{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "extortion",
    "label": "Extortion",
    "isStack": false,
    "url": "https://pwn.watch/t/extortion",
    "feed": "https://pwn.watch/t/extortion/feed.xml"
  },
  "counts": {
    "incidents": 6,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 6
  },
  "incidents": [
    {
      "slug": "discord-support-vendor-breach-id-photos-2025",
      "title": "Discord support vendor breach exposes ~70,000 government ID photos",
      "url": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025",
      "json": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Discord customer support (third-party vendor / ticketing)",
      "tags": [
        "discord",
        "zendesk",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-10-03",
      "closedAt": "2025-10-09",
      "updatedAt": "2025-10-09",
      "summary": "An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.",
      "xPost": null
    },
    {
      "slug": "red-hat-consulting-gitlab-breach-october-2025",
      "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025",
      "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Red Hat Consulting self-managed GitLab",
      "tags": [
        "devtools",
        "red-hat",
        "gitlab",
        "crimson-collective",
        "shinyhunters",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-10-01",
      "closedAt": "2025-10-10",
      "updatedAt": "2025-10-10",
      "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.",
      "xPost": null
    },
    {
      "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882",
      "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle E-Business Suite",
      "tags": [
        "oracle",
        "cl0p",
        "zero-day",
        "rce",
        "data-breach",
        "extortion",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2025-61882"
      ],
      "affectedVersions": [
        "Oracle E-Business Suite 12.2.3 to 12.2.14"
      ],
      "fixedVersions": [
        "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-10-20",
      "updatedAt": "2025-10-20",
      "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.",
      "xPost": null
    },
    {
      "slug": "salesforce-vishing-data-theft-unc6040-2025",
      "title": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025",
      "json": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Salesforce customer instances (social engineering, not a Salesforce vulnerability)",
      "tags": [
        "salesforce",
        "google",
        "shinyhunters",
        "vishing",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-06-04",
      "closedAt": "2025-08-31",
      "updatedAt": "2025-08-31",
      "summary": "UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).",
      "xPost": null
    },
    {
      "slug": "coinbase-bribed-support-agents-breach-may-2025",
      "title": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025",
      "json": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Coinbase customer support systems",
      "tags": [
        "coinbase",
        "crypto",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-05-11",
      "closedAt": "2025-05-30",
      "updatedAt": "2025-05-30",
      "summary": "Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.",
      "xPost": null
    },
    {
      "slug": "snowflake-customer-data-theft-unc5537",
      "title": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537",
      "json": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Snowflake customer instances",
      "tags": [
        "snowflake",
        "ticketmaster",
        "att",
        "infostealer",
        "data-breach",
        "extortion",
        "mfa"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-04-14",
      "closedAt": "2024-07-12",
      "updatedAt": "2024-07-12",
      "summary": "A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-10",
      "title": "FINRA alert to member firms",
      "body": null,
      "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "discord-support-vendor-breach-id-photos-2025",
      "incidentTitle": "Discord support vendor breach exposes ~70,000 government ID photos",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-09",
      "title": "Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed",
      "body": null,
      "sourceUrl": "https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service",
      "url": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-06",
      "title": "CISA adds CVE-2025-61882 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-04",
      "title": "Oracle publishes a Security Alert for CVE-2025-61882",
      "body": null,
      "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "discord-support-vendor-breach-id-photos-2025",
      "incidentTitle": "Discord support vendor breach exposes ~70,000 government ID photos",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-03",
      "title": "Discord discloses that a third-party customer service provider was compromised",
      "body": null,
      "sourceUrl": "https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service",
      "url": "https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-02",
      "title": "Red Hat confirms the incident",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-01",
      "title": "Crimson Collective claims the Red Hat GitLab theft",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "Cl0p-branded extortion emails start arriving at executives",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "salesforce-vishing-data-theft-unc6040-2025",
      "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08",
      "title": "Google confirms the breach exposed prospective Google Ads customers' contact info",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025"
    },
    {
      "incident": "salesforce-vishing-data-theft-unc6040-2025",
      "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-06-04",
      "title": "Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025"
    },
    {
      "incident": "salesforce-vishing-data-theft-unc6040-2025",
      "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-06",
      "title": "Google's corporate Salesforce instance breached by UNC6040",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-15",
      "title": "Coinbase discloses the breach in an SEC filing and refuses the $20M ransom",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05-11",
      "title": "Coinbase receives the extortion demand and discovers the breach",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-05",
      "title": "Breach notice puts affected customers at 69,461",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "coinbase-bribed-support-agents-breach-may-2025",
      "incidentTitle": "Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-12-26",
      "title": "Unauthorized access begins (per breach notification)",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/",
      "url": "https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-07-12",
      "title": "AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace",
      "body": null,
      "sourceUrl": "https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-06-10",
      "title": "Mandiant publishes its UNC5537 report: about 165 organizations notified",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-31",
      "title": "Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake",
      "body": null,
      "sourceUrl": "https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-30",
      "title": "Snowflake publishes detection and hardening guidance",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-22",
      "title": "Mandiant alerts Snowflake to a broader campaign and starts notifying victims",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-20",
      "title": "Live Nation identifies unauthorized activity in a third-party cloud database",
      "body": null,
      "sourceUrl": "https://investors.livenationentertainment.com/sec-filings/all-sec-filings/content/0001335258-24-000081/0001335258-24-000081.pdf",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-14",
      "title": "Earliest attacker DBeaver login shown in Mandiant's sample logs; AT&T later said its data was downloaded in April",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    }
  ]
}