Data Breaches & Incidents

Russian state-sponsored threat actors tracked as Star Blizzard have been running phishing campaigns that use fake event invitations to trick victims into installing a backdoor on Windows systems, according to Microsoft. The activity is aimed at individuals and organizations tied to Ukraine, and has touched more than 100 organizations since January, with most targets located in the U.S. and U.K. At least one machine was confirmed infected, though the full number of compromised systems has not been disclosed. Key points: Star Blizzard is attributed to the Russian state and has previously been linked to credential-harvesting and espionage operations. The current wave relies on convincing fake event invites as the initial lure. The end goal is deployment of a backdoor on Windows hosts. Targeting is concentrated on entities connected to Ukraine, primarily in the U.S. and U.K. Microsoft has not released specific indicators such as CVE identifiers or file hashes in this report, so defenders should focus on behavioral detection: unexpected event-invite emails, suspicious attachment or link chains, and anomalous process execution on endpoints. Mitigation guidance: Treat unsolicited event invitations with suspicion, especially those referencing Ukraine-related topics. Verify sender domains and links out-of-band before interacting. Enforce phishing-resistant MFA and monitor for unusual authentication activity. Harden Windows endpoints and review email filtering rules for invitation-style lures. Source: The Hacker News Has your organization seen an uptick in event-themed phishing lures, and how are you tuning detection to catch them?

The Dutch Institute for Vulnerability Disclosure (DIVD) has disclosed that it suffered a cyberattack carried out by an automated AI agent. The organization described the intrusion as "loud and very, very messy," suggesting the attacker prioritized speed and automation over stealth. According to DIVD, the AI-driven attack did not follow the careful, quiet patterns typical of human-led intrusions. Instead, it was characterized by noisy, chaotic activity that ultimately drew attention. The nonprofit, which focuses on responsible vulnerability disclosure, has not released specific technical details such as exploited vulnerabilities, indicators of compromise, or attribution. Key facts as reported: The target was DIVD, a Dutch cybersecurity nonprofit. The attack was conducted by an automated AI agent. DIVD characterized the incident as "loud and very, very messy." No specific CVE ID, advisory number, or affected product list was provided in the report. The source article does not name a threat actor or provide mitigation steps. This incident adds to a growing conversation about how autonomous agents may change the threat landscape, particularly when their behavior is less predictable than that of human operators. For defenders, the case highlights the value of monitoring for anomalous, noisy activity that may indicate automated exploitation attempts rather than a targeted, stealthy campaign. Source: BleepingComputer Does your organization have detection rules in place for automated or AI-driven intrusion attempts, or is this still a blind spot?

Microsoft has published a technical analysis of a malware family it tracks as NeedyMantis, used by attackers to keep a foothold in networks they had already compromised. Rather than serving as an initial access tool, the malware functions as a persistence mechanism, allowing intruders to retain long-term access to environments they had already breached. The activity has so far been observed in a small number of targeted intrusions, with victims spanning several sectors: Telecommunications organizations Universities Medical nonprofits Intergovernmental organizations Government contractors According to Microsoft, the malware's use dates back to at least a period prior to its public disclosure, indicating the tooling has been in circulation for some time before coming to light. For defenders, the key takeaway is that NeedyMantis is a post-compromise persistence tool, meaning its presence implies an environment was already accessed through other means. Detection efforts should therefore focus on hunting for signs of prolonged unauthorized access rather than treating the malware as a standalone initial infection vector. Source: The Hacker News Has anyone seen NeedyMantis-related activity in their environment, and how is your team approaching detection for long-term persistence tools?

Japanese car-sharing service Times Car has confirmed that roughly 6.6 million user accounts were compromised in a cyberattack that came to light late last week. The company says the breach affected customer account data, making this one of the larger confirmed incidents to hit a Japanese mobility platform in recent years. The exact contents of the leaked data and other technical specifics have not been detailed in the disclosure, so members should avoid assuming which fields were exposed until Times Car publishes a fuller advisory. What is clear is the scale: 6.6 million accounts is a substantial population, and affected users should treat any credential reuse as a real risk. Recommended precautions for anyone with a Times Car account: Change your Times Car password immediately, and avoid reusing it anywhere else. If you used the same credentials on other services, reset those too and enable multi-factor authentication where available. Watch for phishing emails or SMS messages referencing Times Car, especially those asking you to "verify" account details or payment information. Monitor for unusual activity on any payment method linked to your account. No specific CVE ID or advisory identifier has been attached to this incident in the reporting. XploitLK will update this thread if the company releases further technical details or a formal breach notification. Source: BleepingComputer Did you or your organization have a Times Car account, and if so, have you already rotated credentials and reviewed linked payment methods?

Bitget has restored Bitcoin withdrawals after a security breach that led to the theft of more than $350 million in crypto assets. The exchange had suspended withdrawals following the incident, which is attributed to suspected North Korean hackers. The heist is now estimated at approximately $387.5 million. Bitget has not disclosed specific technical details about the intrusion vector, and no CVE identifiers or advisory numbers have been provided in connection with the breach. Key points: Bitget suspended Bitcoin withdrawals after detecting the breach Losses exceed $350 million, with the total now reported at $387.5 million The attack is linked to suspected North Korean threat actors Bitcoin withdrawals have since been resumed Source: Unknown Has your organization reviewed its crypto exchange counterparty risk or withdrawal controls in light of this incident?

AI coding agents are accelerating software development, but they are also accelerating the exposure of credentials. According to GitGuardian's 2026 State of Secrets Sprawl Report, commits identified as AI-assisted leak secrets at roughly twice the rate of human-written commits. The fastest-growing categories of leaked credentials are now tied to AI. This shifts secrets sprawl from a hygiene issue into an identity problem. As AI agents generate and embed credentials faster than teams can track them, traditional detection and rotation practices struggle to keep pace. Key points from the report: AI-assisted commits leak secrets at approximately 2x the rate of human-written commits Most of the fastest-growing categories of leaked credentials are connected to AI AI coding agents are changing how quickly developers build and ship software — and how quickly credentials can become exposed For security teams, the takeaway is that secret management needs to be treated as part of identity and access strategy, not a separate cleanup task. Detection alone will not scale if agents keep producing credentials faster than they can be reviewed and rotated. Source: The Hacker News Has your organization adjusted its secret scanning or rotation policies since adopting AI coding assistants?

The Clop ransomware gang has relocated its data leak site to a new Tor address after confirming that its previous server was compromised and defaced. The intrusion was carried out through an unpatched flaw in Grav CMS, which BleepingComputer has learned is an unauthenticated path traversal vulnerability. According to the reporting, the ShinyHunters group was behind the hack of the Clop leak site. The defacement prompted Clop to move its operations to a fresh Tor hidden service address, indicating the gang treated the compromise as serious enough to abandon the original infrastructure rather than simply restore it. Key points from the incident: The vulnerable software is Grav CMS, and the flaw is an unauthenticated path traversal issue. The Clop leak site was both compromised and defaced before being moved. ShinyHunters has been credited with carrying out the attack. Clop has since shifted its leak site to a new Tor address. For defenders, this incident is a reminder that extortion groups are not immune to the same classes of bugs they exploit in others. An unauthenticated path traversal in a content management system can expose or allow manipulation of files on an internet-facing server, which is exactly the kind of exposure that can lead to a site being taken over or defaced. There is no specific CVE identifier or patch reference provided in the source report, so administrators running Grav CMS should monitor the project's official channels for updates rather than relying on a specific advisory number here. Source: Unknown If your organization runs Grav CMS, have you checked whether it is fully patched and whether any instances are exposed directly to the internet?

GitLab provides each user with a private email address for filing issues by email, and that address functions as a credential. Anyone who obtains it can send an email containing a patch that GitLab commits under the victim's name, targeting any branch the user is permitted to push to, including main. The same access allows the attacker to trigger CI/CD jobs that execute with the victim's privileges. The address is exposed in the GitLab interface behind a button labeled "Email work item to this project." Mail sent to it opens an issue in the corresponding project, with the message authored as the victim. Key points: The issue-by-email address is effectively a secret credential and should be treated as such. A leaked address permits commits to any branch the user can push to, including main. It also permits starting CI/CD jobs that run as the affected user. GitLab surfaces the address through the "Email work item to this project" button. Mitigation considerations: Treat your project's incoming issue email address as sensitive; avoid sharing it in public channels, screenshots, or documentation. Rotate the address if you suspect it has been exposed. Review project and branch permissions to limit what a compromised address could reach. Source: [email protected] (The Hacker News) Has your organization reviewed who can access your GitLab issue-by-email addresses?

Sweden's data protection authority, IMY, has fined IT systems provider Miljödata approximately $183,000 (SEK 1.8 million) following a breach that exposed the personal data of 2.2 million people. The regulator found that the company's security measures were inadequate, leading to the incident in August 2025. The penalty highlights the growing scrutiny on third-party IT providers that handle sensitive data on behalf of municipalities and other organizations, where a single compromise can cascade across many downstream victims. Key details: Regulator: IMY (Sweden's data privacy authority) Company fined: Miljödata Fine amount: $183,000 / SEK 1.8 million People affected: 2.2 million Breach timeframe: August 2025 Reason cited: inadequate security measures Since the article does not specify a CVE ID or advisory number, none is listed here. Organizations relying on Miljödata or similar third-party providers should review their vendor risk assessments and confirm what security obligations are contractually enforced. Source: Unknown Does your organization depend on third-party IT providers for sensitive data, and how are you verifying their security posture?

The ShinyHunters extortion gang claims to have breached FBI systems by exploiting a previously unknown zero-day vulnerability in Oracle PeopleSoft. According to the group's claims, the attack gave them access to internal services and allowed them to steal sensitive data belonging to employees and job applicants. Details remain limited at this stage, and the claims have not been independently confirmed. What stands out is the vector: a zero-day in PeopleSoft, an enterprise application widely used across government and large organizations for HR and personnel management, which makes it an attractive target for data theft. Key points from the claim: ShinyHunters says it exploited a PeopleSoft zero-day to gain access to FBI systems The group claims it reached internal services Stolen data allegedly includes information on employees and job applicants The breach and the zero-day itself have not been verified at the time of reporting Organizations running PeopleSoft should treat this as a reminder to review exposure of their instances and monitor for unusual access to HR and applicant data. As with any unverified extortion claim, treat the details with caution until confirmed by the affected party or Oracle. Source: BleepingComputer If your organization runs PeopleSoft, are you reviewing your exposure in light of this claim?

A webinar taking place tomorrow will examine real-world Google Workspace breaches, focusing on attacks that combine social engineering with malicious OAuth applications. The session walks through the full attack chain, from initial access through the critical first hours of incident response, and highlights which security controls and response decisions have the greatest impact on the outcome. Key topics covered include: How social engineering is used to gain a foothold in Google Workspace environments The role of malicious OAuth applications in compromising accounts Incident response priorities during the first hours of an investigation Security controls that can meaningfully change the result of an attack The webinar is aimed at defenders who want a practical look at how these breaches unfold in practice rather than in theory. Source: BleepingComputer Does your organization review third-party OAuth app permissions granted within Google Workspace, and if so, how?

BigCommerce has begun notifying merchants of data breaches tied to compromised credentials for third-party Ribon applications. According to the reports, attackers obtained those credentials and used them to inject malicious scripts into online storefronts, potentially exposing customer data entered during checkout. The incident centers on the Ribon apps rather than BigCommerce's core platform, though affected merchants are being alerted directly by the company. Script injection of this kind typically allows attackers to silently capture payment or personal details as shoppers interact with a compromised store. At this stage, no specific CVE identifiers or advisory numbers have been disclosed in the reporting, so merchants should rely on official communications from BigCommerce and Ribon for accurate technical details. If you operate a store using any Ribon apps, it is worth reviewing your installed integrations and monitoring for unexpected script changes in your theme or checkout flow. Review any active Ribon apps installed on your store Audit storefront and checkout code for unauthorized script injections Watch for official breach notifications from BigCommerce and Ribon Consider rotating credentials associated with third-party app integrations Source: BleepingComputer Are you running any Ribon apps on your storefront, and if so, have you received a notification from BigCommerce yet?

Threat actors are increasingly weaponizing exposure data faster than defenders can respond. As highlighted in a recent analysis, the window between a credential leaking on a criminal marketplace or a vulnerability advisory going public and the first real-world exploitation attempt has collapsed — often closing before security teams have even finished triaging the initial alert. The core problem is that threat intelligence on its own doesn't close this gap. Knowing a leaked credential exists or that a disclosure advisory has dropped is only the starting point. Attackers are pairing that intelligence with AI-assisted exploitation, which shortens the path from exposure to breach considerably. The result is an operational tempo that most security programs simply weren't designed to match. Key takeaways for defenders: A leaked credential appearing on a criminal marketplace can be weaponized against a real target almost immediately. A vulnerability disclosure advisory can likewise be exploited before internal triage completes. AI-assisted exploitation is accelerating the move from initial exposure to actual breach. Intelligence feeds alone are insufficient — the response side of the equation has to keep pace. The practical implication is that detection and intelligence gathering must be matched by faster containment and remediation capabilities. Sitting on an alert while an attacker operationalizes the same information is exactly the scenario being described here. Source: The Hacker News How is your organization shortening the gap between receiving a credential leak or vulnerability alert and actually containing the exposure?

The North Korean threat actor tracked as Jade Sleet has been linked to a breach at an India-based IT services provider described as a "much smaller organization." According to SentinelOne, which disclosed the activity, the incident underscores the group's continued focus on targeting developers as an entry point into victim networks. The intrusion involved two backdoors, identified as FLATROOF and ROOFDECK, along with the use of Apple-related tooling as part of the attack chain. SentinelOne's findings indicate the adversary maintains its tradecraft of leveraging developer-focused environments to establish a foothold and move deeper into target organizations. Key points from the disclosure: Threat actor: Jade Sleet, a North Korean state-sponsored group Victim: an India-based IT services organization of limited size Malware families observed: FLATROOF and ROOFDECK backdoors Notable tactic: continued targeting of developers to gain initial access The smaller scale of the victim organization is notable, as it suggests Jade Sleet is not limiting its operations to large enterprises and may be casting a wider net across the IT services supply chain. Source: The Hacker News Does your organization monitor developer endpoints for signs of backdoor activity like FLATROOF or ROOFDECK?

A security breach at Gyazo, the image-sharing service operated by Kyoto-based Helpfeel, has exposed approximately 23.62 million user records, including email addresses and password hashes. The company disclosed the incident in a notice published on Wednesday. The breach also exposed roughly 490 million image metadata records. According to Helpfeel, these records mostly relate to images uploaded in January 2019 or earlier, and include the IDs that form Gyazo image links. Affected data at a glance: About 23.62 million user records, containing email addresses and password hashes About 490 million image metadata records, primarily for images from January 2019 or earlier Image link identifiers (the IDs that make up Gyazo image links) Helpfeel has not, in the information available, published a specific CVE identifier or advisory ID for this incident, so none is cited here. Users of the platform should treat credentials reused on other services as potentially compromised and rotate those passwords, particularly where the same email address and password combination was used elsewhere. Source: The Hacker News Have you checked whether your organization has accounts or embedded Gyazo links tied to the affected data, and if so, how are you handling credential rotation?

Attackers are now weaponizing new vulnerabilities in roughly five days, according to Mandiant (part of Google Cloud), while the median organization takes 43 days to patch a single one, per the Verizon DBIR 2026. A new free guide examines how autonomous AI agents are closing that gap, and what security leaders should demand before pointing one at production. One of the more striking findings highlighted in the guide is that exploitation has become the front door for attackers. It now starts 31% of breaches, based on the Verizon DBIR. The guide is aimed at CISOs and security leaders evaluating agentic pentesting tools for websites, with an emphasis on the questions and assurances that should come before any autonomous agent is aimed at production systems. Key points include: The speed mismatch between offensive and defensive timelines: about five days to weaponize versus 43 days to patch. Exploitation now initiates 31% of breaches per the Verizon DBIR. A new free guide covers how autonomous AI agents are being positioned to close that gap. Security leaders are urged to establish requirements before deploying an agent against production. Source: The Hacker News Has your organization started evaluating agentic pentesting tools, and what safeguards would you require before letting one touch production?

The Iran-linked hacktivist persona tracked as Handala Hack has been linked to a Telegram-based surveillance backdoor named HEAVYGRAM, along with a Delphi-based utility called CRUDEEXCLUDE, according to new research. HEAVYGRAM is designed to blend into Telegram traffic while providing its operators with a broad remote access toolkit. Its built-in commands support: Remote command execution System, network, and process information discovery Exfiltration of data and Telegram session files Screenshot capture DLL sideloading The backdoor's reliance on Telegram as a command-and-control channel makes its activity harder to distinguish from legitimate messaging traffic, while its ability to lift Telegram session files raises the risk of account takeover and further credential theft. The campaign also employs CRUDEEXCLUDE, a Delphi-based utility that appears to complement the backdoor's operations. The reporting ties both tools to the Handala Hack persona, which has been assessed as Iran-linked. Defenders should watch for unexpected Telegram-related processes and outbound traffic, unauthorized DLL sideloading activity, and signs of session file access on monitored endpoints. Source: The Hacker News Has anyone observed Telegram-linked command-and-control or session file theft in their environment, and how are you detecting it?

Identity visibility is emerging as a foundational requirement for modern identity security, largely because stolen and misused credentials remain one of the most frequently reported initial access vectors in breach research, including Verizon's annual Data Breach Investigations Report. The core argument is straightforward: you cannot secure what you cannot see, and in identity and access management (IAM), that visibility gap is where attackers tend to operate. The challenge intensifies in cloud and multicloud environments. Identities now span human users, service accounts, workloads, and machine-to-machine connections across multiple providers, which fragments the picture security teams rely on. When visibility is incomplete, unused or over-privileged accounts, stale credentials, and unusual access patterns can go unnoticed. Key capabilities that matter for building this foundation include: Continuous discovery and inventory of identities across cloud and on-premises systems Mapping of permissions and privilege levels to expose excessive access Monitoring of authentication and access behavior to detect anomalies Correlation of identity data across multicloud environments into a unified view The article frames identity visibility not as a one-time audit but as an ongoing operational discipline, and positions it as the necessary first step before enforcement, least-privilege policies, or threat detection can be effective. Source: The Hacker News Does your organization have full visibility into identities and permissions across all its cloud environments, or are there gaps you're still working to close?

The extortion gang ShinyHunters has breached the dark web data leak site belonging to the Clop ransomware operation, also tracked as Cl0p, defacing the Tor portal and claiming to have stolen server data along with the private keys for its onion service. According to reporting on the incident, the attackers replaced the contents of Clop's leak site with their own message and are now threatening to extort the ransomware crew itself — an unusual turn of events in which one criminal group targets another. Key details reported so far: The target was Clop's Tor-based data leak site, which was defaced. ShinyHunters claims to have exfiltrated server data from the site's infrastructure. The private keys for the onion service were allegedly stolen, potentially giving ShinyHunters control over the hidden service's address. ShinyHunters is now threatening to extort the Clop operation. The article does not provide a specific CVE identifier for this incident, and no advisory or tracking number is cited in the source material. The development is notable because Clop has been one of the more prolific ransomware and extortion operations in recent years, so a breach of its own leak infrastructure by a rival group raises questions about operational security within these crews and how such intragroup conflicts may play out. Source: BleepingComputer Do you think rival-gang attacks like this will become a bigger trend in the ransomware ecosystem, or is this an isolated incident?

Fast-growing organizations are flooded with advice on locking down Google Workspace, yet not all controls deliver equal protection. An upcoming webinar takes a practical look at this problem by walking through real-world breaches to identify which security controls genuinely matter, which ones may be overhyped, and where lean security teams should concentrate their limited time and budget. The session is aimed at teams that need to prioritize effectively rather than chase every recommendation. By grounding the discussion in actual breach scenarios, it promises to separate high-value defenses from measures that sound important but contribute less in practice. Source: Unknown Which Google Workspace controls has your team found most worth the investment, and which ones turned out to be less useful than expected?