Search: “messaging”

5 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 32 Advisory 21 AI safety & security 19 Vulnerability 18 Malware 16 Exploit / PoC 14 Threat actor 13 Phishing & fraud 10 Research 9 Data breach 8 Policy & legal 6 AI research 4 Industry 4 AI tools & infra 2

SeverityAll critical 15 high 45 medium 41 low 6 info 71

Hackers reveal how Flock cameras really track cars and people

Hackers tore down a Flock Safety camera, dumped its storage, recovered an encryption key, and revealed its software detects people as well as vehicles.

Hackers from a collective calling itself stegan0gram removed a Flock Safety camera from service, made a near-complete copy of its storage, and recovered an encryption key stored on the device that unlocked thousands of vehicle-detection videos, sharing the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis of about 21 days of logs shows more than a million images, roughly 28 photos per passing vehicle, and Flock-built apps that detect people, bicycles, and even bumper stickers, while plate inference happens on Flock's servers. Flock had previously downplayed early-2025 root-access research by Jon Gaines, and records from Alpharetta, Georgia were searchable by over 2,000 agencies via Flock's national network.

Ars Technica · Security09:43 UTC · 1h agoData breach in the wild 4 sources

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.

Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.

Security AffairsSep 16, 13:09 UTC · 22h agoData breach in the wild

Revolut Data Breach Via Fake Government Requests – What We Know So Far

Revolut confirmed attackers extracted customer KYC records by sending fraudulent data requests from a spoofed or compromised government agency email domain.

Revolut confirmed a data breach in which an unauthorized party obtained sensitive customer records by submitting fraudulent information requests from an email account on a legitimate government agency domain with valid SPF/DKIM/DMARC authentication. Disclosed data could include full names, dates of birth, passport or driving-license copies, onboarding facial images, IBANs, account statements, withdrawal records, and complete transaction histories including Bitcoin activity. Crypto investigator ZachXBT assessed the operation targeted high-net-worth users, while a threat actor using the name 'IAmNotAVillain' claimed Italian law-enforcement departments were compromised over six months with 147 GB of material, claims that remain unverified. Revolut says only a limited number of customers were affected, blocked the email address, and notified regulators and affected customers, stating its systems and funds were not compromised.

Cyber Security NewsSep 15, 03:46 UTC · 2d agoData breach

Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen

CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records, including partial Social Security numbers, via an unprotected API.

CenterPoint Energy disclosed in an SEC 8-K filing that an unauthorized third party obtained personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed on a cybercrime forum to have extracted over 7.49 million records, including names, addresses, account numbers, billing data, and partial Social Security numbers, via an API lacking authentication, rate limiting, and WAF protection. The company confirmed the breach but not the record count; energy services were unaffected and the investigation is ongoing.

Security Affairsupdated Sep 16, 15:32 UTC · 19h agofirst Sep 16, 08:19 UTC · 1d agoData breach in the wild 5 sources

Japan’s Digital Agency Breach Exposes 240,000+ Users’ Personal Records to Hackers

Attackers exploited a patched VPN appliance flaw to breach Japan's Digital Agency shared government platform, exposing about 246,000 personal records.

Japan's Digital Agency disclosed on September 11 that attackers exploited a VPN appliance vulnerability to access the Government Solution Service (GSS), a shared IT platform across ministries, exposing roughly 246,000 personal records. The attacker was active since late May using a maintenance staffer's credentials, with suspicious activity detected June 25 and containment on July 9. Exposed data covers about 189,000 employees/public officials and 57,000 contractors; no My Number, bank, or pension data was included. The VPN flaw was medium severity with a patch already available, and the 78-day detection-to-disclosure gap has drawn scrutiny.

Cyber Security NewsSep 15, 14:43 UTC · 1d agoData breach in the wild 2 sources