29 casos · pág. 1/2
A Tenable blog post for Cybersecurity Awareness Month argues that shadow AI now covers far more than personal chatbots. It includes unvetted MCP servers, AI browser extensions, locally hosted models, coding assistants and autonomous agents holding broad credentials. Citing IBM's 2026 Cost of a Data Breach Report, it says 43% of organizati…
In Weekly Update 519, Troy Hunt describes a busy week of conference talks in Oslo and Copenhagen, including a 3D printing talk, an NDC infosec talk and a talk on cyber-related topics. He also notes that "ratbag hackers" keep dumping more data, but the excerpt names no victims, threat actors, datasets or dates. The rest covers his IoT door…
An actor using the handle Feel claims to have leaked data tied to IAD France, a French real estate network that supports property buying, selling and rental. The listing references three JSONL files: 8,592 agent records, 112,780 property records and 8,592 user-photo records. A sample archive is advertised, and the full download is gated b…
An actor using the handle malconguerra2 claims to be sharing a dataset allegedly from KFC Venezuela, advertised at roughly 1.55 million records. The detailed description lists 1,542,021 JSON records totaling 17.5 GB. A visible sample shows customer and transaction fields: full names, email addresses, phone numbers, physical addresses, ord…
A threat actor using the handle ChimeraZ claims to have leaked a user dataset linked to ISEP, a French engineering school specializing in digital technology, computer science, electronics and cybersecurity. The listing advertises 5,091 lines covering 5,088 people in a 720 KB JSON dataset, with multiple download mirrors provided. The data,…
ScarlettGroup is an emerging data-extortion operation that appeared around September 2026 and gained visibility in October. It runs a Tor-based leak site with public countdown timers to pressure organizations over allegedly stolen data, according to Foresiet research. Its public activity centers on threatened disclosure, not confirmed fil…
State Bank of India (SBI) said in an October 21 stock-exchange filing that it identified 3,897 customer records with personal information within a set of about 375,000 records circulating on the dark web (thehackernews.com). The bank does not yet know where the data came from or whether it is authentic. The figure matches a claim by a thr…
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into cat…
The leaker CyberLeek, behind a series of leaks of Rockstar Games' upcoming Grand Theft Auto 6, has threatened to publish a complete, playable build of the game. The threat followed the release of about 25 minutes of new footage, which Eurogamer reviewed and judged to appear legitimate, noting it carried CyberLeek's emblem. Instead of dema…
In mid-2026, user records allegedly taken from Golf Canada began circulating on Telegram, and Have I Been Pwned added them to its database on 22 Aug 2026. The dataset covers 569k unique email addresses with names, usernames, dates of birth, genders and approximate locations (city, province, postcode). The breach is dated May 2026. It is u…
In July 2025, the German news service NIUS suffered a data breach whose data was subsequently leaked publicly. Have I Been Pwned added the dataset on 23 Aug 2026. It covers 6k unique email addresses along with names, physical addresses and payment details tied to purchases. HIBP flagged the breach as sensitive, so it is not publicly searc…
In August 2026, a dataset of 7.3M rows allegedly sourced from Chess.com was posted online, containing 4.6M unique email addresses. The data also included usernames, names, countries and account-related data. Analysis suggests the data was obtained by scraping rather than a direct breach of Chess.com systems. Have I Been Pwned added it on …
In August 2026, Manchester Airports Group (MAG) disclosed a data breach affecting its services. The FulcrumSec hacking group later claimed the incident and published data relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The leaked data includes email addresses and phone numbers, along with airport service rec…
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. The company's disclosure notice states that attackers accessed a subset of its data. That data was later published publicly and contains about 275k unique email addresses and Discord us…
Indian stock brokerage Angel One confirmed in July 2024 that data leaked online came from a breach that occurred in April 2023. The leak holds 7.9M user records covering 6.8M unique email addresses. It was added to Have I Been Pwned on 7 Oct 2026. Angel One stated the breach "has no impact on client securities, funds, or credentials". The…
An actor using the handle 0xRune claims to have uploaded roughly 20 GB of data belonging to Cast AI, described as a multi-cloud, multi-region infrastructure backup and development environment. The listing references AWS Lambda deployment packages, S3 backups, infrastructure-state data, billing exports and a GitLab backup dated October 5, …
An actor using the handle Shenron claims to have released a dataset tied to APICRYPT Messaging, a secure healthcare messaging system created in 1996 and managed by the APICEM association. The listing advertises 852,757 rows covering 60,911 users, and marks the breach and release as occurring in 2026. The visible sample contains healthcare…
Germany's far-right party AfD (Alternative für Deutschland) has confirmed that its hosting provider was hacked in September 2026 and that some of its mailboxes were copied. A hacker then published a 281 GB corpus, claimed to hold 421,179 internal emails and more than 100,000 files, via a torrent linked from the Hexane.cc leak site. The Af…
A public repository exposed sensitive data from Smart Sampa, the Prefeitura de São Paulo video surveillance system, for about 11 months, allowing unauthorized access to more than 58,000 cameras. Cameras covered sensitive sites such as daycare centers, schools, hospitals and drug-treatment centers. According to UOL, reporters used the expo…
In July 2026, the cloud-based business communications platform RingCentral was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed to have obtained from the platform, covering 1.6M unique email addresses along with names, physical addresses and phone numbers. RingCentral stated in …
