Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breach. Show all posts
healthcare data breach
customer data breach cybersecurity in healthcare Data Breach Data Leak data security Healthcare Data healthcare data breach

DC Health Agency Data Exposure Affects Nearly 400,000 Medicaid Beneficiaries

 

Almost 400,000 people who enrolled in Medicaid and the DC Healthcare Alliance may have been affected by a data breach, which occurred on the website of the District of Columbia Department of Health Care Finance. 

The issue concerned the reports published on the organization’s website, which showed aggregated data about the people who enrolled in the programs between 2023 and 2026. DHCF noted that the breach did not involve cybersecurity issues or intentional unauthorized access to the system. The problem was discovered by the agency in July, when it was revealed that two reports on the website contained fields with personally identifiable information that could have been accessed by unauthorized parties. 

The reports included only aggregated data, such as the number of people enrolled in the programs at specific times and other related information. Nevertheless, according to DHCF, the supporting information on its website could have been accessed by unauthorized parties since 2023. The personally identifiable information of the people who enrolled in Medicaid and the DC Healthcare Alliance includes their ID, providers, date of birth, race, gender, ethnicity, and wards. 

According to the agency, the reports do not contain Social Security numbers, names, and financial information of the affected people. DHCF announced that 399,086 people were affected by the issue and notified the United States Department of Health and Human Services (HHS). The latter added DHCF to its website, which keeps track of data breaches. It is unclear whether the affected people’s information was misused or will be misused in the future. Nevertheless, DHCF advised them to remain wary of potential fraudulent activities and unauthorized attempts to gain access to their information. 

According to the agency, the fact that the reports did not include Social Security numbers and financial accounts minimizes the risk of exploitation, but it remains present due to the inclusion of people’s IDs. After the breach was discovered, DHCF removed the reports from its website. In addition, it initiated an internal review process and responded to the problem by checking its systems for vulnerabilities and ensuring that its internal procedures were appropriate for addressing the issue. 

It is important to note that the breach illustrates how people’s information can be exposed even when it should not be. In this case, the data was not hacked or intentionally shared with unauthorized parties. Nevertheless, it became available to anyone who wanted to see it because the reports containing it were publicly available. 

Therefore, it is essential for people who enrolled in Medicaid and the DC Healthcare Alliance to ensure that they are not contacted by scammers and that their information is not misused. It is necessary for them to contact DHCF if they suspect that something is wrong. At the same time, it is important to keep in mind that, according to the agency, there is no information about the affected people’s information being viewed or misused.
Read more »
Telecom Hacking
Cameron Wagenius Credential Theft Cyber Extortion CyberCrime Data Breach Data Theft SIM Swapping Snowflake Attacks Telecom Hacking

Hacking and Extortion Operation Targeting U.S. Official Ends in Conviction


A former U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in prison for participating in a hacking and extortion campaign which exposed sensitive information and targeted telecommunication companies. According to the U.S. Department of Justice, Wagenius has also been ordered to pay $294,978 in restitution. Wagenius was involved in the cybercrime operation while serving as an active duty military member. 

In April 2023 and December 2024, he and other conspirators obtained credentials allowing them to access protected networks belonging to at least ten organizations. The stolen information was then used to extort victims by threatening publication or sale of the data without their payment.

Investigators have stated Wagenius was an online hacker known as “kiberphant0m” and he contributed to the development of the hacking tool SSH Brute, which was used to obtain login credentials. To exchange stolen credentials and coordinate access to victim networks, the group communicated via Telegram. Additionally, public threats were made on cybercrime forums.

Stolen information was made available for sale on platforms including BreachForums and Wagenius published two posts in November 2024 that contained stolen non-content call detail records associated with a former US government official and relatives of another former official. As part of the threats, the Justice Department also stated that additional confidential records would be released if a ransom was paid.

One of the posts indicated that the activity may be partly motivated by retaliation for the arrest of another cybercriminal. There have been several attacks involving major telecommunications companies and other companies. According to cybersecurity researchers, Wagenius' possession of data was related to broader attacks targeting Snowflake customer environments. Several companies were affected by the campaign, including AT&T, Ticketmaster, Advance Auto Parts, and Santander. 

Wagenius pleaded guilty in separate proceedings filed in the Western District of Washington in support of the charges. A conviction for wire fraud, extortion using computers, and aggravated identity theft was obtained in July 2025. Prior to this, he had pleaded guilty to two counts of unlawfully transferring confidential phone records related to the same operation in March 2025. Additionally, Wagenius appears to be tied to the wave of attacks against organizations using Snowflake cloud environments that took place in 2024. 

According to AT&T, attackers accessed call and text records covering nearly all of its mobile customers in December 2022. The stolen information was later associated with extortion activity involving several cyber criminals. Moreover, court records and the investigation report indicate that Wagenius attempted to sell stolen information to an email address he believed was affiliated with a foreign military intelligence service. Moreover, the prosecution alleges that he searched the Internet for information about leaving the United States for Russia. 

The intelligence services involved have not yet been publicly identified by the government. Based on the findings of the investigation, the hacking operation was primarily a result of the use of stolen credentials, rather than an exploit of a specific software vulnerability. The credentials were used by Wagenius and his associates to gain access to company networks and cloud environments, using Telegram to communicate access details and coordinate further intrusions. 

After invading victim networks, the group aimed at obtaining data to be monetized. In some cases, information was provided to other criminals, whereas other records were used for fraud schemes, such as SIM swapping. Additionally, extortion demands were extorted through private communications as well as public postings on cybercrime forums. 

The FBI, Defense Criminal Investigative Service, and other law enforcement agencies investigated these activities. A warrant was issued for Wagenius' arrest in December 2024, bringing to a close the hacking activities he allegedly conducted for more than a year while remaining an active duty soldier.
Read more »
Linux
Accomplish Bug Bounty Programs CloudFlare Container Security Data Breach Linux

Cloudflare Patches Cross-Tenant Container Flaw That Let Tenants Read Each Other's Leftover Disk Data

 




Cloudflare has patched a vulnerability in its Containers product that could have allowed a paying customer to pull residual data out of disk storage blocks previously used by a different tenant. The company disclosed the issue on September 24, three weeks after security researcher Oren Yomtov from the firm Accomplish filed a report through Cloudflare's HackerOne bug bounty program.

The flaw was rooted in how Cloudflare configured the Linux storage subsystem underpinning its container infrastructure. Cloudflare Containers run each workload inside a dedicated virtual machine powered by the Firecracker virtual machine monitor. Each VM gets a writable root disk backed by Linux device mapper thin provisioning, known as dm-thin, a storage technology that allocates physical disk space on demand rather than upfront. When a container's thin volume was deleted, the physical 64 KiB blocks it had occupied were handed back to a shared pool that served workloads from multiple customer accounts.

The problem was a single configuration option: `skip_block_zeroing`. With this flag set, dm-thin does not wipe a block before reassigning it. That is a performance trade-off operators sometimes make deliberately, but in a multi-tenant environment the consequences were significant. A freshly assigned block would carry the previous tenant's data intact unless the incoming workload happened to overwrite every byte of it.

Yomtov and his team worked out a way to exploit this behavior without needing any privileged access. A tenant with a standard Workers Paid account could open their container's raw root disk at `/dev/vdc` and identify regions that the guest ext4 filesystem had marked as free space. Writing a small 4 KiB block into a 64 KiB-aligned free region would force dm-thin to pull a physical block from the shared pool. Because zeroing was disabled, only the 4 KiB the attacker wrote got replaced. The remaining 60 KiB stayed exactly as the previous owner had left it. A subsequent raw-device read could then pull those bytes out.

What the researchers found across production runs was striking in scope. They tested the technique across 24 placements and found residual data on 18 of them, across 20 of 22 underlying nodes and spanning four continents. The recovered material included directory structures, database pages, and structurally complete SQLite databases. Using ext4's `metadata_csum` checksum feature, the team was able to confirm that recovered directory blocks did not originate from their own test filesystem. Across six placements they identified 2,700 distinct foreign directory inodes. All proof-of-concept materials submitted to Cloudflare were scrubbed of third-party identifiers and content values, and the researchers confirmed they securely deleted the recovered data after submission.

The vulnerability carried real limits. An attacker could not pick a target. Which blocks dm-thin reassigned to a new container depended entirely on Cloudflare's workload scheduler, so exploitation was opportunistic rather than directed. The technique also could not touch any actively mounted disk or modify another tenant's live data.

Cloudflare moved fast. Yomtov filed the report on September 4 at 15:26 UTC. The engineering team opened a security incident and confirmed the production setup behind the flaw within about three hours. A runtime fix was merged by 21:27 UTC the same day. Rolling out the change across the fleet began by 23:15 UTC. But removing `skip_block_zeroing` only stops future misallocation. Blocks already mapped into running containers or cached in pre-built snapshot layers were unaffected. To clean those up, Cloudflare drained hosts during off-peak hours, restarted their VMs, and wiped each host's image cache so every disk would be rebuilt using zeroed allocations. That final cleanup finished on September 19. The researchers confirmed their proof of concept stopped working on September 14.

Cloudflare said it reviewed all available historical disk I/O telemetry and found no activity consistent with the exploit technique other than what came from the researchers and from Cloudflare engineers during authorized validation. No customer-side action is needed.

The disclosure adds to a recent pattern in cloud infrastructure research. Yomtov's team at Accomplish has a track record of finding platform-level flaws; they also reported a sandbox escape in Anthropic's Cowork tool this year. In the wider cloud industry, Wiz researchers disclosed a separate cross-tenant issue in Microsoft Azure Cosmos DB this year, called CosmosEscape, which could have let attackers escalate from a crafted Gremlin query to retrieving primary account keys for other customers' databases. Microsoft said it found no evidence of customer impact in that case either.

Cloudflare co-authored its disclosure with Yomtov and the Accomplish research team, a relatively transparent move for a company of its size. The company's bug bounty sits on HackerOne and remains open for further researcher submissions.


Read more »
Social Engineering Attack
Astrana Health Data Breach Cyberattack Data Breach data security Healthcare cybersecurity healthcare data breach Patient Data Security Social Engineering Attack

Astrana Health Data Breach Exposes Private and Confidential Information


In a cybersecurity incident, Astrana Health disclosed, attackers gained access to company servers and obtained confidential and private information. A social engineering attack targeting employees was conducted by the healthcare technology company's subsidiary, Astrana Health Management, to accomplish the intrusion. 

Astrana Health employees were impersonated in the attack and the main corporate telephone number of the company was spoofed by the attackers, according to a filing with the Securities and Exchange Commission. Employees were contacted using the fraudulent number, and eventually the attacker obtained access to the company's servers through the fraudulent number. Because of the potentially sensitive nature of the information involved, the incident was later determined to be material. 

In its investigation, Astrana Health discovered that some private and confidential information stored on its servers had been accessed or acquired without authorization. As of this writing, the company is still investigating the incident in order to determine whether patient, employee, credentialed provider, business, financial, and intellectual property information was affected. There has been no disclosure of the specific information compromised or the number of individuals affected. 

After detecting the intrusion, Astrana Health consulted with a third-party cybersecurity firm, notified law enforcement and regulatory authorities, and informed partners and customers of the incident. As part of the mitigation, credentials have been rotated, remote access tools have been restricted, certain systems were restored from backups, and monitoring, logging, and detection measures have been strengthened. The extent of the exposure has not yet been identified. 

Currently, Astrana Health is investigating whether patient data, employee data, credentialed provider data, confidential business or financial records, and intellectual property were involved. There has been no disclosure of the number of individuals affected or a specific list of the data accessed and taken by the company. As a result of the potentially sensitive nature of the information involved, this incident has been classified as material. In the meantime, Astrana Health does not anticipate the attack will significantly affect its financial position or operations. 

During the investigation, the company has also notified law enforcement, regulators, and relevant customers. There has been no public attribution for the attack. There are no known ransomware or extortion groups that claim responsibility for the attacks at the time of the reports. In addition, Astrana Health has not confirmed the presence of ransomware. 

Due to the wide range of information stored within Astrana Health's systems, the incident is of particular significance as it affects healthcare providers that provide technology and administrative services. As of the last quarter, the company reported revenue of approximately $972.5 million and provides its operations technology platform to approximately 20,000 medical practitioners. 

A preliminary investigation by Astrana Health is ongoing, with the company seeking to determine the full extent of the information accessed as a result of the cyberattack. Further findings may clarify the type of data involved and the number of individuals affected by the cyberattack.
Read more »
Supply Chain Attack
Big Commerce Customer Data Data Breach master of malt Supply Chain Attack

BigCommerce Merchants Hit in Supply Chain Breach After Ribon App Credentials Were Stolen

 



BigCommerce has started alerting merchants that customer data was stolen from their stores after attackers got hold of API credentials belonging to Ribon, a third-party storefront optimization app used by retailers across the platform.

The stolen credentials gave attackers access to customer records inside merchant accounts on BigCommerce between September 13 and September 17. For those four days, they pulled data page by page until the compromised key was revoked. Names, email addresses, phone numbers, and shipping addresses were taken. Passwords and payment card details were not, because BigCommerce stores that information in a separate system.

The breach did not originate inside BigCommerce. It traced back to a system compromise at Fastr, the parent company of Be A Part Of, the firm that develops and operates Ribon and its updated version, Ribon 1.5. Fastr's internal compromise exposed the API credentials those apps held, and attackers used them to walk directly into merchant environments without triggering any alarm at BigCommerce's own infrastructure level.

"On September 17, 2026, Commerce confirmed that API credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised due to a Fastr system compromise," BigCommerce told SecurityWeek. "This was not a breach of Commerce systems or the BigCommerce platform."

Ribon's own developers noticed the key was being misused on September 16. The access was cut on September 17, and BigCommerce uninstalled the app from all affected stores the same day. Merchants started receiving notifications from BigCommerce on September 18. In some stores, attackers also injected malicious scripts, though BigCommerce has only said this affected a small number of storefronts and has not specified what those scripts were designed to execute.

UK spirits retailer Master of Malt confirmed publicly it was among the merchants notified. In a statement on its website, the company said the attacker accessed its customer database and described what happened in plain terms. "It looks like hackers were able to compromise a BigCommerce Application key held by Ribon, which they were able to use to gain access to customer data held on their system." Master of Malt has reported the incident to the UK Information Commissioner's Office and said the impact may extend to hundreds of other retailers that had Ribon installed on their stores.

That point matters. This was not a breach contained to one retailer or to one retailer's mistakes. Every merchant that had Ribon connected to its BigCommerce store shared the same exposure risk, because every one of them relied on the same third-party credentials that Fastr failed to protect. The total number of affected merchants has not been disclosed. Fastr and Be A Part Of have not issued any public statement. Neither company had responded to media requests for comment as of the time of reporting.

BigCommerce hosts over 1,200 third-party apps and integrations. It told BleepingComputer it is providing log data to support Fastr's investigation. Seattle-based law firm Emery Reddy is already seeking potential claimants, noting that several retailers have begun sending breach notifications to their customers. The firm confirmed the exposed information matches what Master of Malt reported: names, email addresses, phone numbers, and physical addresses.

This incident is not the first time BigCommerce has had to yank a third-party app after attackers used it to reach merchant customers. In late 2024, electronics accessories maker ZAGG disclosed that unknown actors had breached FreshClick, another third-party BigCommerce integration, and injected payment-skimming code into its checkout. That attack ran from October 26 through November 7, 2024, and resulted in the theft of names, addresses, and live payment card data from customers completing transactions on ZAGG's site.

The two incidents differ in method. The FreshClick attack used malicious JavaScript to capture card details at the point of entry, in real time, as customers typed. The Ribon attack used a compromised backend key to query stored customer records directly, without any customer interaction required. No payment data changed hands this time, but the attacker had persistent, authenticated access to customer databases for four consecutive days before anyone pulled the key.

For shoppers at any retailer that used Ribon, names, email addresses, phone numbers, and home addresses are now in someone else's hands. That combination is more than enough to build convincing phishing messages or to attempt account takeover on other services where those same details appear. Affected customers should treat any unsolicited emails referencing their account details or recent orders with skepticism until the full scope of the incident is established.


Read more »
Hacker attack
Chinese Hackers Critical Flaws Data Breach data security data stealing data vulnerability Hacker attack

Chinese Hackers Exploit ZyXEL Switch Flaw to Steal Data From Nearly 1,000 Devices

 

A Chinese threat actor has been using the recently discovered vulnerability in ZyXEL GS1900 switches to steal crucial information from the devices around the world, according to GreyNoise, a threat intelligence company.

The vulnerability, tracked as CVE-2026-7273, has a CVSS score of 8.8 and is a stack-based buffer overflow, enabling a remote unauthenticated attacker to execute OS commands via a specially crafted HTTP request. 

ZyXEL has issued security updates for ten GS1900 switch models in June. However, according to GreyNoise, the flaw was actively exploited in August, targeting the devices in 48 countries. The threat actors used a Python script, which was significantly obfuscated to hide its purpose, to extract the hashes of the root credentials, configuration, and network information from 996 affected switches. 

While the script targeted the GS1900-24 switches with firmware versions 2.10 to 2.90, some of the command-line options in the script contained values related to libc base addresses and global offsets. Therefore, it might be possible that the threat actors could use the same vulnerability to target other firmware versions. The information stolen from the switches also showed that 564 devices were using default credentials. This lets the attackers effortlessly compromise these devices. 

On Monday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog. Also, per the Binding Operational Directive 26-04, all federal agencies must remediate this issue within 3 days of its publication. GreyNoise also reported that the same threat actor conducted Ubiquiti attacks, which involved exploiting the zero-day flaws to gain remote access and execute arbitrary code in the devices. 

In addition, the attackers used exploits targeting WordPress flaws to launch attacks against small businesses and government entities in July. The attacks entailed a threat actor compromising a Western government organization, stealing over 18000 sensitive documents from the agency’s backend database, and publishing the results on a Matrix communication service. 

However, the cybersecurity firm is yet to confirm if any of these attacks were conducted by the same threat actor. Acronis, another cybersecurity firm, previously identified threat actors using the Red Heron hacking group, which primarily used Gitea’s zero-day flaw to target more than 100 organizations worldwide.
Read more »
Screenshot Data Breach
23.6 Million Records Cybersecurity Data Breach Data Privacy Gyazo Data Breach Gyazo Security Breach Image Metadata Exposure Password Hashes Screenshot Data Breach

Gyazo Server Vulnerability Targeted to Steal Millions of User Records


Gyazo, an image-sharing platform, has confirmed a breach after attackers exploited a vulnerability in its upload server, gaining unauthorized access to the company's systems and approximately 23.62 million user records. 

Gyazo was developed by Japanese software company Helpfeel and allows users to upload images, GIFs, short videos and generate links for sharing. There are over 23 million users on the platform from 242 countries and regions, and billions of uploads have been processed. According to Helpfeel, the intrusion occurred on September 11, when a third party exploited a vulnerability in Gyazo's image upload server and became able to execute commands on the system as a result. 

On the same day, the company was notified of suspicious activity and began to investigate the incident. In the early hours of September 12, Helpfeel had blocked the access routes used for the attack and terminated any unauthorized connections. As part of the initial response, the exploited vulnerability was also fixed. However, an investigation revealed that the attacker was already able to access Gyazo's database and obtain user-related information. There are approximately 23.62 million records in the affected dataset. 

Depending on the account, information that will be exposed may include name or nickname, email address, password hashes, user and device IDs, login session IDs, profile information, subscription details, billing status and usage statistics. Additional information may be exposed if an account is linked to an external service. 

According to Helpfeel, integration tokens for accounts connected to X may be included, while Google SSO email addresses may also be included for users who signed in through Google. In a statement issued by the company, it clarified that payment information, including credit card numbers, was not exposed. 

The affected records also include anonymous accounts without registered email addresses, therefore it is not yet known how many people will be affected. The incident involved not only account information, but also a much larger collection of image-related metadata. According to Helpfeel, approximately 490 million metadata records were disclosed, primarily those associated with images uploaded before January 2019. It is possible for an image ID to be exposed, as well as IP addresses and User Agent details, EXIF location information, OCR-extracted text, image titles, and source URLs. 

A separate privacy concern arises from the image metadata, as Gyazo uses image IDs to generate URLs for uploaded captures. According to Helpfeel, the stolen IDs may allow access to some images, so the company temporarily disabled access to affected files while investigating. As a result, approximately 490 million images have been compromised, most of which were uploaded in January 2019 or earlier. 

Information may include image IDs, IP addresses, User-Agent strings, EXIF location information, OCR-extracted text, title of the image, and URL of the source. Besides the data exposed, Helpfeel also identified a separate set of approximately 2.4 million image records which were retrieved according to specific filtering criteria, including hacked passphrases associated with private images. This company has not provided information on the criteria used or clarified whether the records overlap with the larger metadata set. Also exposed in the incident was a list of private images. 

Helpfeel did not exclude the possibility that private pictures were viewed by the attacker. The number of private images accessed has not been determined by the company. Because Gyazo handles image privacy in a very sensitive manner, the disclosure of image IDs is particularly significant. The URL of each capture includes a 32-character ID, and older captures can still be accessed through their original URLs even after they are not prominently displayed within a user's account. 

The leaked identifiers therefore could be used to gain access to content that was not intended to be viewed by the general public. By the early hours of September 12, Helpfeel detected suspicious activity and blocked the identified access routes, terminating the attacker's connections. The exploited server vulnerability was immediately addressed. 

In September 14, the company confirmed the data exposure and reported the incident to the Japanese Personal Information Protection Commission. During the course of the investigation, Gyazo temporarily suspended image delivery. A forensic investigation is currently underway by Helpfeel, and affected users will be contacted directly. 

Anonymous accounts will be handled by Gyazo through notifications posted on the website. Despite finding no evidence of the deletion of image data during the incident, the company has not identified a data leak involving its separate Helpfeel and Cosense services. Users have been advised to change their Gyazo passwords and avoid reusing the same credentials on other services in light of the exposed authentication data. 

Helpfeel has also taken action to invalidate or restrict the affected credentials and authentication information. Furthermore, the company has cautioned against the possibility of exploitation of information disclosed in the breach through suspicious emails and messages.
Read more »
data security
AI Agent AI agent data theft AI technology Competition Watchdogs Cyberattacks Data Breach data security

Spanish Data Watchdog Publicises First AI Agent-Linked Data Breach Report

Spain's data protection watchdog said it has received the first reported notification of a personal data breach allegedly carried out by an artificial intelligence agent, a case suggesting autonomous systems are beginning to play a direct role in cyberattacks. The Spanish Data Protection Agency (AEPD) said in a blog post Monday that the incident involved an AI agent using a widely known large language model to identify vulnerabilities, gain access to a system, and subsequently modify personal data and access invoices. 

The agency said the alleged breach was reported by the affected organization and remains under review. It clarified that the use of a particular AI model does not imply the model itself or its provider's infrastructure was compromised, nor that the technology was built for malicious purposes. AEPD did not immediately respond to a request for comment and did not identify the large language model or the targeted organization. 

According to AEPD, the case is significant because a third party allegedly used an AI agent to carry out multiple stages of an attack with limited human intervention, underscoring the growing role autonomous systems are playing in cybersecurity incidents. The notification submitted by the affected organization indicated that the agent successfully logged into the system, autonomously searched for application weaknesses, and after identifying a vulnerability, altered personal information and viewed billing records. 

The incident emerges as regulators and cybersecurity authorities across the United States and Europe intensify scrutiny of risks posed by increasingly capable AI systems, even as businesses continue adopting the technology at a rapid pace. Spain has positioned itself as one of Europe's most vocal advocates for a "trustworthy AI" model — one that prioritizes protecting privacy, democracy, minors, and public safety over speed or industry profit. 

While AEPD acknowledged that a single case is insufficient to establish a broader trend, it said the notification suggests AI-assisted attacks are moving beyond the theoretical stage and beginning to affect real-world processing of personal data. The watchdog did not indicate when it would complete its review of the reported breach. 

AEPD noted that AI does not create fundamentally new threats but increases the speed, scale, and adaptability of existing malicious techniques, thereby reducing the time available to detect and contain them. The agency added that data controllers, processors, and data protection officers must prepare for a scenario in which the speed of attacks will continue to accelerate.
Read more »
VPN Vulnerability
Data Breach Government Data Breach Government Network Security Japan Cyber attack Japan Digital Agency Phishing Risk VPN Security VPN Vulnerability

Japan Digital Agency Data Breach Linked to VPN Vulnerability


Government Solution Service (GSS) of Japan's Digital Agency was compromised by a vulnerability in a VPN device, resulting in unauthorized access to the shared government platform through an exploit of a vulnerability in the VPN device. In this incident, 246,000 records containing information regarding employees, public officials, contractors, and other individuals connected to organizations using the service may have been exposed. 

Upon discovering unusually large-scale access to files on a server through an account belonging to a maintenance and operations staff member on June 25, the agency first detected the breach. Following an investigation, the agency determined that the account activity was linked to an unauthorized access to a network-connected VPN device. 

By July 9, the agency determined that an external party had accessed the system by exploiting a vulnerability in the VPN equipment. Immediately after the incident, the maintenance account was suspended, and communication between the equipment and external networks was restricted to prevent further access. 

The investigation, conducted with the assistance of an external security company, revealed that some files that contained personal information could have been transferred outside the system. The VPN product used and the specific vulnerability that was exploited have not been disclosed by the agency. Through shared IT infrastructure, 23 Japanese ministries and government agencies are served by the affected GSS environment, which can have a greater impact on the incident. 

The exposed information consists of approximately 236,000 names, 231,000 e-mail addresses, 94,000 telephone numbers, and 1,000 physical addresses. The records relate to personnel and officials who work with GSS user organizations, as well as businesses and individuals who support those organizations. 

Data containing information belonging to the general public was not included in the affected data, according to the agency. Additionally, the compromised dataset is lacking My Number identification numbers, bank account information, or pension number information. Despite the fact that no confirmed cases of misuse have been identified, the exposed contact information could still be used for impersonation, phishing, or other forms of social engineering. 

VPN exposures were categorized as medium severity and were not zero-day vulnerabilities; however, the agency has failed to provide details regarding when the vulnerability was fixed or why the device was still exposed at the time of the intrusion. 

Known VPN Flaw Left Unpatched

Due to the fact that the Digital Agency was already aware of a VPN flaw when the breach occurred, but had not applied the required patch, the incident raises concerns about vulnerability management. According to the agency, the vulnerability has a medium severity and has been confirmed as not a zero-day, indicating that attackers exploited a known vulnerability rather than a newly discovered vulnerability. 

The information accessed is approximately 246,000 records. Over 189,000 of these people are government employees, public officials, or other personnel working for GSS-related organizations, while approximately 57,000 are private companies and individuals involved in government-related activities. 

A total of 236,000 names, 231,000 emails, 94,000 telephone numbers, and 1,000 physical addresses were included in the data. In addition, duplicate entries may be present in the data. More sensitive identifiers are not included in the dataset, such as My Number information, bank account details, and pension information.

Investigation Finds No Confirmed Misuse

The Digital Agency has not received any confirmations of misuse of the exposed information, however, the combination of names and contact information could facilitate targeted phishing or impersonation attempts against affected employees. Messages or phone calls from individuals pretending to represent the government have been warned by the agency, and official personnel will not contact affected parties via email or telephone for passwords or payment information. 

Japan's Personal Information Protection Commission was made aware of this incident on July 15. During the investigation, the agency determined that potentially affected information was likely to be identified and the individuals and organizations involved required a considerable amount of time, which contributed to the delay in public disclosure. 

Digital Agency officials indicated the impact was limited to the affected GSS environment with no evidence of other government systems being compromised or disrupted. As part of its effort to strengthen vulnerability management and review how external connections to the system are handled, the agency is also expected to provide direct notifications to the affected individuals. 

To prevent unauthorized access to sensitive government information and limit unauthorized access, VPN patches should be implemented on time, strict access controls should be implemented, continuous monitoring should occur, and rapid isolation should be instituted.
Read more »
South Korea
AI Data Breach data security Encryption South Korea

South Korean Startup Suffers Breach Due to Encryption Management Failure


Modu-ui, a South Korean government backed startup support platform, suffered a data breach in July. The breach later disclosed a critical encoding key management compromise, showing how encoded information can still become vulnerable when enterprises can’t protect encoding keys properly. 

About Modu-ui

Modu-ui stores participants’ personal details such as email addresses, names, and startup ideas, and the platform also supports a nationwide startup audition overseen by SMEs and Startups (MSS) of the South Korean Ministry.

Suspicions were already raised a month prior to the reported data breach that applicants’ personal data could be structured and exposed via API responses inside the platform. The government said it had taken prompt action but did not reveal if it had upgraded Modu-ui’s security infrastructure.

Startup details leaked

In June, the Ministry of SMEs and Startups disclosed that summaries of startup ideas and personal details had been exposed. Later, it started a detailed enquiry along with National Police Agency, National Intelligence Service, and the Cyber Security Center.

In July, the agencies confirmed that the leak of encoding keys via an API was the reason for the startup idea and personal data leak.

About the breach

The exposed data had already been encoded but the encoded data needs an encoding key decoding.

In this case, the encoding key was leaked along with the API data, causing in the leak of evaluation comments, startup idea summaries and email addresses related to 5000 successful applicants. 

According to the Ministry, the encoding key had been included inside the API and a third party retrieved API data via methods like web crawling, causing the exposure of the key.

Private email addresses were not shown on the public-facing interface but officials believed they could be retrieved via AI-based web crawling. 

Impact on organizations

The incidents also demonstrate the dangers of hard-coding encoding keys as fixed values inside databases, application code, similar environments, or databases.

When businesses follow this method, the keys can become vulnerable in addition to the data or systems they are meant to protect. The main reason for this incident can be viewed as security infrastructure failure in incorporating  robust encoding key management.

Officials found 39 IP addresses related to the access of the exposed data coming from South Korea. Authorities also said that investigations led to more details such as potential connections to AI solution providers.

Read more »
Data Stolen
Credential Credential stealing Credential Theft Data Breach Data Leak data security Data Stolen

Florida Says Motor Vehicle Data Breach Tied to Credentials Stolen From Officer's Personal Device

 

Officials in Florida confirmed Thursday that the state Department of Motor Vehicles suffered a data breach after credentials were stolen from a police officer who had stored login information on a personal device. The ShinyHunters cybercriminal organization claimed on Monday that it had obtained access to data from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). 

The department did not respond to repeated requests for comment throughout the week but publicly confirmed the breach's legitimacy on Thursday night. Officials said they first learned of the breach on September 4 and initially attributed it to an unnamed "international cybercriminal organization." 

According to the department, an investigation determined that a criminal actor exploited a single Plant City Police Department user's credentials, which had been improperly stored on the employee's personal electronic device. Plant City is a small suburb outside Tampa. FLHSMV has since notified other Florida government offices and is partnering with the Florida Digital Service to investigate the incident. 

As proof of access, ShinyHunters shared alleged photos of a DMV record tied to American financier and convicted child sex offender Jeffrey Epstein. When claims of the breach first surfaced, some cybersecurity experts speculated it might be connected to the recently confirmed breach involving 153 million driver's licenses leaked by identity verification firm IDScan. ShinyHunters had previously attempted to purchase the ID database from the hackers behind the IDScan breach.

The group has recently claimed responsibility for attacks on bank IT provider Jack Henry, as well as pharmaceutical and healthcare technology company McKesson, which told regulators that data from its oncology and surgical business units had been stolen. ShinyHunters also caused widespread disruption across the U.S. in May with an attack on a widely used educational software suite and stole the information of more than four million people after targeting the world's largest medical device company in April. 

Other victims linked to the group include Carnival Cruises, Ticketmaster, AT&T, McGraw Hill, ADT, and gaming company Rockstar. In a related development, artificial intelligence company Anthropic released a report Thursday stating that suspected affiliates of ShinyHunters used AI to scan for credentials, map unfamiliar systems, and steal data from victims for extortion purposes. 

The report noted that in one case, an operator escalated from a stolen developer token to full administrative access over a victim's cloud environment in approximately three hours. Incident responders at Google also confirmed last week that members of the group are using Anthropic's AI tools at various stages of their attacks. 

The Florida breach adds to a growing list of incidents tied to ShinyHunters, underscoring the group's persistent targeting of both government systems and major corporations, as well as its evolving use of AI tools to accelerate and scale its intrusions.
Read more »
leaked sensitive data
cybercrime gang Cybercrime Groups data attacks Data Breach Data Leak data security Employee Personal Information leaked sensitive data

Turner Discloses Data Breach Exposing Salary Info, Bank Accounts, and SSNs

 

Turner Construction has notified at least 6,098 people of a data breach that uncovered social security numbers, salaries, dates of birth and bank account information used for direct deposit, a filing with the California Office of Attorney General showed. The New York City-based firm found unauthorized access to its systems occurred between July 2 and July 15, the filing with the California Office of Attorney General said. 

Turner confirmed on July 27 that files that contained personal information had been accessed without authorization, and some of the files that were accessed may have also included individuals' passport numbers. Ransomware group Payouts King claimed responsibility for the attack, alleging that the data that had been breached extended far beyond personal data to include engineering documents, military project files, contracts and non-disclosure agreements, a post on ClaimDEPOT, a class-action lawsuit tracking website, said. 

Turner issued a statement that after discovering that unauthorized access to certain files had occurred, the company engaged third-party cybersecurity and forensic experts and that those experts continue to review the files that were accessed. The company said it would notify impacted individuals and other parties as necessary and provide complimentary identity protection services. Turner added it would not comment on claims made by criminal organizations. 

According to ClaimDEPOT, Payouts King first posted information relating to an unidentified victim on July 24 and publicly naming Turner on August 11. The group posted the claims on a Tor network site, which hides the users' locations and identifies, claiming it had obtained 27.2 terabytes of data. Apart from the file types stated in the California attorney general filing, Payouts King claimed it had also accessed documents that were protected under International Traffic in Arms Regulations, which are US government rules regulating the export and import of military items, technology and services. Turner is offering five years of identity protection services through IDShield and IDX, the notices filed with the California AG's office said. 

One of the two notices set a November 18 deadline for affected individuals to enroll. The incident comes amid a wave of attacks targeting construction-related domains, an August 6 post on Google's Threat Intelligence blog identifying potentially compromised sites said. Turner is the largest contractor in the industry by revenue and focuses on data centers and advanced technology construction. The booming data center sector drove the firm to build a $44.3 billion backlog by the end of 2025.  

Several law firms have since posted notices of investigations into the Turner incident, seeking plaintiffs for potential class-action lawsuits. Turner also reported that at least 38 Vermont residents were affected by the breach, according to the Office of the Vermont Attorney General.
Read more »
IDS
Customer Data Cyberattack Data Breach Data Breaches Attacks Data Leak data security Hacker attack Hacker Sells Stolen Data IDS

IDScan Sued Over Alleged Data Breach Affecting 153 Million Drivers

 

Identity verification company IDScan is being sued in multiple cases after hackers allegedly gained unauthorized access to the service and started selling more than 153 million driver’s licenses via dark web. Markovits, Stock & DeMarco and Hall Attorneys law firms are investigating the class-action claims against the company, which is based in Louisiana. 

Plaintiffs allege that IDScan failed to protect the information of its clients, including car rental company Hertz. Everything started on September 1 when Krebs revealed that a dark-web illegal identity-theft service called Nexus was selling more than 153 million scans of American and Canadian’s driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. 

He confirmed his sources by searching for his own data and the data of other people who gave their consent to do so. His research showed that all the resources were stolen from IDScan. IDScan sells scanners and specialized software for extracting personal data from official documents. Its technology is used in numerous car rental companies, retail stores, gun shops, banks, pot shops, and hotels across the United States. 

The company has not responded to media inquiries about the data breach, leaving the situation unclear. For now, it is unknown how exactly the breach occurred and how many people were affected. According to Krebs, the Federal Bureau of Investigation (FBI) in New Orleans is investigating the issue, confirming the story, Reuters noted. The FBI spokesperson told Bleepingcomputer that the bureau is looking into the reports but declined further comments due to the sensitivity of the case. The illegal website Nexus that was distributing people’s personal data is closed now. 

However, criminals who stole the information from IDScan still have access to the database. According to Krebs, the compromised data includes the documents of the Secretary of Defense Pete Hegseth and an assistant director of the FBI, which could not be confirmed. Markovits, Stock & DeMarco law firm revealed that IDScan started informing some of its business customers around September 1. The company’s representatives stated that if someone’s ID was scanned in their system, they would contact them to discuss the situation and represent their interests in court. 

In addition, the firm is looking for other organizations to file a class-action lawsuit against the company. Because of the potential number of affected people, other class-action lawsuits may arise, which will have to be consolidated in multidistrict litigation. In addition, other states’ attorneys general and federal regulators may also launch separate investigations into this data security breach. Similar situations with 23andMe, Marriott, and Equifax data compromises happened before and ended in multi-state inquiries or even criminal charges.
Read more »
Digital Personal Data Protection
Accenture call cr Cyber hacks Cybersecurity Breach Data Breach Data Breaches Data Leak data security Digital Personal Data Protection

Origin Energy Data Breach Traced to Manila Call Centre, Ex-Accenture Employee Identified

 

An ex Accenture worker from Manila is suspected to be behind last month's security breach. Accenture has an office in the city, which supports the energy business in Origin with its customer call centres. It was alleged by a Nine report that the worker attempted to extort the energy provider for money, for its return of the stolen information. 

When approached by ABC News, an Accenture representative said it would be inappropriate to comment on Origin's data security incident. It stated that it is under active investigation. Origin Energy also refused to comment, citing that the breach is the subject of an ongoing criminal investigation. It was revealed the extent of the incident was apparent when, last month, an The Australian reported a hacker had supplied a sample of 50 customer records including names, addresses, emails, dates of birth, phone numbers and billing histories.

Origin Energy reported it to the authorities a potential data breach. The company later told the Business it believed the information of up to 900,000 current and former customers had been accessed. Origin customers told the ABC they felt their personal data could have been breached and expressed frustration with not being given enough detail on the nature of the incident. 

It is the latest in a series of major cybersecurity incidents affecting Australian companies. Qantas suffered a significant hack in 2025, while Optus and Medibank both experienced mass data breaches in 2022. Origin confirmed it became aware of a potential security threat in early July, but did not initially take it seriously. It has advised affected customers to be on guard against scams and said specialist identity and cyber support services are available. 

Origin chief executive Frank Calabria addressed the incident in July, saying the company had completed the first of its review into the customer data security breach. It apologised to customers for placing trust in Origin to safeguard its information. The Australian Federal Police (AFP) confirmed it is working closely with Origin Energy and relevant partners after the reported cyber incident.

An AFP spokesperson said the focus of investigators is on gathering evidence, identifying those responsible and disrupting any associated criminal activity. It added Origin Energy has been cooperative and transparent in its engagement with investigators, and continues to assist the ongoing investigation. No information has yet been released about possible charges against the former Accenture employee identified by the investigation.
Read more »
Security Breach
Baylor Genetics Data Breach Data Leak Patient Data Security Breach

Baylor Genetics Confirms Cyberattack Exposed Patient Data

 

Baylor Genetics has disclosed a cybersecurity incident that may have exposed personal information belonging to some patients and employees, but the company says laboratory operations were not interrupted and genetic testing services continued as normal. The incident was detected around June 15, 2026, after suspicious activity appeared in a limited part of its IT environment. 

According to the notice, an unauthorized third party accessed certain parts of Baylor Genetics’ network between June 11 and June 17, 2026. The company then launched a forensic investigation with outside cybersecurity specialists and spent weeks reviewing what data may have been involved and which people were potentially affected. That review was completed on or about July 30, 2026, after which written notices were sent to affected individuals when address information was available. 

The data at issue varied by person, but for patients it may have included names, dates of birth, medical testing information, laboratory test results, and possibly health insurance details. In a very limited number of cases, a Social Security number may also have been involved. For current or former employees, the exposed information may have included Social Security numbers, government-issued identification numbers, and financial account information. 

Baylor Genetics says it immediately secured affected systems, strengthened identity and access controls, enhanced monitoring, and coordinated with law enforcement and appropriate regulators. The company also said it has not found evidence of confirmed identity theft, fraud, or misuse tied to the incident so far. It added that test results remain accurate and that no testing data or results were altered, so no retesting is necessary. 

The notice urges people to watch financial account statements, Explanation of Benefits statements, and credit reports for unusual activity. It also points readers to identitytheft.gov, the Federal Trade Commission, and state attorneys general for help with fraud alerts, credit freezes, and identity-theft complaints. Baylor Genetics has set up a dedicated assistance line at 1-866-200-0985, available Monday through Friday from 9 a.m. to 9 p.m. ET.
Read more »
Trezor
Crypto Crypto Wallet Data Breach Data Leak data security Trezor

Trezor Data Breach Rises to 67,000 US Customers


Hardware cryptocurrency wallet organization Trezor has disclosed that additional 67,000 customers in the US have been impacted by a data breach consisting of its shipping provider, ShipMonk. 

The recent news has notably increased the number of consumers potentially exposed in the incident.  “We're deeply saddened to share the news that the recent data breach affects more customers than originally thought,” Trezor said on X. 

As per Trezor, the additional 67000 customers placed orders from November 2019 to August 2021. 

What is leaked?

The leaked data consists of customers' email, phone numbers, names, addresses, order numbers, and shipping addresses. According to Trezor, the data was stored by ShipMonk even though Trezor had earlier received assurance that previous consumer data had been erased. 

“Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications. We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems,” Trezor said.

According to experts, the breach is not impacting Trezor’s own systems. 

Who are impacted?

Trezor said its hardware wallets are safe and there are no signs that customers’ recovery seed phrases or private keys were breached in the leak. 

As per Trezor, “All affected customers have been emailed directly. If you didn’t receive an email, then you are not affected.”

Potential impact

But Trezor and cybersecurity experts are worried that the stolen data could be exploited for social engineering and targeted phishing attacks. Threat actors could misuse customers’ details regarding their Trezor purchases to create scam phone calls or fraud messages.

This can be a serious problem for cryptocurrency users. A threat actor could mimic a company employee if they know someone owns a Trezor wallet and ask the target to verify their wallet or account. 

User advisory

If successful, the attacker could steal the target’s recovery seed phrase, which can allow access to cryptocurrency funds. “Trezor systems were not compromised, and your device is secure. But please be alert for fake emails, phone calls, fraudulent letters, and potential risks to physical security,” the company added. 

The announcement comes after the August incident when 13,689 customers had been impacted by the same shipping-provider. At the time, Trezor estimated around 14,000 customers to have been affected by the breach. The recent disclosure of 67,000 suggests the scope of the incident was larger than expected.

Read more »
passwords
Data Breach Dropbox Lenovo login systems passwords

Dropbox Says 5,000 Accounts Compromised After Flaw in Lenovo Login System

 


Dropbox has confirmed that hackers broke into roughly 5,000 user accounts last month by exploiting a weakness in how Lenovo verifies email addresses, allowing intruders to log into victims' cloud storage without ever knowing their passwords.

The cloud storage company began notifying affected users this week, telling them that an "unauthorized party" had accessed their accounts between August 4 and August 21. In some cases, the notification said, the attacker viewed or downloaded files stored in the account.

What makes the incident unusual is that Dropbox's own systems were never breached. The company lets users sign in with a Lenovo ID, a login credential tied to Lenovo's Identity Provider Services, as an alternative to a Dropbox password. According to Dropbox, a flaw in Lenovo's email verification process let an outside party register a Lenovo ID using someone else's email address. Once that fraudulent ID was created, the attacker could use it to log straight into the Dropbox account tied to that same email, bypassing the account's actual password entirely.

Dropbox's system trusted Lenovo's confirmation that the attacker owned the email address and did not ask for any additional check through the user's normal Dropbox login. Some of the people affected told Dropbox they had never signed up for a Lenovo ID in the first place, yet their accounts were still reachable through the integration.

A handful of users noticed something was off before Dropbox sent out its warning. One person, posting on Hacker News under the handle xaphod, said they had gotten alerts about suspicious sign-ins roughly two weeks earlier and changed their password and turned on two-factor authentication right away. They also noted that the Dropbox login page had started showing a "Continue with SSO" option tied to their email, despite never having created a Lenovo account.

Dropbox told Reuters that about 5,000 accounts were affected in total, and that none of them had two-factor authentication switched on, which is part of why the fraudulent logins went through unchallenged. Files were viewed or downloaded in fewer than a third of those accounts, a company spokesperson said. Bloomberg, which first reported the breach, cited Dropbox statements and internal records describing hackers browsing and pulling material that users had stored on the platform. Shares of Dropbox slipped about 2.4% in after-hours trading once the news broke.

Lenovo, for its part, described the problem as tied to a "legacy integration" between Lenovo ID and Dropbox that could be misused to improperly authenticate certain Dropbox accounts. A company spokesperson said Lenovo and Dropbox worked together to contain the issue once it was identified, and that Lenovo's own customer accounts were not compromised as a result. Both companies said their investigations are continuing.

Once it understood what was happening, Dropbox expired every session that had been authenticated through a Lenovo ID and cut the link between the two systems altogether. Going forward, anyone signing in through a Lenovo ID will also have to enter their Dropbox password, closing the gap that let the fraudulent logins succeed without one. The company said it has reported the incident to data protection regulators, as required in jurisdictions covered by breach notification rules.

For affected users, Dropbox's advice mirrors standard breach guidance: change the Dropbox password, change the password on the linked email account, and enable two-step verification if it isn't already on. Security researchers reviewing the incident have also suggested checking active sessions, connected third-party apps, shared links, and recent file activity for anything unfamiliar, along with account recovery settings that an attacker could have altered while inside.

The breach adds to a run of recent incidents built around federated login systems rather than direct server intrusions. Security teams have flagged this pattern for years: as more services link their sign-in process to outside identity providers to make logging in more convenient, a flaw in any one partner can end up exposing accounts across the whole chain, even for users who never signed up with that partner directly.

Dropbox has not said whether it plans to end the Lenovo ID integration entirely or continue it under the new password requirement. The company said users who did not receive a direct notification from Dropbox were not affected by the incident.

Read more »
leaked sensitive data
Court Data Breach Data Leak data security government data breaches Hacker attack leaked sensitive data

Thomson Reuters Court Records Breach Exposes Sensitive Data Across North America

 

Sensitive court records and personal information were spilled from a data breach in the court system, which impacts at least 12 states in the U.S., including the U.S. Virgin Islands and Canada, Thomson Reuters announced on Wednesday. The breach occurred in C-Track, a court case management software, run by one of Thomson Reuters’ subsidiaries. 

The company remains silent on how the hackers accessed the program, who was responsible and how much data was compromised, as well as the number of individuals impacted. Thomson Reuters stressed that the breach was within their own environment and “not related to security vulnerabilities in the networks, systems or data of the courts.” The company discovered unauthorized access to its system on June 30, and it initiated an investigation alongside outside cyber security experts and law enforcement. 

Their probe established that unauthorized intruders accessed some C-Track files in March. Meanwhile, a separate disclosure by the Montana Supreme Court revealed that Thomson Reuters advised the state court officials that unauthorized access to C-Track persisted up to June, which means that hackers may have remained undetected within the system for several months. The sensitive information spilled includes names, Social Security numbers, driver licenses, medical information, dates of birth, and health insurance. 

Thomson Reuters added that confidential, redacted, or otherwise restricted information from court records may have been accessed in some jurisdictions, but the company confirmed that no abuse of the situation has occurred. The data breach did not impact the operations of C-Track, which continues to function normally. Thomson Reuters implemented additional security measures, following the breach, after they were approved by outside cybersecurity experts, although the company did not disclose who they were. 

The courts in the U.S. whose data is at risk, according to the company, are the appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee, and Wyoming. In addition, several Pennsylvania courts, 10 Ohio district courts of appeals, the Supreme Court, and the Superior Court of the U.S. Virgin Islands are also on the list. The breach in Oregon Judicial Department added another state to the list, expanding the reach to at least 12 states. 

Nevada officials reminded their residents that the types of data compromised differs from state to state, and that not all the data in each state is necessarily confidential or protected. They added that, for example, in Montana, most of the data already was publicly available, but the state’s court system acknowledged the breach of the drivers’ licenses and dates of birth. 

In addition, several of the jurisdictions were notified weeks after Thomson Reuters became aware of the security threat. For example, the court administrator of Montana and the Ontario Ministry of the Attorney General were notified of the unauthorized access to the data on July 23. The chief justices of Ontario agreed that it still remains unclear what information was at risk and how many people were impacted. Thomson Reuters notifies affected individuals that they can receive 12 months of free of credit monitoring and identity theft protection.
Read more »
KrebsonSecurity
Credential Theft Cyber Security Data Breach driver’s license FBI Identity Theft KrebsonSecurity

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

 



The FBI has opened an investigation into an apparent breach involving identity verification provider IDScan.net after a newly launched dark web service began advertising access to more than 153 million U.S. and Canadian driver’s license records.

The service, named Nexus, appeared on the Russian cybercrime forum Exploit on August 31, claiming access to identity documents belonging to more than 170 million people across North America. Its advertised database includes more than 153 million driver’s licenses, over 10 million identification cards, more than three million travel or international identity documents, and at least 579,000 medical cards.

An examination of the service indicates that the claimed volume may be credible. A search without filters reportedly produced about 11.5 million pages of records, with approximately 15 results per page. Canadian licenses accounted for roughly 1.1 million results, including 473,673 records from Ontario, while most listings originated from the United States.

The dataset also contains marijuana dispensary cards, commercial driver’s licenses and records marked “CAC,” potentially referring to U.S. government Common Access Cards. Nexus operators claim the information is being obtained through an ongoing compromise of a major identity verification company serving Fortune 500 customers. They claim to have continuously extracted new records for more than a year.

Evidence examined by KrebsOnSecurity also indicates that the database may still be receiving stolen information. The number of available driver’s license records reportedly increased by nearly 400,000 within 24 hours.

The exposed records are unusually detailed. One license examined by Krebs contained six image files showing the front and back of the document, including standard, infrared and ultraviolet captures. Each file carried a timestamp. In several cases, those timestamps corresponded closely with victims’ real-world activities.

Krebs tested the apparent pattern by obtaining permission to search for licenses belonging to more than a dozen acquaintances. Nine licenses were located, and each individual confirmed travelling on or around the dates associated with the image timestamps. Further comparison with rental records indicated the timestamps appeared consistent with Greenwich Mean Time.

The evidence initially pointed toward airports, but that theory weakened because the database contained no passports and several individuals had not presented their licenses at airport security. Two federal employees who appeared in the dataset said they used other government identification at airport checkpoints, but later handed their state licenses to Hertz when renting vehicles.

A particularly revealing comparison involved Krebs’ own license and his mother’s. Their records carried timestamps only seconds apart, corresponding to the time both licenses were handed to a Hertz representative. Another exposed license belonged to security researcher Zach Edwards, whose timestamp matched a trip to Las Vegas for DEF CON. Edwards said he showed his license to TSA, his hotel and Planet 13, but identified the dispensary as the only location that definitely scanned it.

That connection is notable because Planet 13 announced in 2022 that it had deployed IDScan.net’s VeriScan technology across 16 check-in stations at its Las Vegas SuperStore. The system captures government-issued identification, performs document authentication and can use white-light, infrared and ultraviolet imagery. IDScan.net says its technology performs more than 21 million identity verifications each month across more than 20,000 locations.

IDScan.net also publicly lists major organizations using its technology, including Hertz, Target, FedEx and Caesars Entertainment. Its current platform supports ID scanning, document authentication, data parsing and integrations through APIs and software development kits.

IDScan.net told KrebsOnSecurity that it was investigating but had not provided a substantive public explanation of the suspected incident. Its documentation shows that its systems can retain raw files generated during scans, while its security documentation describes encryption for data at rest and in transit.

The FBI’s New Orleans field office subsequently opened an official investigation into the suspected breach. The development adds a law-enforcement dimension to an incident that could expose highly sensitive identity information at unprecedented scale.

The potential consequences extend beyond conventional credential theft. Driver’s license information is legally recognized as identifying information, and stolen identity data can be used to open accounts, obtain services, commit financial fraud or impersonate victims.

The incident also exposes a difficult security trade-off in modern identity verification. Organizations increasingly depend on third-party systems to scan government credentials for travel, rentals, retail, financial services and age verification. TSA began enforcing REAL ID requirements for domestic air travel in May 2025, further embedding government-issued identification into everyday verification processes.

For now, the precise intrusion path, affected customers and total number of compromised individuals remain unconfirmed. However, the combination of detailed document images, matching timestamps, apparent fresh data collection and the FBI investigation makes Nexus a serious warning about the risks created when sensitive identity documents are concentrated within third-party verification infrastructure.

Read more »
Rhysida Ransomware
Berlin Ransomware Attack Data Breach Data Exfiltration government cyberattack Government Data Theft Ransomware Extortion Rhysida Ransomware

Berlin Defies Hackers After Data Theft From State Network


A Berlin state government official has confirmed that hackers are attempting to extort the city after its administrative network was compromised earlier this month. Berlin has refused to pay the ransom demand, saying that Berlin will not be paying the attackers. The Senate Department for Mobility, Transport, Climate Protection, and Environment was affected by the incident. 

An initial data leak was detected on August 7, followed by forensic analysis that detected additional exfiltrations between August 7 and August 12. On August 14, authorities took down the company's network as a result of the breach. As part of the response, the Senate Department for Urban Development, Construction, and Housing network was also shut down. There is currently no indication as to how much data has been stolen. 

Senate Chancellery officials have reported that the investigation is still in progress and that the extent and nature of the data removed from the network cannot be ruled out. A figure circulating from the attackers claims that more than 5.7 TB of data has been stolen, including records relating to more than 12,000 individuals. 

The city has not disclosed the extent of the data exfiltrated. On August 28, the ransomware group published the claim on their leak site. Berlin has not independently verified those figures, but the threat actor has also claimed that the stolen material included financial documents, contracts, human resources files, legal documents, complaints, passwords, and other confidential information.

More than 16,000 email addresses and nearly 12,000 phone numbers are reported in the claimed haul. Despite not publicly identifying the attackers, the Rhysida ransomware group has claimed responsibility, briefly listing the city on its Tor-based leak site. The group has reportedly requested 30 Bitcoins, worth approximately $2.3 million, in exchange for not disclosing the unauthorized data. 

Investigation Continues as Scope of Breach Remains Unclear Until the full scope of the compromise has been established, forensic investigators confirmed that additional data was collected from the Senate Department for Mobility, Transport, Climate Protection and the Environment between August 7 and August 12, before the affected departments were disconnected from Berlin's state network on August 14. 

Rhysida has provided an extensive list of alleged stolen information, however, their claims have not been fully verified. Around 1.44 million files are reportedly contained within the claimed 5.79 TB haul, including government, legal, financial, contractual, and human resources documents. Also included in the list are identity documents, payroll information, email archives, database dumps, banking information, credentials, and more. 

The group has also tried to press Berlin into paying through the alleged exposure of sensitive records. According to Rhysida, she threatened to publish the stolen files, citing potential GDPR violations as a further means of leverage. The Berlin Senate's Iris Spranger asserted that, despite the extent of the claims, no evidence has been provided to support election-related systems. There has been no evidence that election data has been compromised, according to Spranger. 

Rhysida's initial access method has not been disclosed. As a result of the lack of details, there is no clear indication of the entry point and the circumstances under which the attackers gained access to the administrative network. Investigations are continuing by Berlin's State Criminal Police Office, the Public Prosecutors' Office, and federal security agencies. 

Since its inception in 2023, Rhysida has been targeting government bodies, healthcare providers, educational institutions and critical infrastructure organizations. Researchers have linked the group to hundreds of attacks, making its claim against Berlin part of a broader pattern of attacks against public networks. It is still unclear whether Berlin has determined the full extent of the data theft or verified all information allegedly released by the attackers as part of the ongoing investigation.
Read more »
Subscribe to: Posts (Atom)