https://pwn.watch/t/scattered-spider Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 09 Jul 2025 00:00:00 GMT https://pwn.watch/i/qantas-contact-centre-breach-july-2025 https://pwn.watch/i/qantas-contact-centre-breach-july-2025 Wed, 09 Jul 2025 00:00:00 GMT high <p>A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-07-09: Qantas update: 5.7M unique customers affected (<a href="https://www.qantasnewsroom.com.au/media-releases/update-on-qantas-cyber-incident-wednesday-9-july-2025/">source</a>)</li><li>2025-07-02: Qantas discloses the cyber incident (initially 6M records) (<a href="https://www.qantasnewsroom.com.au/media-releases/qantas-cyber-incident/">source</a>)</li></ul> https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025 https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025 Tue, 10 Jun 2025 00:00:00 GMT critical <p>Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&amp;S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click &amp; Collect and online ordering broke; online orders were paused from April 25 to June 10. M&amp;S put the hit at about £300M of operating profit.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-06-10: Online clothing orders resume after 46 days (<a href="https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/">source</a>)</li><li>2025-05-21: M&amp;S estimates about £300M cost; disruption to last into July (<a href="https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/">source</a>)</li><li>2025-04-29: Attack linked to Scattered Spider and DragonForce ransomware on ESXi (<a href="https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/">source</a>)</li></ul> https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023 https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023 Thu, 05 Oct 2023 00:00:00 GMT high <p>Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2023-10-05: MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen (<a href="https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm">source</a>)</li><li>2023-09-14: Caesars 8-K filing; reports say it paid about half of a $30M demand (<a href="https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html">source</a>)</li><li>2023-09-12: MGM statement on the cybersecurity issue (<a href="https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE">source</a>)</li></ul>