16 casos · pág. 1/1
MITRE released version 20 of its ATT&CK framework, expanding coverage of recent adversary tradecraft across the Enterprise, ICS and Mobile domains. Enterprise gains nine techniques and sub-techniques, including two prompt injection techniques (direct and indirect), abuse of an organization's own AI agents for data theft, poisoning of web …
The FBI warns that scammers are likely to exploit the 2026 US Midterm Election to run financial fraud schemes against victims across the United States. The PSA updates alert I-102924-PSA from 29 October 2024. Scammers use candidates' names, images, logos and slogans to solicit fake campaign contributions, sell merchandise that is never de…
Microsoft, working with industry partners and Japanese police, disrupted a Chinese-language phishing-as-a-service (PhaaS) ecosystem centered on Yam Store, an underground marketplace tracked as Storm-3119. The phishing kits sold there were responsible for over a billion phishing emails and texts sent to more than 75,000 organizations since…
Check Point Research's Q3 2026 Brand Phishing Report finds Microsoft was the most impersonated brand, at 33% of all attempts (up from 23% in Q2) and roughly four times the share of any other brand. Apple, Google, LinkedIn and Amazon completed the top five, together accounting for more than half of attempts. Dropbox (up ten places to eight…
The European Commission opened formal proceedings against Booking.com on October 21, 2026, to assess possible breaches of the Digital Services Act (DSA) linked to phishing and fraud on the platform. The investigation follows a preliminary inquiry and covers how the company assesses and mitigates phishing risks, including how reservation a…
In late August 2026, Sekoia's TDR team observed an attacker compromise an unauthenticated Flowise honeypot (emulating v2.2.8). The attacker harvested stored credentials, tried to plant a malicious chatflow with a callback to 154.217.251.226, and used prompt injection to turn the LLM agent into an offensive analysis assistant. The activity…
The Massachusetts Attorney General settled alleged HIPAA and Massachusetts Data Security Law violations with former medical transportation provider Transformative Healthcare, LLC and its subsidiaries Lifeline and Fallon. The settlement also resolves MassHealth upcoding allegations, and the combined allegations carry a $1,000,000 penalty p…
The FBI and CISA issued a joint Public Service Announcement warning that malicious cyber actors may use phishing and smishing against election officials, candidates and political organizations ahead of the 2026 U.S. midterm elections. These targets are attractive because of their access to voter registration data, current government offic…
Scammers are exploiting the annual Medicare Open Enrollment period (October 15 to December 7) as a pretext to impersonate insurers, agencies or Medicare itself. Contact comes by phone, SMS, email, social media and malicious Google ads that lead to spoofed, official-looking websites. Lures include plan changes, card replacement, lower prem…
The Eclipse leak site has listed Taiwan Otsuka Pharmaceutical, a Taiwan-based pharmaceutical manufacturer, and claims to hold about 832 GB of internal company data. The victim page shows a countdown to a claimed publication deadline. The listing gives examples of allegedly stolen material across many business functions, including finance,…
Ridgeway Pharmacy Ltd, a Victor, Montana mail order and community pharmacy, disclosed that a security incident involving its third-party designed and developed website exposed the personal and health information of 258,920 customers. The company became aware of the exposure on August 21, 2026. Forensic experts confirmed the incident was l…
Mid Florida Dermatology & Plastic Surgery, a 33-location medical group in central Florida, reported to the HHS Office for Civil Rights a breach affecting 85,585 individuals. An unauthorized third party accessed its network from March 26 to March 30, 2026, and patient files may have been viewed or acquired. Two other healthcare incidents w…
Boston Children's Health Physicians (BCHP) and its managed IT provider XTIUM (formerly Axispoint Technology Solutions Group) settled with the New York and Connecticut Attorneys General over an August 2024 breach affecting almost 890,000 individuals. The settlement carries a $4 million penalty, of which $2.7 million is payable (New York $2…
Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications …
Conduent has agreed to an $80 million settlement of the consolidated class action In Re Conduent Business Services Data Breach Litigation, filed in the U.S. District Court for the District of New Jersey on October 16, 2026 and confirmed in an 8-K filing with the SEC (infosecurity-magazine.com). The suit stems from the 2024 breach at Condu…
Indian stock brokerage Angel One confirmed in July 2024 that data leaked online came from a breach that occurred in April 2023. The leak holds 7.9M user records covering 6.8M unique email addresses. It was added to Have I Been Pwned on 7 Oct 2026. Angel One stated the breach "has no impact on client securities, funds, or credentials". The…
