{ "site": "https://pwn.watch", "generatedAt": "2026-10-23T18:42:33.457Z", "tag": { "id": "data-breach", "label": "Data breach", "isStack": false, "url": "https://pwn.watch/t/data-breach", "feed": "https://pwn.watch/t/data-breach/feed.xml" }, "counts": { "incidents": 45, "live": 8, "notFullyPatched": 6, "patched": 36 }, "incidents": [ { "slug": "quest-diagnostics-quanum-lsm-breach", "title": "Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager", "url": "https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach", "json": "https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach.json", "status": "live", "severity": "high", "patchStatus": "partial", "category": "breach", "product": "Quest Diagnostics Quanum Lab Services Manager (lab ordering and results portal)", "tags": [ "quest-diagnostics", "healthcare", "data-breach" ], "cveIds": [], "affectedVersions": [ "Quanum Lab Services Manager (LSM) patient data; affected patients and providers not yet identified" ], "fixedVersions": [ "Access to Quanum LSM paused and the unauthorized access discontinued; full restoration expected as soon as Oct 23" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "Quest Diagnostics says it learned on Oct 21 2026 of unauthorized access to its Quanum Lab Services Manager (LSM), the system some clients use to place lab test orders and receive and look up results. Quest believes some patient data in Quanum LSM was accessed and confirms PHI/PII was involved; the specific data affected is still being investigated. Quest paused access to Quanum LSM (and, as a precaution, Essential Insights and LabHQ, where no data was accessed), notified federal law enforcement and engaged outside experts. Core operations are not materially disrupted, and Quest says the incident is not related to the PHP vulnerabilities.", "xPost": { "id": "2113446811151356228", "postedAt": "2026-10-23T01:46:00.682Z", "url": "https://x.com/pwnwatch_app/status/2113446811151356228" } }, { "slug": "capcom-id-breach-oct-2026", "title": "Capcom ID breach exposes 11.7M account email addresses", "url": "https://pwn.watch/i/capcom-id-breach-oct-2026", "json": "https://pwn.watch/i/capcom-id-breach-oct-2026.json", "status": "live", "severity": "high", "patchStatus": "patched", "category": "breach", "product": "CAPCOM ID (Capcom online account service)", "tags": [ "capcom", "gaming", "data-breach" ], "cveIds": [], "affectedVersions": [ "CAPCOM ID accounts (11,774,247 records worldwide)" ], "fixedVersions": [ "Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available" ], "startedAt": "2026-10-19", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom.", "xPost": null }, { "slug": "updraftcentral-keys-wordpress-backdoor", "title": "TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored", "url": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor", "json": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json", "status": "closed", "severity": "high", "patchStatus": "partial", "category": "supply-chain", "product": "UpdraftPlus / UpdraftCentral (WordPress)", "tags": [ "php", "wordpress", "updraftplus", "supply-chain", "data-breach" ], "cveIds": [], "affectedVersions": [ "Sites with stolen UpdraftCentral connection keys" ], "fixedVersions": [], "startedAt": "2026-10-18", "closedAt": "2026-10-20", "updatedAt": "2026-10-20", "summary": "UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.", "xPost": null }, { "slug": "opencode-console-provider-key-breach", "title": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "url": "https://pwn.watch/i/opencode-console-provider-key-breach", "json": "https://pwn.watch/i/opencode-console-provider-key-breach.json", "status": "live", "severity": "high", "patchStatus": "partial", "category": "breach", "product": "OpenCode Console (hosted service by Anomaly)", "tags": [ "ai", "opencode", "data-breach" ], "cveIds": [], "affectedVersions": [ "OpenCode Console workspaces with saved OpenAI, Anthropic or Google provider keys (~1.4% of Console users; affected users were emailed)" ], "fixedVersions": [], "startedAt": "2026-10-17T00:30:00Z", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.", "xPost": null }, { "slug": "state-bank-of-india-dark-web-data-leak-oct-2026", "title": "State Bank of India confirms customer data exposed on the dark web", "url": "https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026", "json": "https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026.json", "status": "live", "severity": "medium", "patchStatus": "partial", "category": "breach", "product": "State Bank of India customer records", "tags": [ "sbi", "banking", "india", "data-breach" ], "cveIds": [], "affectedVersions": [ "3,897 SBI customer records with PII (preliminary, out of ~375,000 records found on the dark web)" ], "fixedVersions": [ "SBI activated incident response and containment and engaged a CERT-In-empanelled agency; source and full extent still under investigation" ], "startedAt": "2026-10-16", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "State Bank of India (SBI), India's largest bank, disclosed that customer data turned up on the dark web. In a preliminary analysis of about 375,000 records, it identified 3,897 customer records with personal data: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and loan/lead metadata. SBI says balances and funds are safe and core operations are unaffected; the source of the exposure is still under investigation. Affected customers have been notified by email and/or WhatsApp. Expect targeted phishing and fraud calls.", "xPost": null }, { "slug": "zeabur-october-2026-breach-shutdown", "title": "Zeabur breach exposes 3.2M env-var records; company to shut down", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown", "json": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown.json", "status": "live", "severity": "critical", "patchStatus": "partial", "category": "breach", "product": "Zeabur (PaaS)", "tags": [ "hosting", "zeabur", "data-breach" ], "cveIds": [], "affectedVersions": [ "Platform-wide (accounts with stored env vars)" ], "fixedVersions": [], "startedAt": "2026-10-14", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.", "xPost": null }, { "slug": "nikkei-cloud-dev-credentials-breach-oct-2026", "title": "Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud", "url": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026", "json": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026.json", "status": "live", "severity": "medium", "patchStatus": "patched", "category": "breach", "product": "Nikkei Inc. development cloud service (customer data of Nikkei and group services such as Nikkei BP)", "tags": [ "nikkei", "data-breach" ], "cveIds": [], "affectedVersions": [ "Personal information stored in a Nikkei cloud service used for system development (about 1.83 million items)", "Nikkei BP service users: about 800,000 items (about 50,000 with name, email, address, phone or date of birth)" ], "fixedVersions": [ "Nikkei disabled the stolen credentials used for the access; scope review ongoing" ], "startedAt": "2026-10-07", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "Japanese media group Nikkei Inc. (owner of the Financial Times) says attackers used stolen credentials, obtained by unknown means, to access a cloud service it uses for system development in the early hours to morning of October 7, 2026, and personal information stored there leaked. As of October 16, about 1.83 million items had leaked: about 150,000 contain a name, email address, postal address, phone number or date of birth (about 120,000 include an email address), and about 1.68 million contain only information that cannot identify a person. No credit card data. Nikkei disabled the credentials, reported to Japan's Personal Information Protection Commission on October 11 and says it found no misuse so far. On October 21 Nikkei BP said about 800,000 of the leaked items belong to users of its services. BleepingComputer counts this as Nikkei's third disclosed incident in about a month.", "xPost": { "id": "2113338849544012108", "postedAt": "2026-10-22T18:37:00.609Z", "url": "https://x.com/pwnwatch_app/status/2113338849544012108" } }, { "slug": "pingcap-tidb-cloud-breach", "title": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach", "json": "https://pwn.watch/i/pingcap-tidb-cloud-breach.json", "status": "live", "severity": "high", "patchStatus": "partial", "category": "breach", "product": "PingCAP TiDB Cloud (hosted database platform)", "tags": [ "hosting", "pingcap", "tidb", "data-breach" ], "cveIds": [], "affectedVersions": [ "TiDB Cloud customers (customer-specific impact still being determined)" ], "fixedVersions": [], "startedAt": "2026-09-09", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.", "xPost": null }, { "slug": "canvas-instructure-shinyhunters-may", "title": "Instructure Canvas Free-for-Teacher breach (ShinyHunters)", "url": "https://pwn.watch/i/canvas-instructure-shinyhunters-may", "json": "https://pwn.watch/i/canvas-instructure-shinyhunters-may.json", "status": "closed", "severity": "high", "patchStatus": "partial", "category": "breach", "product": "Instructure Canvas (Free-for-Teacher)", "tags": [ "instructure", "shinyhunters", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-05-01", "closedAt": "2026-05-31", "updatedAt": "2026-05-31", "summary": "In May 2026 Instructure confirmed a security incident involving Canvas Free-for-Teacher after ShinyHunters claimed theft of data tied to hundreds of millions of users. Exposed data included names, emails, student IDs and some private messages; Instructure said it had no evidence passwords or financial/government IDs were taken.", "xPost": null }, { "slug": "openai-employee-devices-tanstack-shai-hulud", "title": "OpenAI employee devices hit via TanStack Mini Shai-Hulud wave", "url": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud", "json": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json", "status": "closed", "severity": "high", "patchStatus": "patched", "category": "supply-chain", "product": "TanStack-related npm packages / OpenAI employee endpoints", "tags": [ "node", "npm", "openai", "tanstack", "shai-hulud", "supply-chain", "data-breach" ], "cveIds": [], "affectedVersions": [ "Compromised TanStack package versions in the May wave" ], "fixedVersions": [], "startedAt": "2026-05-01", "closedAt": "2026-05-31", "updatedAt": "2026-05-31", "summary": "In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.", "xPost": null }, { "slug": "lexisnexis-breach-react2shell-claim", "title": "LexisNexis breach (FulcrumSec claims React2Shell path)", "url": "https://pwn.watch/i/lexisnexis-breach-react2shell-claim", "json": "https://pwn.watch/i/lexisnexis-breach-react2shell-claim.json", "status": "closed", "severity": "high", "patchStatus": "patched", "category": "breach", "product": "LexisNexis Legal & Professional (legacy systems / React frontend claim)", "tags": [ "react", "aws", "lexisnexis", "data-breach" ], "cveIds": [ "CVE-2025-55182" ], "affectedVersions": [ "n/a (customer breach); alleged unpatched React Server Components / Next.js stack" ], "fixedVersions": [], "startedAt": "2026-02-24", "closedAt": "2026-03-31", "updatedAt": "2026-03-31", "summary": "In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.", "xPost": null }, { "slug": "eu-dutch-ivanti-epmm-zero-day-breach", "title": "European Commission & Dutch authorities hit via Ivanti EPMM zero-days", "url": "https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach", "json": "https://pwn.watch/i/eu-dutch-ivanti-epmm-zero-day-breach.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "breach", "product": "Ivanti EPMM deployments (EU institutions)", "tags": [ "ivanti", "zero-day", "data-breach" ], "cveIds": [ "CVE-2026-1340" ], "affectedVersions": [ "Vulnerable EPMM versions prior to Jan/Feb 2026 patches" ], "fixedVersions": [ "Ivanti patched EPMM releases" ], "startedAt": "2026-02-01", "closedAt": "2026-02-28", "updatedAt": "2026-02-28", "summary": "February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.", "xPost": null }, { "slug": "singapore-unc3886-telecom-espionage", "title": "UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)", "url": "https://pwn.watch/i/singapore-unc3886-telecom-espionage", "json": "https://pwn.watch/i/singapore-unc3886-telecom-espionage.json", "status": "closed", "severity": "unknown", "patchStatus": "partial", "category": "breach", "product": "Singapore major telecom providers", "tags": [ "zero-day", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-02-01", "closedAt": "2026-02-28", "updatedAt": "2026-02-28", "summary": "In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.", "xPost": null }, { "slug": "crunchbase-shinyhunters-jan", "title": "ShinyHunters leak Crunchbase data (~2M records)", "url": "https://pwn.watch/i/crunchbase-shinyhunters-jan", "json": "https://pwn.watch/i/crunchbase-shinyhunters-jan.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Crunchbase", "tags": [ "crunchbase", "shinyhunters", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-01-01", "closedAt": "2026-01-31", "updatedAt": "2026-01-31", "summary": "In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.", "xPost": null }, { "slug": "mixpanel-smishing-breach-openai-api-users-2025", "title": "Mixpanel smishing breach exposes OpenAI API users' names and emails", "url": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025", "json": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025.json", "status": "closed", "severity": "medium", "patchStatus": "no-fix-needed", "category": "breach", "product": "Mixpanel (analytics vendor); OpenAI API platform users", "tags": [ "ai", "mixpanel", "openai", "smishing", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-11-08", "closedAt": "2025-11-27", "updatedAt": "2025-11-27", "summary": "Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.", "xPost": null }, { "slug": "discord-support-vendor-breach-id-photos-2025", "title": "Discord support vendor breach exposes ~70,000 government ID photos", "url": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025", "json": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Discord customer support (third-party vendor / ticketing)", "tags": [ "discord", "zendesk", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-10-03", "closedAt": "2025-10-09", "updatedAt": "2025-10-09", "summary": "An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.", "xPost": null }, { "slug": "red-hat-consulting-gitlab-breach-october-2025", "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025", "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Red Hat Consulting self-managed GitLab", "tags": [ "devtools", "red-hat", "gitlab", "crimson-collective", "shinyhunters", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-10-01", "closedAt": "2025-10-10", "updatedAt": "2025-10-10", "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.", "xPost": null }, { "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882", "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882", "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "patch", "product": "Oracle E-Business Suite", "tags": [ "oracle", "cl0p", "zero-day", "rce", "data-breach", "extortion", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2025-61882" ], "affectedVersions": [ "Oracle E-Business Suite 12.2.3 to 12.2.14" ], "fixedVersions": [ "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)" ], "startedAt": "2025-09-29", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.", "xPost": null }, { "slug": "sonicwall-mysonicwall-cloud-backup-breach-2025", "title": "SonicWall: state actor stole firewall config backups of every cloud-backup customer", "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025", "json": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "SonicWall MySonicWall cloud backup", "tags": [ "sonicwall", "nation-state", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-09-17", "closedAt": "2025-11-05", "updatedAt": "2025-11-05", "summary": "SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.", "xPost": null }, { "slug": "f5-nation-state-breach-big-ip-source-code-2025", "title": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen", "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025", "json": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "breach", "product": "F5 BIG-IP (vendor breach)", "tags": [ "f5", "nation-state", "china", "brickstorm", "data-breach" ], "cveIds": [], "affectedVersions": [ "BIG-IP, F5OS, BIG-IP Next and others (see F5 K000154696 and Oct 2025 Quarterly Security Notification)" ], "fixedVersions": [ "F5 October 2025 Quarterly Security Notification releases" ], "startedAt": "2025-08-09", "closedAt": "2025-10-15", "updatedAt": "2025-10-15", "summary": "F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.", "xPost": null }, { "slug": "salesloft-drift-oauth-salesforce-data-theft-2025", "title": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)", "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025", "json": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Salesloft Drift integration (Salesforce, Google Workspace)", "tags": [ "salesloft", "drift", "salesforce", "oauth", "cloudflare", "data-breach", "supply-chain" ], "cveIds": [], "affectedVersions": [ "Organizations with Drift connected to Salesforce or other apps" ], "fixedVersions": [ "Drift tokens revoked; rotate any secrets stored in Salesforce" ], "startedAt": "2025-08-08", "closedAt": "2025-09-07", "updatedAt": "2025-09-07", "summary": "Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.", "xPost": null }, { "slug": "qantas-contact-centre-breach-july-2025", "title": "Qantas: 5.7M customers' data stolen from a contact-centre platform", "url": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025", "json": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Qantas contact-centre (third-party platform)", "tags": [ "qantas", "aviation", "scattered-spider", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-06-30", "closedAt": "2025-07-09", "updatedAt": "2025-07-09", "summary": "A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.", "xPost": null }, { "slug": "salesforce-vishing-data-theft-unc6040-2025", "title": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025", "json": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Salesforce customer instances (social engineering, not a Salesforce vulnerability)", "tags": [ "salesforce", "google", "shinyhunters", "vishing", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-06-04", "closedAt": "2025-08-31", "updatedAt": "2025-08-31", "summary": "UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).", "xPost": null }, { "slug": "coinbase-bribed-support-agents-breach-may-2025", "title": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused", "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025", "json": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Coinbase customer support systems", "tags": [ "coinbase", "crypto", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-05-11", "closedAt": "2025-05-30", "updatedAt": "2025-05-30", "summary": "Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.", "xPost": null }, { "slug": "oracle-cloud-classic-login-breach-march-2025", "title": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale", "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025", "json": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Oracle Cloud Classic (Gen 1) login/IDM servers", "tags": [ "hosting", "oracle", "oracle-cloud", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-03-21", "closedAt": "2025-04-08", "updatedAt": "2025-04-08", "summary": "A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.", "xPost": null }, { "slug": "fearless-wallet-extension-key-leak", "title": "Fearless Wallet browser extension leaked private keys for ~20 months", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak", "json": "https://pwn.watch/i/fearless-wallet-extension-key-leak.json", "status": "live", "severity": "critical", "patchStatus": "unpatched", "category": "patch", "product": "Fearless Wallet browser extension (Chrome; Firefox build delisted)", "tags": [ "chrome", "data-breach" ], "cveIds": [], "affectedVersions": [ "3.0.1", "3.0.3", "3.0.4", "3.0.5" ], "fixedVersions": [], "startedAt": "2025-02-19", "closedAt": null, "updatedAt": "2026-10-23T18:41:32Z", "summary": "The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.", "xPost": null }, { "slug": "deepseek-exposed-clickhouse-database-january-2025", "title": "DeepSeek leaves ClickHouse database open: chat logs and API keys exposed", "url": "https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025", "json": "https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025.json", "status": "closed", "severity": "high", "patchStatus": "patched", "category": "breach", "product": "DeepSeek backend (ClickHouse)", "tags": [ "ai", "deepseek", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [ "Database secured by DeepSeek" ], "startedAt": "2025-01-29", "closedAt": "2025-01-29", "updatedAt": "2025-01-29", "summary": "Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.", "xPost": null }, { "slug": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "title": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "json": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "patch", "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)", "tags": [ "beyondtrust", "remote-support", "espionage", "data-breach", "cisa-kev", "rce", "nation-state" ], "cveIds": [ "CVE-2024-12356" ], "affectedVersions": [ "Remote Support and Privileged Remote Access 24.3.1 and earlier (BeyondTrust)" ], "fixedVersions": [ "Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16" ], "startedAt": "2024-12-05", "closedAt": "2024-12-19", "updatedAt": "2024-12-30", "summary": "Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.", "xPost": null }, { "slug": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "title": "Cleo file transfer zero-days exploited by Clop for data theft", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "json": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "patch", "product": "Cleo Multiple Products", "tags": [ "cleo", "zero-day", "cl0p", "file-transfer", "data-breach", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-50623", "CVE-2024-55956" ], "affectedVersions": [ "Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 (Cleo)" ], "fixedVersions": [ "5.8.0.24 (Cleo, for CVE-2024-55956)", "5.8.0.21 (Cleo, for CVE-2024-50623)" ], "startedAt": "2024-12-03", "closedAt": "2024-12-17", "updatedAt": "2024-12-17", "summary": "Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "internet-archive-breach-31-million", "title": "Internet Archive hacked: 31 million user records stolen", "url": "https://pwn.watch/i/internet-archive-breach-31-million", "json": "https://pwn.watch/i/internet-archive-breach-31-million.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Internet Archive (archive.org)", "tags": [ "internet-archive", "data-breach", "hibp" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-10-09", "closedAt": "2024-10-20", "updatedAt": "2024-10-20", "summary": "Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.", "xPost": null }, { "slug": "national-public-data-breach-ssn-leak", "title": "National Public Data breach: 2.7 billion records with SSNs leaked", "url": "https://pwn.watch/i/national-public-data-breach-ssn-leak", "json": "https://pwn.watch/i/national-public-data-breach-ssn-leak.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "National Public Data", "tags": [ "national-public-data", "data-breach", "data-broker" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-08-06", "closedAt": "2024-08-11", "updatedAt": "2024-08-11", "summary": "Data stolen from background-check broker National Public Data, nearly 2.7 billion plaintext records with names, mailing addresses and Social Security numbers of people in the US, was leaked for free on a hacking forum. It had first been offered for sale in April 2024 by an actor called USDoD.", "xPost": null }, { "slug": "hugging-face-spaces-secrets-leak", "title": "Hugging Face Spaces secrets accessed without authorization", "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak", "json": "https://pwn.watch/i/hugging-face-spaces-secrets-leak.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Hugging Face Spaces", "tags": [ "ai", "hosting", "hugging-face", "secrets", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-05-31", "closedAt": "2024-05-31", "updatedAt": "2024-05-31", "summary": "Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.", "xPost": null }, { "slug": "dropbox-sign-production-breach", "title": "Dropbox Sign (HelloSign) production environment breached", "url": "https://pwn.watch/i/dropbox-sign-production-breach", "json": "https://pwn.watch/i/dropbox-sign-production-breach.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Dropbox Sign", "tags": [ "dropbox", "api-keys", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-04-24", "closedAt": "2024-06-21", "updatedAt": "2024-06-21", "summary": "A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.", "xPost": null }, { "slug": "snowflake-customer-data-theft-unc5537", "title": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537", "json": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "category": "breach", "product": "Snowflake customer instances", "tags": [ "snowflake", "ticketmaster", "att", "infostealer", "data-breach", "extortion", "mfa" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-04-14", "closedAt": "2024-07-12", "updatedAt": "2024-07-12", "summary": "A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.", "xPost": null }, { "slug": "change-healthcare-ransomware-attack", "title": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack", "json": "https://pwn.watch/i/change-healthcare-ransomware-attack.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "category": "breach", "product": "Change Healthcare (UnitedHealth Group / Optum)", "tags": [ "change-healthcare", "unitedhealth", "healthcare", "ransomware", "alphv", "citrix", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-02-21", "closedAt": "2024-10-22", "updatedAt": "2024-10-22", "summary": "The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).", "xPost": null }, { "slug": "microsoft-midnight-blizzard-corporate-email-breach", "title": "Midnight Blizzard breaches Microsoft corporate email", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach", "json": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Microsoft corporate email (Microsoft 365)", "tags": [ "microsoft", "microsoft-365", "midnight-blizzard", "espionage", "password-spraying", "data-breach", "nation-state" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-01-12", "closedAt": "2024-04-02", "updatedAt": "2024-04-02", "summary": "Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.", "xPost": null }, { "slug": "xfinity-citrix-bleed-data-breach-2023", "title": "Xfinity breach via Citrix Bleed: 35.9M customers", "url": "https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023", "json": "https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023.json", "status": "closed", "severity": "high", "patchStatus": "patched", "category": "breach", "product": "Xfinity (Comcast)", "tags": [ "xfinity", "comcast", "citrix", "citrix-bleed", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-10-16", "closedAt": "2023-12-18", "updatedAt": "2023-12-18", "summary": "Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.", "xPost": null }, { "slug": "23andme-credential-stuffing-data-breach-2023", "title": "23andMe: credential stuffing exposes 6.9M users' ancestry data", "url": "https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023", "json": "https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "23andMe", "tags": [ "23andme", "credential-stuffing", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-10-06", "closedAt": "2023-12-04", "updatedAt": "2023-12-04", "summary": "Attackers used reused passwords to log into about 14,000 23andMe accounts, then scraped the DNA Relatives profiles those accounts could see. Data on about 6.9 million people was exposed and sold on hacking forums.", "xPost": null }, { "slug": "okta-support-system-breach-2023", "title": "Okta support system breach: HAR files with session tokens stolen", "url": "https://pwn.watch/i/okta-support-system-breach-2023", "json": "https://pwn.watch/i/okta-support-system-breach-2023.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "Okta Help Center (customer support system)", "tags": [ "okta", "beyondtrust", "cloudflare", "1password", "identity", "session-hijacking", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-09-28", "closedAt": "2023-11-29", "updatedAt": "2023-11-29", "summary": "An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.", "xPost": null }, { "slug": "mgm-resorts-caesars-scattered-spider-2023", "title": "MGM Resorts and Caesars hit by Scattered Spider", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023", "json": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "MGM Resorts International; Caesars Entertainment", "tags": [ "mgm-resorts", "caesars", "scattered-spider", "alphv", "ransomware", "social-engineering", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-09-07", "closedAt": "2023-10-05", "updatedAt": "2023-10-05", "summary": "Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.", "xPost": null }, { "slug": "microsoft-ai-research-sas-token-38tb-exposure-2023", "title": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023", "json": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json", "status": "closed", "severity": "high", "patchStatus": "patched", "category": "breach", "product": "Microsoft Azure Storage (SAS token in a GitHub repo)", "tags": [ "ai", "microsoft", "azure", "github", "secrets", "misconfiguration", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-06-22", "closedAt": "2023-09-18", "updatedAt": "2023-09-18", "summary": "A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.", "xPost": null }, { "slug": "moveit-transfer-cl0p-mass-exploitation-2023", "title": "MOVEit Transfer zero-day: Cl0p mass data theft", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023", "json": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "patch", "product": "Progress MOVEit Transfer", "tags": [ "progress", "moveit", "cl0p", "zero-day", "sql-injection", "data-breach", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-34362", "CVE-2023-35036", "CVE-2023-35708" ], "affectedVersions": [ "CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)", "CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)", "CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)" ], "fixedVersions": [ "2021.0.8 (13.0.8)", "2021.1.6 (13.1.6)", "2022.0.6 (14.0.6)", "2022.1.7 (14.1.7)", "2023.0.3 (15.0.3)", "Older branches: see vendor advisory" ], "startedAt": "2023-05-27", "closedAt": "2023-06-16", "updatedAt": "2023-06-16", "summary": "Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.", "xPost": null }, { "slug": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "title": "Storm-0558: stolen Microsoft signing key used to read government email", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023", "json": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "category": "breach", "product": "Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)", "tags": [ "microsoft", "microsoft-365", "exchange-online", "azure", "china", "token-forgery", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-05-15", "closedAt": "2023-09-06", "updatedAt": "2023-09-06", "summary": "China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.", "xPost": null }, { "slug": "t-mobile-api-breach-37-million-2023", "title": "T-Mobile: API abused to pull data on 37M accounts", "url": "https://pwn.watch/i/t-mobile-api-breach-37-million-2023", "json": "https://pwn.watch/i/t-mobile-api-breach-37-million-2023.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "category": "breach", "product": "T-Mobile US", "tags": [ "t-mobile", "api", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-01-05", "closedAt": "2023-01-19", "updatedAt": "2023-01-19", "summary": "T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.", "xPost": null }, { "slug": "circleci-security-incident-rotate-all-secrets-2023", "title": "CircleCI breach: rotate every secret", "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023", "json": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "category": "breach", "product": "CircleCI", "tags": [ "devtools", "circleci", "ci-cd", "secrets", "infostealer", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-01-04", "closedAt": "2023-01-13", "updatedAt": "2023-01-13", "summary": "Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.", "xPost": null } ], "posts": [ { "authorName": "FOX Business", "handle": "FoxBusiness", "avatarUrl": "https://pbs.twimg.com/profile_images/1988464557983940608/sm7TY2SM_bigger.jpg", "text": "Quest Diagnostics confirms patient information accessed in cyberattack, systems temporarily shut down https://t.co/exvlCOF4u1", "date": "2026-10-22T23:00:23.000Z", "url": "https://x.com/FoxBusiness/status/2113405133467910216", "media": [], "incident": "quest-diagnostics-quanum-lsm-breach" }, { "authorName": "Reuters Legal", "handle": "ReutersLegal", "avatarUrl": "https://pbs.twimg.com/profile_images/1880342703323389952/JfE-9dxP_bigger.jpg", "text": "Quest Diagnostics on Thursday said it learned of unauthorized access to its Quanum LSM system, which some clients use to place test orders, receive and look up results. https://t.co/tvqxrMZHmo", "date": "2026-10-22T12:00:38.000Z", "url": "https://x.com/ReutersLegal/status/2113239100698354157", "media": [], "incident": "quest-diagnostics-quanum-lsm-breach" }, { "authorName": "VGC", "handle": "VGC_News", "avatarUrl": "https://pbs.twimg.com/profile_images/1231535389606895616/M-XleYjI_bigger.png", "text": "Capcom says a data breach resulted in the details of more than 11 million Capcom ID accounts being accessed. Credit card details are unaffected, it says.\n\nhttps://t.co/EPFUQ5uty6 https://t.co/ECTHLtmaPt", "date": "2026-10-22T09:46:57.000Z", "url": "https://x.com/VGC_News/status/2113205457397637606", "media": [], "incident": "capcom-id-breach-oct-2026" }, { "authorName": "Pierluigi Paganini - Security Affairs", "handle": "securityaffairs", "avatarUrl": "https://pbs.twimg.com/profile_images/1998085617335386112/cn6KDctR_bigger.jpg", "text": "#Nikkei data breach affected over 1.8 million records\nhttps://t.co/rmToMCQ0Um\n#securityaffairs #hacking", "date": "2026-10-20T18:00:52.000Z", "url": "https://x.com/securityaffairs/status/2112604980301402312", "media": [], "incident": "nikkei-cloud-dev-credentials-breach-oct-2026" }, { "authorName": "dax", "handle": "thdxr", "avatarUrl": "https://pbs.twimg.com/profile_images/1602333093485891584/mmVqjFNI_bigger.jpg", "text": "they've been non stop trying to attack our systems for the past 48 hours\n\na side effect is everything is getting hardened but damn we basically need agents going 24/7\n\nbecause that's what they have", "date": "2026-10-18T12:04:27.000Z", "url": "https://x.com/thdxr/status/2111790511409258796", "media": [], "incident": "opencode-console-provider-key-breach" }, { "authorName": "dax", "handle": "thdxr", "avatarUrl": "https://pbs.twimg.com/profile_images/1602333093485891584/mmVqjFNI_bigger.jpg", "text": "@lydiahallie note this is the OpenCode Console, not OpenCode itself, those keys never come to us", "date": "2026-10-17T21:38:37.000Z", "url": "https://x.com/thdxr/status/2111572618340188393", "media": [], "incident": "opencode-console-provider-key-breach" }, { "authorName": "OpenCode", "handle": "opencode", "avatarUrl": "https://pbs.twimg.com/profile_images/1973794620233433088/nBn75BTm_bigger.png", "text": "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users\n\nWe have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers", "date": "2026-10-17T18:08:06.000Z", "url": "https://x.com/opencode/status/2111519637049319818", "media": [], "incident": "opencode-console-provider-key-breach" } ], "changes": [ { "incident": "quest-diagnostics-quanum-lsm-breach", "incidentTitle": "Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-23", "title": "TechCrunch: Quest's notice says some patients' protected health information was taken, but the company still hasn't said how many patients or clients are affected, when the breach began, or whether attackers made demands. Quanum is used by about half a million clinicians across North America.", "body": null, "sourceUrl": "https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-during-breach/", "url": "https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach" }, { "incident": "state-bank-of-india-dark-web-data-leak-oct-2026", "incidentTitle": "State Bank of India confirms customer data exposed on the dark web", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-23", "title": "SBI says it has individually informed all affected customers by email and/or WhatsApp and reiterates that account balances and funds are safe.", "body": null, "sourceUrl": "https://www.thehindu.com/business/Industry/data-breach-sbi-says-it-individually-informed-all-affected-customers/article71615008.ece", "url": "https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026" }, { "incident": "nikkei-cloud-dev-credentials-breach-oct-2026", "incidentTitle": "Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "patched", "date": "2026-10-23", "title": "Nikkei updates its breach notice: it modified its inquiry/contact form in response to a vulnerability identified in the PHP programming language.", "body": null, "sourceUrl": "https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html", "url": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026" }, { "incident": "quest-diagnostics-quanum-lsm-breach", "incidentTitle": "Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "8-K filing: Quest believes an unauthorized party accessed certain patient records; federal law enforcement notified and outside experts engaged; operations not materially disrupted.", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm", "url": "https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach" }, { "incident": "quest-diagnostics-quanum-lsm-breach", "incidentTitle": "Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Quest FAQ confirms PHI/PII was involved, pauses Essential Insights and LabHQ as a precaution, says the incident is not PHP-related, and expects Quanum LSM back as soon as Oct 23. Clients can use paper requisitions or Quanum eLabs meanwhile.", "body": null, "sourceUrl": "https://www.questdiagnostics.com/links/quanum-notice", "url": "https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach" }, { "incident": "capcom-id-breach-oct-2026", "incidentTitle": "Capcom ID breach exposes 11.7M account email addresses", "category": "breach", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified.", "body": null, "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html", "url": "https://pwn.watch/i/capcom-id-breach-oct-2026" }, { "incident": "quest-diagnostics-quanum-lsm-breach", "incidentTitle": "Quest Diagnostics breach: patient records accessed via Quanum Lab Services Manager", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Quest learns of unauthorized access to Quanum LSM, starts incident response and pauses access to the system.", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm", "url": "https://pwn.watch/i/quest-diagnostics-quanum-lsm-breach" }, { "incident": "capcom-id-breach-oct-2026", "incidentTitle": "Capcom ID breach exposes 11.7M account email addresses", "category": "breach", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission.", "body": null, "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html", "url": "https://pwn.watch/i/capcom-id-breach-oct-2026" }, { "incident": "state-bank-of-india-dark-web-data-leak-oct-2026", "incidentTitle": "State Bank of India confirms customer data exposed on the dark web", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "SBI discloses the incident to stock exchanges: 3,897 customer records with PII identified among about 375,000 records, containment activated and an independent CERT-In-empanelled agency engaged.", "body": null, "sourceUrl": "https://nsearchives.nseindia.com/corporate/SBIN_21102026084938_BSE_NSE_21102026.pdf", "url": "https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026" }, { "incident": "nikkei-cloud-dev-credentials-breach-oct-2026", "incidentTitle": "Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Nikkei BP says about 800,000 of the leaked items belong to users of its services (about 50,000 with name, email, address, phone or date of birth; about 750,000 identifiers only).", "body": null, "sourceUrl": "https://www.nikkeibp.co.jp/atcl/newsrelease/corp/20261021_2/", "url": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "PingCAP Japan adds support-ticket information to the list of exposed data.", "body": null, "sourceUrl": "https://pingcap.co.jp/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "fearless-wallet-extension-key-leak", "incidentTitle": "Fearless Wallet browser extension leaked private keys for ~20 months", "category": "patch", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-21", "title": "Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost.", "body": null, "sourceUrl": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak" }, { "incident": "capcom-id-breach-oct-2026", "incidentTitle": "Capcom ID breach exposes 11.7M account email addresses", "category": "breach", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-20", "title": "Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed.", "body": null, "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html", "url": "https://pwn.watch/i/capcom-id-breach-oct-2026" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week.", "body": null, "sourceUrl": "https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there.", "body": null, "sourceUrl": "https://cryptobriefing.com/bitget-no-user-data-tidb-cloud-breach/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "capcom-id-breach-oct-2026", "incidentTitle": "Capcom ID breach exposes 11.7M account email addresses", "category": "breach", "severity": "high", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "Capcom detects suspicious activity on CAPCOM ID, starts blocking the access and confirms unauthorized access the same day.", "body": null, "sourceUrl": "https://www.capcom.co.jp/ir/english/news/html/e261022.html", "url": "https://pwn.watch/i/capcom-id-breach-oct-2026" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records.", "body": null, "sourceUrl": "https://pingcap.co.jp/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-18", "title": "Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111790511409258796", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users.", "body": null, "sourceUrl": "https://x.com/opencode/status/2111519637049319818", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111572618340188393", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17T00:30Z", "title": "Earliest possible exposure of saved provider keys (per OpenCode's email to affected users).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "state-bank-of-india-dark-web-data-leak-oct-2026", "incidentTitle": "State Bank of India confirms customer data exposed on the dark web", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-16", "title": "SBI receives alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web.", "body": null, "sourceUrl": "https://nsearchives.nseindia.com/corporate/SBIN_21102026084938_BSE_NSE_21102026.pdf", "url": "https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026" }, { "incident": "nikkei-cloud-dev-credentials-breach-oct-2026", "incidentTitle": "Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "patched", "date": "2026-10-16", "title": "Nikkei discloses the breach: about 1.83 million items leaked, about 150,000 with identifying details, no credit card data, no misuse or system outage found. It will contact affected people individually.", "body": null, "sourceUrl": "https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html", "url": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026" }, { "incident": "zeabur-october-2026-breach-shutdown", "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down", "category": "breach", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-15", "title": "Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05.", "body": null, "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown" }, { "incident": "zeabur-october-2026-breach-shutdown", "incidentTitle": "Zeabur breach exposes 3.2M env-var records; company to shut down", "category": "breach", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers.", "body": null, "sourceUrl": "https://zeabur.com/blogs/october-2026-security-incident", "url": "https://pwn.watch/i/zeabur-october-2026-breach-shutdown" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-14", "title": "All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "nikkei-cloud-dev-credentials-breach-oct-2026", "incidentTitle": "Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "patched", "date": "2026-10-11", "title": "Nikkei reports the incident to Japan's Personal Information Protection Commission.", "body": null, "sourceUrl": "https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html", "url": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026" }, { "incident": "fearless-wallet-extension-key-leak", "incidentTitle": "Fearless Wallet browser extension leaked private keys for ~20 months", "category": "patch", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2026-10-10", "title": "Last known period the exfiltration code was active (it could be re-enabled).", "body": null, "sourceUrl": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak" }, { "incident": "nikkei-cloud-dev-credentials-breach-oct-2026", "incidentTitle": "Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud", "category": "breach", "severity": "medium", "status": "live", "patchStatus": "patched", "date": "2026-10-07", "title": "Attackers use stolen credentials to access a Nikkei cloud service used for system development, from the early hours to the morning, and personal information stored there leaks.", "body": null, "sourceUrl": "https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html", "url": "https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-07", "title": "PingCAP detects the intrusion and starts disabling credentials.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "pingcap-tidb-cloud-breach", "incidentTitle": "PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken", "category": "breach", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-09-09", "title": "Unauthorized access with stolen service-account credentials begins.", "body": null, "sourceUrl": "https://www.pingcap.com/trust-hub/security/security-update-october-2026/", "url": "https://pwn.watch/i/pingcap-tidb-cloud-breach" }, { "incident": "mixpanel-smishing-breach-openai-api-users-2025", "incidentTitle": "Mixpanel smishing breach exposes OpenAI API users' names and emails", "category": "breach", "severity": "medium", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-11-26", "title": "OpenAI discloses impact on API users and drops Mixpanel", "body": null, "sourceUrl": "https://openai.com/index/mixpanel-incident/", "url": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025" }, { "incident": "mixpanel-smishing-breach-openai-api-users-2025", "incidentTitle": "Mixpanel smishing breach exposes OpenAI API users' names and emails", "category": "breach", "severity": "medium", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-11-08", "title": "Mixpanel detects the smishing campaign and unauthorized export", "body": null, "sourceUrl": "https://openai.com/index/mixpanel-incident/", "url": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025" }, { "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025", "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-11", "title": "SonicWall says the investigation is complete and attributes it to a state-sponsored actor", "body": null, "sourceUrl": "https://www.sonicwall.com/blog/cloud-backup-security-incident-investigation-complete-and-strengthened-cyber-resilience", "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "f5-nation-state-breach-big-ip-source-code-2025", "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-15", "title": "F5 discloses the breach (SEC 8-K) and ships patches", "body": null, "sourceUrl": "https://my.f5.com/manage/s/article/K000154696", "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025" }, { "incident": "f5-nation-state-breach-big-ip-source-code-2025", "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-15", "title": "CISA issues Emergency Directive 26-01 for F5 devices", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices", "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-10", "title": "FINRA alert to member firms", "body": null, "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "discord-support-vendor-breach-id-photos-2025", "incidentTitle": "Discord support vendor breach exposes ~70,000 government ID photos", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-09", "title": "Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed", "body": null, "sourceUrl": "https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service", "url": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025" }, { "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025", "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-08", "title": "SonicWall and Mandiant confirm all cloud-backup customers' files were accessed", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/", "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA adds CVE-2025-61882 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-04", "title": "Oracle publishes a Security Alert for CVE-2025-61882", "body": null, "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "discord-support-vendor-breach-id-photos-2025", "incidentTitle": "Discord support vendor breach exposes ~70,000 government ID photos", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-03", "title": "Discord discloses that a third-party customer service provider was compromised", "body": null, "sourceUrl": "https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service", "url": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-02", "title": "Red Hat confirms the incident", "body": null, "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-01", "title": "Crimson Collective claims the Red Hat GitLab theft", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882", "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-09-29", "title": "Cl0p-branded extortion emails start arriving at executives", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation", "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882" }, { "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025", "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-17", "title": "SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers)", "body": null, "sourceUrl": "https://www.sonicwall.com/support/notices/mysonicwall-cloud-backup-file-incident/kA1VN0000000RoD0AU", "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025" }, { "incident": "salesloft-drift-oauth-salesforce-data-theft-2025", "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-09-02", "title": "Cloudflare details the impact on its Salesforce case data", "body": null, "sourceUrl": "https://blog.cloudflare.com/response-to-salesloft-drift-incident/", "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025" }, { "incident": "salesloft-drift-oauth-salesforce-data-theft-2025", "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-08-26", "title": "Google Threat Intelligence publishes UNC6395 findings", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift", "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025" }, { "incident": "salesloft-drift-oauth-salesforce-data-theft-2025", "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-08-20", "title": "Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift", "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025" }, { "incident": "f5-nation-state-breach-big-ip-source-code-2025", "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-09", "title": "F5 learns of the intrusion", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1048695/000104869525000149/ffiv-20251015.htm", "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025" }, { "incident": "salesloft-drift-oauth-salesforce-data-theft-2025", "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-08-08", "title": "Data theft from Salesforce instances begins (through Aug 18)", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift", "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025" }, { "incident": "salesforce-vishing-data-theft-unc6040-2025", "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-08", "title": "Google confirms the breach exposed prospective Google Ads customers' contact info", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025" }, { "incident": "qantas-contact-centre-breach-july-2025", "incidentTitle": "Qantas: 5.7M customers' data stolen from a contact-centre platform", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-07-09", "title": "Qantas update: 5.7M unique customers affected", "body": null, "sourceUrl": "https://www.qantasnewsroom.com.au/media-releases/update-on-qantas-cyber-incident-wednesday-9-july-2025/", "url": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025" }, { "incident": "qantas-contact-centre-breach-july-2025", "incidentTitle": "Qantas: 5.7M customers' data stolen from a contact-centre platform", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-07-02", "title": "Qantas discloses the cyber incident (initially 6M records)", "body": null, "sourceUrl": "https://www.qantasnewsroom.com.au/media-releases/qantas-cyber-incident/", "url": "https://pwn.watch/i/qantas-contact-centre-breach-july-2025" }, { "incident": "salesforce-vishing-data-theft-unc6040-2025", "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-06-04", "title": "Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025" }, { "incident": "salesforce-vishing-data-theft-unc6040-2025", "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-06", "title": "Google's corporate Salesforce instance breached by UNC6040", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025" }, { "incident": "coinbase-bribed-support-agents-breach-may-2025", "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-05-15", "title": "Coinbase discloses the breach in an SEC filing and refuses the $20M ransom", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm", "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025" }, { "incident": "coinbase-bribed-support-agents-breach-may-2025", "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-05-11", "title": "Coinbase receives the extortion demand and discovers the breach", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/", "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025" }, { "incident": "coinbase-bribed-support-agents-breach-may-2025", "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-05", "title": "Breach notice puts affected customers at 69,461", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/", "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025" }, { "incident": "oracle-cloud-classic-login-breach-march-2025", "incidentTitle": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-04-08", "title": "Reports that Oracle privately confirmed the breach to customers", "body": null, "sourceUrl": "https://www.theregister.com/off-prem/2025/04/08/oracle-tells-customers-its-public-cloud-was-compromised/431082", "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025" }, { "incident": "oracle-cloud-classic-login-breach-march-2025", "incidentTitle": "Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-03-21", "title": "rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/", "url": "https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025" }, { "incident": "fearless-wallet-extension-key-leak", "incidentTitle": "Fearless Wallet browser extension leaked private keys for ~20 months", "category": "patch", "severity": "critical", "status": "live", "patchStatus": "unpatched", "date": "2025-02-19", "title": "Malicious code merged into the extension's public source as part of a 'TON ecosystem' PR.", "body": null, "sourceUrl": "https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058", "url": "https://pwn.watch/i/fearless-wallet-extension-key-leak" }, { "incident": "deepseek-exposed-clickhouse-database-january-2025", "incidentTitle": "DeepSeek leaves ClickHouse database open: chat logs and API keys exposed", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-29", "title": "Wiz finds the exposed database and reports it; DeepSeek secures it within an hour", "body": null, "sourceUrl": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak", "url": "https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-30", "title": "Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT", "body": null, "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "coinbase-bribed-support-agents-breach-may-2025", "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-12-26", "title": "Unauthorized access begins (per breach notification)", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/", "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-19", "title": "CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-17", "title": "CVE-2024-12356 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-17", "title": "CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "BeyondTrust advisory BT24-10; cloud instances patched", "body": null, "sourceUrl": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "Clop claims responsibility for the Cleo data-theft attacks", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-14", "title": "Cleo advisory: patch 5.8.0.24 for CVE-2024-55956", "body": null, "sourceUrl": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-13", "title": "CVE-2024-55956 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-13", "title": "CISA added CVE-2024-50623 to the KEV catalog (federal deadline 2025-01-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-09", "title": "Huntress warns that fully patched 5.8.0.21 systems are still exploitable", "body": null, "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-08", "title": "BeyondTrust notifies the US Treasury", "body": null, "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356", "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-05", "title": "BeyondTrust identifies a compromised Remote Support SaaS infrastructure API key", "body": null, "sourceUrl": "https://www.beyondtrust.com/remote-support-saas-service-security-investigation", "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-12-03", "title": "Earliest exploitation Huntress observed against Cleo servers", "body": null, "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956", "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-10-27", "title": "CVE-2024-50623 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623", "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-10-22", "title": "Change Healthcare tells HHS OCR it has sent about 100 million individual notices", "body": null, "sourceUrl": "https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "internet-archive-breach-31-million", "incidentTitle": "Internet Archive hacked: 31 million user records stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-10-09", "title": "archive.org shows a hacker's JavaScript alert; breach of 31M records confirmed", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/", "url": "https://pwn.watch/i/internet-archive-breach-31-million" }, { "incident": "internet-archive-breach-31-million", "incidentTitle": "Internet Archive hacked: 31 million user records stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-09-28", "title": "Most recent timestamp in the stolen user database", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/", "url": "https://pwn.watch/i/internet-archive-breach-31-million" }, { "incident": "national-public-data-breach-ssn-leak", "incidentTitle": "National Public Data breach: 2.7 billion records with SSNs leaked", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-08-11", "title": "BleepingComputer reports the 2.7 billion record leak", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/hackers-leak-27-billion-data-records-with-social-security-numbers/", "url": "https://pwn.watch/i/national-public-data-breach-ssn-leak" }, { "incident": "national-public-data-breach-ssn-leak", "incidentTitle": "National Public Data breach: 2.7 billion records with SSNs leaked", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-08-06", "title": "Actor 'Fenice' leaks the most complete version of the data for free on Breached", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/hackers-leak-27-billion-data-records-with-social-security-numbers/", "url": "https://pwn.watch/i/national-public-data-breach-ssn-leak" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-07-12", "title": "AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace", "body": null, "sourceUrl": "https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "dropbox-sign-production-breach", "incidentTitle": "Dropbox Sign (HelloSign) production environment breached", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-06-21", "title": "Dropbox updates its post: investigation concluded, no access to documents or payment info", "body": null, "sourceUrl": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign", "url": "https://pwn.watch/i/dropbox-sign-production-breach" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-06-10", "title": "Mandiant publishes its UNC5537 report: about 165 organizations notified", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "hugging-face-spaces-secrets-leak", "incidentTitle": "Hugging Face Spaces secrets accessed without authorization", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-31", "title": "Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens", "body": null, "sourceUrl": "https://huggingface.co/blog/space-secrets-disclosure", "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-31", "title": "Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake", "body": null, "sourceUrl": "https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-30", "title": "Snowflake publishes detection and hardening guidance", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-22", "title": "Mandiant alerts Snowflake to a broader campaign and starts notifying victims", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-20", "title": "Live Nation identifies unauthorized activity in a third-party cloud database", "body": null, "sourceUrl": "https://investors.livenationentertainment.com/sec-filings/all-sec-filings/content/0001335258-24-000081/0001335258-24-000081.pdf", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-01", "title": "CEO Andrew Witty testifies before the Senate Finance Committee", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "dropbox-sign-production-breach", "incidentTitle": "Dropbox Sign (HelloSign) production environment breached", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-24", "title": "Dropbox becomes aware of unauthorized access to the Dropbox Sign production environment", "body": null, "sourceUrl": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign", "url": "https://pwn.watch/i/dropbox-sign-production-breach" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-22", "title": "UnitedHealth: stolen files could cover a substantial proportion of people in America", "body": null, "sourceUrl": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "snowflake-customer-data-theft-unc5537", "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-14", "title": "Earliest attacker DBeaver login shown in Mandiant's sample logs; AT&T later said its data was downloaded in April", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion", "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537" }, { "incident": "microsoft-midnight-blizzard-corporate-email-breach", "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-02", "title": "CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach" }, { "incident": "national-public-data-breach-ssn-leak", "incidentTitle": "National Public Data breach: 2.7 billion records with SSNs leaked", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04", "title": "USDoD offers 2.9 billion records allegedly stolen from National Public Data for $3.5 million", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/hackers-leak-27-billion-data-records-with-social-security-numbers/", "url": "https://pwn.watch/i/national-public-data-breach-ssn-leak" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-22", "title": "UnitedHealth files an SEC 8-K on the cybersecurity incident", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/731766/000073176624000085/unh-20240221.htm", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-21", "title": "Ransomware deployed; Change Healthcare systems disconnected", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "change-healthcare-ransomware-attack", "incidentTitle": "Change Healthcare ransomware attack (ALPHV/BlackCat)", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-02-12", "title": "Attackers access a Change Healthcare Citrix portal with stolen credentials (no MFA), per CEO testimony", "body": null, "sourceUrl": "https://www.finance.senate.gov/imo/media/doc/0501%5Fwitty%5Ftestimony.pdf", "url": "https://pwn.watch/i/change-healthcare-ransomware-attack" }, { "incident": "microsoft-midnight-blizzard-corporate-email-breach", "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-01-25", "title": "Microsoft publishes guidance for responders on the Midnight Blizzard attack", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach" }, { "incident": "microsoft-midnight-blizzard-corporate-email-breach", "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-01-12", "title": "Microsoft detects a nation-state attack on its corporate systems", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach" }, { "incident": "xfinity-citrix-bleed-data-breach-2023", "incidentTitle": "Xfinity breach via Citrix Bleed: 35.9M customers", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-12-18", "title": "Public notice; customers are forced to reset passwords", "body": null, "sourceUrl": "https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix", "url": "https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023" }, { "incident": "xfinity-citrix-bleed-data-breach-2023", "incidentTitle": "Xfinity breach via Citrix Bleed: 35.9M customers", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-12-06", "title": "Xfinity concludes usernames and hashed passwords were taken", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023" }, { "incident": "23andme-credential-stuffing-data-breach-2023", "incidentTitle": "23andMe: credential stuffing exposes 6.9M users' ancestry data", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-12-04", "title": "23andMe confirms about 6.9 million people affected", "body": null, "sourceUrl": "https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/", "url": "https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023" }, { "incident": "okta-support-system-breach-2023", "incidentTitle": "Okta support system breach: HAR files with session tokens stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-11-29", "title": "Okta: the attacker downloaded the names and email addresses of all customer support system users", "body": null, "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/", "url": "https://pwn.watch/i/okta-support-system-breach-2023" }, { "incident": "xfinity-citrix-bleed-data-breach-2023", "incidentTitle": "Xfinity breach via Citrix Bleed: 35.9M customers", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-16", "title": "Xfinity determines customer information was likely acquired", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023" }, { "incident": "okta-support-system-breach-2023", "incidentTitle": "Okta support system breach: HAR files with session tokens stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-11-03", "title": "Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked", "body": null, "sourceUrl": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/", "url": "https://pwn.watch/i/okta-support-system-breach-2023" }, { "incident": "okta-support-system-breach-2023", "incidentTitle": "Okta support system breach: HAR files with session tokens stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-19", "title": "Okta notifies customers of the security incident", "body": null, "sourceUrl": "https://sec.okta.com/harfiles", "url": "https://pwn.watch/i/okta-support-system-breach-2023" }, { "incident": "okta-support-system-breach-2023", "incidentTitle": "Okta support system breach: HAR files with session tokens stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-18", "title": "Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta", "body": null, "sourceUrl": "https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/", "url": "https://pwn.watch/i/okta-support-system-breach-2023" }, { "incident": "xfinity-citrix-bleed-data-breach-2023", "incidentTitle": "Xfinity breach via Citrix Bleed: 35.9M customers", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-16", "title": "Unauthorized access to Xfinity internal systems begins (through Oct 19), per Xfinity's notice", "body": null, "sourceUrl": "https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf", "url": "https://pwn.watch/i/xfinity-citrix-bleed-data-breach-2023" }, { "incident": "23andme-credential-stuffing-data-breach-2023", "incidentTitle": "23andMe: credential stuffing exposes 6.9M users' ancestry data", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-06", "title": "23andMe confirms user profile data was scraped and offered on hacking forums", "body": null, "sourceUrl": "https://blog.23andme.com/articles/addressing-data-security-concerns", "url": "https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-05", "title": "MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "okta-support-system-breach-2023", "incidentTitle": "Okta support system breach: HAR files with session tokens stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-10-02", "title": "BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta", "body": null, "sourceUrl": "https://www.beyondtrust.com/blog/entry/okta-support-unit-breach", "url": "https://pwn.watch/i/okta-support-system-breach-2023" }, { "incident": "okta-support-system-breach-2023", "incidentTitle": "Okta support system breach: HAR files with session tokens stolen", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-28", "title": "Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC", "body": null, "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/", "url": "https://pwn.watch/i/okta-support-system-breach-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "Public disclosure by Wiz and Microsoft", "body": null, "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-14", "title": "Caesars 8-K filing; reports say it paid about half of a $30M demand", "body": null, "sourceUrl": "https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-12", "title": "MGM statement on the cybersecurity issue", "body": null, "sourceUrl": "https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-11", "title": "MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "mgm-resorts-caesars-scattered-spider-2023", "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-09-07", "title": "Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm", "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-06", "title": "Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-14", "title": "Microsoft details how the stolen MSA key was used to forge tokens", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "Microsoft discloses the intrusion; CISA and FBI publish AA23-193A", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-24", "title": "Microsoft revokes the SAS token", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-22", "title": "Wiz reports the exposure to Microsoft", "body": null, "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-16", "title": "Third round of fixes for CVE-2023-35708 after a public proof of concept", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35708", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-16", "title": "Microsoft opens an investigation after a customer reports anomalous mail access", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-09", "title": "Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35036", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-07", "title": "CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-02", "title": "CISA adds CVE-2023-34362 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-31", "title": "Progress discloses the critical MOVEit Transfer vulnerability and ships patches", "body": null, "sourceUrl": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "moveit-transfer-cl0p-mass-exploitation-2023", "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft", "category": "patch", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-27", "title": "Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft", "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-15", "title": "Storm-0558 begins accessing customer email with forged tokens", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "t-mobile-api-breach-37-million-2023", "incidentTitle": "T-Mobile: API abused to pull data on 37M accounts", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-01-19", "title": "T-Mobile 8-K filing discloses about 37 million affected accounts", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm", "url": "https://pwn.watch/i/t-mobile-api-breach-37-million-2023" }, { "incident": "circleci-security-incident-rotate-all-secrets-2023", "incidentTitle": "CircleCI breach: rotate every secret", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-01-13", "title": "Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated", "body": null, "sourceUrl": "https://circleci.com/blog/jan-4-2023-incident-report/", "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023" }, { "incident": "t-mobile-api-breach-37-million-2023", "incidentTitle": "T-Mobile: API abused to pull data on 37M accounts", "category": "breach", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-01-05", "title": "T-Mobile detects the API abuse and stops it within a day", "body": null, "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm", "url": "https://pwn.watch/i/t-mobile-api-breach-37-million-2023" }, { "incident": "circleci-security-incident-rotate-all-secrets-2023", "incidentTitle": "CircleCI breach: rotate every secret", "category": "breach", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2023-01-04", "title": "CircleCI tells all customers to rotate every secret stored in CircleCI", "body": null, "sourceUrl": "https://circleci.com/blog/january-4-2023-security-alert/", "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023" } ] }