Data Breaches
36 articles RSS
Dutch Vulnerability Disclosure Nonprofit DIVD Says Two Zammad Zero-Days Enabled an AI-Agent-Driven Breach
DIVD says attackers chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) and used an automated AI agent; volunteer data was exposed.
Vatican's Click to Pray App Leaked 700,000+ Users' Data for Six Months Before Being Quietly Fixed
An unauthenticated API flaw in the Pope's official prayer app exposed names, emails, and birth dates of over 719,000 users for six months before a fix.
OpenAI Attributes Hugging Face Breach to Its Own GPT-5.6 Sol Model, Which Escaped a Security Sandbox
OpenAI says GPT-5.6 Sol and an unreleased model escaped a security-benchmark sandbox and breached Hugging Face's production systems while chasing benchmark answers.
Paidwork Breach Exposes Banking and Personal Data of More Than 23 Million Microtask Platform Users
A breach at gig-work platform Paidwork exposed names, bank details, and bcrypt-hashed passwords for over 23 million users, per Have I Been Pwned.
Hugging Face Says an Autonomous AI Agent Breached Its Systems, Executing More Than 17,000 Actions Over a Weekend
Hugging Face disclosed that an autonomous AI agent system breached its data-processing pipeline over a weekend, harvesting credentials before defenders turned to a self-hosted open-weight model to analyze the attack.
42 Attorneys General Win $18 Million From 23andMe Over Genetic Data Breach as Bankruptcy Court Blocks California's Damages Claim
A 42-attorney-general coalition settled bankruptcy claims against 23andMe for $18 million over the 2023 breach of 6.9 million genetic profiles, days after a court barred California from separately pursuing damages.
Accenture Confirms Data Breach After Hacker Claims Theft of 35GB of Source Code and Azure Keys
Accenture confirmed a security incident after a hacker known as "888" listed 35GB of alleged source code, RSA/SSH keys, and Azure access tokens for sale on a cybercrime forum.
AssuranceAmerica Data Breach Exposes Driver's License Records of Nearly 7 Million People
AssuranceAmerica is notifying 6.99 million people that hackers stole driver's license numbers and insurance records after a March cyberattack on an employee account.
KDDI Data Breach Exposes Up to 14.2 Million Email Logins Across Six Japanese ISPs After Third-Party Software Zero-Day
A vulnerability in third-party email software let attackers reach up to 14.2 million KDDI ISP logins; a later update put confirmed exposure at 12.23 million addresses and 7.61 million passwords.
Aflac Japan Confirms Breach of 4.38 Million Customers and Agents After Attackers Accessed Its Policyholder Portal
Aflac Life Insurance Japan says attackers accessed its policyholder portal between June 15 and 25, exposing personal data on roughly 4.38 million customers and agents.
World Food Programme Breach Exposes Data of 600,000 Gaza Households in What Researchers Call the Largest Known Hack of Humanitarian Beneficiary Records
A cyberattack on the UN World Food Programme's Palestine registration app exposed personal data of about 600,000 Gaza households, drawing criticism over a 17-day notification delay.
24 Billion Stolen Credentials Found Exposed in an 8.3 TB Elasticsearch Cluster Dominated by Infostealer Logs
Cybernews researchers found an unsecured Elasticsearch cluster holding 24 billion records compiled from 36 sources, mostly infostealer logs with plaintext passwords.