11 casos · pág. 1/1
Troy Hunt of Have I Been Pwned (HIBP) analysed the leak that ShinyHunters attributed to Carhartt. The leak was claimed to hold more than 50 GB of customer and employee records. The initial extraction showed 24,876,077 unique email addresses. Closer review showed that a large share came from the TPC-DS benchmark dataset (tpcdssf1000) store…
Episode 488 of the Smashing Security podcast, hosted by Graham Cluley with guest Paul Ducklin, covers several recent security stories. The lead item is the arrest by the FBI of an executive at a ransomware negotiation firm, reportedly at a cybersecurity conference, in connection with the investigation into the ShinyHunters gang. The hosts…
On October 6, 2026, ASOS app users received a push notification stating the company had been hacked, sent by attackers who gained access to third-party customer messaging platforms used by ASOS. The note, addressed to ASOS's DPO and IT team, claimed the Snowflake instance was "fully compromised" and threatened a leak unless ASOS engaged. …
The UK Information Commissioner's Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service (MPS) over governance failures in its use of the third-party Auror retail crime intelligence-sharing platform. Between March 2023 and September 2024, MPS officers and staff used Auror without formal approval, …
The UK Information Commissioner's Office (ICO) issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after officers and staff shared personal information through the unapproved third-party platform Auror without adequate data protection safeguards. The platform was used between March 2023 and September 2024, w…
An actor using the handle malconguerra2 claims to be sharing a dataset allegedly from KFC Venezuela, advertised at roughly 1.55 million records. The detailed description lists 1,542,021 JSON records totaling 17.5 GB. A visible sample shows customer and transaction fields: full names, email addresses, phone numbers, physical addresses, ord…
Kaspersky Security Services published a threat-model paper on how attackers can compromise modern logistics warehouses. It follows an order through eight fulfillment stages: unloading, receiving, putaway, storage, picking, sorting, packing and shipment. The paper identifies the warehouse management system (WMS) as the highest-value target…
The UK Information Commissioner's Office (ICO) has reprimanded the Metropolitan Police Service (MPS) and issued an enforcement notice. Between March 2023 and September 2024, officers registered about 500 free accounts on the retail crime platform Auror without formal procurement, a data protection impact assessment (DPIA) or data-sharing …
Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications …
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
