Search: “verifiers”

6 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 25 AI research 25 AI safety & security 24 AI industry 22 Tools 15 Research 14 Industry 11 Phishing & fraud 11 Exploit / PoC 8 Malware 7 Data breach 7 Threat actor 7 Advisory 6 AI tools & infra 5

SeverityAll critical 3 high 36 medium 34 low 4 info 118

America's Driver's License Breach Is a National Security Disaster

Dark web service Nexus sells 153 million US/Canadian driver's licenses linked to a breach of identity verifier IDScan.

Krebs on Security revealed a dark web service, Nexus, selling access to 153 million driver's licenses and 3 million travel documents from US and Canadian citizens, roughly 63 percent of all US licenses. Circumstantial evidence links the data to identity verification firm IDScan, which confirmed it is investigating a breach, and the FBI is probing the incident. Licenses belonging to senior US officials, including Pete Hegseth, an FBI assistant director, and Krebs's own contacts were verified as genuine. The exfiltration appears ongoing, with the database growing by nearly 400,000 licenses in a single day, and the data carries significant national security value for foreign intelligence services.

Hacker News · securitySep 15, 15:58 UTC · 2d agoData breach HN 26↑ · 4 comments3· 1 read

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.

Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.

Security Affairsupdated Sep 17, 13:57 UTC · 1d agofirst Sep 16, 13:09 UTC · 2d agoData breach in the wild 2 sources

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Attackers breached Brevo, hijacked a Cloudflare API key, and injected ClickFix malware scripts served to visitors of 100,000+ websites including Trezor.

Brevo was hacked on September 10, 2026, via a vulnerability in its SAML SSO handling, exposing 138 accounts including crypto storage provider Trezor; attackers phished from six accounts and exported contacts from 43. On September 14 they used a compromised long-lived Cloudflare API key to deploy a worker that injected malicious scripts into brevo.com, sibforms.com, and three JavaScript files embedded in customer websites. The scripts showed fake 'Cloudflare, verify you are human' pages using the ClickFix technique and tried to install a malicious WordPress plugin for logged-in admins. Sansec estimates more than 100,000 websites were affected during roughly four hours; the API key was first misused in late August 2026.

SecurityWeek09:46 UTC · 4h agoData breach in the wild 5 sources1

Spain reports first alleged AI-powered data theft attack

Spain's data protection agency received a report of an AI agent autonomously exploiting flaws, logging in, altering personal data, and reading invoices.

The Spanish Data Protection Agency (AEPD) was notified of an incident in which an AI agent powered by a known LLM reportedly searched for vulnerabilities, gained access to systems, modified personal data, and accessed financial documents. AEPD has not yet investigated or verified the report but says it shows AI-related data breaches are no longer theoretical. The agency urged defenders to revise incident-response procedures, strengthen credential and identity security, and explicitly account for machine-speed AI-assisted attacks.

BleepingComputerSep 16, 17:26 UTC · 1d agoData breach in the wild 2 sources1

CenterPoint Energy Confirms Data Breach Exposing Customers’ Personal Information

CenterPoint Energy confirmed an unauthorized third party accessed customer personal data via an external system, disclosed in an SEC Form 8-K filing.

CenterPoint Energy disclosed in a September 14, 2026 Form 8-K that an unauthorized third party obtained personal information of some customers through one of the company's external systems. The company learned of the incident after an online post claimed possession of a customer dataset, then activated incident-response protocols and engaged external forensic specialists. Electric and gas delivery operations were unaffected and the company does not expect a material financial impact, though response, notification, and compliance costs are being incurred. The number of affected customers, data types, and threat actor remain undisclosed as the investigation continues.

GBHackersupdated Sep 16, 15:32 UTC · 1d agofirst Sep 16, 11:40 UTC · 2d agoData breach 5 sources1

Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far

TechCrunch's 2026 roundup covers SSA data exposure, Iranian water-utility attacks, Klue breach hitting ~200 firms, and Meta AI chatbot account hijacks.

TechCrunch's mid-year roundup highlights a whistleblower claim that DOGE uploaded a live Social Security database copy to an unsecured third-party server, which House Democrats called potentially the largest US breach in history. CISA reported Iranian hackers targeted over 100 US water providers over the summer, while Russian-linked attacks hit Polish, Swedish, and Norwegian energy and water infrastructure. Market research firm Klue was breached via a stale 2022 pilot credential, exposing cloud keys of ~200 customers including Jamf, HackerOne, and LastPass to extortion gang Icarus. Separately, tens of thousands of Instagram accounts were hijacked by abusing Meta's AI chatbot to trigger password resets to attacker-controlled emails.

TechCrunch · SecuritySep 15, 16:00 UTC · 2d agoData breach in the wild