336 casos · pág. 6/17
Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…
Unit 42 investigated a months-long intrusion against a European bank, which began with unauthorized VPN-based access through a third-party-managed external gateway appliance that did not enforce strict authentication. Using compromised credentials, the attacker ran noisy, high-volume internal reconnaissance and brute-force campaigns again…
Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including…
Dropbox confirmed that roughly 5,000 customer accounts were accessed between 4 and 21 August after attackers abused a legacy login integration between Dropbox and Lenovo ID, Lenovo's identity system. Lenovo ID did not verify that a person registering an account actually controlled the email address used. Because Dropbox implicitly trusted…
Reportedly, the US Army, Air Force, Navy and Special Operations Command have disabled mobile advertising IDs on government-issued phones and computers. The move follows concerns that commercially available location data has been used to target American forces in the Middle East. It became public after Senator Ron Wyden released letters, h…
The US Department of Defense has confirmed a breach of the Defense Manpower Data Center (DMDC), one of its main personnel data repositories. The breach exposed sensitive data on roughly 2.76 million people plus about 294,000 deceased individuals. Unauthorised users reportedly accessed files between October 2025 and 16 July 2026, and the i…
Dutch police arrested a 24-year-old Amsterdam man on September 15 on suspicion of playing a role in the ShinyHunters criminal organisation. Police have not named him, but Brian Krebs identified him as Pepijn van der Stap, a convicted hacker. A search of his laptop reportedly turned up details of two murders "to be committed abroad", which…
The US State Department is offering up to US $10 million through Rewards for Justice for information on Zhang Yu, 44, a Chinese national accused of being a key figure in the state-sponsored group Hafnium (also tracked as Silk Typhoon). Zhang is described as a director at Shanghai Firetech Information Science and Technology, working under …
Episode 488 of the Smashing Security podcast, hosted by Graham Cluley with guest Paul Ducklin, covers several recent security stories. The lead item is the arrest by the FBI of an executive at a ransomware negotiation firm, reportedly at a cybersecurity conference, in connection with the investigation into the ShinyHunters gang. The hosts…
In mid-2026, user records allegedly taken from Golf Canada began circulating on Telegram, and Have I Been Pwned added them to its database on 22 Aug 2026. The dataset covers 569k unique email addresses with names, usernames, dates of birth, genders and approximate locations (city, province, postcode). The breach is dated May 2026. It is u…
In August 2026, Australian beauty retailer Oz Hair and Beauty was targeted in an extortion attack by the group xpl0itrs. The group subsequently published data allegedly stolen from the company. The leak contains roughly 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchase recor…
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach exposed roughly 145k unique email addresses along with usernames and passwords stored as MD5 or PBKDF2 hashes. OTW self-submitted the data to Have I Been Pwned, which added it on 19 Aug 2026 (144.5k af…
In July 2026, the cloud-based business communications platform RingCentral was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed to have obtained from the platform, covering 1.6M unique email addresses along with names, physical addresses and phone numbers. RingCentral stated in …
In August 2026, clothing retailer Carhartt was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published data allegedly taken from the company, including 12.9M unique email addresses, names, phone numbers and physical addresses. The leaked corpus also held millions of synthetic records unrelated to real individuals,…
In August 2026, a dataset of 7.3M rows allegedly sourced from Chess.com was posted online, containing 4.6M unique email addresses. The data also included usernames, names, countries and account-related data. Analysis suggests the data was obtained by scraping rather than a direct breach of Chess.com systems. Have I Been Pwned added it on …
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a substantial corpus of data allegedly taken from the company, including 6.4M unique email addresses alongside other personal and corporate attributes. The data relates to marketing campaign r…
In August 2026, Manchester Airports Group (MAG) disclosed a data breach affecting its services. The FulcrumSec hacking group later claimed the incident and published data relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The leaked data includes email addresses and phone numbers, along with airport service rec…
In August 2026, French intellectual property software and services company Questel was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a large corpus of data it claimed to have taken from the company. The data is largely corporate contact information tied to sales leads, support cases and marketing activit…
In September 2026, Swiss medical device company Medela was targeted in a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published and covers about 424k unique email addresses, mostly belonging to healthcare professionals, Medela staff and sales leads. Have I Been Pwned added the dataset …
The now-defunct B2B marketing leads service LimeLeads suffered a data breach in August 2019 after an Elasticsearch server was left exposed and unsecured. The incident exposed tens of millions of records of largely corporate contact data, covering 17.8M unique email addresses. Have I Been Pwned added the dataset on 22 Sep 2026. The article…
