructure and government environments worldwide. This threat's combination of geopolitical alignment, technical capability, and sustained access creates a potential long-term threat. 

Unit 42 encourages governments and critical infrastructure operators to revisit long-held assumptions related to perimeter security and incident visibility in light of these findings. Through the campaign, it can be seen how advanced threat actors are increasingly combining prolonged reconnaissance with selective exploitation in order to achieve durable access and remain undetected for extended periods of time. 

It is recommended that security professionals prioritize continuous monitoring of exposed services, improve detection capabilities at both the endpoint and network layers, and closely monitor anomalous activity within trusted system components, such as kernel-level processes, where appropriate. 

Additionally, the researchers emphasize the importance of cross-sector coordination and threat intelligence sharing in addition to immediate technical mitigations, noting that the campaign's scale and geopolitical alignment demonstrate the deterioration of national resilience over time through cyberespionage operations. 

Keeping a keen eye on current and future state-aligned operations and adjusting defensive strategies in response will remain critical to limiting their strategic impact, especially as state-aligned actors continue to develop their skills.
Read more »
Malware Attack
Data Breach Database Breach Database Compromised Infostealer Infostealer Malware Malware Attack

Unsecured Database Exposes 149 Million Logins Linked to Infostealer Malware Operations

 

Appearing without warning on the internet, a massive collection of personal login details became reachable to any passerby. This trove - spanning about 96 gigabytes - included close to 150 million distinct credentials gathered from various sources. Not shielded by locks or scrambled coding, its contents lay fully exposed. Inside, endless spreadsheets paired emails with user handles, access codes, plus entry points to accounts. Examination showed evidence of widespread digital theft, driven by aggressive software designed to harvest private information. Such leaks reveal how deeply automated attacks now penetrate everyday online activity. 

Credentials came from people across the globe, tied to many different websites. Access information showed up for big social networks, romance apps, subscription video sites, games, and money-handling services. Among them: login pairs for digital currency storage, bank entry points, and systems linked to payment cards. A mix like that points not to one hacked business but likely stems from software designed to gather passwords automatically.  

What stood out most was the appearance of login details tied to government-backed email addresses in various nations. Though these accounts do not always grant entry to critical infrastructure, basic official credentials might still be exploited - serving as tools for focused scams or fake identities. Starting from minor access points, attackers could work their way deeper into secure environments. The level of danger shifts with each individual's privileges; when higher-access .gov logins fall into the wrong hands, consequences can stretch well beyond a single agency. 

Appearing first in the analysis was a database organized much like those seen in infostealer activities. Keylog results sat alongside extra details - hostnames flipped intentionally to sort thefts by target and origin. Though built on hashes, every record carried its own distinct ID, likely meant to prevent repeats while easing bulk sorting tasks. From this setup emerges something functional: a system shaped for gathering, handling, even passing along login information. Last noted - the traits match what supports credential trafficking behind the scenes. 

With unclear responsibility for the database, reporting went straight to the hosting company. Still, fixing the issue dragged on - weeks passed, with multiple alerts needed before entry was blocked. While delays continued, more data kept flowing in, expanding the volume of sensitive records exposed. Who controlled the system, how long it stayed open online, or whether others harvested its contents stays unanswered. One wrong move here leads to serious trouble. 

When hackers get full logins alongside active URLs, they run automated break-ins across many accounts - this raises chances of stolen identities, fake messages that seem real, repeated fraud, and unauthorized access. Personal habits emerge through used platforms, painting a clearer picture of who someone is online, which deepens threats to private data and future safety. 

Midway through this event lies proof: stealing login details now operates like mass production, fueled by weak cloud setups. Because information-harvesting software grows sharper every month, staying protected means doing basics well - shielding devices, practicing careful habits online, using separate codes everywhere, while adding extra identity checks. Found gaps here reveal something odd at first glance - not just legitimate systems fail from poor setup, but illegal networks do too; when they collapse, masses of people get caught unaware, their private pieces scattered without knowing a breach ever happened.
Read more »
Spain
Data Breach Data Leak Education ministry of science Online Platforms Spain

Spain’s Science Ministry Partially Shuts Online Systems After Suspected Cyber Incident

 



Spain’s Ministry of Science, Innovation and Universities has temporarily disabled parts of its digital infrastructure following what it described as a technical problem. The disruption has affected several online services used by citizens, universities, researchers, and businesses for official procedures and submissions. These platforms support important administrative functions and process sensitive information, which is why access was restricted as a precaution.

The ministry oversees national science policy, research programs, innovation initiatives, and higher education administration. Its systems handle high-value data, including academic and research records, application materials, and personal information linked to students and professionals. Because of the incident, multiple digital services were made unavailable, and active procedures were placed on hold to limit any potential risk to data or system integrity.

In a public notice on its official website, the ministry stated that the incident is under technical assessment and did not disclose further details at the time. The announcement clarified that the ministry’s online portal is only partially operational and that ongoing administrative processes have been paused to protect the rights and lawful interests of affected users. To reduce the impact of the outage, authorities confirmed that deadlines for affected procedures will be extended in line with Spain’s administrative law provisions, so applicants and institutions are not penalized for delays caused by the shutdown.

Separately, claims surfaced on underground online platforms from an individual alleging unauthorized access to the ministry’s systems. The person shared what they presented as sample data to support the claim and stated that additional information was available for sale. The material reportedly includes personal records, email information, application-related documents, and images of official paperwork. These claims have not been independently verified, and the online space where the samples were shared later became inaccessible.

The same individual alleged that access was gained by exploiting a security weakness that can allow users to reach restricted resources without proper authorization. Such flaws, when present in web applications, can expose internal systems if not properly secured. At this stage, the technical details of the claim remain unconfirmed by authorities.

Spanish media outlets have reported that a ministry spokesperson acknowledged that the service disruption is linked to a cybersecurity incident. However, officials have not confirmed whether any data was accessed or taken, nor have they outlined the scope of any potential compromise. The ministry has indicated that investigations are ongoing to determine what occurred and to restore services safely.

Cybersecurity experts consistently warn that public sector systems are frequent targets because of the volume and sensitivity of data they manage. Strong access controls, continuous monitoring, and timely security updates are critical to reducing exposure to such risks. Further updates from the ministry are expected once technical assessments are completed and the situation is fully clarified.

Read more »
Tribal Clinics
Data Breach Medical Data Leak Ransomware attack Rhysida Ransomware Tribal Clinics

Rhysida Ransomware Hits California Tribal Clinics, Leaks SSNs and Medical Data

 

A recent ransomware attack has disrupted healthcare services and exposed sensitive patient data at the MACT Health Board, which operates clinics serving American Indian communities in California’s Sierra Foothills. The cybercriminal group Rhysida has claimed responsibility for the November 2025 breach and has listed MACT on its data leak site, demanding a ransom of eight bitcoin, valued at about 662,000 dollars at the time. Although MACT has notified affected patients, the organization has not confirmed Rhysida’s claims or disclosed how many individuals were impacted.

According to MACT’s notice to victims, an unauthorized party accessed some files on its systems between November 12 and November 20, 2025, leading to serious exposure of personal and medical information. Compromised data includes names, Social Security numbers, and detailed medical information such as diagnoses, doctors, insurance details, medications, test results, images, and records of care and treatment. In response, MACT is offering eligible victims free identity monitoring, recognizing the heightened risk of identity theft and fraud.

The attack caused significant operational disruption across MACT’s clinics starting November 20, 2025, affecting phone services, prescription ordering, and appointment scheduling. Phone lines were restored by December 1, but some specialized imaging services were still offline as of January 22, illustrating the long-term impact such incidents can have on patient care. The Board declined to answer detailed questions about the breach, including whether a ransom was paid or how the attackers infiltrated the network.

Rhysida, which emerged in May 2023, runs a ransomware-as-a-service model, providing its malware and infrastructure to affiliates who carry out attacks. Its ransomware both steals data and encrypts systems, with victims pressured to pay for deletion of stolen information and for decryption keys. The group has claimed responsibility for 102 confirmed attacks and an additional 157 unacknowledged incidents, with an average ransom demand of around 884,000 dollars. At least 24 of its confirmed attacks have targeted healthcare entities, compromising about 3.83 million records, including high-profile breaches at MedStar Health, Spindletop Center, and Cytek Biosciences.

The MACT incident highlights a broader surge in ransomware targeting US healthcare providers. Comparitech researchers documented 109 confirmed ransomware attacks against hospitals, clinics, and other care providers in 2025 alone, affecting nearly 8.9 million records. These attacks can force organizations back to pen-and-paper operations, trigger appointment cancellations, and even require patient diversions, putting both safety and privacy at risk. MACT, which serves five California counties—Mariposa, Amador, Alpine, Calaveras, and Tuolumne—through about a dozen clinics offering medical, dental, behavioral, optometry, and chiropractic care, now faces the dual challenge of restoring services and rebuilding trust with its community.
Read more »
supply chain security
Data Breach developer credential theft GlassWorm malware malicious VS Code extensions Open VSX Registry attack supply chain security

Open VSX Supply Chain Breach Delivers GlassWorm Malware Through Trusted Developer Extensions

 

Cybersecurity experts have uncovered a supply chain compromise targeting the Open VSX Registry, where unknown attackers abused a legitimate developer’s account to distribute malicious updates to unsuspecting users.

According to findings from Socket, the attackers infiltrated the publishing environment of a trusted extension author and used that access to release tainted versions of widely used tools.

"On January 30, 2026, four established Open VSX extensions published by the oorzc author had malicious versions published to Open VSX that embed the GlassWorm malware loader," Socket security researcher Kirill Boychenko said in a Saturday report.

The compromised extensions had long been considered safe and were positioned as genuine developer utilities, with some having been available for more than two years.

"These extensions had previously been presented as legitimate developer utilities (some first published more than two years ago) and collectively accumulated over 22,000 Open VSX downloads prior to the malicious releases."

Socket noted that the incident stemmed from unauthorized access to the developer’s publishing credentials. The Open VSX security team believes the breach may have involved a leaked access token or similar misuse of credentials. All affected versions have since been taken down from the registry.

Impacted extensions include:
  • FTP/SFTP/SSH Sync Tool (oorzc.ssh-tools — version 0.5.1)
  • I18n Tools (oorzc.i18n-tools-plus — version 1.6.8)
  • vscode mindmap (oorzc.mind-map — version 1.0.61)
  • scss to css (oorzc.scss-to-css-compile — version 1.3.4)
The malicious updates were engineered to deploy GlassWorm, a loader malware linked to an ongoing campaign. The loader decrypts and executes payloads at runtime and relies on EtherHiding—a technique that conceals command-and-control infrastructure—to retrieve C2 endpoints. Its ultimate objective is to siphon Apple macOS credentials and cryptocurrency wallet information.

Before activating, the malware profiles the infected system and checks locale settings, avoiding execution on systems associated with Russian regions, a behavior often seen in malware tied to Russian-speaking threat groups.

The stolen data spans a broad range of sensitive assets, including browser credentials, cryptocurrency wallets, iCloud Keychain data, Safari cookies, Apple Notes, user documents, VPN configurations, and developer secrets such as AWS and SSH credentials.

The exposure of developer-related data is particularly dangerous, as it can lead to deeper enterprise breaches, cloud account takeovers, and lateral movement across networks.

"The payload includes routines to locate and extract authentication material used in common workflows, including inspecting npm configuration for _authToken and referencing GitHub authentication artifacts, which can provide access to private repositories, CI secrets, and release automation," Boychenko said.

What sets this incident apart is the delivery method. Instead of relying on fake or lookalike extensions, the attackers leveraged a real developer’s account to push the malware—an evolution from earlier GlassWorm campaigns that depended on typosquatting and brand impersonation.

"The threat actor blends into normal developer workflows, hides execution behind encrypted, runtime-decrypted loaders, and uses Solana memos as a dynamic dead drop to rotate staging infrastructure without republishing extensions," Socket said. "These design choices reduce the value of static indicators and shift defender advantage toward behavioral detection and rapid response."
Read more »
Dating Apps
Consumer Information Cyber Phishing Data Breach Data Leak data security Data Theft dating app security Dating Apps

ShinyHunters Claims Match Group Data Breach Exposing 10 Million Records

 

A new data theft has surfaced linked to ShinyHunters, which now claims it stole more than 10 million user records from Match Group, the U.S. company behind several major swipe-based dating platforms. The group has positioned the incident as another major addition to its breach history, alleging that personal data and internal materials were taken without authorization. 

According to ShinyHunters, the stolen data relates to users of Hinge, Match.com, and OkCupid, along with hundreds of internal documents. The Register reported seeing a listing on the group’s dark web leak site stating that “over 10 million lines” of data were involved. The exposure was also linked to AppsFlyer, a marketing analytics provider, which was referenced as the likely source connected to the incident. 

Match Group confirmed it is investigating what it described as a recently identified security incident, and said some user data may have been accessed. The company stated it acted quickly to terminate the unauthorized access and is continuing its investigation with external cybersecurity experts. Match Group also said there was no indication that login credentials, financial information, or private communications were accessed, and added that it believes only a limited amount of user data was affected. 

It said notifications are being issued to impacted individuals where appropriate. However, Match Group did not disclose what categories of data were accessed, how many users were impacted, or whether any ransom demand was made or paid, leaving key details about the scope and motivation unresolved. Cybernews, which reviewed samples associated with the listing, reported that the dataset appears to include customer personal data, some employee-related information, and internal corporate documents. 

The analysis also suggested the presence of Hinge subscription details, including user IDs, transaction IDs, payment amounts, and records linked to blocked installations, along with IP addresses and location-related data. In a separate post published the same week, ShinyHunters also claimed it had stolen data from Bumble. The group uploaded what it described as 30 GB of compressed files allegedly sourced from Google Drive and Slack. The claims come shortly after researchers reported that ShinyHunters targeted around 100 organizations by abusing stolen Okta single sign-on credentials. The alleged victim list included well-known SaaS and technology firms such as Atlassian, AppLovin, Canva, Epic Games, Genesys, HubSpot, Iron Mountain, RingCentral, and ZoomInfo, among others. 

Bumble has issued a statement saying that one contractor’s account had been compromised in a phishing incident. The company said the account had limited privileges but was used for brief unauthorized access to a small portion of Bumble’s network. Bumble stated its security team detected and removed the access quickly, confirmed the incident was contained, engaged external cybersecurity experts, and notified law enforcement. Bumble also emphasized that there was no access to its member database, member accounts, the Bumble app, or member direct messages or profiles.
Read more »
Third Party Risk
Cyber Risk Management Data Breach Healthcare cybersecurity Healthcare IT Systems Healthcare Ransomware Medical Data Security patient data protection ransomware attacks Third Party Risk

Cybercriminals Report Monetizing Stolen Data From US Medical Company


Modern healthcare operations are frequently plagued by ransomware attacks, but the recent attack on Change Healthcare marks a major turning point in terms of scale and consequence. In the context of an industry that is increasingly relying on digital platforms, there is a growing threat environment characterized by organized cybercrime, fragile third-party dependency, and an increasing data footprint as a result of an increasingly hostile threat environment. 

With hundreds of ransomware incidents and broader security incidents already occurring in a matter of months, recent figures from 2025 illustrate just how serious this shift is. It is important to note that a breach will not only disrupt clinical and administrative workflows, but also put highly sensitive patient information at risk, which can result in cascading operational, financial, and legal consequences for organizations. 

The developments highlighted here highlight a stark reality: safeguarding healthcare data does not just require technical safeguards; it now requires a coordinated risk management strategy that anticipates breaches, limits their impacts, and ensures institutional resilience should prevention fail. 

Connecticut's Community Health Center (CHC) recently disclosed a significant data breach that occurred when an unauthorized access to its internal systems was allowed to result in a significant data breach, which exemplifies the sector's ongoing vulnerability to cyber risk. 

In January 2025, the organization was alerted to irregular network activity, resulting in an urgent forensic investigation that confirmed there was a criminal on site. Upon further analysis, it was found that the attacker had maintained undetected access to the system from mid-October 2024, thereby allowing a longer window for data exfiltration before the breach was contained and publicly disclosed later that month. 

There was no ransomware or disruption of operations during the incident, but the extent of the data accessed was significant, including names, dates of birth, Social Security numbers, health insurance details, and clinical records of patients and employees, which included sensitive patient and employee information.

More than one million people, including several thousand employees, were affected according to CHC, demonstrating the difficulties that persist in early detection of threats and data protection across healthcare networks, and highlighting the urgent need for strengthened security measures as medical records continue to attract cybercriminals. 

According to Cytek Biosciences' notification to affected individuals, it was learned in early November 2025 that an outside party had gained access to portions of the Biotechnology company's systems and that the company later determined that personal information had been obtained by an outside party. 

As soon as the company became aware of the extent of the exposure, it took immediate steps to respond, including offering free identity theft protection and credit monitoring services for up to two years to eligible individuals, which the company said it had been working on. 

As part of efforts to mitigate potential harm resulting from the incident, enrollment in the program continues to be open up until the end of April 2026. Threat intelligence sources have identified the breach as being connected to Rhysida, which is known for being a ransomware group that first emerged in 2023 and has since established itself as a prolific operation within the cybercrime ecosystem.

A ransomware-as-a-service model is employed by the group which combines data theft with system encryption, as well as allowing affiliates to conduct attacks using its malware and infrastructure in return for a share of the revenue. 

The Rhysida malware has been responsible for a number of attacks across several sectors since its inception, and healthcare is one of the most frequent targets. A number of the group's intrusions have previously been credited to hospitals and care providers, but the Cytek incident is the group's first confirmed attack on a healthcare manufacturer, aligning with a trend which is increasingly involving ransomware activity that extends beyond direct patient care companies to include medical suppliers and technology companies. 

Research indicates that these types of attacks are capable of exposing millions of records, disrupting critical services, and amplifying risks to patient privacy as well as operational continuity, which highlights that the threat landscape facing the U.S. healthcare system is becoming increasingly complex. 

As a result of the disruption that occurred in the U.S. healthcare system, organizations and individuals affected by the incident have stepped back and examined how Change Healthcare fits into the system and why its outage was so widespread. 

With over 15 years of experience in healthcare technology and payment processing under the UnitedHealth Group umbrella, Change Healthcare has played a critical role as a vital intermediary between healthcare providers, insurers, and pharmacists by verifying eligibility, getting prior authorizations, submitting claims, and facilitating payment processes. 

A failure of this organization in its role at the heart of these transactions can lead to cascading delays in prescription, reimbursement, and claim processing across the country when its operational failure extends far beyond the institution at fault. 

According to findings from a survey conducted by the American Medical Association, which documented widespread financial and administrative stress among physician practices, this impact was of a significant magnitude. There have been numerous reports of suspended or delayed claims payments, the inability to submit claims, or the inability to receive electronic remittance advice, and widespread service interruptions as a consequence. 

Several practices cited significant revenue losses, forcing some to rely on personal funds or find an alternative clearinghouse in order to continue to operate. There have been some relief measures relating to emergency funding and advance payments, but disruptions continue to persist, prompting UnitedHealth Group to disburse more than $2 billion towards these efforts. 

Moreover, patients have suffered indirect effects not only through billing delays, unexpected charges, and notifications about potential data exposures but also outside the provider community. This has contributed to increased public concern and renewed scrutiny of the systemic risks posed by the compromise of an organization's central healthcare infrastructure provider. 

The fact that the incidents have been combined in this fashion highlights a clear and cautionary message for healthcare stakeholders: it is imperative to treat cyber resilience as a strategic priority, rather than a purely technical function. 

Considering that large-scale ransomware campaigns have been running for some time now, undetected intrusions for a prolonged period of time, as well as failures at critical intermediaries, it is evident that even a single breach can escalate into a systemic disruption that affects providers, manufacturers, and patients. 

A growing number of industry leaders and regulators are called upon to improve the oversight of third parties, enhance the tools available for breach detection, and integrate financial, legal, and operational preparedness into their cybersecurity strategies. 

It is imperative that healthcare organizations adopt proactive, enterprise-wide approaches to risk management as the volume and value of healthcare data continues to grow. Organizations that fail to adopt this approach may not only find themselves unable to cope with cyber incidents, but also struggle to maintain trust, continuity, and care delivery in the aftermath of them.
Read more »
patient portal phishing scam
Data Breach health data security Manage My Health data breach medical data breach NZ New Zealand healthcare cyberattack patient portal phishing scam

Manage My Health Warns of Impersonation Scams as Fallout From Major Data Breach Continues

 

The repercussions of the Manage My Health data breach are still unfolding, with the company cautioning that cybercriminals may now be targeting affected users by posing as the online patient portal.

Manage My Health, which runs a widely used digital health platform across New Zealand, has confirmed that the majority of individuals impacted by the incident have been notified. At the same time, the organization has raised concerns that opportunistic criminals are attempting to exploit the situation by circulating phishing or spam messages designed to look like official communications from Manage My Health.

“We’re also aware that secondary actors may impersonate MMH and send spam or phishing emails to prompt engagement. These communications are not from MMH,” the company said in a statement. It added that steps are being examined to curb this activity, alongside issuing safety guidance to help users avoid further harm.

The cyberattack, which took place toward the end of last year, involved unauthorized access to documents stored within a limited section of the platform. According to reports, the attackers demanded a ransom of several thousand dollars, threatening to publish sensitive data on the dark web. Had this occurred, personal medical information belonging to more than 120,000 New Zealanders could have been exposed.

Manage My Health clarified that core services remained unaffected by the breach. Live GP clinical systems, prescriptions, appointment bookings, secure messaging, and real-time medical records were not compromised. The intrusion was restricted to documents housed in the “My Health Documents” feature.

The affected files included user-uploaded materials such as correspondence, medical reports, and test results, along with certain clinical documents. These clinical records consisted of hospital discharge summaries and clinical letters linked to care provided in Northland Te Tai Tokerau. After detecting suspicious activity, the company said it swiftly locked down the affected feature, prevented further unauthorized access, and activated its incident response protocols. Independent cybersecurity experts were brought in to assess the breach and verify its extent.

Manage My Health has since confirmed that the incident is contained and that testing shows the vulnerability has been fully addressed.

Notifications and Regulatory Response

The company acknowledged that its early response resulted in some users being contacted before the full scope of the breach was understood. “When we first identified the breach, our priority was to promptly inform all potentially affected patients,” it said, explaining that this precautionary approach meant some individuals were later found not to be impacted.

Those users were subsequently advised that their data was not involved. Individuals can also verify their status by logging into the Manage My Health web application, where a green “No Impact” banner confirms no exposure.

Notification efforts are continuing, with the company citing the complexity of coordinating communications across patient groups, regulators, and data controllers while meeting obligations under the New Zealand Privacy Act.

The breach has drawn regulatory attention, with the Office of the Privacy Commissioner (OPC) launching an inquiry into the privacy implications of the incident. Manage My Health said it is cooperating closely with the OPC, Health New Zealand | Te Whatu Ora, the National Cyber Security Centre, and the New Zealand Police.

Legal Action and Monitoring Efforts

As part of its response, Manage My Health successfully obtained an interim injunction from the High Court, preventing any third party from accessing, publishing, or sharing the compromised data.

The company is also monitoring known data leak sites and stands ready to issue takedown notices if any information surfaces online. Additional steps include resetting compromised credentials, temporarily disabling the Health Documents module, and maintaining continuous system monitoring while wider security improvements are implemented. An independent forensic investigation is still underway, though the company has declined to disclose specific technical details at this time.

Manage My Health has reiterated that it will never request passwords or one-time security codes and has urged users to be cautious of unsolicited or urgent messages claiming to be from the platform.

Anyone contacted by individuals alleging they possess health data is advised not to engage and to report the matter to New Zealand Police via 105, or 111 in an emergency, and to inform Manage My Health support. To further assist users worried about identity misuse, the company has partnered with IDCARE to provide free and confidential cyber and identity support across Australia and New Zealand.

“We take the privacy of our clients and staff very seriously, and we sincerely apologise for any concern or inconvenience this incident may have caused,” Manage My Health said, adding that it remains committed to transparency as investigations into the cyberattack on Manage My Health continue.
Read more »
SoundCloud breach
Betterment data leak Crunchbase hack CyberCrime dark web leaks Data Breach ShinyHunters data leak SoundCloud breach

ShinyHunters Allege Massive Data Leaks from SoundCloud, Crunchbase, and Betterment After Extortion Refusals

 

The cybercrime group known as ShinyHunters has resurfaced, claiming responsibility for leaking millions of records allegedly taken from SoundCloud, Crunchbase, and Betterment after failed extortion efforts. The group has launched a new dark web (.onion) leak platform and has already shared what it says are partial databases connected to the three organizations.

The activity reportedly began on 22 January 2026, when ShinyHunters posted messages on its Telegram channel containing links to onion services where the data could be accessed freely. The hackers assert that the disclosures were carried out because the targeted companies refused to meet their extortion demands.

“We are after corporate regime change in all parts of the world. Pay or leak. We will aggressively and viciously come after you once we have your data. By the time you are listed here, it will be too late. Next time. You will learn from it. It will ALWAYS be your best decision, choice, and option to engage with us and come to an agreement with us. Proceed wisely,” the group’s message on the leak site says.

Among the affected firms, SoundCloud had previously acknowledged a breach in December 2025 that impacted roughly 20% of its users. With the platform reporting between 175 and 180 million users overall, this translates to approximately 35–36 million accounts—closely aligning with the volume of data ShinyHunters claims to possess.

According to the hackers, the leaked information includes more than 20 million records tied to Betterment containing Personally Identifiable Information, over 2 million alleged records associated with Crunchbase, and upwards of 30 million records linked to SoundCloud that are now circulating online.

On the same day the leaks emerged, 22 January 2026, Okta issued a security advisory warning of an ongoing Okta SSO vishing campaign that has already affected multiple victims, though the total number has not been disclosed. In a LinkedIn post, Alon Gal of Israel-based cybersecurity firm Hudson Rock stated that ShinyHunters contacted him, claiming responsibility for the Okta SSO vishing activity and suggesting that more data leaks are forthcoming.

This development has prompted speculation about whether the alleged breaches at all three companies are connected to Okta. At this stage, no definitive link has been confirmed. Hackread.com has reached out directly to ShinyHunters to seek clarification on the matter.

The purported datasets linked to SoundCloud, Crunchbase, and Betterment remain accessible for download, and Hackread.com reports that the links are now being widely shared across prominent cybercrime forums, including French- and Russian-language communities.

Hackread.com has also contacted all three companies for comment. Until the organizations involved verify the legitimacy of the leaked data, the incidents should be treated strictly as unconfirmed claims.

In a statement shared with Hackread.com, a SoundCloud spokesperson said the company detected unauthorized activity within an ancillary service dashboard in mid-December and acted immediately to contain the situation. The response included engaging third-party cybersecurity experts and launching a comprehensive investigation.

According to SoundCloud’s blog post, the investigation found that no sensitive information such as passwords or financial data was accessed. The exposure was limited to email addresses and details already visible on public profiles, affecting about one-fifth of its users. SoundCloud further stated that while a group claiming responsibility has made public accusations and carried out email flooding tactics, there is no evidence to support broader claims. The company says it is cooperating with law enforcement and continuing to strengthen monitoring, access controls, and other security defenses
Read more »
phishing
Credential Theft Data Breach Data Theft Emails IP Address Microsoft Microsoft SharePoint phishing

Attackers Hijack Microsoft Email Accounts to Launch Phishing Campaign Against Energy Firms

 


Cybercriminals have compromised Microsoft email accounts belonging to organizations in the energy sector and used those trusted inboxes to distribute large volumes of phishing emails. In at least one confirmed incident, more than 600 malicious messages were sent from a single hijacked account.

Microsoft security researchers explained that the attackers did not rely on technical exploits or system vulnerabilities. Instead, they gained access by using legitimate login credentials that were likely stolen earlier through unknown means. This allowed them to sign in as real users, making the activity harder to detect.

The attack began with emails that appeared routine and business-related. These messages included Microsoft SharePoint links and subject lines suggesting formal documents, such as proposals or confidentiality agreements. To view the files, recipients were asked to authenticate their accounts.

When users clicked the SharePoint link, they were redirected to a fraudulent website designed to look legitimate. The site prompted them to enter their Microsoft login details. By doing so, victims unknowingly handed over valid usernames and passwords to the attackers.

After collecting credentials, the attackers accessed the compromised email accounts from different IP addresses. They then created inbox rules that automatically deleted incoming emails and marked messages as read. This step helped conceal the intrusion and prevented account owners from noticing unusual activity.

Using these compromised inboxes, the attackers launched a second wave of phishing emails. These messages were sent not only to external contacts but also to colleagues and internal distribution lists. Recipients were selected based on recent email conversations found in the victim’s inbox, increasing the likelihood that the messages would appear trustworthy.

In this campaign, the attackers actively monitored inbox responses. They removed automated replies such as out-of-office messages and undeliverable notices. They also read replies from recipients and responded to questions about the legitimacy of the emails. All such exchanges were later deleted to erase evidence.

Any employee within an energy organization who interacted with the malicious links was also targeted for credential theft, allowing the attackers to expand their access further.

Microsoft confirmed that the activity began in January and described it as a short-duration, multi-stage phishing operation that was quickly disrupted. The company did not disclose how many organizations were affected, identify the attackers, or confirm whether the campaign is still active.

Security experts warn that simply resetting passwords may not be enough in these attacks. Because attackers can interfere with multi-factor authentication settings, they may maintain access even after credentials are changed. For example, attackers can register their own device to receive one-time authentication codes.

Despite these risks, multi-factor authentication remains a critical defense against account compromise. Microsoft also recommends using conditional access controls that assess login attempts based on factors such as location, device health, and user role. Suspicious sign-ins can then be blocked automatically.

Additional protection can be achieved by deploying anti-phishing solutions that scan emails and websites for malicious activity. These measures, combined with user awareness, are essential as attackers increasingly rely on stolen identities rather than software flaws.


Read more »
Ledger
Customer Data customer data leak customer data privacy Data Breach Data Exposure data security leaked sensitive data Ledger

Ledger Customer Data Exposed After Global-e Payment Processor Cloud Incident

 

A fresh leak of customer details emerged, linked not to Ledger’s systems but to Global-e - an outside firm handling payments for Ledger.com. News broke when affected users received an alert email from Global-e. That message later appeared online, posted by ZachXBT, a known blockchain tracker using a fake name, via the platform X. 

Unexpectedly, a breach exposed some customer records belonging to Ledger, hosted within Global-e’s online storage system. Personal details, including names and email addresses made up the compromised data, one report confirmed. What remains unclear is the number of people impacted by this event. At no point has Global-e shared specifics about when the intrusion took place.  

Unexpected behavior triggered alerts at Global-e, prompting immediate steps to secure systems while probes began. Investigation followed swiftly after safeguards were applied, verifying unauthorized entry had occurred. Outside experts joined later to examine how the breach unfolded and assess potential data exposure. Findings showed certain personal details - names among them - were viewed without permission. Contact records also appeared in the set of compromised material. What emerged from analysis pointed clearly to limited but sensitive information being reached. 

Following an event involving customer data, Ledger confirmed details in a statement provided to CoinDesk. The issue originated not in Ledger's infrastructure but inside Global-e’s operational environment. Because Global-e functions as the Merchant of Record for certain transactions, it holds responsibility for managing related personal data. That role explains why Global-e sent alerts directly to impacted individuals. Information exposed includes records tied to purchases made on Ledger.com when buyers used Global-e’s payment handling system. 

While limited to specific order-related fields, access was unauthorized and stemmed from weaknesses at Global-e. Though separate entities, their integration during checkout links them in how transactional information flows. Customers involved completed orders between defined dates under these service conditions. Security updates followed after discovery, coordinated across both organizations. Notification timing depended on forensic review completion by third-party experts. Each step aimed at clarity without premature disclosure before full analysis. 

Still, the firm pointed out its own infrastructure - platform, hardware, software - was untouched by the incident. Security around those systems remains intact, according to their statement. What's more, since users keep control of their wallets directly, third parties like Global-e cannot reach seed phrases or asset details. Access to such private keys never existed for external entities. Payment records, meanwhile, stayed outside the scope of what appeared in the leak. 

Few details emerged at first, yet Ledger confirmed working alongside Global-e to deliver clear information to those involved. That setup used by several retailers turned out to be vulnerable, pointing beyond a single company. Updates began flowing after detection, though the impact spread wider than expected across shared infrastructure. 

Coming to light now, this revelation follows earlier security problems connected to Ledger. Back in 2020, a flaw at Shopify - the online store platform they used - led to a leak affecting 270,000 customers’ details. Then, in 2023, another event hit, causing financial damage close to half a million dollars and touching multiple DeFi platforms. Though different in both scale and source, the newest issue highlights how reliance on outside vendors can still pose serious threats when handling purchases and private user information.  

Still, Ledger’s online platforms showed no signs of a live breach on their end, yet warnings about vigilance persist. Though nothing points to internal failures, alerts remind customers to stay alert regardless. Even now, with silence across official posts, guidance leans toward caution just the same.
Read more »
User Privacy
Data Breach Data Theft ESA User Privacy

ESA Confirms Cyber Breach After Hacker Claims 200GB Data Theft

 

The European Space Agency (ESA) has confirmed a major cybersecurity incident in the external servers used for scientific cooperation. The hackers who carried out the operation claim responsibility for the breach in a post in the hacking community site BreachForums and claim that over 200 GB worth of data has been stolen, including source code, API tokens, and credentials. This incident highlights escalating cyber threats to space infrastructure amid growing interconnectedness in the sector 

It is alleged that the incident occurred around December 18, 2025, with an actor using the pseudonym "888" allegedly gaining access to ESA's JIRA and Bitbucket systems for an approximate week's duration. ESA claims that the compromised systems represented a "very small number" of systems not on their main network, which only included unclassified data meant for engineering partnerships. As a result, the agency conducted an investigation, secured the compromised systems, and notified stakeholders, while claiming that no mission critical systems were compromised. 

The leaked data includes CI/CD pipelines, Terraform files, SQL files, configurations, and hardcoded credentials, which have sparked supply chain security concerns. As for the leaked data, it includes screenshots from the breach, which show unauthorized access to private repositories. However, it is unclear whether this data is genuine or not. It is also unclear whether the leaked data is classified or not. As for security experts, it is believed that this data can be used for lateral movements by highly sophisticated attackers, even if it is unclassified. 

Adding to the trouble, the Lapsus$ group said they carried out a separate breach in September 2025, disclosing they exfiltrated 500 GB of data containing sensitive files on spacecraft operations, mission specifics, and contractor information involving partners such as SpaceX and Airbus. The ESA opened a criminal investigation, working with the authorities, however the immediate effects were minimized. The agency has been hit by a string of incidents since 2011, including skimmers placed on merchandise site readers. 

The series of breaches may be indicative of the "loosely coupled" regional space cooperative environment featuring among the ESA 23 member states. Space cybersecurity requirements are rising—as evidenced by open solicitations for security products—incidents like this may foster distrust of global partnerships. Investigations continue on what will be the long-term threats, but there is a pressing need for stronger protection.
Read more »
Google security
AI tools Data Breach Data Leak Digital Personal Data Protection Gemini AI Gemini Flaw Gemini vulnerability Google Gemini Google security

Google Gemini Calendar Flaw Allows Meeting Invites to Leak Private Data

 

Though built to make life easier, artificial intelligence helpers sometimes carry hidden risks. A recent study reveals that everyday features - such as scheduling meetings - can become pathways for privacy breaches. Instead of protecting data, certain functions may unknowingly expose it. Experts from Miggo Security identified a flaw in Google Gemini’s connection to Google Calendar. Their findings show how an ordinary invite might secretly gather private details. What looks innocent on the surface could serve another purpose beneath. 

A fresh look at Gemini shows it helps people by understanding everyday speech and pulling details from tools like calendars. Because the system responds to words instead of rigid programming rules, security experts from Miggo discovered a gap in its design. Using just text that seems normal, hackers might steer the AI off course. These insights, delivered openly to Hackread.com, reveal subtle risks hidden in seemingly harmless interactions. 

A single calendar entry is enough to trigger the exploit - no clicking, no downloads, no obvious red flags. Hidden inside what looks like normal event details sits coded directions meant for machines, not people. Rather than arriving through email attachments or shady websites, the payload comes disguised as routine scheduling data. The wording blends in visually, yet when processed by Gemini, it shifts into operational mode. Instructions buried in plain sight tell the system to act without signaling intent to the recipient. 

A single harmful invitation sits quietly once added to the calendar. Only after the user poses a routine inquiry - like asking about free time on Saturday - is anything set in motion. When Gemini checks the agenda, it reads the tainted event along with everything else. Within that entry lies a concealed instruction: gather sensitive calendar data and compile a report. Using built-in features of Google Calendar, the system generates a fresh event containing those extracted details. 

Without any sign, personal timing information ends up embedded within a new appointment. What makes the threat hard to spot is its invisible nature. Though responses appear normal, hidden processes run without alerting the person using the system. Instead of bugs in software, experts point to how artificial intelligence understands words as the real weak point. The concern grows as behavior - rather than broken code - becomes the source of danger. Not seeing anything wrong does not mean everything is fine. 

Back in December 2025, problems weren’t new for Google’s AI tools when it came to handling sneaky language tricks. A team at Noma Security found a gap called GeminiJack around that time. Hidden directions inside files and messages could trigger leaks of company secrets through the system. Experts pointed out flaws deep within how these smart tools interpret context across linked platforms. The design itself seemed to play a role in the vulnerability. Following the discovery by Miggo Security, Google fixed the reported flaw. 

Still, specialists note similar dangers remain possible. Most current protection systems look for suspicious code or URLs - rarely do they catch damaging word patterns hidden within regular messages. When AI helpers get built into daily software and given freedom to respond independently, some fear misuse may grow. Unexpected uses of helpful features could lead to serious consequences, researchers say.
Read more »
Subscribe to: Comments (Atom)