pwn.watch: Breaches & attacks updates

[high] Capcom ID breach exposes 11.7M account email addresses

Fri, 23 Oct 2026 11:12:55 GMT

Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom.

Status: live · Patch: patched · Fixed in: Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available

Latest updates:

2026-10-22: Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified. (source)
2026-10-21: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. (source)
2026-10-20: Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed. (source)

[critical] ConnectWise Cloud Backup shut down after M365 app-identity hijack

Fri, 23 Oct 2026 11:12:55 GMT

ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.

Status: live · Patch: partial

Latest updates:

2026-10-22: Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days. (source)
2026-10-22: ConnectWise CEO Manny Rivelo says the affected application connections are contained and services are being restored gradually, but cutting those connections won't necessarily evict attackers who already set up persistent access in customer tenants. Microsoft hasn't said how many customers were compromised. (source)
2026-10-22: Wiz Research says the same ARTEX-using actor, overlapping with Storm-0940, is also targeting other IT and software vendors: password-spraying Okta and Entra, abusing Cognito and account-recovery endpoints, and probing Microsoft 365 integrations and tenant isolation. Wiz published IPs and user agents to hunt for. (source)

[critical] Hackers hijack refrigeration controllers at about 700 French supermarkets (Danfoss, Copeland and Dixell XWEB)

Fri, 23 Oct 2026 11:12:55 GMT

Overnight on Oct 11 to 12, attackers took remote control of internet-exposed refrigeration controllers at about 700 French supermarkets (Intermarché and Netto, Coopérative U, Carrefour with 80 stores, Monoprix, E. Leclerc and others), forcing fridges and freezers into continuous defrost with setpoints around 50°C, spoiling fresh and frozen stock and reportedly causing small fires. A second wave followed the next night and also hit stores with Dixell controllers. CERT-FR names Danfoss AK-SM and AK-SC series plus Copeland and Dixell xweb controllers, says campaigns are probably still ongoing, and tells operators to take every controller off the public internet. Most affected Danfoss units are end-of-life models (AK-SM 800, AK-SC 355) that get no fixes; the entry vector and attacker are still unconfirmed.

Status: live · Patch: partial · Fixed in: No fix for end-of-life units: remove internet exposure and replace them, Danfoss AK-SM 800A: update to current firmware, security level Strict, change default passwords (CERT-FR)

Latest updates:

2026-10-22: Dark Reading reports a little over 700 stores were hit in one night; a Sekoia analyst told Reuters Spain, Portugal, Poland, Germany and Belgium were also affected, and Les Mousquetaires (Intermarché, Netto) said the attack came through a refrigeration service provider. (source)
2026-10-16: CERT-FR publishes a third version with separate steps for compromised and uncompromised units: remove internet exposure, check defrost ranges, restore access only via VPN, and reset and reconfigure compromised Danfoss units. (source)
2026-10-15: France's finance minister has told lawmakers about 700 of the country's roughly 10,000 supermarkets were affected; Copeland now acknowledges a vulnerability and says it is working with impacted customers. Censys saw exposed Danfoss StoreView panels in France drop from 1,800+ to 537 in three days. (source)

[medium] Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud

Fri, 23 Oct 2026 11:12:55 GMT

Japanese media group Nikkei Inc. (owner of the Financial Times) says attackers used stolen credentials, obtained by unknown means, to access a cloud service it uses for system development in the early hours to morning of October 7, 2026, and personal information stored there leaked. As of October 16, about 1.83 million items had leaked: about 150,000 contain a name, email address, postal address, phone number or date of birth (about 120,000 include an email address), and about 1.68 million contain only information that cannot identify a person. No credit card data. Nikkei disabled the credentials, reported to Japan's Personal Information Protection Commission on October 11 and says it found no misuse so far. On October 21 Nikkei BP said about 800,000 of the leaked items belong to users of its services. BleepingComputer counts this as Nikkei's third disclosed incident in about a month.

Status: live · Patch: patched · Fixed in: Nikkei disabled the stolen credentials used for the access; scope review ongoing

Latest updates:

2026-10-23: Nikkei updates its breach notice: it modified its inquiry/contact form in response to a vulnerability identified in the PHP programming language. (source)
2026-10-21: Nikkei BP says about 800,000 of the leaked items belong to users of its services (about 50,000 with name, email, address, phone or date of birth; about 750,000 identifiers only). (source)
2026-10-16: Nikkei discloses the breach: about 1.83 million items leaked, about 150,000 with identifying details, no credit card data, no misuse or system outage found. It will contact affected people individually. (source)

[high] GMO Onamae Desktop Cloud malware on customer VPS

Fri, 23 Oct 2026 11:12:55 GMT

GMO Internet’s Japanese VPS service Onamae Desktop Cloud said an attacker installed malicious programs in customer environments, forcing shutdown of as many as ~26,739 servers with no immediate restart date (mid-October 2026 reporting).

Status: live · Patch: partial

[high] OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys

Fri, 23 Oct 2026 11:12:55 GMT

On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.

Status: live · Patch: partial

Latest updates:

2026-10-20: Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week. (source)
2026-10-19: BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits. (source)
2026-10-18: Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened. (source)

[high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken

Fri, 23 Oct 2026 11:12:55 GMT

PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.

Status: live · Patch: partial

Latest updates:

2026-10-21: PingCAP Japan adds support-ticket information to the list of exposed data. (source)
2026-10-20: FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. (source)
2026-10-19: PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. (source)

[high] Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager

Fri, 23 Oct 2026 11:12:55 GMT

Quest Diagnostics says it learned on Oct 21 2026 of unauthorized access to its Quanum Lab Services Manager (LSM), the system some clients use to place lab test orders and receive and look up results. Quest believes some patient data in Quanum LSM was accessed and confirms PHI/PII was involved; the specific data affected is still being investigated. Quest paused access to Quanum LSM (and, as a precaution, Essential Insights and LabHQ, where no data was accessed), notified federal law enforcement and engaged outside experts. Core operations are not materially disrupted, and Quest says the incident is not related to the PHP vulnerabilities.

Status: live · Patch: partial · Fixed in: Access to Quanum LSM paused and the unauthorized access discontinued; full restoration expected as soon as Oct 23

Latest updates:

2026-10-22: 8-K filing: Quest believes an unauthorized party accessed certain patient records; federal law enforcement notified and outside experts engaged; operations not materially disrupted. (source)
2026-10-22: Quest FAQ confirms PHI/PII was involved, pauses Essential Insights and LabHQ as a precaution, says the incident is not PHP-related, and expects Quanum LSM back as soon as Oct 23. Clients can use paper requisitions or Quanum eLabs meanwhile. (source)
2026-10-21: Quest learns of unauthorized access to Quanum LSM, starts incident response and pauses access to the system. (source)

[high] Railway discloses unauthorized access to customer environment variables

Fri, 23 Oct 2026 11:12:55 GMT

On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.

Status: live · Patch: partial

Latest updates:

2026-10-22: Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC. (source)
2026-10-22: Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation). (source)
2026-10-22: CEO: builds ramping up overnight; full post-mortem promised. (source)

[medium] State Bank of India confirms customer data exposed on the dark web

Fri, 23 Oct 2026 11:12:55 GMT

State Bank of India (SBI), India's largest bank, disclosed that customer data turned up on the dark web. In a preliminary analysis of about 375,000 records, it identified 3,897 customer records with personal data: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and loan/lead metadata. SBI says balances and funds are safe and core operations are unaffected; the source of the exposure is still under investigation. Affected customers have been notified by email and/or WhatsApp. Expect targeted phishing and fraud calls.

Status: live · Patch: partial · Fixed in: SBI activated incident response and containment and engaged a CERT-In-empanelled agency; source and full extent still under investigation

Latest updates:

2026-10-23: SBI says it has individually informed all affected customers by email and/or WhatsApp and reiterates that account balances and funds are safe. (source)
2026-10-21: SBI discloses the incident to stock exchanges: 3,897 customer records with PII identified among about 375,000 records, containment activated and an independent CERT-In-empanelled agency engaged. (source)
2026-10-16: SBI receives alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. (source)

[medium] Major U.S. banks detect unauthorized third-party AI agents inside customer accounts

Fri, 23 Oct 2026 11:12:55 GMT

Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.

Status: live · Patch: partial · Fixed in: Morgan Stanley: blocking third-party agents, JPMorgan, Bank of America, Citi: restricting agent access, Most banks: moving to read-only access through authorized data connectors

Latest updates:

2026-10-22: Axios scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley is blocking agents and JPMorgan, Bank of America and Citi are restricting them. (source)
2026-10-22: Chase tells Axios that customers should not give their usernames and passwords to anyone. Morgan Stanley says it hasn't observed "rogue AI agents accessing our platforms." (source)
2026-10-22: Reuters picks up the Axios report and says it could not immediately verify it. (source)

[unknown] Refrigeration outages at up to a dozen US military commissaries, investigated by Army CID's Cyber Field Office (cause unconfirmed)

Fri, 23 Oct 2026 11:12:55 GMT

Starting Aug 26, refrigeration at Defense Commissary Agency (DeCA) stores on at least six US bases failed within days of each other, with some freezers going into defrost mode overnight and thousands of dollars of meat, dairy, produce and frozen food thrown out. Army CID's Cyber Field Office and the Air Force Office of Special Investigations confirmed investigations, with the Defense Criminal Investigative Service in the lead. The Pentagon only acknowledges a "possible refrigeration disruption" and no cause has been announced, so this is not a confirmed cyberattack; Reuters later noted it resembles the October attacks on French supermarket refrigeration controllers.

Status: live · Patch: unpatched

Latest updates:

2026-10-13: After the French supermarket refrigeration attacks, Reuters notes they resemble the late-August disruptions at about a dozen US military commissaries. (source)
2026-09-30: DeCA says cooler outages at four commissaries in Germany and England are equipment failures unrelated to the stateside outages; no findings from the investigation have been announced. (source)
2026-09-01: Army CID's Cyber Field Office and Air Force OSI confirm active investigations, with the Defense Criminal Investigative Service in the lead; some stores reported their freezers went into defrost mode. (source)

[critical] Zeabur breach exposes 3.2M env-var records; company to shut down

Fri, 23 Oct 2026 11:12:55 GMT

Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.

Status: live · Patch: partial

Latest updates:

2026-10-15: Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05. (source)
2026-10-14: Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers. (source)

[unknown] Bullhorn staffing platform taken offline for cyber incident

Wed, 21 Oct 2026 00:00:00 GMT

Recruitment software provider Bullhorn confirmed a cyber incident and temporarily disabled customer access, forcing password and API credential resets.

Status: closed · Patch: partial

[unknown] Dashlane 2FA brute-force; encrypted vaults for <20 accounts

Mon, 15 Jun 2026 00:00:00 GMT

Beginning May 31 2026 attackers brute-forced six-digit 2FA codes to register new devices on Dashlane accounts and downloaded encrypted vaults for fewer than 20 personal accounts. Dashlane said its own systems were not compromised and worked with affected customers.

Status: closed · Patch: partial

[high] Instructure Canvas Free-for-Teacher breach (ShinyHunters)

Sun, 31 May 2026 00:00:00 GMT

In May 2026 Instructure confirmed a security incident involving Canvas Free-for-Teacher after ShinyHunters claimed theft of data tied to hundreds of millions of users. Exposed data included names, emails, student IDs and some private messages; Instructure said it had no evidence passwords or financial/government IDs were taken.

Status: closed · Patch: partial

[unknown] Anthropic investigates unauthorized access to Claude Mythos Preview via vendor

Thu, 30 Apr 2026 00:00:00 GMT

In April 2026 Anthropic said it was investigating reports that unauthorized users accessed its unreleased vulnerability-discovery tool Claude Mythos Preview through a third-party vendor environment rather than a direct Anthropic system compromise (Bloomberg / CRN reporting).

Status: closed · Patch: no-fix-needed

[unknown] Stryker hit by Handala data-wiping attack

Sun, 05 Apr 2026 00:00:00 GMT

In March 2026 medical-tech company Stryker suffered a disruptive attack on its Microsoft environment. Iran-linked Handala claimed responsibility, alleging mass device wipes after domain-admin compromise. CISA warned organizations to harden endpoint management. Stryker reported being fully operational by early April.

Status: closed · Patch: no-fix-needed

[high] LexisNexis breach (FulcrumSec claims React2Shell path)

Tue, 31 Mar 2026 00:00:00 GMT

In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.

Status: closed · Patch: patched

CVEs: CVE-2025-55182

[critical] European Commission & Dutch authorities hit via Ivanti EPMM zero-days

Sat, 28 Feb 2026 00:00:00 GMT

February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.

Status: closed · Patch: patched · Fixed in: Ivanti patched EPMM releases

CVEs: CVE-2026-1340

[unknown] UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)

Sat, 28 Feb 2026 00:00:00 GMT

In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.

Status: closed · Patch: partial

[high] ShinyHunters leak Crunchbase data (~2M records)

Sat, 31 Jan 2026 00:00:00 GMT

In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.

Status: closed · Patch: no-fix-needed

[medium] Mixpanel smishing breach exposes OpenAI API users' names and emails

Thu, 27 Nov 2025 00:00:00 GMT

Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11-26: OpenAI discloses impact on API users and drops Mixpanel (source)
2025-11-08: Mixpanel detects the smishing campaign and unauthorized export (source)

[critical] Jaguar Land Rover cyberattack stops car production for five weeks

Fri, 14 Nov 2025 00:00:00 GMT

A cyberattack that began on August 31, 2025 forced JLR to shut down IT systems and halt production worldwide from September 1. A phased restart began October 8; UK production was back to normal by November 14. The UK government guaranteed a £1.5B loan to keep JLR's suppliers afloat.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11-14: UK production returns to normal (source)
2025-10-08: Phased manufacturing restart begins (source)
2025-09-28: UK government guarantees a £1.5B loan to support JLR and suppliers (source)

[high] SonicWall: state actor stole firewall config backups of every cloud-backup customer

Wed, 05 Nov 2025 00:00:00 GMT

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11: SonicWall says the investigation is complete and attributes it to a state-sponsored actor (source)
2025-10-08: SonicWall and Mandiant confirm all cloud-backup customers' files were accessed (source)
2025-09-17: SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers) (source)

[high] Asahi ransomware attack halts orders and beer shipments in Japan (Qilin claims it)

Wed, 15 Oct 2025 00:00:00 GMT

A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-07: Qilin claims responsibility and leaks data (source)
2025-10-03: Asahi confirms ransomware and possible data exfiltration (source)
2025-09-29: Cyberattack halts orders, shipments and call centres in Japan (source)

[critical] F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen

Wed, 15 Oct 2025 00:00:00 GMT

F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.

Status: closed · Patch: patched · Fixed in: F5 October 2025 Quarterly Security Notification releases

Latest updates:

2025-10-15: F5 discloses the breach (SEC 8-K) and ships patches (source)
2025-10-15: CISA issues Emergency Directive 26-01 for F5 devices (source)
2025-08-09: F5 learns of the intrusion (source)

[high] Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen

Fri, 10 Oct 2025 00:00:00 GMT

The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-10: FINRA alert to member firms (source)
2025-10-02: Red Hat confirms the incident (source)
2025-10-01: Crimson Collective claims the Red Hat GitLab theft (source)

[high] Discord support vendor breach exposes ~70,000 government ID photos

Thu, 09 Oct 2025 00:00:00 GMT

An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-09: Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed (source)
2025-10-03: Discord discloses that a third-party customer service provider was compromised (source)

[high] Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin

Wed, 24 Sep 2025 00:00:00 GMT

Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-09-24: Collins works on restoring software for affected airlines (source)
2025-09-22: ENISA confirms third-party ransomware behind the disruption (source)
2025-09-20: Disruption expected to stretch into Sunday; Brussels cancels flights (source)

[high] Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)

Sun, 07 Sep 2025 00:00:00 GMT

Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Status: closed · Patch: no-fix-needed · Fixed in: Drift tokens revoked; rotate any secrets stored in Salesforce

Latest updates:

2025-09-02: Cloudflare details the impact on its Salesforce case data (source)
2025-08-26: Google Threat Intelligence publishes UNC6395 findings (source)
2025-08-20: Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange (source)

[high] Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)

Sun, 31 Aug 2025 00:00:00 GMT

UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Status: closed · Patch: no-fix-needed

Latest updates:

2025-08: Google confirms the breach exposed prospective Google Ads customers' contact info (source)
2025-06-04: Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse (source)
2025-06: Google's corporate Salesforce instance breached by UNC6040 (source)

[high] Ingram Micro SafePay ransomware takes down ordering systems for a week

Thu, 10 Jul 2025 00:00:00 GMT

SafePay ransomware hit IT distributor Ingram Micro around July 3, 2025, taking down its website, ordering systems, the Xvantage platform and Impulse licensing. Ingram Micro took systems offline and restored order processing globally by July 9-10.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-07-09: Order processing restored globally (source)
2025-07-05: Ingram Micro confirms ransomware on internal systems (8-K) (source)
2025-07-03: Outage begins across website and ordering systems (source)

[high] Qantas: 5.7M customers' data stolen from a contact-centre platform

Wed, 09 Jul 2025 00:00:00 GMT

A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-07-09: Qantas update: 5.7M unique customers affected (source)
2025-07-02: Qantas discloses the cyber incident (initially 6M records) (source)

[critical] Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days

Tue, 10 Jun 2025 00:00:00 GMT

Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-06-10: Online clothing orders resume after 46 days (source)
2025-05-21: M&S estimates about £300M cost; disruption to last into July (source)
2025-04-29: Attack linked to Scattered Spider and DragonForce ransomware on ESXi (source)

[high] Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Fri, 30 May 2025 00:00:00 GMT

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-05-15: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom (source)
2025-05-11: Coinbase receives the extortion demand and discovers the breach (source)
2025-05: Breach notice puts affected customers at 69,461 (source)

[high] Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale

Tue, 08 Apr 2025 00:00:00 GMT

A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-04-08: Reports that Oracle privately confirmed the breach to customers (source)
2025-03-21: rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach (source)

[critical] Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)

Thu, 06 Mar 2025 00:00:00 GMT

North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-03-06: Safe{Wallet} confirms a developer machine compromise by TraderTraitor (source)
2025-02-26: FBI attributes the theft to North Korea ('TraderTraitor') (source)
2025-02-21: About $1.5B in ETH drained from a Bybit cold wallet

[high] DeepSeek leaves ClickHouse database open: chat logs and API keys exposed

Wed, 29 Jan 2025 00:00:00 GMT

Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.

Status: closed · Patch: patched · Fixed in: Database secured by DeepSeek

Latest updates:

2025-01-29: Wiz finds the exposed database and reports it; DeepSeek secures it within an hour (source)

[critical] Salt Typhoon: Chinese state hackers inside US telecom networks

Wed, 04 Dec 2024 00:00:00 GMT

PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-12-04: CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure (source)
2024-11-13: FBI and CISA joint statement on PRC targeting of commercial telecommunications (source)

[critical] Change Healthcare ransomware attack (ALPHV/BlackCat)

Tue, 22 Oct 2024 00:00:00 GMT

The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).

Status: closed · Patch: no-fix-needed

Latest updates:

2024-10-22: Change Healthcare tells HHS OCR it has sent about 100 million individual notices (source)
2024-05-01: CEO Andrew Witty testifies before the Senate Finance Committee (source)
2024-04-22: UnitedHealth: stolen files could cover a substantial proportion of people in America (source)

[high] Internet Archive hacked: 31 million user records stolen

Sun, 20 Oct 2024 00:00:00 GMT

Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-10-09: archive.org shows a hacker's JavaScript alert; breach of 31M records confirmed (source)
2024-09-28: Most recent timestamp in the stolen user database (source)

[high] National Public Data breach: 2.7 billion records with SSNs leaked

Sun, 11 Aug 2024 00:00:00 GMT

Data stolen from background-check broker National Public Data, nearly 2.7 billion plaintext records with names, mailing addresses and Social Security numbers of people in the US, was leaked for free on a hacking forum. It had first been offered for sale in April 2024 by an actor called USDoD.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-08-11: BleepingComputer reports the 2.7 billion record leak (source)
2024-08-06: Actor 'Fenice' leaks the most complete version of the data for free on Breached (source)
2024-04: USDoD offers 2.9 billion records allegedly stolen from National Public Data for $3.5 million (source)

[critical] CrowdStrike Falcon update crashes 8.5 million Windows machines

Tue, 06 Aug 2024 00:00:00 GMT

A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.

Status: closed · Patch: patched · Fixed in: Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)

Latest updates:

2024-08-06: CrowdStrike publishes the Channel File 291 root cause analysis (source)
2024-07-20: CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected (source)
2024-07-19: 04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash (source)

[critical] Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)

Fri, 12 Jul 2024 00:00:00 GMT

A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-07-12: AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace (source)
2024-06-10: Mandiant publishes its UNC5537 report: about 165 organizations notified (source)
2024-05-31: Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake (source)

[high] Dropbox Sign (HelloSign) production environment breached

Fri, 21 Jun 2024 00:00:00 GMT

A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-06-21: Dropbox updates its post: investigation concluded, no access to documents or payment info (source)
2024-04-24: Dropbox becomes aware of unauthorized access to the Dropbox Sign production environment (source)

[high] Hugging Face Spaces secrets accessed without authorization

Fri, 31 May 2024 00:00:00 GMT

Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-05-31: Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens (source)

[high] Midnight Blizzard breaches Microsoft corporate email

Tue, 02 Apr 2024 00:00:00 GMT

Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-04-02: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed (source)
2024-01-25: Microsoft publishes guidance for responders on the Midnight Blizzard attack (source)
2024-01-12: Microsoft detects a nation-state attack on its corporate systems (source)

[high] Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach

Thu, 01 Feb 2024 00:00:00 GMT

A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-02-01: Cloudflare publishes its full write-up (source)
2023-11-23: Cloudflare detects the attacker on its self-hosted Atlassian server (source)
2023-11-14: Attacker begins reconnaissance with credentials from the Okta compromise (source)

[high] Xfinity breach via Citrix Bleed: 35.9M customers

Mon, 18 Dec 2023 00:00:00 GMT

Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.

Status: closed · Patch: patched

Latest updates:

2023-12-18: Public notice; customers are forced to reset passwords (source)
2023-12-06: Xfinity concludes usernames and hashed passwords were taken
2023-11-16: Xfinity determines customer information was likely acquired