76 casos · pág. 3/4
An actor using the handle 0xRune claims to have uploaded roughly 20 GB of data belonging to Cast AI, described as a multi-cloud, multi-region infrastructure backup and development environment. The listing references AWS Lambda deployment packages, S3 backups, infrastructure-state data, billing exports and a GitLab backup dated October 5, …
An actor using the handle Shenron claims to have released a dataset tied to APICRYPT Messaging, a secure healthcare messaging system created in 1996 and managed by the APICEM association. The listing advertises 852,757 rows covering 60,911 users, and marks the breach and release as occurring in 2026. The visible sample contains healthcare…
Threat actor ChimeraZ claims to be selling a partial dataset from I-CAD, the French national identification registry for dogs, cats and ferrets. The listing advertises 2,948,630 lines in a 643 MB JSONL file, made up of 2,898,001 animal records and 50,629 veterinary records, with the price set to "make offer". The dataset's authenticity, s…
A vehicle belonging to school photography firm Pret-a-Portrait was broken into overnight on 6-7 October, and a camera bag containing SD memory cards was stolen. The cards may hold photographs taken at Priory School in Lewes, UK, plus images of QR code cards showing pupils' names and class names. The same equipment was used for three furth…
An unauthorized party used a compromised login credential to access a file transfer (SFTP) site belonging to Educational Testing Service (ETS) and copy files containing California public school student data, according to the California Department of Education (CDE). ETS supports the state's CAASPP and ELPAC assessment programs. Access occ…
An intruder reached a legacy system at OpenCode on the night of October 16, and the company says third-party AI provider keys saved in OpenCode Console "may have been exposed." About 1.4% of Console users, all with an outside provider linked, were notified by email on October 17 and told to revoke and replace their OpenAI, Anthropic or Go…
The UK Information Commissioner's Office (ICO) has issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) over a ransomware attack on 1 November 2024 (theregister.com, infosecurity-magazine.com). The intruder entered Data Cymru's network through a forgotten test account, Test2 (…
Conduent has agreed to an $80 million settlement of the consolidated class action In Re Conduent Business Services Data Breach Litigation, filed in the U.S. District Court for the District of New Jersey on October 16, 2026 and confirmed in an 8-K filing with the SEC (infosecurity-magazine.com). The suit stems from the 2024 breach at Condu…
On October 6, 2026, ASOS app users received a push notification stating the company had been hacked, sent by attackers who gained access to third-party customer messaging platforms used by ASOS. The note, addressed to ASOS's DPO and IT team, claimed the Snowflake instance was "fully compromised" and threatened a leak unless ASOS engaged. …
Episode 488 of the Smashing Security podcast, hosted by Graham Cluley with guest Paul Ducklin, covers several recent security stories. The lead item is the arrest by the FBI of an executive at a ransomware negotiation firm, reportedly at a cybersecurity conference, in connection with the investigation into the ShinyHunters gang. The hosts…
In July 2026, the cloud-based business communications platform RingCentral was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed to have obtained from the platform, covering 1.6M unique email addresses along with names, physical addresses and phone numbers. RingCentral stated in …
In August 2026, clothing retailer Carhartt was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published data allegedly taken from the company, including 12.9M unique email addresses, names, phone numbers and physical addresses. The leaked corpus also held millions of synthetic records unrelated to real individuals,…
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a substantial corpus of data allegedly taken from the company, including 6.4M unique email addresses alongside other personal and corporate attributes. The data relates to marketing campaign r…
In August 2026, French intellectual property software and services company Questel was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a large corpus of data it claimed to have taken from the company. The data is largely corporate contact information tied to sales leads, support cases and marketing activit…
In September 2026, Swiss medical device company Medela was targeted in a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published and covers about 424k unique email addresses, mostly belonging to healthcare professionals, Medela staff and sales leads. Have I Been Pwned added the dataset …
In August 2026, data centre operator CyrusOne was targeted in a ShinyHunters "pay or leak" extortion attempt. The group later published data allegedly stolen from the company, covering about 373k unique email addresses across records for users, sales leads and CyrusOne employees. The data is mostly corporate contact information, and also …
In January 2026, the company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly stolen from the company was later published, covering about 560k unique email addresses, mostly belonging to leads and business contacts. Crunchbase subsequently confirmed that a threat actor had exf…
In August 2026, the food and animal safety company Neogen was targeted in a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed to have obtained from Neogen. The data consists largely of corporate contact records and includes 436k unique email addresses drawn from mailing lists, employee records and oth…
In August 2026, the digital health company Sharecare was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consists of B2B sales and marketing records, including names, physical addresses…
A reader comment on Schneier on Security discusses the arrest of a suspect in a case involving the hacking of FBI systems. The comment cites Reuters reporting that the person involved was a contractor working for Accenture, and that the bureau says it has "removed the contractor" and taken steps to protect its workforce. The commenter, Cl…
