Kroll: tech-firm breaches drove most third-party victim impact
From June 2025 to June 2026, tech compromises accounted for 60% of all breach victims Kroll counted.
48
Threat actor
Scattered Spider
- Mentions · 7d0
- Mentions · 30d9
- All mentions19
- First seenAug 28, 2026
- Last mentioned7d ago
Timeline
19 articles · newest firstExaforce says GitHub token theft and vishing drain data in minutes
A dormant OAuth token pulled 472 of 638 repositories; ClickFix and help-desk vishing followed the same pattern.
36
Scattered Spider uses help-desk calls to bypass MFA
Flare says a help-desk call alone does not prove the group, and CISA urges phishing-resistant MFA.
52
Flare says Scattered Spider, LAPSUS$ and ShinyHunters are separate clusters
Shared branding does not prove one gang; Flare treats original LAPSUS$ as defunct after September 2022.
48
Ransomware gets personal: 'We-know-where-you-are kind of stuff'
Semperis survey finds 37% of ransomware cases include psychological or physical threats against staff and families.
66
Another ShinyHunters suspect arrested
Authorities arrested a teenage ShinyHunters suspect in Jordan, the second member detained after a Dutch arrest.
74
Social Engineering Detection Moves Into the Live Conversation
Netarx launches live-conversation detection that rates callers green, amber, or red to catch deepfake social engineering.
30
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
Jordan detained ShinyHunters suspect Rey, who is reportedly helping the FBI identify other members.
76
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
Jordan reportedly detained ShinyHunters suspect Saif al-Din Khader, who is helping the FBI find other members.
67
Recorded Future Launches MCP, the Intelligence Layer for Agentic Security Operations
Recorded Future made its MCP generally available so AI agents can query its threat intelligence.
48
Accelerating vision-language models with LFM2.5-VL-DSpark
OpenAI's AI agents launched on keychain and broke into an Australian government portal; Meta's AI assistant is now on keychain; industry news on AI security and tooling.
0
Academic publisher Elsevier hit by LAPSUS$ redirect attack
Elsevier says a short-lived LAPSUS$ compromise redirected some visitors to a criminal leak page.
62
Jun Kim, oMLX creator and maintainer, joins Hugging Face to support the MLX community
An anonymous comment can run code if an admin opens the page, using a crafted link to install a theme and execute commands with admin access. These are stack-based buffer overflow vulnerabilities in CGI of Zyxel…
40
A Global Comparison of Schemas, Transparency, and Interoperability in Public-Sector AI Registers and Inventories
A study of public-sector AI registers and inventories finds missing data and proposes a layered visibility framework for transparency and interoperability.
70
Early Scattered Spider member pleads guilty to cybercrime spree
Early Scattered Spider member Ahmed Elbadawy pleaded guilty to wire fraud conspiracy and identity theft, with prosecutors seeking $17.6 million in forfeiture.
62
Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal
A new DOT rule exempts airlines from providing meal vouchers or hotels for cyberattack-caused delays if carriers comply with applicable cybersecurity regulations.
45
MFA's Weakest Link: Account Recovery Is the New Attack Path
Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.
32
Keepnet launches free SMS/Call Reporter for iOS
Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.
22
ATF confirms cyberattack hit system containing info on its investigation targets
Qilin ransomware group claimed breaching the ATF, exposing data on investigation targets; the agency says a standalone system was hit with no mission impact.
78
Appears with
- FBIorganization · 8
- ShinyHuntersthreat actor · 7
- Microsoftvendor · 6
- Lapsus$threat actor · 6
- Microsoftorganization · 4
- CISAorganization · 3
- Scattered Lapsus$ Huntersthreat actor · 3
- FBIvictim · 3
- The Comthreat actor · 3
- Instructurevictim · 2
- Hellcatthreat actor · 2
- Octo Tempestthreat actor · 2
- LockBitthreat actor · 2
- PeopleSoftproduct · 2
- Oraclevendor · 2
- Hugging Facevendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.