Data Breaches
37 articles RSS
24 Billion Stolen Credentials Found Exposed in an 8.3 TB Elasticsearch Cluster Dominated by Infostealer Logs
Cybernews researchers found an unsecured Elasticsearch cluster holding 24 billion records compiled from 36 sources, mostly infostealer logs with plaintext passwords.
FortiBleed Campaign Exposes Credentials for Roughly 86,000 FortiGate Devices Across 194 Countries as CISA Urges Immediate Password Resets
A credential-harvesting campaign dubbed FortiBleed reached 86,644 compromised FortiGate devices across 194 countries by June 19, prompting a CISA hardening advisory.
Salesforce Disables Klue Battlecards Integration After OAuth Token Theft Drains CRM Data From Customers Including Huntress
Attackers abused a compromised legacy Klue credential to mint Salesforce OAuth tokens and pull CRM records over roughly 24 hours. Salesforce disabled the Battlecards app on June 17.
Carnival Confirms Data Breach Affecting Nearly 6 Million People After Social-Engineering Attack as ShinyHunters Claims the Records
Carnival told Maine's attorney general that 5,995,277 people were affected by an April breach traced to a compromised employee account; ShinyHunters claims the data.
Foxconn Confirms Nitrogen Ransomware Attack on North American Factories with 8 TB Data and 11 Million Documents Stolen
World's largest electronics manufacturer acknowledges cyberattack claimed by Nitrogen ransomware group on North American factories; attackers allege 8 TB data theft including confidential schematics for Apple, Nvidia, Google and others, with production now resuming.
RedAccess Finds More Than 5,000 Vibe-Coded Apps on Lovable, Replit, Base44 and Netlify Running With No Authentication
Israeli security firm RedAccess says vibe-coding platforms ship apps that default to public, exposing medical, financial and corporate data to anyone who can find them.
Instructure Confirms Canvas Data Breach as ShinyHunters Claims 275 Million Records From 9,000 Schools
Instructure says names, email addresses, student IDs and user messages were exposed in a breach disclosed May 1. ShinyHunters then listed the firm on its leak site, claiming 3.65 TB of data tied to 275 million people at close to 9,000 institutions.
ADT Confirms Breach of 5.5 Million Customers After ShinyHunters Vish an Okta SSO Account and Loot Salesforce
Home security giant ADT says attackers detected on April 20 stole names, phone numbers and addresses for 5.5 million customers after voice-phishing an employee's Okta single sign-on. ShinyHunters published an 11GB archive when the company refused to pay.
Vercel Breach Traces Back to a Roblox Cheat: How a Lumma Stealer Infection at Context.ai Became an OAuth Pivot Into a Cloud Provider
A Lumma Stealer infection at AI startup Context.ai escalated into a cross-tenant OAuth attack on Vercel, exposing employee accounts, environment variables, and customer credentials, with attackers reportedly demanding a $2 million ransom in Telegram messages with the company.
France Titres Breach Exposes Up to 12 Million Government ID Records as Hacker Claims 19 Million Stolen
France's national identity document agency confirmed hackers breached its portal and stole data on up to 12 million citizens, while the threat actor claims 19 million records are for sale.
ShinyHunters Breach Rockstar Games via Third-Party Cloud Exploit, Release Financial Data After GTA VI Maker Refuses Ransom
Hackers exploited Anodot's integration with Rockstar's Snowflake cloud to steal nearly 80 million records of financial and analytics data, then published them after the studio refused to pay.
European Commission Confirms Data Breach After ShinyHunters Publish Stolen Europa.eu Records
The European Commission confirms a breach of its AWS-hosted Europa.eu platform after ShinyHunters published over 90 GB of stolen data. CERT-EU traces the intrusion to a supply chain attack on the Trivy security scanner.