Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Leak. Show all posts
SBI
Customer Data Dark Web Data Breach Data Leak SBI

SBI Probes Suspected Exposure of 3,897 Customer Records

 

State Bank of India (SBI) is investigating a suspected data exposure after identifying personal information in 3,897 customer records reportedly found on the dark web. The country’s largest lender said it received alerts about the issue last week and has initiated cyber incident response procedures. The bank has also appointed an independent cybersecurity agency to assess the suspected compromise and determine the source, scope, and potential impact of the exposure. 

According to SBI’s October 21 stock-exchange filing, the bank first received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). Its initial review covered around 375,000 records found on the dark web. Of these, 3,897 records were found to contain personal customer information. SBI is now verifying whether the exposed records are genuine and complete, while also attempting to trace their origin and assess the risks for affected customers and the bank. 

The exposed records reportedly included customers’ names, dates of birth, gender, registered mobile numbers, email addresses, and home addresses. They also contained branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records. Although the information does not appear to include banking passwords or transaction credentials, personal and loan-related details can still be misused for phishing, identity fraud, targeted scams, and social-engineering attacks. 

SBI said it activated its cyber incident response and containment procedures after receiving the alerts. The bank has engaged a CERT-In-empanelled independent cybersecurity agency to investigate the matter and is working on remedial and preventive measures in line with regulatory requirements. SBI added that it is continuing to monitor the situation and will take appropriate steps to prevent similar incidents in the future. 

The bank has sought to reassure customers that the incident has not materially affected its financial performance, core business operations, or ability to continue services. Core banking functions are reportedly running normally, with no disruption reported. However, customers should remain cautious: avoid clicking unexpected links claiming to be from SBI, never share OTPs, passwords, or card details, and verify suspicious communications directly through the bank’s official app, website, or customer-care channels. The investigation is ongoing, and further clarity is expected once SBI confirms whether the dark-web data is authentic and identifies how it was exposed.
Read more »
User Privacy
Data Breach Data Leak Japan Skyticket User Privacy

Skyticket Breach Exposes Data of 14.6 Million Customers

 

Japanese travel booking platform Skyticket has disclosed a major data breach that may have exposed the personal information of approximately 14.64 million customers. Its operator, Adventure Inc., said attackers gained unauthorized access to internal servers and cloud storage between October 2 and October 4, 2026. The company publicly confirmed the incident on October 9 after blocking the access route and launching an investigation. The breach is among the largest recent cybersecurity incidents involving a Japanese travel company.

The compromised records reportedly include customers’ names, dates of birth, email addresses, phone numbers, postal codes, addresses, and names used for bank transfers. Adventure also said about 4.13 million records contained hashed login passwords. The company stated that passport numbers and credit card information were not leaked, although it temporarily disabled payments using saved credit cards as a precaution. 

Adventure identified additional unauthorized-access incidents beyond the main breach. It said attackers accessed its business management system on September 20, potentially compromising more than 17,000 customer records, including bank account details registered for refunds. A third incident involved bus booking confirmation pages that could be accessed without logging in; the company said it detected and fixed the issue on October 1. 

The company has reported the incidents to Japan’s Personal Information Protection Commission and said it is continuing to investigate. Adventure warned customers that they could receive fraudulent emails, text messages, phone calls, or letters pretending to be from Skyticket, banks, airlines, or bus companies. It urged users not to click links in suspicious messages or share passwords, credit card numbers, bank PINs, or online banking credentials. 

Skyticket members should change their passwords immediately through the official website or app and update the same password anywhere else it has been reused. Security experts generally recommend enabling multi-factor authentication where available and monitoring bank statements for unusual activity. The incident highlights the growing risk facing travel platforms, which hold large volumes of identity, contact, payment, and booking data attractive to cybercriminals.
Read more »
Malware Attack
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Employee Data Breach Malware Attack

Nippon Columbia Malware Incident Puts 8.6 Million Customer Records at Risk

 

Japanese entertainment group Nippon Columbia hit with malware, affecting more than 8.7 million customers and employees' personal data, according to karaoke system maker Daiichi Kosho. The company asked its customers to be cautious, but it is still unclear if their personal information was stolen or leaked. 

Daiichi Kosho, Japan’s biggest karaoke company, owns 521 karaoke places and provides services for the well-known chain of Big Echo. They rely on Nippon Columbia Group (NCG) to provide customer information. NCG’s businesses range from music creation, video and game software development and distribution to artist management, making it an important supplier for the karaoke entertainment sector. 

The issue was raised when NCG notified Daiichi Kosho of the incident on October 5 when the malware was found on one of the staff member's computers, which was then isolated the next day. The company then proceeded to reset all the passwords and other authentication methods and investigate the incident to determine its scope and origin. 

According to Daiichi Kosho's statement, the affected information includes approximately 8,631,000 customers and 93,000 employees of the company, and it may include the full name, gender, date of birth, email address, and phone number of the affected individuals. BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining entertainments' users should be particularly wary of the security breach, as it could affect their data the most. 

Daiichi Kosho reiterated that their information was not at risk and that the data contained in the breach does not include the passwords. Additionally, the company stated that there was no suspicion of unlawful interference with customer loyalty points. On the other hand, they are still not certain if the information was stolen or if it was leaked online. They are investigating the breach to find out if the data was shared, what the scope of the problem was, and if the information was shared. 

The latest statement did not mention anything else about the possible leak. Customers are advised to protect themselves from scams, deception, and unlawful access to their personal information. They should be wary of strange emails, text messages, and phone numbers and avoid providing any personal and financial information. If the crooks managed to collect and compile the data of these users, it would be easy for them to engage in phishing schemes and similar scams. 

BleepingComputer, as of the time of publishing this article, has not been able to find any official statement from Nippon Columbia Group about the incident. They mentioned that they contacted the company for an official comment, and they are still waiting for the response. Until an official statement is issued, the possible data theft remains an issue, as it raises several questions about the safety of the companies' data and the safety of customers' personal information.
Read more »
User Data
Cyber Attacks Data Leak Data Privacy Google Microsoft Nikkei User Data

Japanase Media Company Nikkei Reveals Intrusions Attacking Users and Employees


Japanese media company Nikkei has disclosed two separate cyber incidents involving employee accounts on Microsoft 365 and Google Workspace. One of the incidents allowed attackers to use an employee's account to send about 9,000 phishing emails, while the other may have exposed the personal information of 1,646 employees and business partners.

The incidents were disclosed on October 4 and reveal the risks organizations face when attackers gain access to legitimate employee accounts. Nikkei has not attributed either incident to a specific hacking group or confirmed whether the two attacks were connected. 

Microsoft 365 account used to send phishing mails

The more recent incident involved an employee's Microsoft 365 account. According to Nikkei, attackers gained unauthorized access to the account and used it on September 30 to send approximately 9,000 emails.

The messages were sent to people both inside and outside the company. Some recipients were journalistic sources and other individuals who had previously communicated with Nikkei employees.

The emails contained links leading to malicious websites. Because the messages were sent from a legitimate Nikkei employee account, recipients could have been more likely to trust them. This type of account compromise can allow attackers to use an organization's existing relationships to distribute phishing messages.

Nikkei said the incident may have exposed recipients' names and email addresses, along with the contents of some emails. The company is still investigating the number of people whose personal information may have been affected. According to Nikkei, “There may be an increase in emails impersonating Nikkei employees or our group companies,”

Google workspace breach

Nikkei also disclosed a separate incident involving an employee's Google Workspace account. The account was accessed without authorization beginning in late July.

The company discovered the intrusion in early August after receiving an alert from Google. Nikkei then changed the account's password and said it has not detected any further unauthorized access.

The incident may have exposed information belonging to 1,646 employees and business partners. The potentially affected information included names and email addresses.

Nikkei said the exposed information did not include data related to its readers or journalistic sources. The company also said it has found no evidence that the information was misused. 

Nikkei’s response

After the Microsoft 365 incident, Nikkei changed the affected password and contacted recipients of the phishing emails, asking them to delete the messages. The company warned that additional emails impersonating Nikkei employees or its group companies could appear.

Nikkei has also reported the incidents to Japan's data protection authority. Investigations into the scope of the Microsoft 365 compromise and the information potentially exposed are continuing.

Nikkei has experienced other cybersecurity incidents in recent years. In November 2025, the company disclosed a malware-related credential theft incident that potentially exposed information connected to more than 17,000 employees and business partners. 

Read more »
User Privacy
Cyber Attacks Data Leak DTU Identity Security User Privacy

DTU Data Breach Exposes Information of 200,000 People

 


The Technical University of Denmark (DTU) has disclosed a major data breach that may have exposed personal information belonging to as many as 200,000 current and former users. Hackers reportedly accessed DTUBasen, the university’s identity and access management system, after obtaining valid credentials. The system contains records collected over more than two decades, raising concerns about identity theft, targeted phishing and other forms of fraud.

DTU said it cannot yet determine exactly which information attackers downloaded or how many people have been affected. However, the database contains details linked to nearly 40,000 active users and approximately 160,000 former users. Information related to current users may include Danish civil registration numbers, full names, home addresses, profile photographs, work email addresses, job titles, office locations and other employment details. 

The breach may also have exposed emergency-contact information submitted by active users. This could include the names, relationships and phone numbers of next of kin. DTU noted that information about home addresses, profile pictures and next of kin belonging to former users is automatically deleted after six months. University Director Bjarke Bak Christensen described the incident as a serious attack and apologised for the uncertainty caused to potentially affected individuals. 

DTU plans to notify potentially impacted people through e-Boks, Denmark’s official digital mailbox service. The university said it will contact current and former employees, although not every student whose information may be stored in the system will receive a direct notification. Anyone who has been a DTU employee, student, guest or external partner since 2003 could potentially be affected, according to the university’s public warning. 

The university is advising affected individuals to remain alert for suspicious emails, text messages and phone calls that mention their connection with DTU or contain accurate personal details. People should avoid sharing passwords, personal information or authentication codes in response to unexpected requests. They should also change reused passwords on other services and consider placing a credit alert on their affected civil registration number. The incident highlights how compromised credentials can give attackers access to extensive historical records, even when an organisation’s main systems remain operational.
Read more »
Patient Data
Cyber Attacks Data Leak Dental Software FELG Dent Patient Data

Polish Dental Software Firm Hit by Cyberattack

 

Polish dental software provider FELG Software has confirmed a cybersecurity incident affecting its FELG Dent cloud-based practice management platform. The company became aware of the attack on September 28, 2026, and publicly acknowledged it on October 1. A threat actor using the alias Horus reportedly contacted Polish cybersecurity news outlets, claiming to have accessed sensitive information stored in the system. FELG Software also confirmed receiving a ransom demand in exchange for preventing the disclosure of the allegedly stolen data. More than 16,000 dentists reportedly use the company’s tools, meaning one vendor breach could affect patients from numerous independent practices. 

The attackers claim to have obtained records linked to approximately 2.4 million patients and more than 700,000 medical professionals. The allegedly exposed information includes names, addresses, telephone numbers, national identification numbers known as PESEL, company details, medical records, electronic prescriptions, electronic sick-leave certificates and insurance-verification information. The group also claims to have accessed around 1.2 million prescriptions, visit documentation and diagnostic images. However, these figures have not been independently verified, and the company disputes the attackers’ assessment of the incident’s scale. 

FELG Software has reportedly said that the stolen information represents about 10 percent of its overall database, rather than the complete dataset claimed by Horus. Reports also indicate that the attackers threatened to publish or sell the information after the company refused to pay the ransom. One reported explanation for the intrusion involves an IDOR vulnerability, or Insecure Direct Object Reference flaw. Such weaknesses can allow unauthorized users to manipulate references in requests and retrieve records belonging to other accounts when access controls are not properly enforced. 

The incident is significant because FELG Dent operates as a shared platform for many healthcare organizations. A weakness in the central service can therefore create risks across multiple dental practices at the same time. The breach is also reportedly the third attack in three months targeting Polish healthcare software providers, following incidents involving MyDr in August and Medyc, operated by Qbusoft, in September. These repeated attacks highlight the risks created when sensitive medical information is concentrated in cloud systems without strong tenant isolation, monitoring and access controls. 

The exact scope of the FELG Dent breach remains under investigation. Dental practices using the service may need to review logs, identify affected patients and assess their legal notification responsibilities under applicable data-protection rules. Healthcare providers should also reset potentially compromised credentials, monitor suspicious activity and communicate carefully with patients without relying solely on unverified attacker claims. The case demonstrates why software vendors handling medical data require regular security testing, strict authorization controls, vulnerability disclosure processes and tested incident-response plans. Until forensic investigations are complete, the number of affected records and the precise information accessed should be treated as provisional.
Read more »
healthcare data breach
customer data breach cybersecurity in healthcare Data Breach Data Leak data security Healthcare Data healthcare data breach

DC Health Agency Data Exposure Affects Nearly 400,000 Medicaid Beneficiaries

 

Almost 400,000 people who enrolled in Medicaid and the DC Healthcare Alliance may have been affected by a data breach, which occurred on the website of the District of Columbia Department of Health Care Finance. 

The issue concerned the reports published on the organization’s website, which showed aggregated data about the people who enrolled in the programs between 2023 and 2026. DHCF noted that the breach did not involve cybersecurity issues or intentional unauthorized access to the system. The problem was discovered by the agency in July, when it was revealed that two reports on the website contained fields with personally identifiable information that could have been accessed by unauthorized parties. 

The reports included only aggregated data, such as the number of people enrolled in the programs at specific times and other related information. Nevertheless, according to DHCF, the supporting information on its website could have been accessed by unauthorized parties since 2023. The personally identifiable information of the people who enrolled in Medicaid and the DC Healthcare Alliance includes their ID, providers, date of birth, race, gender, ethnicity, and wards. 

According to the agency, the reports do not contain Social Security numbers, names, and financial information of the affected people. DHCF announced that 399,086 people were affected by the issue and notified the United States Department of Health and Human Services (HHS). The latter added DHCF to its website, which keeps track of data breaches. It is unclear whether the affected people’s information was misused or will be misused in the future. Nevertheless, DHCF advised them to remain wary of potential fraudulent activities and unauthorized attempts to gain access to their information. 

According to the agency, the fact that the reports did not include Social Security numbers and financial accounts minimizes the risk of exploitation, but it remains present due to the inclusion of people’s IDs. After the breach was discovered, DHCF removed the reports from its website. In addition, it initiated an internal review process and responded to the problem by checking its systems for vulnerabilities and ensuring that its internal procedures were appropriate for addressing the issue. 

It is important to note that the breach illustrates how people’s information can be exposed even when it should not be. In this case, the data was not hacked or intentionally shared with unauthorized parties. Nevertheless, it became available to anyone who wanted to see it because the reports containing it were publicly available. 

Therefore, it is essential for people who enrolled in Medicaid and the DC Healthcare Alliance to ensure that they are not contacted by scammers and that their information is not misused. It is necessary for them to contact DHCF if they suspect that something is wrong. At the same time, it is important to keep in mind that, according to the agency, there is no information about the affected people’s information being viewed or misused.
Read more »
User Privacy
Cyber Attacks Dark Web Data Leak University of Munich User Privacy

Cyberattack Hits University of Munich, Exposing Student Data

 

Germany’s Ludwig Maximilian University of Munich (LMU) is investigating a significant cyberattack that potentially exposed sensitive student information, including financial aid and health insurance data. The breach, detected on a Wednesday, led the university to disconnect affected servers and engage external cyber security experts while cooperating with law enforcement. 

The compromised records reportedly include students’ names, dates of birth, contact details, LMU email addresses, bank account information, and details about their courses of study and prior educational qualifications. In some cases, health insurance numbers and identifiers linked to Germany’s student financial aid program may also have been accessed, along with data related to leaves of absence. However, the university confirmed that examination records, specific course content, and individual academic performance data were not affected. 

Operational impact and response 

Following the discovery of the breach, LMU took several systems offline as a precaution, temporarily disrupting some internal services. While teaching activities continued uninterrupted, enrollment processes were briefly suspended and are expected to resume with extended deadlines to ensure students are not disadvantaged. Some students reported difficulties accessing university services needed for semester preparation, including course registration and grade viewing. The institution has not disclosed the number of affected individuals or the duration of unauthorized access, and no ransom demand has been publicly confirmed. 

Universities remain attractive targets for cybercriminals due to their extensive networks containing vast amounts of personal and financial information across large populations of students, researchers, and staff. Recent ransomware attacks have affected prominent U.S. institutions such as the University of Texas, University of Oklahoma, Stanford University, and the University of Michigan, with several incidents occurring after holiday breaks. Other notable cases include disruptions at the University of Pennsylvania, Columbia University, and Harvard University over the past years.

LMU has enlisted specialists to monitor dark-web forums and other platforms for signs that the stolen information is being circulated or misused. While there is currently no evidence that the data has been altered, deleted, or published, the investigation remains ongoing to determine the full extent of the breach. The attacker has not yet been identified, and the university continues to work with cybersecurity professionals and authorities to secure its systems and protect affected students.
Read more »
Data Stolen
Credential Credential stealing Credential Theft Data Breach Data Leak data security Data Stolen

Florida Says Motor Vehicle Data Breach Tied to Credentials Stolen From Officer's Personal Device

 

Officials in Florida confirmed Thursday that the state Department of Motor Vehicles suffered a data breach after credentials were stolen from a police officer who had stored login information on a personal device. The ShinyHunters cybercriminal organization claimed on Monday that it had obtained access to data from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). 

The department did not respond to repeated requests for comment throughout the week but publicly confirmed the breach's legitimacy on Thursday night. Officials said they first learned of the breach on September 4 and initially attributed it to an unnamed "international cybercriminal organization." 

According to the department, an investigation determined that a criminal actor exploited a single Plant City Police Department user's credentials, which had been improperly stored on the employee's personal electronic device. Plant City is a small suburb outside Tampa. FLHSMV has since notified other Florida government offices and is partnering with the Florida Digital Service to investigate the incident. 

As proof of access, ShinyHunters shared alleged photos of a DMV record tied to American financier and convicted child sex offender Jeffrey Epstein. When claims of the breach first surfaced, some cybersecurity experts speculated it might be connected to the recently confirmed breach involving 153 million driver's licenses leaked by identity verification firm IDScan. ShinyHunters had previously attempted to purchase the ID database from the hackers behind the IDScan breach.

The group has recently claimed responsibility for attacks on bank IT provider Jack Henry, as well as pharmaceutical and healthcare technology company McKesson, which told regulators that data from its oncology and surgical business units had been stolen. ShinyHunters also caused widespread disruption across the U.S. in May with an attack on a widely used educational software suite and stole the information of more than four million people after targeting the world's largest medical device company in April. 

Other victims linked to the group include Carnival Cruises, Ticketmaster, AT&T, McGraw Hill, ADT, and gaming company Rockstar. In a related development, artificial intelligence company Anthropic released a report Thursday stating that suspected affiliates of ShinyHunters used AI to scan for credentials, map unfamiliar systems, and steal data from victims for extortion purposes. 

The report noted that in one case, an operator escalated from a stolen developer token to full administrative access over a victim's cloud environment in approximately three hours. Incident responders at Google also confirmed last week that members of the group are using Anthropic's AI tools at various stages of their attacks. 

The Florida breach adds to a growing list of incidents tied to ShinyHunters, underscoring the group's persistent targeting of both government systems and major corporations, as well as its evolving use of AI tools to accelerate and scale its intrusions.
Read more »
leaked sensitive data
cybercrime gang Cybercrime Groups data attacks Data Breach Data Leak data security Employee Personal Information leaked sensitive data

Turner Discloses Data Breach Exposing Salary Info, Bank Accounts, and SSNs

 

Turner Construction has notified at least 6,098 people of a data breach that uncovered social security numbers, salaries, dates of birth and bank account information used for direct deposit, a filing with the California Office of Attorney General showed. The New York City-based firm found unauthorized access to its systems occurred between July 2 and July 15, the filing with the California Office of Attorney General said. 

Turner confirmed on July 27 that files that contained personal information had been accessed without authorization, and some of the files that were accessed may have also included individuals' passport numbers. Ransomware group Payouts King claimed responsibility for the attack, alleging that the data that had been breached extended far beyond personal data to include engineering documents, military project files, contracts and non-disclosure agreements, a post on ClaimDEPOT, a class-action lawsuit tracking website, said. 

Turner issued a statement that after discovering that unauthorized access to certain files had occurred, the company engaged third-party cybersecurity and forensic experts and that those experts continue to review the files that were accessed. The company said it would notify impacted individuals and other parties as necessary and provide complimentary identity protection services. Turner added it would not comment on claims made by criminal organizations. 

According to ClaimDEPOT, Payouts King first posted information relating to an unidentified victim on July 24 and publicly naming Turner on August 11. The group posted the claims on a Tor network site, which hides the users' locations and identifies, claiming it had obtained 27.2 terabytes of data. Apart from the file types stated in the California attorney general filing, Payouts King claimed it had also accessed documents that were protected under International Traffic in Arms Regulations, which are US government rules regulating the export and import of military items, technology and services. Turner is offering five years of identity protection services through IDShield and IDX, the notices filed with the California AG's office said. 

One of the two notices set a November 18 deadline for affected individuals to enroll. The incident comes amid a wave of attacks targeting construction-related domains, an August 6 post on Google's Threat Intelligence blog identifying potentially compromised sites said. Turner is the largest contractor in the industry by revenue and focuses on data centers and advanced technology construction. The booming data center sector drove the firm to build a $44.3 billion backlog by the end of 2025.  

Several law firms have since posted notices of investigations into the Turner incident, seeking plaintiffs for potential class-action lawsuits. Turner also reported that at least 38 Vermont residents were affected by the breach, according to the Office of the Vermont Attorney General.
Read more »
IDS
Customer Data Cyberattack Data Breach Data Breaches Attacks Data Leak data security Hacker attack Hacker Sells Stolen Data IDS

IDScan Sued Over Alleged Data Breach Affecting 153 Million Drivers

 

Identity verification company IDScan is being sued in multiple cases after hackers allegedly gained unauthorized access to the service and started selling more than 153 million driver’s licenses via dark web. Markovits, Stock & DeMarco and Hall Attorneys law firms are investigating the class-action claims against the company, which is based in Louisiana. 

Plaintiffs allege that IDScan failed to protect the information of its clients, including car rental company Hertz. Everything started on September 1 when Krebs revealed that a dark-web illegal identity-theft service called Nexus was selling more than 153 million scans of American and Canadian’s driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. 

He confirmed his sources by searching for his own data and the data of other people who gave their consent to do so. His research showed that all the resources were stolen from IDScan. IDScan sells scanners and specialized software for extracting personal data from official documents. Its technology is used in numerous car rental companies, retail stores, gun shops, banks, pot shops, and hotels across the United States. 

The company has not responded to media inquiries about the data breach, leaving the situation unclear. For now, it is unknown how exactly the breach occurred and how many people were affected. According to Krebs, the Federal Bureau of Investigation (FBI) in New Orleans is investigating the issue, confirming the story, Reuters noted. The FBI spokesperson told Bleepingcomputer that the bureau is looking into the reports but declined further comments due to the sensitivity of the case. The illegal website Nexus that was distributing people’s personal data is closed now. 

However, criminals who stole the information from IDScan still have access to the database. According to Krebs, the compromised data includes the documents of the Secretary of Defense Pete Hegseth and an assistant director of the FBI, which could not be confirmed. Markovits, Stock & DeMarco law firm revealed that IDScan started informing some of its business customers around September 1. The company’s representatives stated that if someone’s ID was scanned in their system, they would contact them to discuss the situation and represent their interests in court. 

In addition, the firm is looking for other organizations to file a class-action lawsuit against the company. Because of the potential number of affected people, other class-action lawsuits may arise, which will have to be consolidated in multidistrict litigation. In addition, other states’ attorneys general and federal regulators may also launch separate investigations into this data security breach. Similar situations with 23andMe, Marriott, and Equifax data compromises happened before and ended in multi-state inquiries or even criminal charges.
Read more »
Digital Personal Data Protection
Accenture call cr Cyber hacks Cybersecurity Breach Data Breach Data Breaches Data Leak data security Digital Personal Data Protection

Origin Energy Data Breach Traced to Manila Call Centre, Ex-Accenture Employee Identified

 

An ex Accenture worker from Manila is suspected to be behind last month's security breach. Accenture has an office in the city, which supports the energy business in Origin with its customer call centres. It was alleged by a Nine report that the worker attempted to extort the energy provider for money, for its return of the stolen information. 

When approached by ABC News, an Accenture representative said it would be inappropriate to comment on Origin's data security incident. It stated that it is under active investigation. Origin Energy also refused to comment, citing that the breach is the subject of an ongoing criminal investigation. It was revealed the extent of the incident was apparent when, last month, an The Australian reported a hacker had supplied a sample of 50 customer records including names, addresses, emails, dates of birth, phone numbers and billing histories.

Origin Energy reported it to the authorities a potential data breach. The company later told the Business it believed the information of up to 900,000 current and former customers had been accessed. Origin customers told the ABC they felt their personal data could have been breached and expressed frustration with not being given enough detail on the nature of the incident. 

It is the latest in a series of major cybersecurity incidents affecting Australian companies. Qantas suffered a significant hack in 2025, while Optus and Medibank both experienced mass data breaches in 2022. Origin confirmed it became aware of a potential security threat in early July, but did not initially take it seriously. It has advised affected customers to be on guard against scams and said specialist identity and cyber support services are available. 

Origin chief executive Frank Calabria addressed the incident in July, saying the company had completed the first of its review into the customer data security breach. It apologised to customers for placing trust in Origin to safeguard its information. The Australian Federal Police (AFP) confirmed it is working closely with Origin Energy and relevant partners after the reported cyber incident.

An AFP spokesperson said the focus of investigators is on gathering evidence, identifying those responsible and disrupting any associated criminal activity. It added Origin Energy has been cooperative and transparent in its engagement with investigators, and continues to assist the ongoing investigation. No information has yet been released about possible charges against the former Accenture employee identified by the investigation.
Read more »
Security Breach
Baylor Genetics Data Breach Data Leak Patient Data Security Breach

Baylor Genetics Confirms Cyberattack Exposed Patient Data

 

Baylor Genetics has disclosed a cybersecurity incident that may have exposed personal information belonging to some patients and employees, but the company says laboratory operations were not interrupted and genetic testing services continued as normal. The incident was detected around June 15, 2026, after suspicious activity appeared in a limited part of its IT environment. 

According to the notice, an unauthorized third party accessed certain parts of Baylor Genetics’ network between June 11 and June 17, 2026. The company then launched a forensic investigation with outside cybersecurity specialists and spent weeks reviewing what data may have been involved and which people were potentially affected. That review was completed on or about July 30, 2026, after which written notices were sent to affected individuals when address information was available. 

The data at issue varied by person, but for patients it may have included names, dates of birth, medical testing information, laboratory test results, and possibly health insurance details. In a very limited number of cases, a Social Security number may also have been involved. For current or former employees, the exposed information may have included Social Security numbers, government-issued identification numbers, and financial account information. 

Baylor Genetics says it immediately secured affected systems, strengthened identity and access controls, enhanced monitoring, and coordinated with law enforcement and appropriate regulators. The company also said it has not found evidence of confirmed identity theft, fraud, or misuse tied to the incident so far. It added that test results remain accurate and that no testing data or results were altered, so no retesting is necessary. 

The notice urges people to watch financial account statements, Explanation of Benefits statements, and credit reports for unusual activity. It also points readers to identitytheft.gov, the Federal Trade Commission, and state attorneys general for help with fraud alerts, credit freezes, and identity-theft complaints. Baylor Genetics has set up a dedicated assistance line at 1-866-200-0985, available Monday through Friday from 9 a.m. to 9 p.m. ET.
Read more »
Trezor
Crypto Crypto Wallet Data Breach Data Leak data security Trezor

Trezor Data Breach Rises to 67,000 US Customers


Hardware cryptocurrency wallet organization Trezor has disclosed that additional 67,000 customers in the US have been impacted by a data breach consisting of its shipping provider, ShipMonk. 

The recent news has notably increased the number of consumers potentially exposed in the incident.  “We're deeply saddened to share the news that the recent data breach affects more customers than originally thought,” Trezor said on X. 

As per Trezor, the additional 67000 customers placed orders from November 2019 to August 2021. 

What is leaked?

The leaked data consists of customers' email, phone numbers, names, addresses, order numbers, and shipping addresses. According to Trezor, the data was stored by ShipMonk even though Trezor had earlier received assurance that previous consumer data had been erased. 

“Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications. We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems,” Trezor said.

According to experts, the breach is not impacting Trezor’s own systems. 

Who are impacted?

Trezor said its hardware wallets are safe and there are no signs that customers’ recovery seed phrases or private keys were breached in the leak. 

As per Trezor, “All affected customers have been emailed directly. If you didn’t receive an email, then you are not affected.”

Potential impact

But Trezor and cybersecurity experts are worried that the stolen data could be exploited for social engineering and targeted phishing attacks. Threat actors could misuse customers’ details regarding their Trezor purchases to create scam phone calls or fraud messages.

This can be a serious problem for cryptocurrency users. A threat actor could mimic a company employee if they know someone owns a Trezor wallet and ask the target to verify their wallet or account. 

User advisory

If successful, the attacker could steal the target’s recovery seed phrase, which can allow access to cryptocurrency funds. “Trezor systems were not compromised, and your device is secure. But please be alert for fake emails, phone calls, fraudulent letters, and potential risks to physical security,” the company added. 

The announcement comes after the August incident when 13,689 customers had been impacted by the same shipping-provider. At the time, Trezor estimated around 14,000 customers to have been affected by the breach. The recent disclosure of 67,000 suggests the scope of the incident was larger than expected.

Read more »
leaked sensitive data
Court Data Breach Data Leak data security government data breaches Hacker attack leaked sensitive data

Thomson Reuters Court Records Breach Exposes Sensitive Data Across North America

 

Sensitive court records and personal information were spilled from a data breach in the court system, which impacts at least 12 states in the U.S., including the U.S. Virgin Islands and Canada, Thomson Reuters announced on Wednesday. The breach occurred in C-Track, a court case management software, run by one of Thomson Reuters’ subsidiaries. 

The company remains silent on how the hackers accessed the program, who was responsible and how much data was compromised, as well as the number of individuals impacted. Thomson Reuters stressed that the breach was within their own environment and “not related to security vulnerabilities in the networks, systems or data of the courts.” The company discovered unauthorized access to its system on June 30, and it initiated an investigation alongside outside cyber security experts and law enforcement. 

Their probe established that unauthorized intruders accessed some C-Track files in March. Meanwhile, a separate disclosure by the Montana Supreme Court revealed that Thomson Reuters advised the state court officials that unauthorized access to C-Track persisted up to June, which means that hackers may have remained undetected within the system for several months. The sensitive information spilled includes names, Social Security numbers, driver licenses, medical information, dates of birth, and health insurance. 

Thomson Reuters added that confidential, redacted, or otherwise restricted information from court records may have been accessed in some jurisdictions, but the company confirmed that no abuse of the situation has occurred. The data breach did not impact the operations of C-Track, which continues to function normally. Thomson Reuters implemented additional security measures, following the breach, after they were approved by outside cybersecurity experts, although the company did not disclose who they were. 

The courts in the U.S. whose data is at risk, according to the company, are the appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee, and Wyoming. In addition, several Pennsylvania courts, 10 Ohio district courts of appeals, the Supreme Court, and the Superior Court of the U.S. Virgin Islands are also on the list. The breach in Oregon Judicial Department added another state to the list, expanding the reach to at least 12 states. 

Nevada officials reminded their residents that the types of data compromised differs from state to state, and that not all the data in each state is necessarily confidential or protected. They added that, for example, in Montana, most of the data already was publicly available, but the state’s court system acknowledged the breach of the drivers’ licenses and dates of birth. 

In addition, several of the jurisdictions were notified weeks after Thomson Reuters became aware of the security threat. For example, the court administrator of Montana and the Ontario Ministry of the Attorney General were notified of the unauthorized access to the data on July 23. The chief justices of Ontario agreed that it still remains unclear what information was at risk and how many people were impacted. Thomson Reuters notifies affected individuals that they can receive 12 months of free of credit monitoring and identity theft protection.
Read more »
data theft attack
Clop Gang Clop Ransomware Gang Cyberattacks Data Breach Data Leak data security Data Theft data theft attack

Clop-Linked Web Shell Targets PTC Windchill Servers in Data Theft Attacks

 

A custom Java web shell, associated with the Clop ransomware group, was created to target the PTC Windchill and FlexPLM servers by decrypting their credentials, enumerating file repositories, and stealing data. Researchers at cybersecurity firm ReliaQuest discovered the web shell after analyzing the recent data-theft campaign that abused the critical remote code execution vulnerability, CVE-2026-12569, affecting PTC Windchill. 

According to the researchers, the attackers did not use a traditional web shell to gain persistent access to the targeted servers. Instead, they used a custom component that demonstrated an in-depth understanding of the target application’s internal API, database schema, keystore, and file-vault structure. ReliaQuest notes that the discovered resource is an application-specific variation of the Clop ransomware group’s known mass exploitation framework. The web shell was linked to the Clop ransomware group because of extortion e-mails sent by the threat actors using the e-mail addresses associated with the data-leakage web site operated by Clop. 

In addition, the researchers identified X-windchill-req headers used by the web shell, which were also used by the Clop ransomware group in the past, as well as similar tactics, techniques, and procedures (TTPs). Earlier this year, Clop ransomware group’s infrastructure was found to target enterprise business software solutions such as Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer. This campaign, which affected the MOVEit Transfer application, compromised more than 2,770 organizations worldwide. 

The web shell is implemented as JavaServer Pages (JSP), which directly imports the PTC Windchill-specific classes such as MethodContext, WTConnection, and WTKeyStoreUtil, giving the threat actors’ access to PTC Windchill’s native functions, including the database, encrypted credentials decryption, and locating files stored in the application’s vaults. The web shell’s command execution capability was established using the custom protocol that utilizes the HTTP X-windchill-req header. 

Overall, the custom component allowed the attackers to achieve multiple malicious objectives, including Windchill secrets and configuration data theft, file vault discovery and enumeration, directory listing, file retrieval and deletion, executing additional Java classes, and identifying the server’s operating system. Besides that, ReliaQuest reports that the web shell’s implementation contains the Windchill vault enumeration code that queries multiple Windchill database tables, namely ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. 

The PTC released a set of security updates to address CVE-2026-12569 on June 17. Additionally, the vulnerability was included in the CISA’s Known Exploited Vulnerabilities catalog earlier this week after the PTC reported active exploitation attempts in the wild. Ransom-ISAC confirmed that ransomware group Clop was behind the attacks by sending extortion emails to the employees of the targeted organizations. ReliaQuest recommends that all the JSP files found in the PTC Windchill directories should be investigated for any suspicious content and that the researchers should look for the X-windchill-req string. 

Moreover, the organizations that determined that their Windchill servers were compromised by the ransomware group should change the LDAP manager’s password and other user credentials because they are considered insecure and may have been leaked.
Read more »
data security
Credential Stuffing Credential Stuffing Attacks Credential Theft Customer Data Customer Data Theft Data Breach Data Leak data security

Chick-fil-A Warns Customers After Credential Stuffing Attack Compromises User Accounts

 

Chick-fil-A notifies customer about personal information exposure after data breach occurred due to credential stuffing attack Chick-fil-A company has announced that personal and account information about some of its customers may have been exposed due to a data breach. This breach occurred through the use of credential stuffing, which is not a vulnerability within the corporation’s website or mobile application.

As explained in the company note to customers, unauthorized access attempts came from bad actors using credentials stolen elsewhere. The company discovered unauthorized access attempts to customer accounts after noticing anomalous activity in the login database, and the phishing campaign occurred between June 17-19, 2026, targeting Chick-fil-A One loyalty program accounts. The corporation concluded its investigation on July 13 th and established that attackers had used compromised credentials to access the account information of some customers. 

The information available to bad actors and potentially at risk of being misused varies depending on the customer’s account. It may include names, contact information, mailing addresses, phone numbers, dates of birth, and Chick-fil-A One account information like ID or QR code and mobile payment credentials. Moreover, attackers may have gained access to reward balances, gift card balances, and the last four digits of payment cards. Although the corporation has not revealed the number of affected clients, the number exceeds several thousand. 

According to the documents filed with the state, 2,182 Texas residents and 39 Massachusetts residents were impacted by the breach. However, there are also other states affected, as notifications to state attorney generals in charge of consumer protection have also been filed, including the District of Columbia. After discovering the issue, the corporation remediated the security risks and notified the affected clients. 

Moreover, Chick-fil-A took measures to enhance account security for all customers, including allowing password reset, account logout, and removing payment methods in the application. Some customers also received bonus points on their accounts as compensation for the issues experienced. Chick-fil-A corporation acknowledges the concern caused by the data breach and assures clients that it takes customer account security seriously. Moreover, the company has recommended that customers change passwords to strong and unique words or phrases not used for other accounts. 

Credential stuffing works only when the same or similar passwords are used across different accounts, so changing them to unique ones decreases the chances of experiencing another breach. Chick-fil-A data breach demonstrates once more that it is crucial to make sure that each online account, including email, banking, and social media accounts, uses a unique and strong password. 

If one suspects that an account may have been compromised, it should be changed to a strong password immediately. Also, it is essential to use multi-factor authentication when available and to monitor account activity regularly for unauthorized transactions or unauthorized access attempts.
Read more »
Employee Data
Cyber Criminals Cyberattacks cybersecurity incidents Data Breach Data Leak data security Digital Personal Data Protection Employee Data

Estée Lauder Discloses HR Data Breach Linked to Oracle E-Business Suite Vulnerability

 

Estee Lauder announced that their Oracle E-Business Suite (EBS) system that manages human capital operations was targeted by cyber criminals who managed to steal personal data of some of the company’s employees. The company confirmed that some of the information on the intranet belonged to third parties who were not authorized to access it. 

According to the company’s statement, Estee Lauder learned about the breach following an internal investigation into the cybersecurity incident. Specifically, investigators discovered on June 19, 2026, that unauthorized users accessed the Oracle EBS system on or around August 9, 2025. The data exfiltrated by the hackers varied depending on the individual’s details but generally included names, addresses, and email, birth dates, social security numbers, passport numbers, bank information, medical data, and records of payroll and performance reviews. 

Since the breach involved PII, financial information, and employment data, there is a risk of identity theft and financial fraud for the affected employees. After detecting the anomaly, Estee Lauder contracted cybersecurity experts to conduct a forensic audit, report the pertinent information to the relevant law enforcement agencies, and take additional measures to secure the site. The company is offering 24 months of identity and restoration services through Kroll to all the affected parties free of charge, and the services will be available until October 31, 2026. All the affected employees should remain on the lookout for possible suspicious activities, including monitoring financial accounts, credit reports, and other relevant personal information. 

Even though Estee Lauder did not disclose the identity of the perpetrators, in the context of the discovered timeline, it is plausible to assume that the threat actors who targeted the company are part of the Cl0p extortion group. According to reports by Google and Mandiant, the hacking group utilized several Oracle EBS vulnerabilities, including the zero-day flaw with the reference number CVE-2025-61882, to initiate attacks against other companies. 

The vulnerability that was most likely used in the attack allowed malicious cyber actors to deploy arbitrary code via an unauthenticated HTTP request and affected all Oracle EBS versions from 12.2.3 to 12.2.14. Notably, Oracle released a security patch on October 4, 2025, after detecting that the vulnerability was being actively exploited. The latest breach serves as a reminder of the potential risks associated with the use of enterprise resource planning software that has the capability to store PII and other sensitive information about employees. 

It is strongly advised that organizations that use similar systems remain wary of the threats and make sure that all the relevant software has been updated with the latest security patches while also configuring the tools in a manner that minimizes the attack surface. In addition, enterprise systems should be constantly monitored for any suspicious activities that could indicate possible threats to data security.
Read more »
User Privacy
Cyber Security Data Leak Location Sharing User Privacy

Location Sharing: Convenience at the Cost of Safety

 

Location sharing has become a routine feature in messaging, navigation, and social apps, yet it carries security and privacy risks that many users underestimate. While convenient for coordinating meetups or ensuring family safety, careless configuration can expose sensitive patterns about your daily life to strangers, advertisers, and even attackers who compromise the platforms you trust. 

The most immediate danger is physical safety. Continuous location sharing reveals where you live, work, study, and spend leisure time, effectively mapping your routine for anyone with access. Stalkers, harassers, or opportunistic criminals can exploit this data to time thefts, orchestrate impersonation scams, or physically follow you. Real-time updates on platforms like Snapchat’s Snap Maps make it trivial to see when you are home or away, turning a social feature into a surveillance tool if permissions are too broad. 

Beyond individual bad actors, the apps themselves and their data ecosystems present another layer of risk. Many services collect and retain location histories, which can be sold to data brokers, advertisers, or accessed by third parties through data breaches. Incidents like the Gravy Analytics hack show how aggregated location data can leak at scale, exposing users who never intended their movements to be public. Even when companies claim strong security, breaches and insider misuse remain persistent threats in today’s threat landscape. 

Location data also fuels more sophisticated cyberattacks through social engineering and targeted fraud. Attackers can correlate your whereabouts with spending habits, social posts, and device usage to craft convincing phishing messages, fake support calls, or credential-reset scams. For example, seeing that you just visited a shopping mall or a specific campus building can help criminals personalize spam about credit-card fraud or IT alerts, increasing the chance you click a malicious link. Geotagged photos and live stories further amplify this risk by publicly broadcasting your precise coordinates. 

Mitigating these risks requires deliberate permission management and a mindset Of location sharing has become a routine feature in messaging, navigation, and social apps, yet it carries security and privacy risks that many users underestimate. While convenient for coordinating meetups or ensuring family safety, careless configuration can expose sensitive patterns about your daily life to strangers, advertisers, and even attackers who compromise the platforms you trust.
Read more »
EY
Customer Data customer data leak Cyberattack Data Breach Data Leak data security EY

Ernst & Young Notifies Clients Following Third-Party Support Platform Data Breach

 

The company Ernst & Young (EY) has sent out notices to the affected clients about the data breach involving the third-party support ticket platform, which EY’s employees used, and therefore, potentially exposed documents with sensitive tax details to hackers. EY is one of the world’s largest accounting firms that is known to have faced a cybersecurity incident when the unauthorized party gained access to the third-party support ticket platform used by EY’s IT staff on March 28, 2026, and removed several documents from it, reported on April 23, 2026. 

A company statement noted, after reviewing the activity within its environment with the help of outside cybersecurity experts, that the threat actors accessed the EY environment between March 28, 2026, and April 12, 2026. As per the breach notification letter, the documents removed from the support platform could include personal information or financial information, as well as details provided to EY’s support teams during the process of submitting the tickets or in connection with the preparation of the clients’ tax returns. 

EY acknowledges that tax-related information may have been involved in the data security incident but chose not to identify what specific details were affected, as the breach notification letters also include placeholders for the affected customers’ personal information. The company also declined to indicate how many clients were affected by the breach or whether it was limited to the U.S., as there are other EY entities around the globe. EY announced that after detecting the issue, the company took measures to secure the affected systems by cutting down the unauthorized access, and notified the appropriate federal agencies. 

Furthermore, EY has found no evidence that the information from the breach had been deployed or that any particular individuals were the specific targets. Nevertheless, the firm offered its affected clients with credit monitoring and identity theft protection services for 24 months for free from Experian. The customers whose data was at risk were encouraged to sign up for the monitoring services by October 31, 2026. 

At the moment of the announcement, neither ransomware gangs nor data extortionists have claimed responsibility for the cyberattack, nor did any bad actors leak the data or sell it on the dark web. The attack involving the third-party support ticket platform yet again demonstrated the challenges organizations face regarding their ability to protect clients’ data and ensure that their vendors and partners do the same. 

Experts note that companies should invest in making sure their third-party vendors have reliable security practices in place, monitor their activity on a regular basis, and avoid storing any sensitive data on the platforms that can be accessed by numerous individuals, as in the case of EY’s tickets system, to mitigate the risks of supply chain breaches and data leakage incidents.
Read more »
Subscribe to: Posts (Atom)