Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breach. Show all posts
Employee Personal Information
Data Breach Data Leak data security DHS Digital Personal Data Protection Employee Personal Information

DHS Data Breach Exposes Personal Details of More Than 41,000 US Immigration and Security Personnel

 

Personal and professional details of over 41,000 employees of the United States Department of Homeland Security (DHS) have been leaked online. This includes names, addresses, phone numbers and roles of those working at several federal agencies who are involved in enforcing immigration and national security. 

The data was leaked on October 29, 2026 and shows that over 21,000 people work within Customs and Border Protection (CBP) with almost 6,600 working within Immigration and Customs Enforcement (ICE). Other agencies affected include Homeland Security Investigations, Federal Protective Service and Cybersecurity and Infrastructure Security Agency. The breach was carried out by a group known as the Department of Peace. 

They accessed personal profiles using a single sign-on service known as Okta. The information was then shared by journalist and cybersecurity researcher maia crimew alongside Distributed Denial of Secrets (DDoSecrets). The leaked information also includes the names of secret government operations, people involved and information on the technology used by investigators. Some of the tools include those provided by Cellebrite and Palantir. Emma Best, co-founder of DDoSecrets said the leak was aimed to shine a light on the officials involved in government operations. 

However, the information includes people involved with undercover operations, investigations into government leaks and deportation. The Department of Peace have cited the actions of immigration enforcement officials as the reason for the breach. The DHS have admitted they are aware of the potential breach and are working to resolve this. They have also said employee safety is a priority. Okta have also confirmed they are aware of the claims but have said there is no evidence that their systems or data have been breached. This comes after a number of cybersecurity issues within US government agencies. 

In September 2026 the FBI were targeted by hacking group ShinyHunters. They were able to gain personal information of thousands of agents. The Federal Election Commission also suffered an outage recently after a suspected hacking attack. This breach is particularly worrying as immigration enforcement often carry out operations with their faces covered and minimal identification. This makes having their work details and operations known a potential security risk for employees and their families. 

The breach comes at a time where US immigration enforcement has been under increased scrutiny. Since Donald Trump returned to office in 2025 nearly one million people have been deported from the country. Over 70% of these people had no criminal record.
Read more »
South Korea
Airlines Amadeus Data Breach Data Breach Japan Airlines Data Breach leaked sensitive data South Korea

Japan Airlines Passengers Caught in Amadeus Reservation System Breach

 



Japan Airlines has warned roughly 92,000 customers that hackers accessed their personal information through a third-party reservation platform, in what is turning out to be one of the most critical data security incidents to hit the global aviation industry in recent memory.

The airline said the breach originated at Amadeus IT Group, the Spain-based technology company whose software powers ticketing, check-in, and reservation systems for airlines worldwide. JAL said Amadeus notified it the week before it published its own disclosure notice on October 28, 2026, stating that an unauthorized party had accessed "a portion of customer reservation data" stored within the Amadeus platform.

For the vast majority of affected customers, the exposed information included names, booking reference codes, and flight details. But for approximately 2,000 of those customers, the picture is considerably worse. Hackers also accessed passport numbers, frequent-flyer numbers, email addresses, and phone numbers. No credit card numbers or passwords were compromised, JAL said, because that data was not stored in the same system.

Japan Transocean Air, a JAL affiliate, was swept up in the same incident. The two carriers share infrastructure through the Amadeus platform, which is how the breach spread across both brands without requiring a separate intrusion.

JAL said it would reach out to affected customers individually and urged everyone to stay alert for phishing emails, fraudulent phone calls, and fake JAL websites. The warning carries real weight: when scammers know your name, flight number, and booking code, their messages tend to look far more convincing than a generic blast.

The company said its own internal systems were not touched. That distinction, while technically accurate, offers only limited reassurance. From a customer's perspective, the data was real, the exposure was real, and JAL was the brand they trusted when they handed over their information.

JAL is far from alone in this. The Amadeus breach has since grown into an industry-wide event. Cathay Pacific disclosed that hackers used login credentials assigned to one of its system accounts to access reservation data inside Amadeus, with the intrusion running from August 2023 to September 2026, a window of more than three years. Amadeus reportedly detected the unauthorized access in late September, then reset the compromised credentials, disabled the account, and added monitoring. Airlines were notified between October 20 and October 28.

ANA, another major Japanese carrier, said about 37,800 of its customers were affected, with roughly 1,700 of those having passport details viewed. Cathay Pacific put its figure at approximately 53,000 bookings. Korean Air, Asiana Airlines, Malaysia Airlines, and German leisure carrier Condor have all said they are investigating their exposure. Qantas was still assessing whether its bookings were affected as of early November. Three smaller Japanese regional carriers, Air Do, Solaseed Air, and Starflyer, said they had been notified and were reviewing their records.

No single overall figure covering all airlines has been published, but the numbers keep climbing.

The mechanism behind the breach is straightforward and deeply familiar to anyone who follows enterprise security incidents. At its core, attackers used legitimate credentials to log into a system they were not supposed to access. No elaborate zero-day exploit, no ransomware deployment. Someone had the right username and password, and they used it. Cathay Pacific's disclosure that the credentials were tied to a "system account" suggests the compromised login may not have belonged to a human employee at all, but rather to an automated or service-level account, which tend to receive less routine monitoring than individual user logins.

The timeline raises its own troubling questions. If the unauthorized access began in August 2023 and was not detected until September 2026, attackers had more than three years to move through reservation data at their leisure. It is not yet clear whether that access was continuous or sporadic, or whether the full scope of what was taken is known.

The disclosure lands at a sensitive moment for Japan's cybersecurity posture. The country has seen a string of high-profile incidents over the past two years, and Prime Minister Sanae Takaichi convened a cabinet meeting on the issue, pledging emergency measures, though specifics had not been released at the time of publication.

For passengers, the practical exposure is primarily the risk of targeted fraud. Scammers with access to real booking records can craft fake refund notices or schedule-change alerts that clear most basic suspicion checks. Security researchers consistently advise the same response: access your booking only by typing the airline's official website address directly into your browser, and treat any unsolicited message about your flight as suspicious until verified through official channels.

Amadeus has not issued a detailed public statement about how the breach occurred, its full scope, or what it is doing to prevent a similar incident. As more airlines finish their own assessments, that number is likely to rise.



Read more »
Russian Hackers
Dark Web Data Breach Data Leak Italian Minister Russian Hackers

Italy Minister’s Personal Data Leaked on Dark Web

 

Italy’s Foreign Minister Antonio Tajani has said that cybercriminals circulated his personal data on the dark web, exposing him and his family to threats and intimidation. Prime Minister Giorgia Meloni blamed pro-Russian hackers, although Tajani did not publicly identify the attackers. The episode highlights how digital harassment and data leaks can be used to pressure political leaders. 

Tajani, who is also Italy’s deputy prime minister, announced the breach in a social-media post. He said that for days, cybercriminals had been spreading information about him on the dark web while trying to obtain additional details about him and his relatives. He said the criminals were even prepared to pay for further personal information, creating what he described as new threats and intimidation for his family. 

The foreign minister did not specify exactly what data had been leaked or which group carried out the attack. However, he linked the targeting to Italy’s position on Ukraine, saying that defending a sovereign state’s freedom and supporting democracy and independence had made him a target. He also said the attack appeared to be a reaction to measures Italy had taken to strengthen cybersecurity at its foreign ministry. 

Meloni expressed full solidarity with Tajani and described the alleged sale of confidential information about government officials as a matter of grave concern. She said it must be addressed with the utmost determination, framing the incident as an attack not only on an individual minister but on Italy’s institutions. Her statement came amid wider concern across Europe about cyberattacks, sabotage, drone incidents, and other hybrid threats. 

Tajani rejected the intimidation and vowed to continue his work. “I will not allow myself to be intimidated in any way,” he said, adding that he would keep defending his ministry and Italy while strengthening cooperation with partners to improve collective security. Italy remains a supporter of Ukraine, providing humanitarian and military assistance as the country continues to defend itself against Russia’s invasion. 

The incident follows a series of security disruptions across Europe, including hoax bomb threats that caused flight diversions, threats against broadcasters, attacks on supermarket refrigeration systems, and drone incursions. Authorities have not publicly attributed those threats to a particular group or state, and no evidence has emerged directly linking the hoaxes to a government. Still, the alleged leak of Tajani’s data has intensified concerns that political figures and critical institutions are increasingly vulnerable to online intimidation campaigns.
Read more »
Information Security
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Healthcare Healthcare Breach Information Security

Amplifon Americas Data Breach Exposes Personal and Medical Information of 1.3 Million People

 

Hearing healthcare company Amplifon Americas has revealed a data breach which has led to personal information being exposed for around 1.33 million people across the United States. The records were reportedly stolen and include personal details, medical histories, health insurance information and in some cases Social Security numbers and financial information. 

The breach occurred at Amplifon Americas, the Minneapolis-based US branch of Amplifon, an Italian-based hearing healthcare company which has over 80 million members across thousands of clinics nationwide. A third party gained unauthorised access to Amplifon’s systems in January 2026 and stole data from specific systems between 18th January and 8th February. A response was made by Amplifon to limit the breach and investigate the incident. 

However, the company found it took a long time to establish how much information had been exposed. It took around eight months to complete its analysis. The investigation revealed a range of information had been stolen, including names, contact details, date of birth, drivers licence numbers and other government issued identification information. Medical information, including hearing information, other medical details, date of medical service and health insurance information had also been exposed. 

Those whose Social Security and financial information had been accessed are at greater risk of identity theft. This could increase their chances of being victims of financial fraud and other issues. Amplifon said they were not aware of any fraudulent activity using the stolen personal information but cannot rule out the possibility of future misuse. A filing was made with the Texas Attorney General’s Office by Amplifon and listed 1,332,826 individuals who had been affected by the data breach across the country. 

The company have not said any further information about who had accessed their information or how they had done so. This shows how at risk healthcare companies can be. They often hold large amounts of personal, medical and insurance information. This can be extremely valuable to cyber criminals as they will have access to a variety of different information which can be used for identity fraud.  

There is not much more information available about the breach. We contacted Amplifon to ask for more information about the breach and how many individuals were affected. More information will be available depending on their response.
Read more »
vpn
Cloud Breach Customer Data Data Breach data security Japan passwords sensitive information vpn

Japanese Homeware Giant Iris Ohyama Says Cloud Breach at Its Online Store May Have Exposed Data of Up to 7.7 Million Shoppers

 



Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its online shopping platform was accessed without authorization, potentially exposing personal data belonging to roughly 7.7 million people, including customers who never created an account.

The company, founded in 1971 and headquartered in Sendai, is best known for plastic storage solutions and home appliances sold across Asia, Europe, and North America. Its e-commerce platform, Iris Plaza, caters to millions of customers in Japan and handles a large volume of household product purchases. The scale of the breach puts it among the larger data security incidents Japan has seen this year, in a period when Japanese companies and government agencies have dealt with a string of serious intrusions.


How the Breach Was Detected

On October 28, 2026, Iris Ohyama staff detected suspicious files inside a cloud service that Iris Plaza relies on for its operations. The company did not name the cloud provider or describe the method the attacker used to get in. Within a day, the company suspended access to Iris Plaza and related systems, reported the incident to Japan's Personal Information Protection Commission, and filed a report with police.

A follow-up disclosure on November 5 gave a clearer picture of the scope: up to 5.8 million registered and former members may have had their data accessed, along with up to 1.9 million non-members, meaning people who had completed a guest checkout without registering. The fact that guest buyers are part of the exposure is insurmountable, since many people assume their data is not retained when they shop without creating an account. In Iris Plaza's case, it was.


What Data Was in the Affected System

The range of information potentially accessed varies depending on the type of account. For registered members, exposed fields can include full name, home address, phone number, email address, gender, and date of birth. Account passwords were also stored in the affected environment, though the company said they were encrypted. It did not specify which encryption method was used, leaving questions open about how resistant those passwords are to cracking.

Former members are in a slightly different position: Iris Ohyama said it does not retain passwords for accounts that have been closed, so that group faces a narrower exposure. For non-members who checked out as guests, the data stored was more limited.

One notable reassurance: the company confirmed that credit card information was not stored in the affected cloud environment, sparing customers from the most immediately damaging form of financial exposure.

As of November 5, Iris Ohyama said it had not received any communication from whoever carried out the intrusion, had not identified any perpetrators, and had not seen reports of fraudulent use or financial damage tied to the breach. The investigation into how many records were actually exfiltrated, as opposed to merely accessible, is still ongoing.


What Iris Plaza Customers Should Do Now

The company has urged customers to change their Iris Plaza passwords and, critically, to change passwords on any other service where they used the same credentials. Password reuse across sites remains one of the most common ways a single breach cascades into wider account takeovers. Anyone who shops with the same email and password combination across multiple retail or financial platforms is at elevated risk.

Iris Ohyama also warned customers to be on guard for phishing attempts. With names, addresses, phone numbers, and email addresses potentially in circulation, attackers have enough to craft convincing messages that appear to come from the company. Iris Ohyama said it will not send emails or SMS messages asking for passwords, PINs, authentication codes, or other sensitive information through links, and customers should treat any such request as fraudulent.


A Year of Costly Data Incidents in Japan

The Iris Ohyama breach lands in the middle of a rough stretch for data security in Japan. This year alone, cloud hosting provider Sakura Internet reported a hack affecting up to 1.36 million accounts, telecommunications giant KDDI disclosed a breach tied to a zero-day vulnerability in third-party software that hit around 12 million accounts across shared email platforms, and Japan's Digital Agency acknowledged that a VPN flaw exposed approximately 246,000 government personnel records. The common thread across several of these incidents is reliance on third-party services and cloud environments where access controls or vendor security fell short.

Iris Ohyama's breach fits that pattern. A third-party cloud provider, an intrusion the retailer only caught when suspicious files turned up, and millions of customer records sitting in an environment the company did not fully control. The investigation remains open, and the company has not said when it expects to restore Iris Plaza to service.



Read more »
telegram
CERT-In Data Breach data fiduciaries Data Stolen DPDP Act India Indian Railways Road telegram

India’s Road Ministry Orders Forensic Audit of Four Transport Portals After Vehicle Data Found for Sale on Telegram

 




The Ministry of Road Transport and Highways has directed India's national cybersecurity agency to conduct a forensic security audit of four of its core digital portals, following reports that personal data of vehicle owners was being sold through Telegram bots and mobile applications for as little as ₹5 per lookup.

The ministry ordered the Computer Emergency Response Team of India, commonly known as CERT-In, to audit VAHAN, SARATHI, e-Challan, and the Pollution Under Control Certificate portal. These four platforms collectively hold some of the most sensitive civic data in the country, covering vehicle registrations, driving licences, traffic challans, and vehicle fitness records for hundreds of millions of Indians.

The trigger for the audit was a report documenting an active Telegram-based service that allowed anyone to query a vehicle registration number and receive the owner's full name, father's name, present and permanent addresses, PIN code, and mobile number. The same service also offered driving licence details, challan history, FASTag information, and downloadable copies of registration certificates and driving licences. A cybersecurity firm, Cyderes, traced the service's backup channel to 21,329 subscribers before it was taken down. It rebuilt itself under new handles within weeks.

The scale of commercial access to these government databases is not incidental. As of the latest available figures, 25,314 private corporate entities held active credentials for the four portals, collectively running 1.708 crore searches over a 33-month period. Officials are now reviewing whether daily search limits and usage guidelines were actually enforced during this period or simply existed on paper.

The concern does not stop at the portals themselves. On the Unified Logistics Interface Platform, managed by the National Industrial Corridor Development Corporation, some authorized entities reportedly logged more than five million data transactions in a single month. The National Informatics Centre has been directed to audit these access patterns. Under revised protocols, any government body seeking data through this logistics platform will now require explicit authorization from the Transport Secretary, with requesting officers verified through Aadhaar-based digital signature certificates or video-based KYC procedures.

The ministry has also written to app store operators, including Google, requesting the removal of applications that surface vehicle owner details without adequate safeguards. Two apps drew particular attention: Vehicle Information App, with roughly 10 million downloads, and VehicleSetu, with about 1 million. The largest vehicle information app on the Play Store reportedly carries over 100 million downloads. MoRTH is also reviewing its data-sharing arrangements with the Ministry of Electronics and Information Technology in light of the Digital Personal Data Protection Act, 2023.

What makes this episode harder to dismiss as a simple breach is that no government database was hacked in the traditional sense. Investigators found no sign of a backend intrusion. Instead, Cyderes traced the data flow to credentials held by licensed identity verification companies, with lookups routed through authentication tokens on a third-party platform. As recently as August 4, 2026, one such route was still returning full VAHAN records including mobile numbers. This points less to a technical failure and more to systemic gaps in how credential use is monitored and how downstream sharing by licensed entities is controlled.

The government's relationship with vehicle data predates this episode by several years. In 2019, Transport Minister Nitin Gadkari told the Rajya Sabha that the government had earned ₹65 crore from selling VAHAN and SARATHI data to 87 private companies and 32 government bodies under a bulk data sharing policy. By February 2021, that revenue figure had grown to over ₹111 crore, with more than 170 recipient entities. Recipients included automakers, insurance firms, and second-hand vehicle dealers. The Internet Freedom Foundation noted at the time, and has reiterated since, that the Motor Vehicles Act contains no provision authorising the commercial transfer of this data to private companies.

IFF sent a formal representation to MoRTH, the NIC, and CERT-In on September 23, 2026, asking for the incident to be registered as a cyber incident, for server logs to be preserved, and for a comprehensive forensic audit. It also asked the ministry to publish a register of all entities currently holding access credentials, introduce technical controls to cap and monitor search volumes, and notify affected individuals.

The ministry says "controlled private access will continue to support commercial efficiency," language that suggests the government is not planning to end third-party access to these databases altogether. What it has not yet addressed publicly is how it will verify that the access controls now being introduced will hold in practice, given that the previous framework apparently operated without meaningful enforcement for years.

India's Digital Personal Data Protection Act places compliance obligations on data fiduciaries starting May 2027, with penalties reaching ₹250 crore for violations. The forensic audit ordered by MoRTH will now determine whether the exposure was a question of technical vulnerability, policy failure, or both.



Read more »
FTP Security
Credential Security Data Breach Data Exploit data security DreamHost Security Incident FTP FTP Security

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information

 

DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident. 

The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed. 

According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts. The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure. 

A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion. DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company. 

Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access. Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere. 

To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity. BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.
Read more »
Sensitive Business Data
AI Data Exposure AI Security Artificial Intelligence Security Cloud Security Data Breach Data Privacy Microsoft Azure Misconfiguration Private Chat Logs Sensitive Business Data

Over 18 Million Files Leaked in AI Aggregator Breach, Raising Privacy Concerns


There has been a major data exposure at the AI aggregator 302.ai that has resulted in millions of documents containing private user conversations, personal information and confidential business material becoming publicly accessible. 


Cybernews cybersecurity researchers discovered an unsecured Microsoft Azure storage bucket belonging to this platform, which exposed approximately 22.72 terabytes of information. There were 17.6 million files in the exposed archive, including images, videos, audio recordings, documents and chat histories. The storage bucket was publicly accessible without password protection or encryption, resulting in anyone able to discover its location having access to the information stored there. 

302.ai is a platform that facilitates the interaction between users and a variety of artificial intelligence services, enabling customers to access multiple large language models on one platform. In addition to ChatGPT, Claude, Grok, DeepSeek, and Gemini, the company supports ChatGPT, Claude, Grok, and Gemini. This arrangement permits users to switch between artificial intelligence models without having to access each provider separately. 

According to Cybernews, the exposed storage contained approximately 144,000 JSON-formatted conversation logs. Users' prompts, AI-generated responses, models used to process requests, timestamps, token consumption costs, and other related metadata were part of these records. As part of the conversations, users entered personally identifiable information as they interacted with the platform. 

The records included details about their birthdates, genders, names, contact information, and addresses, among other personal information. A combination of such information and conversation histories and uploaded documents can reveal more details about individuals than their ordinary chatbot activity. The exposure was more extensive than text-based communications.

The archive contained more than 9 terabytes of images, 7.7 terabytes of videos, and another 5.6 terabytes of audio files. The researchers also discovered over 26,000 ZIP archives containing conversation summaries, inputs from users, AI responses, and attachments to individual sessions. According to reports, a number of documents within the storage were related to large language model development research projects and materials reportedly submitted for private analysis. It is evident from the findings that the information exposed was not confined to individuals, but included information related to business activities as well. 

An especially sensitive discovery involved multiple conversations with a chatbot that provided customer support for a prominent manufacturer of sex dolls. These records illustrate the increasing use of third-party artificial intelligence platforms to manage enterprise customer interactions, resulting in potentially exposing confidential and personal information to external storage environments. Cybernews failed to identify the manufacturer or determine whether all of its customer-service records were exposed. 

Despite the discovery, other concerns have been raised regarding the handling of sensitive customer conversations by third-party artificial intelligence services. As opposed to a confirmed cyberattack, researchers stated that the exposure was likely the result of an accidental storage configuration error. Nonetheless, the investigation did not determine whether any unauthorised parties accessed the files prior to the security measures being implemented or if the technical cause could be determined.

The exposed Azure storage was discovered on August 2, 2026, as reported by Cybernews. A team of researchers contacted 302.ai on August 11 and observed that public access had been disabled by September 8. Researchers found no evidence of malicious actors downloading the information, however it was not impossible for unknown parties to obtain access.

Exposed AI Conversations Could Enable Targeted Cyberattacks

Cybercriminals might be able to conduct targeted phishing and social engineering campaigns if these information is obtained by malicious individuals. As a result of chat histories revealing personal details, business relationships, ongoing projects, customer concerns, and other information, attackers are able to make fraudulent communications appear more convincing by using this information. 

Conversations between employees, customers or senior management could be particularly useful for impersonation attempts. An attacker could also use information contained in uploaded documents and interactions with chatbots to identify potential targets and gain an understanding of internal company operations. The incident demonstrates the security risks associated with third-party AI aggregators. 

In addition to providing access to models developed by major technology companies, platforms such as 302.ai also maintain their own infrastructure to handle prompts, conversation histories, and uploaded files. Generally, the security protections offered by the underlying AI providers do not extend to third-party intermediaries. 

Businesses Urged to Review AI Data Handling Practices

For organizations that rely on artificial intelligence platforms to process customer inquiries, internal documents, and other confidential information, the exposure raises significant concerns. Companies using 302.ai should identify which employees and departments have used the service and whether sensitive company information or customer information has been shared. 

A security team should also review all available conversation histories and uploaded files for potential vulnerabilities in credentials, API keys, and confidential documents. Credentials discovered in submitted materials should be rotated, while suspicious account activity should be investigated. In light of the incident, it is important to evaluate third-party AI vendors before incorporating them into business workflows.

Providers should be examined to determine how they restrict access to storage, protect uploaded files, separate customer information, and manage data retention and deletion. 302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020. This exposure illustrates how weaknesses in intermediary platforms can result in sensitive information being compromised, even when the AI models accessed through those services are operated by established technology companies.

It is clear from the 302.ai exposure that there are growing security concerns associated with third-party artificial intelligence platforms and sensitive data they handle. Businesses are increasingly integrating artificial intelligence tools into their operations; however, preventing confidential information from being made public requires strong data protection measures, regular security assessments, and thorough vendor evaluations.
Read more »
Northflank
AI API Data Breach data security Northflank

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage


Cloud application hosting platform Northflank has warned customers to rotate their stored credentials and API keys following a security breach that resulted in unauthorized use of customers' artificial intelligence (AI) API keys.

Northflank provides a cloud-based platform that allows developers to deploy and manage applications, containers, databases and AI applications without having to manage the underlying infrastructure. 

About the incident

After the warning, Northflank advised customers to immediately change their environment variables and API keys stored on the platform. The company later issued a stronger warning, asking users to assume that all environment variables had been decrypted and that the sensitive information stored inside them had been stolen.

Environment variables are commonly used by applications to store sensitive information, including database passwords, cloud service credentials, authentication tokens and API keys. If attackers gain access to these details, they can use them to compromise other services, steal data or misuse accounts to generate unauthorized charges.

Northflank later confirmed that several customers had reported unauthorized use of AI API keys stored on its platform.

"Users have reported unauthorised use of AI API keys supplied to the Northflank platform," the company said in an update. It urged customers who had not yet changed their stored secrets to do so immediately.

The company also advised users to examine their AI service providers' usage and billing records for unusual activity. Any suspicious usage should be reported to Northflank and the relevant AI service provider.

According to the company's incident timeline, Wiz notified Northflank about the security breach at 11:43 UTC on October 30. Its engineering team began investigating the alert one minute later. Northflank initially introduced a network policy patch and deployed additional security updates at 12:50 UTC and 13:05 UTC. The company also requested assistance from Wiz's incident response team.

As part of its response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis databases. It also introduced audit logs for all customers, including users on free accounts, to help them identify suspicious activities.

According to Wiz, attackers are increasingly targeting environment variables that contain AI service credentials. Stolen API keys can be used in a practice known as LLMJacking, in which attackers exploit another organization's AI accounts to access expensive AI models without permission. They may also resell access to these services to other users.

In two cases investigated by Wiz, attackers used compromised enterprise credentials to make approximately 2.5 million requests to Amazon Bedrock, resulting in nearly $100,000 in AI usage charges.

Read more »
Social Security Number Exposure
Data Breach Education Cybersecurity Financial Aid Website Hack Florida Department Of Education Personal Information Leak Social Security Number Exposure

Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants


The Florida Department of Education (FLDOE) has disclosed a data breach involving its student financial aid website that may have exposed the sensitive personal information of approximately 4.9 million individuals. The compromised information reportedly includes Social Security numbers, names, residential addresses, phone numbers, email addresses, genders and dates of birth. According to the department, unauthorized criminal access to the Florida Student Financial Aid website was discovered on October 19, 2026. 

The agency publicly disclosed the incident on October 29, describing it as a security breach involving unauthorized access to a system containing personal information. The exact method used to gain access and the identity of those responsible have not been disclosed. In a statement issued by the Florida Department of Education, it was noted that individuals who had used the state's financial aid portal may have been affected by the incident. 

The website facilitates the application process for scholarship, grant, and other financial assistance programs, including the lottery-funded Bright Futures scholarship program. After identifying the intrusion, the department activated its cybersecurity response procedures. It has been determined that the unauthorized activity was stopped, contained, and the affected systems were secured. 

As part of the response, the Florida Digital Service and the Florida Department of Law Enforcement are also involved, and the issue has been reported to the Attorney General's Office. According to information reported by The Record, the information exposed may pertain to nearly five million Florida students who applied for financial aid. 

This incident is particularly concerning as Social Security numbers and dates of birth are included, as such information can be exploited for identity theft, fraudulent account creation, and other financial crimes. Rather than affecting the entire Florida Student Financial Aid network, the department believes that the breach was limited to the website. Despite this, the investigation is still ongoing, and officials have not confirmed a breakdown of the affected records or explained how the unauthorized party entered the system. 

The FLDOE has taken the financial aid website offline as part of the response. During the recovery process and security measures, other departmental websites and online services may experience temporary disruptions. Although sensitive personal information was exposed in the incident, the department clarified that it did not affect the administration of financial aid.

Scholarship and grant eligibility, as well as student loan services administered by the department, are expected to continue without delay in spite of the exposure of sensitive personal information. A warning has been issued to potentially affected individuals to monitor their financial and online accounts for unusual activity and to regularly review their credit reports. 

In addition, the department recommended that students consider placing an alert or placing a credit freeze with the major credit bureaus to prevent identity fraud. Currently, the investigation has not been able to determine who is responsible for the intrusion or how the financial aid website was accessed. No information has been provided by the Florida Department of Education as to whether the breach involved stolen credentials, exploited software vulnerabilities, or used another approach to attack. 

Additionally, the authorities have not disclosed any further information concerning the nature of the intrusion, but stated that additional information will be provided once verified findings are available. The breach is not the only recent cyberattack involving government educational systems in the United States. 

Separate data breaches were reported by the California Department of Education approximately one week earlier, which involved information associated with children who had been enrolled in public schools for the previous three years. Despite the lack of connection between these two incidents, the disclosures have raised concerns about the security of sensitive educational information. This year, Florida has also experienced several security breaches relating to government organizations. 

During September, the Department of Motor Vehicles reported a breach involving a prominent hacking group. According to The Record, the hackers continued to advertise the stolen DMV information on cybercriminal forums throughout October.

In a separate incident, a central Florida county experienced significant internet service disruption following an alleged cyberattack. The increasing number of incidents involving public institutions emphasizes the risks associated with large amounts of personal information stored in government databases. 

A majority of educational and administrative portals maintain records containing personal information, which may make unauthorized access particularly concerning when the information relates to millions of individuals. In accordance with Florida's law requiring notification of data breaches, Section 501.171 of the state statutes requires organizations covered by the law to implement reasonable measures to protect electronic personal information. 

There is generally a 30 day notification period for a breach that affects 500 or more Florida residents in order for the Department of Legal Affairs to be notified of the breach. According to applicable legal exceptions, affected individuals must also be notified as soon as possible. The incident occurs in the context of a wider increase in reported data exposures. 

At least 3,43 million people were affected by 5,429 breach notification filings in the first half of 2026, according to the Privacy Rights Clearinghouse, which covered 1,969 distinct incidents. As a result, 33.8% of the reported breach incidents were unable to be determined from public filings during this period, compared with 22.6% in 2022. There remains a priority for the Florida Department of Education in determining the extent of the exposure. 

In the ongoing criminal investigation, the final number of affected individuals, the method of intrusion, and the identity of the unauthorized party are still unknown. Public-sector systems that store sensitive personal and financial information face increasing security risks as a result of this incident. 

There will be a continuing need to determine how the attackers gained access to the system as well as ensuring affected individuals are given timely protection as the investigation proceeds.
Read more »
stablecoin
Binance Blockchain Crypto Theft cryptocurrency Data Breach North Korea stablecoin

North Korean Hackers Drain $6.3 Billion from Binance in Record-Breaking Crypto Theft

 



Hackers tied to North Korea stole roughly $6.36 billion from Binance on Wednesday, stripping the world's largest cryptocurrency exchange of funds across ten blockchains in a heist that blockchain intelligence firms are calling the largest crypto theft in history.

The attack, which began at 8:05 p.m. UTC on October 29, moved faster than most exchange security teams could respond. The bulk of the money was gone within 20 minutes.

Binance suspended deposits and withdrawals shortly after detecting the breach and said user funds would be covered in full. "Investigating a potential security issue," the exchange wrote in an early-evening post, adding that user assets were safe. By late that night, a coalition of blockchain infrastructure firms had frozen roughly $3 billion of the stolen assets, though more than $2.4 billion remained in the attacker's control as of press time.


How They Got In

Blockchain intelligence firm TRM Labs, which traced the attack in near real-time, said the intrusion bore the hallmarks of TraderTraitor, the North Korean state-sponsored hacking unit that the FBI also attributed to February's $1.5 billion Bybit breach.

The preparation started at least 36 hours before the theft. TRM Labs found that the attackers funded an operator wallet with small withdrawals from Tornado Cash, a crypto mixing service, then ran test transactions across wallets they controlled. In the day before the main theft, the attackers rehearsed the final version of their code on a third wallet before installing it on a live Binance hot wallet.

The technical method on Ethereum was particularly precise. The attackers used EIP-7702, an account delegation feature introduced in a recent Ethereum upgrade, to effectively convert a Binance hot wallet into a sweeper they controlled. A single transaction carried 50 pre-signed authorizations; one matched the wallet's transaction count exactly, granting the attackers the ability to sweep new incoming deposits for hours after the initial theft, all the way until 11:56 p.m. UTC.

On nine other blockchains, including Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, and several Ethereum layer-2 networks, wallets sent funds through standard signed transfers during the same window. TRM's analysis concluded the most likely explanation was that the attacker had somehow obtained the ability to instruct Binance's hot wallet signing infrastructure to authorize transactions of their choosing. Binance has not yet published a root cause analysis.


What Was Taken

The breakdown by chain is staggering. Ethereum accounts for the largest slice: about $3.79 billion, including 200,630 ETH and roughly 1.875 billion USDT. Bitcoin follows with 18,270 BTC worth approximately $1.47 billion. Tron contributed about $628 million, primarily USDT, and XRP Ledger added 233 million XRP worth around $296 million. The remaining losses were spread across Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

At those figures, the theft dwarfs every previous crypto hack on record by a considerable margin. The Bybit breach in February 2025, which itself broke every prior record, involved $1.5 billion. This attack is roughly four times larger.


The Freeze Race

Within hours of the theft, stablecoin issuers and blockchain governance bodies began freezing assets. Tether moved first, blacklisting 971 million USDT across wallets traced to the attacker at 9:01 p.m. UTC. Circle followed three minutes later with a freeze on $823 million in USDC, acting in coordination with law enforcement. Ripple froze 40.5 million RLUSD at 10:01 p.m. The Arbitrum Security Council executed forced transfers of 8,426 ETH and 74.6 million ARB tokens after midnight.

By 11:35 p.m. UTC, Binance said the verified total of frozen assets had reached $2.54 billion. TRM Labs placed the figure closer to $2.7 billion by 12:30 a.m. the following morning.

The attacker, however, moved quickly to convert portions of the stolen funds. Some USDT was swapped for ETH at a discount of more than 10%, and the attacker used Aave, a decentralized lending protocol, to borrow ETH against frozen stablecoin positions. As of the morning of October 30, the attacker still held more than 420,000 ETH and all 18,270 BTC, assets beyond the reach of any issuer's freeze function.


North Korea's Crypto Playbook

The FBI said it was aware of the incident and working with partners to assess the activity. The U.S. Secret Service had not responded to a request for comment at time of publication.

The timing fits a pattern that intelligence analysts have tracked closely. Chainalysis reported that North Korean operatives stole about $2 billion in cryptocurrency throughout 2025. TRM Labs found that two North Korea-linked groups accounted for three-quarters of all crypto hack losses in the first quarter of 2026 alone. The funds are widely believed to support Pyongyang's weapons programs, which have been cut off from conventional financial markets through international sanctions.

TRM Labs said it expects the attacker to route remaining funds through cross-chain bridges, swap services, and over-the-counter brokers in the coming weeks, and said it was monitoring those flows in real time.



Read more »
ShinyHunters
cisa systems Data Breach DHS Employee Data Hacktivist group ShinyHunters

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation

 



A hacktivist group has published internal records identifying more than 41,000 Department of Homeland Security employees and contractors, in what security researchers are calling one of the most detailed government workforce exposures in recent memory.

The group, which calls itself the "Department of Peace," shared the data with Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked government datasets, and with Swiss hacker-journalist maia arson crimew. The records went public on October 29 and cover staff across nine DHS agencies.

The group tied the release directly to DHS Secretary Markwayne Mullin's July 17 comments, in which he told reporters he was "turning up the heat" on immigration enforcement. That remark, the group said, was the trigger.


What the data contains

The leaked dataset holds 41,191 records spanning employees and contractors across nine DHS sub-agencies, pulled from nearly 7,000 offices and more than 2,200 locations. Each record contains names, job titles, supervisor relationships, direct reports, employment status, workplace addresses, email addresses, phone numbers, and internal group memberships.

CBP accounts for the largest share with 21,329 records, followed by ICE at 6,598 and USCIS at 6,245. Homeland Security Investigations holds 3,421 records, DHS headquarters 1,755, and CISA 980. The Federal Protective Service, FLETC, and the Science and Technology Directorate account for the remainder. Combined, the exposed records represent roughly one-fifth of DHS's reported headcount of 222,538, according to the DOGE website. CISA records were pulled from the public-facing search results but remain in the underlying dataset.


The Icepick tool

Crimew, who faces a U.S. federal indictment tied to prior leaks, built a searchable interface called "Icepick" and hosted it at icepi.cx. The domain registrar pulled the site down shortly after launch. DDoSecrets responded by releasing the tool's source code publicly. By Thursday morning, the searchable site was offline, but the data itself continued to circulate.

DDoSecrets co-founder Emma Best said the dataset extends well beyond contact information. The records, she wrote, identify officials overseeing covert and undercover operations, the government's internal effort to track down leakers, and the now-defunct BlueLeaks investigation. Crimew described it as "a complete game changer for anyone investigating DHS" and said it "provides FOIA material for years to come."

Ryan Shapiro of Property of the People, a government transparency organization, offered a narrower read, noting that staff contact information could prove useful for Freedom of Information Act requests.


Okta in the spotlight

The Department of Peace claimed the data came from an Okta single sign-on service used internally at DHS. Okta said it reviewed the report and found no evidence that its systems or data had been affected.

That denial has not fully closed the question. CyberScoop verified that numerous active CISA employees appear in the dataset alongside former agency leaders who left government years ago. The records also reference internal groups tied to COVID-19 planning and a 2023 internal summit, suggesting the data spans multiple years and may reflect sustained access rather than a single point-in-time pull.

Bluesky moved to block links pointing to the leaked data and flagged them as malicious, according to WIRED. The speed with which journalists and researchers confirmed active employees in the dataset drew particular concern, given that portions of the records appear to touch on undercover personnel.


A pattern of DHS breaches

This is not the first substantial data exposure tied to DHS. In 2014, a breach potentially affected as many as 390,000 current and former employees, applicants, and contractors. In 2018, the department notified nearly 250,000 people after another incident. Earlier this year, security firm GitGuardian found a publicly accessible GitHub repository containing credentials for privileged AWS GovCloud accounts and internal CISA systems, with the exposure dating back to at least November 2025.

Last month, the hacking group ShinyHunters published a separate spreadsheet containing records on roughly 5,000 alleged FBI employees, including home addresses and emergency contacts, framing that release as retaliation for an FBI advisory about the group.

DHS confirmed it is investigating the current incident. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," as mentioned by a spokesperson, adding that the department would release further details as they became available. DHS did not respond to additional requests for comment by publication time.



Read more »
Ransomware
Data Breach energy company France GDPR Ransomware

French Energy Giant ENGIE Hit by Data Breach, Customer Records Accessed Through Partner Platform

 


ENGIE, one of the world's largest energy companies, has notified customers in France that an unauthorized third party accessed their personal data through a marketing platform used by the company's business partners, the company confirmed this week.

The breach notification letters, dated October 23, went to affected customers after ENGIE said it detected "unusual data access activity" on the partner tool. The company has not stated exactly when the intrusion took place or how long the attacker had access before it was caught.

According to the notifications, the data the intruder obtained includes customers' first and last names, mailing addresses, email addresses, and phone numbers. It also includes two types of energy infrastructure identifiers specific to the French grid: the Delivery Point identifier (PDL) and the Metering and Estimation Point identifier (PCE). Both codes are tied to a customer's physical connection to the gas and electricity supply network. Customer IDs and contract numbers were also taken.

ENGIE said no banking data was involved, and that the breach was confined to the partner-facing marketing platform rather than any of its internal systems. The scope of the incident is currently limited to its French customer base, though the company has not said how many customers received notifications.

"We have cut off the attacker's access to the platform, notified the relevant authorities, and are directly informing each affected customer," the company said in a statement.

Customers were advised to stay alert to unsolicited contact and potential phishing attempts in the wake of the exposure.

No ransomware group or extortion actor had publicly claimed responsibility for the breach at the time of publication.


A Company With a Recurring Target on Its Back

ENGIE operates across 30 countries, employs more than 90,000 people, and posted €71.9 billion in revenue last year. Its scale across utilities, renewables, and energy infrastructure makes it a high-value target for threat actors looking for customer data at volume.

This latest breach is not the first time attackers have made it inside ENGIE's wider corporate ecosystem. Approximately a year ago, the Scattered LAPSUS$ Hunters group claimed it had breached a Salesforce instance belonging to Engie Records, the retail energy subsidiary of ENGIE North America, and leaked records from the intrusion. Engie Records appeared on the group's leak site as the 27th of 39 organizations allegedly hit through the same Salesforce-related campaign, with around 3GB of data listed.

Before that, in August 2023, a separate incident affected roughly 110,000 French ENGIE customers. In that case, a hacker known online as "HommedeLombre" reportedly got into ENGIE's systems through an external contractor's network, a technique also used in the Pôle Emploi breach around the same period. That attacker exposed names, email addresses, and phone numbers, and later said the intrusion was meant to demonstrate that "nothing is ever secure," citing rising gas prices as a grievance. ENGIE filed a complaint with authorities following that incident and said it had brought the affected system under control.

If we look closer to understand the link here, the three incidents point to a recurring problem: ENGIE's data, whether held by internal systems, subsidiaries, or third-party partners, keeps ending up in attackers' hands.


Why Energy Sector Customer Data Is Valuable

The combination of contact information and energy-specific identifiers like PDL and PCE codes makes the stolen data more useful to attackers than a standard contact list. Those codes link a name and address to a specific gas or electricity metering point in the French national grid, which means the data could be used to convincingly impersonate ENGIE in phishing campaigns or to target customers with fraudulent offers around energy billing or contracts.

France's energy market also went through a turbulent period of price volatility in recent years, which means many customers have been actively comparing suppliers and receiving legitimate outreach about tariff changes. That context makes it easier for fraudsters to craft believable messages that reference contract numbers, delivery point details, and billing information, exactly the kind of data now in circulation.

ENGIE said it has notified the relevant authorities, as required under GDPR. French data protection rules mandate that breaches of personal data be reported to the CNIL, the national data protection authority, within 72 hours of detection, and that affected individuals be notified without undue delay when the breach poses a risk to their rights and freedoms.

As of now, ENGIE has not attributed the breach to any specific threat actor, and it is unclear whether the platform through which the data was accessed belonged to an external vendor or an internal partner system. The investigation appears to be ongoing.



Read more »
Warp Breach
Agent Logs AI Security Data Breach Telemetry Exposure Warp Breach

Warp Breach Exposes AI Agent Logs and Telemetry

 

Warp has disclosed a security incident involving a third party infrastructure vendor that exposed AI agent decision logs and user telemetry. Chief executive Zach Lloyd estimated that approximately 1% of users could be affected, while emphasizing that the investigation remains ongoing. The disclosure identifies an exposure of operational records rather than establishing a compromise of every component in Warp’s development environment. The vendor, initial access mechanism, affected infrastructure components, and precise data boundaries have not been publicly identified, limiting independent assessment of the incident. 

Warp combines terminal functionality, a code editor, task orchestration, and agent activity review within an agentic development environment. Developers use its AI agents to generate code, execute tests, and deploy software. Consequently, agent traces and telemetry represent records associated with automated development workflows, although their exact contents vary with implementation. Warp reports at least 800,000 users, but its preliminary estimate of affected users does not establish the number of exposed records, compromised sessions, or affected organizations. Those measurements describe different dimensions of a security incident.

According to Lloyd, Warp detected what it believed was active, narrowly targeted exploitation of an infrastructure vendor on Friday and intervened within hours. The company described an attacker operation involving an “agent swarm,” sophisticated penetration techniques, and privilege escalation. However, the disclosure does not provide enough technical detail to reconstruct the attack chain or verify individual exploitation stages. No publicly identified vulnerability, authentication bypass, compromised identity, or execution mechanism has been specified. Claims about particular exploit classes would therefore exceed the available evidence. 

The exposed data categories were agent traces and telemetry. Warp has not established publicly whether these records included source code, user prompts, credentials, or other sensitive content. This uncertainty prevents a definitive assessment of confidentiality impact or potential secondary compromise. Exposure of operational logs should not automatically be equated with theft of API keys or unauthorized access to customer repositories. Warp notified identified affected users, informed the vendor, engaged CrowdStrike to assist with investigation, and contacted law enforcement. Further findings are needed to establish scope. 

A separate incident involving AI coding platform OpenCode illustrates why data classification matters when comparing breaches. That compromise exposed stored API keys for external providers, affected approximately 1.4% of users, and resulted in unauthorized charges reaching $1,700 for some victims. Equivalent credential exposure or financial abuse has not been established for Warp. The technical questions remain which records were accessible, what sensitive fields they contained, and how vendor access enabled their exposure. Until those details emerge, conclusions about downstream exploitation must remain provisional.
Read more »
Times Car
Data Breach driver's license details Japan Park24 personal data Times Car

Japan's Largest Car-Sharing Service Exposes 6.6 Million Accounts in Serious Data Breach

 



Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging to more than 6.6 million current and former members of Japan's largest car-sharing service. The final investigation report, released October 23, puts the incident among the most serious personal data exposures Japan has seen in recent years, with identity documents at the center of the damage.

The stolen data covers names, home addresses, dates of birth, phone numbers, email addresses, and driver's license details for 6,628,007 accounts. For 1,464,800 of those accounts, attackers transmitted encrypted images of identity documents outside the company's systems. Those images included driver's licenses, utility bills used to verify home addresses, student IDs from people enrolled in student plans, and family verification documents for members on family plans. Another 891,602 account holders had their images accessed but not transmitted. In total, roughly 2.36 million identity document files were touched in some form.

  • 6.6M: Accounts with personal data accessed
  • 1.46M: ID document images transmitted out
  • ¥5.5B: Projected special loss
  • 64K: Potential class-action claimants

Attackers entered through a vulnerability in the Times Car web application and used what they found there to navigate into the company's underlying database and file storage. Park24 has not named the specific flaw or described the compromised architecture, saying only that the confirmed access path is closed and that systems built the same way were reviewed afterward. The breach was detected at 9:07 a.m. on September 25. By the following morning, the attacker's communication route was cut off.

Times Mobility's Times Club loyalty program was accessed in the same incident. That system contributed 135,436 linked service IDs, 19,510 Times Club card numbers, and the last four digits of 28 credit cards to the exposure. Park24 said it does not store full card numbers or security codes in either system. Four hashed passwords were also transmitted, though the company described them as stored "in a form that cannot be restored."

The financial toll has been significant. Park24 projected a 5.5 billion yen special loss and cut its full-year net profit forecast by 12.5 percent. The company plans to pay 3,000 yen per person, in cash or vouchers, to each of the 1.46 million customers whose encrypted ID images left the system. Daily sales have since returned to pre-incident levels, though the company acknowledged that membership numbers dropped in the immediate aftermath of the disclosure.

A Japanese attorney opened a plaintiff intake site on September 30, and by October 7, roughly 64,000 people had registered as potential claimants. No lawsuit has been filed yet, but the figure is unusually high by the standards of Japan's data-privacy litigation history.

Regulators moved across several agencies. The National Police Agency issued guidance on October 8, warning businesses to tighten identity verification and alerting the public to impersonation scams. The Financial Services Agency followed the next day, asking banks and financial firms to stop accepting uploaded ID photos for account verification ahead of the April 2027 legal deadline and to read IC chips from physical documents instead. Japan's transport ministry instructed the Japan Rental Car Association to survey its members on data protection practices and report back by October 30.

"A reissue is not something that lets you feel safe." [Police official, quoted by Asahi Shimbun, on driver's license replacement]

One consequence without much precedent in Japanese data-protection cases has been a wave of driver's license reissue requests. Because license numbers and photographs are permanent identifiers, prefectural public safety commissions began accepting applications for replacements under the Road Traffic Act. By October 10, at least 16 prefectures, including Aichi, Hiroshima, Miyagi, and Niigata, were processing applications. A reissued license carries a new number and photograph but does not change the holder's name, address, or date of birth, which limits how much protection it actually offers.

Times Mobility changed its retention practices on October 16, announcing it would delete ID images once a registration check is complete for current members and would no longer keep images of former members at all, reversing a policy of retaining them for seven years. The company had cited identity verification needs and the Corporation Tax Act as justification for the extended retention, though tax law does not require keeping license images. All existing images are scheduled for deletion by the end of October.

Times Mobility has held Japan's Privacy Mark certification from JIPDEC since 2021, valid through August 2027. JIPDEC received the incident report and asked for a prompt investigation; its options include issuing a recommendation, suspending the mark, or revoking it.

The breach arrived during a period of rising unauthorized access across Japan. The National Police Agency recorded more than 7,190 such cases in 2025, more than four times the 2021 figure. Nippon Rent-A-Car disclosed a separate intrusion the same week affecting 96 members across two access events, though neither company has suggested any connection between the incidents.

Anyone who ever registered with Times Car, including those who never finished sign-up, should treat their information as having been accessed. The company has said it will never request passwords, SMS codes, or card PINs by phone or message. Its official fraud hotline is 0120-25-8924.


Read more »
railway
API Keys Cloud Platform Data Breach Developers GitHub openAI private credentials railway

Railway Tells 4.8 Million Users to Rotate Secrets After Possible Breach of Environment Variables







Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents.

The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway.

"We strongly recommend that you immediately roll all environment variables, including any API keys."
[Railway, Security Disclosure — October 21, 2026]

By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window.

Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud.

That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet.

What Railway Users Should Do Now
  • Rotate all environment variables stored on Railway, including API keys for every third-party service.
  • Rotate private container registry credentials.
  • Review service logs for any unusual or unauthorized activity since October 21.
  • After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window.
  • Reconnect GitHub integrations if they were created after the freeze began.
Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments.

For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not.

Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.


Read more »
User Security
Data Breach Medical Data Patient Records Quest Diagnostics User Security

Quest Diagnostics Reports Cyber Breach Affecting Patient Records

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown. 

In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data. 

The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates. 

This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor. 

The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.

 

Read more »
Subscribe to: Posts (Atom)