https://pwn.watch/t/extortion Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 20 Oct 2025 00:00:00 GMT https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882 https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882 Mon, 20 Oct 2025 00:00:00 GMT critical <p>Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-20: CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV (<a href="https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/">source</a>)</li><li>2025-10-06: CISA adds CVE-2025-61882 to KEV</li><li>2025-10-04: Oracle publishes a Security Alert for CVE-2025-61882 (<a href="https://www.oracle.com/security-alerts/alert-cve-2025-61882.html">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-61882</p> https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025 https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025 Fri, 10 Oct 2025 00:00:00 GMT high <p>The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-10: FINRA alert to member firms (<a href="https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010">source</a>)</li><li>2025-10-02: Red Hat confirms the incident (<a href="https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance">source</a>)</li><li>2025-10-01: Crimson Collective claims the Red Hat GitLab theft (<a href="https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/">source</a>)</li></ul> https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025 https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025 Thu, 09 Oct 2025 00:00:00 GMT high <p>An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust &amp; Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-09: Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed (<a href="https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service">source</a>)</li><li>2025-10-03: Discord discloses that a third-party customer service provider was compromised (<a href="https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service">source</a>)</li></ul> https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 Sun, 31 Aug 2025 00:00:00 GMT high <p>UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-08: Google confirms the breach exposed prospective Google Ads customers' contact info (<a href="https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/">source</a>)</li><li>2025-06-04: Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse (<a href="https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion">source</a>)</li><li>2025-06: Google's corporate Salesforce instance breached by UNC6040 (<a href="https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/">source</a>)</li></ul> https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025 https://pwn.watch/i/coinbase-bribed-support-agents-breach-may-2025 Fri, 30 May 2025 00:00:00 GMT high <p>Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-05-15: Coinbase discloses the breach in an SEC filing and refuses the $20M ransom (<a href="https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm">source</a>)</li><li>2025-05-11: Coinbase receives the extortion demand and discovers the breach (<a href="https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/">source</a>)</li><li>2025-05: Breach notice puts affected customers at 69,461 (<a href="https://www.bleepingcomputer.com/news/security/coinbase-says-recent-data-breach-impacts-69-461-customers/">source</a>)</li></ul> https://pwn.watch/i/snowflake-customer-data-theft-unc5537 https://pwn.watch/i/snowflake-customer-data-theft-unc5537 Fri, 12 Jul 2024 00:00:00 GMT critical <p>A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&amp;T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-07-12: AT&amp;T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace (<a href="https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/">source</a>)</li><li>2024-06-10: Mandiant publishes its UNC5537 report: about 165 organizations notified (<a href="https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion">source</a>)</li><li>2024-05-31: Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake (<a href="https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/">source</a>)</li></ul>