pwn.watch: Data breach incident updates

[critical] Fearless Wallet browser extension leaked private keys for ~20 months

Thu, 22 Oct 2026 19:09:59 GMT

The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.

Status: live · Patch: unpatched

Latest updates:

2026-10-21: Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost. (source)
2026-10-10: Last known period the exfiltration code was active (it could be re-enabled). (source)
2025-02-19: Malicious code merged into the extension's public source as part of a 'TON ecosystem' PR. (source)

[critical] Zeabur breach exposes 3.2M env-var records; company to shut down

Thu, 22 Oct 2026 19:09:59 GMT

Zeabur disclosed an October 14–15 2026 security incident in which an attacker used leaked internal credentials stored in plaintext to access shared clusters in 9 regions, root into 101 Zeabur-managed GCP dedicated servers, and read the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur is winding down: from December 1 2026 shared-cluster services pause and dedicated servers stop renewing, and on December 31 all services stop and service data is deleted. Refund and incident-claim requests close November 30. Users must rotate every secret stored on Zeabur and migrate off.

Status: live · Patch: partial

Latest updates:

2026-10-15: Attacker reads ~53 production secrets and re-adds SSH keys after a key is disabled; last recorded activity at 21:05. (source)
2026-10-14: Attacker starts using Zeabur internal AWS keys and shared-cluster admin tokens (stored in plaintext), reads secrets and env vars across 9 regions, and signs in as root to 101 GCP dedicated servers. (source)

[medium] Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud

Thu, 22 Oct 2026 18:31:55 GMT

Japanese media group Nikkei Inc. (owner of the Financial Times) says attackers used stolen credentials, obtained by unknown means, to access a cloud service it uses for system development in the early hours to morning of October 7, 2026, and personal information stored there leaked. As of October 16, about 1.83 million items had leaked: about 150,000 contain a name, email address, postal address, phone number or date of birth (about 120,000 include an email address), and about 1.68 million contain only information that cannot identify a person. No credit card data. Nikkei disabled the credentials, reported to Japan's Personal Information Protection Commission on October 11 and says it found no misuse so far. On October 21 Nikkei BP said about 800,000 of the leaked items belong to users of its services. BleepingComputer counts this as Nikkei's third disclosed incident in about a month.

Status: live · Patch: patched · Fixed in: Nikkei disabled the stolen credentials used for the access; scope review ongoing

Latest updates:

2026-10-21: Nikkei BP says about 800,000 of the leaked items belong to users of its services (about 50,000 with name, email, address, phone or date of birth; about 750,000 identifiers only). (source)
2026-10-16: Nikkei discloses the breach: about 1.83 million items leaked, about 150,000 with identifying details, no credit card data, no misuse or system outage found. It will contact affected people individually. (source)
2026-10-11: Nikkei reports the incident to Japan's Personal Information Protection Commission. (source)

[high] Capcom ID breach exposes 11.7M account email addresses

Thu, 22 Oct 2026 16:00:43 GMT

Capcom says a third party gained unauthorized access to CAPCOM ID, the account needed to play some Capcom games online. 11,774,247 records worldwide had email addresses plus account creation time, last login time, login count and last-login IP exposed; 43 also had date of birth, gender, country/region and nickname. Passwords were changed without authorization on 196 accounts (already reset). Capcom says it has not confirmed any leak of customer-set passwords, and no credit card data was involved. Detected Oct 19; reported to Osaka Prefectural Police and Japan's PPC on Oct 21. Expect phishing impersonating Capcom.

Status: live · Patch: patched · Fixed in: Capcom says emergency measures are complete and the attack method was identified and addressed; services remain available

Latest updates:

2026-10-22: Public disclosure: 11,774,247 records (email, account creation and last-login times, login count, last-login IP), 43 with date of birth, gender, country and nickname, 196 accounts with unauthorized password changes (reset). No credit card data. Affected customers will be notified. (source)
2026-10-21: Capcom reports the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. (source)
2026-10-20: Capcom sets up an internal incident response headquarters and confirms customer data was accessed and some account passwords were changed. (source)

[high] OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys

Thu, 22 Oct 2026 14:32:37 GMT

On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.

Status: live · Patch: partial

Latest updates:

2026-10-20: Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week. (source)
2026-10-19: BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits. (source)
2026-10-18: Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened. (source)

[high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken

Thu, 22 Oct 2026 09:20:00 GMT

PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.

Status: live · Patch: partial

Latest updates:

2026-10-21: PingCAP Japan adds support-ticket information to the list of exposed data. (source)
2026-10-20: FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. (source)
2026-10-19: PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. (source)

[high] TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored

Tue, 20 Oct 2026 00:00:00 GMT

UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.

Status: closed · Patch: partial

[high] Instructure Canvas Free-for-Teacher breach (ShinyHunters)

Sun, 31 May 2026 00:00:00 GMT

In May 2026 Instructure confirmed a security incident involving Canvas Free-for-Teacher after ShinyHunters claimed theft of data tied to hundreds of millions of users. Exposed data included names, emails, student IDs and some private messages; Instructure said it had no evidence passwords or financial/government IDs were taken.

Status: closed · Patch: partial

[high] OpenAI employee devices hit via TanStack Mini Shai-Hulud wave

Sun, 31 May 2026 00:00:00 GMT

In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.

Status: closed · Patch: patched

[high] LexisNexis breach (FulcrumSec claims React2Shell path)

Tue, 31 Mar 2026 00:00:00 GMT

In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.

Status: closed · Patch: patched

CVEs: CVE-2025-55182

[critical] European Commission & Dutch authorities hit via Ivanti EPMM zero-days

Sat, 28 Feb 2026 00:00:00 GMT

February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.

Status: closed · Patch: patched · Fixed in: Ivanti patched EPMM releases

CVEs: CVE-2026-1340

[unknown] UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)

Sat, 28 Feb 2026 00:00:00 GMT

In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.

Status: closed · Patch: partial

[high] ShinyHunters leak Crunchbase data (~2M records)

Sat, 31 Jan 2026 00:00:00 GMT

In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.

Status: closed · Patch: no-fix-needed

[medium] Mixpanel smishing breach exposes OpenAI API users' names and emails

Thu, 27 Nov 2025 00:00:00 GMT

Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11-26: OpenAI discloses impact on API users and drops Mixpanel (source)
2025-11-08: Mixpanel detects the smishing campaign and unauthorized export (source)

[high] SonicWall: state actor stole firewall config backups of every cloud-backup customer

Wed, 05 Nov 2025 00:00:00 GMT

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-11: SonicWall says the investigation is complete and attributes it to a state-sponsored actor (source)
2025-10-08: SonicWall and Mandiant confirm all cloud-backup customers' files were accessed (source)
2025-09-17: SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers) (source)

[critical] Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)

Mon, 20 Oct 2025 00:00:00 GMT

Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.

Status: closed · Patch: patched · Fixed in: Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)

Latest updates:

2025-10-20: CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV (source)
2025-10-06: CISA adds CVE-2025-61882 to KEV
2025-10-04: Oracle publishes a Security Alert for CVE-2025-61882 (source)

CVEs: CVE-2025-61882

[critical] F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen

Wed, 15 Oct 2025 00:00:00 GMT

F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.

Status: closed · Patch: patched · Fixed in: F5 October 2025 Quarterly Security Notification releases

Latest updates:

2025-10-15: F5 discloses the breach (SEC 8-K) and ships patches (source)
2025-10-15: CISA issues Emergency Directive 26-01 for F5 devices (source)
2025-08-09: F5 learns of the intrusion (source)

[high] Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen

Fri, 10 Oct 2025 00:00:00 GMT

The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-10: FINRA alert to member firms (source)
2025-10-02: Red Hat confirms the incident (source)
2025-10-01: Crimson Collective claims the Red Hat GitLab theft (source)

[high] Discord support vendor breach exposes ~70,000 government ID photos

Thu, 09 Oct 2025 00:00:00 GMT

An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-09: Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed (source)
2025-10-03: Discord discloses that a third-party customer service provider was compromised (source)

[high] Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)

Sun, 07 Sep 2025 00:00:00 GMT

Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Status: closed · Patch: no-fix-needed · Fixed in: Drift tokens revoked; rotate any secrets stored in Salesforce

Latest updates:

2025-09-02: Cloudflare details the impact on its Salesforce case data (source)
2025-08-26: Google Threat Intelligence publishes UNC6395 findings (source)
2025-08-20: Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange (source)

[high] Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)

Sun, 31 Aug 2025 00:00:00 GMT

UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Status: closed · Patch: no-fix-needed

Latest updates:

2025-08: Google confirms the breach exposed prospective Google Ads customers' contact info (source)
2025-06-04: Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse (source)
2025-06: Google's corporate Salesforce instance breached by UNC6040 (source)

[high] Qantas: 5.7M customers' data stolen from a contact-centre platform

Wed, 09 Jul 2025 00:00:00 GMT

A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-07-09: Qantas update: 5.7M unique customers affected (source)
2025-07-02: Qantas discloses the cyber incident (initially 6M records) (source)

[high] Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Fri, 30 May 2025 00:00:00 GMT

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-05-15: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom (source)
2025-05-11: Coinbase receives the extortion demand and discovers the breach (source)
2025-05: Breach notice puts affected customers at 69,461 (source)

[high] Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale

Tue, 08 Apr 2025 00:00:00 GMT

A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-04-08: Reports that Oracle privately confirmed the breach to customers (source)
2025-03-21: rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach (source)

[high] DeepSeek leaves ClickHouse database open: chat logs and API keys exposed

Wed, 29 Jan 2025 00:00:00 GMT

Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.

Status: closed · Patch: patched · Fixed in: Database secured by DeepSeek

Latest updates:

2025-01-29: Wiz finds the exposed database and reports it; DeepSeek secures it within an hour (source)

[critical] BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)

Mon, 30 Dec 2024 00:00:00 GMT

Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.

Status: closed · Patch: patched · Fixed in: Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16

Latest updates:

2024-12-30: Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT (source)
2024-12-19: CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27) (source)
2024-12-17: CVE-2024-12356 published (source)

CVEs: CVE-2024-12356

[critical] Cleo file transfer zero-days exploited by Clop for data theft

Tue, 17 Dec 2024 00:00:00 GMT

Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: 5.8.0.24 (Cleo, for CVE-2024-55956), 5.8.0.21 (Cleo, for CVE-2024-50623)

Latest updates:

2024-12-17: CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07) (source)
2024-12-16: Clop claims responsibility for the Cleo data-theft attacks (source)
2024-12-14: Cleo advisory: patch 5.8.0.24 for CVE-2024-55956 (source)

CVEs: CVE-2024-50623, CVE-2024-55956

[critical] Change Healthcare ransomware attack (ALPHV/BlackCat)

Tue, 22 Oct 2024 00:00:00 GMT

The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).

Status: closed · Patch: no-fix-needed

Latest updates:

2024-10-22: Change Healthcare tells HHS OCR it has sent about 100 million individual notices (source)
2024-05-01: CEO Andrew Witty testifies before the Senate Finance Committee (source)
2024-04-22: UnitedHealth: stolen files could cover a substantial proportion of people in America (source)

[high] Internet Archive hacked: 31 million user records stolen

Sun, 20 Oct 2024 00:00:00 GMT

Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-10-09: archive.org shows a hacker's JavaScript alert; breach of 31M records confirmed (source)
2024-09-28: Most recent timestamp in the stolen user database (source)

[high] National Public Data breach: 2.7 billion records with SSNs leaked

Sun, 11 Aug 2024 00:00:00 GMT

Data stolen from background-check broker National Public Data, nearly 2.7 billion plaintext records with names, mailing addresses and Social Security numbers of people in the US, was leaked for free on a hacking forum. It had first been offered for sale in April 2024 by an actor called USDoD.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-08-11: BleepingComputer reports the 2.7 billion record leak (source)
2024-08-06: Actor 'Fenice' leaks the most complete version of the data for free on Breached (source)
2024-04: USDoD offers 2.9 billion records allegedly stolen from National Public Data for $3.5 million (source)

[critical] Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)

Fri, 12 Jul 2024 00:00:00 GMT

A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-07-12: AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace (source)
2024-06-10: Mandiant publishes its UNC5537 report: about 165 organizations notified (source)
2024-05-31: Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake (source)

[high] Dropbox Sign (HelloSign) production environment breached

Fri, 21 Jun 2024 00:00:00 GMT

A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-06-21: Dropbox updates its post: investigation concluded, no access to documents or payment info (source)
2024-04-24: Dropbox becomes aware of unauthorized access to the Dropbox Sign production environment (source)

[high] Hugging Face Spaces secrets accessed without authorization

Fri, 31 May 2024 00:00:00 GMT

Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-05-31: Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens (source)

[high] Midnight Blizzard breaches Microsoft corporate email

Tue, 02 Apr 2024 00:00:00 GMT

Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-04-02: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed (source)
2024-01-25: Microsoft publishes guidance for responders on the Midnight Blizzard attack (source)
2024-01-12: Microsoft detects a nation-state attack on its corporate systems (source)

[high] Xfinity breach via Citrix Bleed: 35.9M customers

Mon, 18 Dec 2023 00:00:00 GMT

Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.

Status: closed · Patch: patched

Latest updates:

2023-12-18: Public notice; customers are forced to reset passwords (source)
2023-12-06: Xfinity concludes usernames and hashed passwords were taken
2023-11-16: Xfinity determines customer information was likely acquired

[high] 23andMe: credential stuffing exposes 6.9M users' ancestry data

Mon, 04 Dec 2023 00:00:00 GMT

Attackers used reused passwords to log into about 14,000 23andMe accounts, then scraped the DNA Relatives profiles those accounts could see. Data on about 6.9 million people was exposed and sold on hacking forums.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-12-04: 23andMe confirms about 6.9 million people affected (source)
2023-10-06: 23andMe confirms user profile data was scraped and offered on hacking forums (source)

[high] Okta support system breach: HAR files with session tokens stolen

Wed, 29 Nov 2023 00:00:00 GMT

An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-11-29: Okta: the attacker downloaded the names and email addresses of all customer support system users (source)
2023-11-03: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked (source)
2023-10-19: Okta notifies customers of the security incident (source)

[high] MGM Resorts and Caesars hit by Scattered Spider

Thu, 05 Oct 2023 00:00:00 GMT

Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-10-05: MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen (source)
2023-09-14: Caesars 8-K filing; reports say it paid about half of a $30M demand (source)
2023-09-12: MGM statement on the cybersecurity issue (source)

[high] Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link

Mon, 18 Sep 2023 00:00:00 GMT

A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.

Status: closed · Patch: patched

Latest updates:

2023-09-18: Public disclosure by Wiz and Microsoft (source)
2023-06-24: Microsoft revokes the SAS token (source)
2023-06-22: Wiz reports the exposure to Microsoft (source)

[critical] Storm-0558: stolen Microsoft signing key used to read government email

Wed, 06 Sep 2023 00:00:00 GMT

China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.

Status: closed · Patch: patched

Latest updates:

2023-09-06: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network (source)
2023-07-14: Microsoft details how the stolen MSA key was used to forge tokens (source)
2023-07-11: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A (source)

[critical] MOVEit Transfer zero-day: Cl0p mass data theft

Fri, 16 Jun 2023 00:00:00 GMT

Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.

Status: closed · Patch: patched · Fixed in: 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), Older branches: see vendor advisory

Latest updates:

2023-06-16: Third round of fixes for CVE-2023-35708 after a public proof of concept (source)
2023-06-09: Progress fixes more SQL injection bugs found during code review (CVE-2023-35036) (source)
2023-06-07: CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505) (source)

CVEs: CVE-2023-34362, CVE-2023-35036, CVE-2023-35708

[high] T-Mobile: API abused to pull data on 37M accounts

Thu, 19 Jan 2023 00:00:00 GMT

T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-01-19: T-Mobile 8-K filing discloses about 37 million affected accounts (source)
2023-01-05: T-Mobile detects the API abuse and stops it within a day (source)

[critical] CircleCI breach: rotate every secret

Fri, 13 Jan 2023 00:00:00 GMT

Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-01-13: Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated (source)
2023-01-04: CircleCI tells all customers to rotate every secret stored in CircleCI (source)