Search: “data theft”

Hackers publish thousands of drivers’ data after breaching Florida motor vehicle database

ShinyHunters published hundreds of thousands of records from Florida's DAVID vehicle database, including SSNs and passports, after an unpaid ransom demand.

The ShinyHunters group published hundreds of thousands of files from Florida's DAVID motor vehicle database on its leak site, saying the victim did not pay a ransom. Stolen records include vehicle ownership certificates with names, addresses, and VINs, plus a smaller number of Social Security numbers, non-US passports, and immigration documents. FLHSMV confirmed the breach, which followed theft of a police officer's credentials stored on a personal device. It comes the same month as the IDScan hack exposing over 150 million driver's license images.

TechCrunch · Security·18:00 UTC · 5h agoData breach 3 sources

ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen

ID verification firm IDScan confirms hackers stole over 150 million driver's license records, including names and license numbers, from its cloud.

IDScan confirmed that threat actors stole driver's license records — full names, license numbers, and other government ID numbers — from the company's cloud systems during a roughly year-long intrusion. Brian Krebs previously reported a dark web service exposing data on over 150 million US and Canada residents, including license photos and records of high-profile individuals such as Defense Secretary Pete Hegseth. The FBI is investigating, and IDScan indicated hackers apparently demanded payment for full access to the stolen cache; the investigation is ongoing.

TechCrunch · Security·updated Sep 11, 09:59 UTC · 5d ago·first Sep 10, 13:21 UTC · 6d agoData breach in the wild 4 sources1

CenterPoint Energy confirms customer data stolen in cyberattack

CenterPoint Energy confirms attackers stole customer personal data, with a threat actor leaking 7.49 million records scraped from an unprotected API.

CenterPoint Energy, a utility serving about 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, confirmed in an SEC filing that an unauthorized third party obtained customer personal information via an external-facing system. A threat actor using the alias "4d722e4d656f77" leaked 7.49 million records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The actor claims the data was exfiltrated by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting and WAF protections. Electric and gas services were not impacted, but multiple federal class-action lawsuits have already been filed.

BleepingComputer·updated 15:32 UTC · 7h ago·first Sep 15, 16:40 UTC · 1d agoData breach 5 sources

Spain reports first alleged AI-powered data theft attack

Spain's data protection agency received a report of an AI agent autonomously exploiting flaws, logging in, altering personal data, and reading invoices.

The Spanish Data Protection Agency (AEPD) was notified of an incident in which an AI agent powered by a known LLM reportedly searched for vulnerabilities, gained access to systems, modified personal data, and accessed financial documents. AEPD has not yet investigated or verified the report but says it shows AI-related data breaches are no longer theoretical. The agency urged defenders to revise incident-response procedures, strengthen credential and identity security, and explicitly account for machine-speed AI-assisted attacks.

BleepingComputer·17:26 UTC · 6h agoData breach in the wild 2 sources

US charges 17 Iranian hackers over 31-terabyte academic data theft

US indicts 17 Iranian Mabna Institute hackers who stole 31TB of academic data from universities, companies, and agencies via spearphishing.

The US Department of Justice charged 17 alleged Mabna Institute members, adding eight defendants to the nine charged in 2018, for a 2013-2017 campaign largely conducted for Iran's Islamic Revolutionary Guard Corps. The group stole over 31TB of academic data and intellectual property from 144 US and 178 foreign universities, at least 42 US companies, and at least five federal and state agencies, compromising about 8,000 of 100,000 spearphished professor email accounts. US universities spent roughly $3.4 billion procuring the stolen data; one defendant also hacked HBO and sought about $6 million in bitcoin ransom. The State Department offers up to $10 million for information on five defendants, none of whom are in US custody.

Help Net Security·Aug 20, 00:00 UTC · 27d agoPolicy & legal in the wild

Extortion crews have their eyes on high-value AI data, Google warns

Google's Mandiant warns extortion crews now steal proprietary AI models, prompts, and research for ransom, while threat actors automate attacks with agentic AI.

Google's AI Threat Tracker details intrusions in which extortion crews exfiltrated healthcare drug research and a proprietary AI model, and stole an AI media company's source code, prompts, skills, model scripts, and secrets, threatening leaks unless paid. TeamPCP (UNC6780), behind large open-source supply chain attacks on PyPI, npm, and Docker Hub since March, used a malicious GitHub Actions workflow to exfiltrate a company's proprietary AI repository. Mandiant also observed a fully autonomous multi-agent credential-harvesting cloud intrusion completed in under six hours, and a China-linked espionage group using Gemini to build a dynamic automated penetration-testing framework.

The Register · Security·Sep 8, 12:00 UTC · 8d agoThreat actor in the wild 2 sources1

IT Help Desk Impersonation Lets Hackers Bypass MFA

Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.

Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.

Security Affairs·Sep 8, 07:41 UTC · 8d agoPhishing & fraud in the wild1

Berlin refuses to be blackmailed after network breach

Rhysida extorts Berlin's state government after stealing 5.79 TB across 1.44 million files, demanding roughly 2 million euros in bitcoin.

Berlin's state government confirmed an extortion attempt after data theft from its administrative network between August 7 and 12, with affected departments disconnected only on August 14. The Rhysida ransomware gang lists 5.79 TB across 1.44 million files on its leak site, including HR files, contracts, 148 IBANs, personal data on 12,076 individuals, and plaintext credentials from internal systems including Berlin's leadership. Der Spiegel reports a 30 bitcoin demand of about 2 million euros; officials say the city will not pay and investigators include the State Criminal Police Office and federal agencies. Forensics revealed additional leaks in the Senate Department for Mobility, Transport, Climate Protection and the Environment, while the Berlin House of Representatives election environment is reported secure.

Help Net Security·Sep 1, 00:00 UTC · 15d agoRansomware in the wild

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog·Sep 2, 22:51 UTC · 14d agoThreat actor in the wild

ShinyHunters claims Florida DMV breach, puts data on the clock

ShinyHunters claims it breached Florida DMV's DAVID database, stole 200,000+ driver records including SSNs, and set a September 11 extortion deadline.

The ShinyHunters extortion group claims it breached the Florida Department of Highway Safety and Motor Vehicles' DAVID driver and vehicle database and stole more than 200,000 records. As evidence it published a screenshot of a Jeffrey Epstein record showing address, Social Security number, date of birth, license number and registered vehicles, and set a September 11 deadline before publication. The group says it obtained access through a password-reset weakness, compromised employee accounts, and queried and downloaded driver records and images. The Florida DMV has not confirmed the claim; it follows a separate confirmed IDScan.net breach exposing over 153 million license scans that prompted an FBI investigation.

CSO Online·Sep 9, 11:25 UTC · 7d agoData breach in the wild1

BigBear phishing crew nets thousands of Microsoft 365 credentials

CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.

CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.

The Register · Security·Sep 8, 13:26 UTC · 8d agoPhishing & fraud in the wild1

Berlin investigates new data leak after hackers publish stolen login credentials

Berlin investigates a fresh leak after Rhysida hackers published stolen login credentials; the city refuses to pay the ransom demand.

Berlin confirmed hackers published additional stolen data, including login credentials, from a mid-August cyberattack on two city ministries responsible for urban development/housing and transport/climate. The Rhysida ransomware group claimed the breach in late August, saying it stole 5.79 TB of data including contracts, emails, passwords and classified information; Berlin acknowledged an extortion demand but refused to pay. Berlin's data protection regulator said the leak includes personal data on public employees and possibly residents, such as names, addresses, dates of birth and bank information. Germany's BSI separately linked the campaign to the TerminalFix fake-CAPTCHA technique and the LoremIpsumLoader/AxolotLoader malware tied to financially motivated Rhysida-associated hackers, days before Berlin's Sept. 20 election.

The Record·Sep 7, 11:50 UTC · 9d agoRansomware in the wild1

Conti Ransomware Hacker Sentenced After Group Attacked Over 1,000 Victims Worldwide

Ukrainian national Oleksii Lytvynenko sentenced to four years in US prison for his role in Conti ransomware attacks on 1,000+ victims.

Oleksii Oleksiyovych Lytvynenko, 44, pleaded guilty to conspiracy to commit wire fraud for working as a developer and intruder in the Conti ransomware operation, coding a malware loader and handling data stolen from 12 victims. Conti compromised over 1,000 victims across 47 US states and 31 foreign countries between 2020 and 2022, generating more than $150 million in ransoms. He was arrested in County Cork, Ireland in July 2023 and extradited to the US. The sentencing is part of a wider US investigation into the Conti and TrickBot ecosystem.

Cyber Security News·updated Sep 11, 16:07 UTC · 5d ago·first Sep 11, 12:31 UTC · 5d agoPolicy & legal 7 sources

Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson

Hackers claim theft of millions of patient records from US healthcare distributor McKesson, which confirmed a hack and expects service degradation.

McKesson, which distributes medicines and medical devices to hospitals and healthcare practices across the US, said it was hacked. Threat actors claim millions of patient records were stolen in the breach. The company said it expects intermittent service degradation as it responds to the incident.

TechCrunch · Security·Aug 31, 18:10 UTC · 16d agoData breach in the wild

Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks

Revolut handed over KYC documents, selfies, and Bitcoin transaction histories to attackers after a fraudulent email from a genuine government domain passed authentication checks.

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer KYC data to an unauthorized third party after a fraudulent information request was sent from an email account operating inside a real government agency's domain, carrying valid domain authentication credentials. The exposed data included identity documents (passports, driver's licenses), verification selfies, birth dates, contact details, IBANs, account statements, and full transaction histories including Bitcoin. Revolut discovered the fraud only after independently verifying with the agency, blocked the sender, and notified law enforcement and financial regulators, but did not disclose the number of affected customers or the agency involved. Researcher ZachXBT assessed the operation was targeted at high-net-worth users, useful for fraud, impersonation, or extortion.

Security Affairs·Sep 12, 21:05 UTC · 4d agoData breach

France’s tax authority admits hackers made off with data on 678,000 individuals

An attacker used stolen credentials and an MFA bypass to steal tax data on 678,000 individuals from France's tax authority DGFiP.

France's General Directorate of Public Finances (DGFiP) disclosed that intrusions into its portals exposed tax data, including reference tax income, family quotient, withholding tax rate, and business identifiers such as company name and SIREN number, on 678,000 individuals and professionals. An attacker using the alias 'ZeroBytes' claimed credit on a cybercrime forum and offered a stolen database for sale, claiming the portal contains data on roughly 20 million citizens. DGFiP suspended the affected accounts, notified the CNIL, and is working with ANSSI and the finance ministry's security office; it said the main online tax portals and their login credentials were not compromised.

Help Net Security·Aug 17, 00:00 UTC · Aug 17, 2026Data breach

ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up

ENISA warns frontier AI compresses attack lifecycles to minutes, with exploits possible within 15 minutes of disclosure and median 72-minute breach-to-exfiltration times.

ENISA's July 2026 paper 'ENISA's view on Cybersecurity in the Frontier AI Era' argues AI-assisted attackers may weaponize vulnerabilities within 15 minutes of disclosure and achieve initial-access-to-data-exfiltration in a median 72 minutes, creating a 'negative time-to-exploit' problem. The report cites one organisation whose CVE volume rose from roughly 80 in Q1 2025 to almost 500 in Q1 2026, then about 500 reports per day when frontier-AI tools were used. ENISA recommends machine-speed defence under 'Cybersecurity as Code', EPSS and VEX-based prioritisation, AI-assisted incident response with human oversight, and an assume-breached architecture.

Security Affairs·Sep 14, 20:35 UTC · 2d agoAdvisory

Three intrusions at UK criminal records office went undetected for two years

UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.

The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.

The Record·Aug 12, 13:08 UTC · Aug 12, 2026Data breach in the wild

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

The GTA VI leaks are breaking the internet. Security researchers have seen this before.

A hacker or insider leaked GTA VI gameplay footage before launch, triggering Take-Two DMCA subpoenas against Discord, Google, Microsoft and X.

The persona "CyberLeek" published stolen Grand Theft Auto VI gameplay footage and a manifesto, in what experts call a familiar data extortion playbook with monetization via watermarks, crypto wallets and a memecoin. Take-Two Interactive obtained DMCA subpoenas against Discord, Microsoft and X, and sent copyright notices to Google, treating the case like an insider threat investigation. GTA VI is projected to earn $3.3–5.2 billion in launch-week sales, raising financial and reputational stakes. Related leak websites went offline after the subpoenas.

CyberScoop·Aug 26, 01:54 UTC · 21d agoData breach

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise·Sep 9, 00:00 UTC · 7d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Electronic health record company says customer data stolen in breach

Veradigm disclosed that attackers used stolen vendor credentials via an API to steal patient data including Social Security numbers, as the Gentlemen ransomware gang claims 3.5 million patients' records.

Electronic health records company Veradigm filed an 8-K with the SEC stating that an unauthorized party obtained credentials from a vendor's environment and used them to access a Veradigm API, downloading patients' personal data including Social Security numbers; no clinical or medical data was involved. The Gentlemen ransomware gang added Veradigm to its leak site, claiming theft of 3.5 million patients' health records. Access was limited to the specific API interface, with no operational disruption. Veradigm was previously hit by SamSam ransomware in 2019 and disclosed a December 2024 breach affecting 2,672,036 people.

The Record·Sep 9, 17:03 UTC · 7d agoData breach in the wild

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop·Sep 9, 13:00 UTC · 7d agoPolicy & legal

Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!

Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.

Risky Business News, citing Google Threat Intelligence Group (GTIG), reports that cybercriminals are shifting from encrypting ransomware to data theft extortion. Law firms Goodwin Procter and WilmerHale paid Silent Ransom (Luna Moth) ransoms of $10 million and $18 million respectively; GTIG says the group often completes contact-to-extortion in a single day, now sometimes compromising systems in person posing as IT staff. BlackFile, now calling itself Redact, used high-volume vishing to steal credentials and pivot through OneDrive, SharePoint and other SaaS apps, collecting more than $10 million between February and mid-May with an average ransom of $750,000, including attempted attacks on Wall Street hedge funds and private equity firms. The piece argues governments should keep pressure on encrypting ransomware gangs while lower-impact extortion absorbs criminal energy.

Risky Business News·Aug 13, 09:46 UTC · Aug 13, 2026Threat actor1

Ransomware negotiation tactics have turned into a business process

Intel 471's Dave Ross details ransomware negotiation tactics, with demands typically set at 1-5% of annual revenue and specialized criminal service roles.

In a Help Net Security video, Intel 471 Senior Director Dave Ross explains how ransomware groups research a victim's revenue and insurance coverage, run test decryptions to prove they hold a working key, and set demands at roughly 1% to 5% of annual revenue. He describes negotiation dynamics with shifting deadlines and a criminal service economy supplying language skills, data review, and legal analysis. Multi-extortion methods include data theft, DDoS attacks, and direct contact with customers and journalists.

Help Net Security·Sep 8, 05:40 UTC · 8d agoRansomware

River Bank obtained assurances from the attackers that the stolen data in the June attack was deleted

Security Affairs·Aug 3, 14:34 UTC · Aug 3, 2026Data breach

OpenAI puts major frontier AI training run on hold over cyber risks

OpenAI paused its largest frontier RL training run for two weeks to harden research environments after Astra showed potentially critical cybersecurity capability.

OpenAI temporarily paused reinforcement learning on its latest deployment-bound models for two weeks while it hardened and red-teamed research environments and expanded monitoring. The pause followed the OpenAI-Hugging Face incident and preliminary evidence that the upcoming Astra model may meet the Critical cybersecurity capability threshold in its Preparedness Framework. The company described activation classifiers inspecting every sampled token with 30-minute alerting targets, stronger isolation and network restrictions for code execution, and broader alignment coverage across RL training stages, plus a planned Preparedness Framework update.

Help Net Security·Aug 19, 00:00 UTC · 28d agoAI safety & security

ShinyHunters hackers claim breach of Florida "DAVID" DMV database

ShinyHunters claims it breached Florida's DAVID DMV database via a password-reset flaw, stealing 200,000+ driver records including SSNs.

The ShinyHunters extortion gang added Florida FLHSMV to its leak site, claiming theft of over 200,000 driver records from the DAVID platform since September 3. As proof, the group published a screenshot of Jeffrey Epstein's DMV record showing address, Social Security number, driver's license ID, and registered vehicles. The gang says it compromised DMV employee and FBI agent accounts via a password-reset flaw and iterated through records by ID. Access has reportedly been lost and the flaw is being patched, but ShinyHunters expects to announce breaches of other states' DMV platforms.

BleepingComputer·Sep 8, 16:35 UTC · 8d agoData breach

4.1 Million Impacted by AdaptHealth Data Breach

AdaptHealth disclosed a breach affecting 4,115,802 people after a socially engineered attacker stole health and insurance data from cloud-based patient systems.

A threat actor used social engineering to hijack a user session at a third-party contractor and gained access to AdaptHealth cloud applications, including patient management and document storage systems, in early June. Names, contact and demographic information, and health and health insurance data were exfiltrated; Social Security numbers and financial information were not affected. AdaptHealth reported 4,115,802 affected individuals to HHS, whose breach portal listed the incident this week; Baylor Genetics separately reported 2,810,878 individuals affected in a related June healthcare breach.

SecurityWeek·Sep 10, 11:20 UTC · 6d agoData breach

McKesson confirms cyber incident after ShinyHunters claims patient-data theft

Healthcare giant McKesson confirmed a cyber incident after ShinyHunters claimed theft of hundreds of millions of patient records.

McKesson acknowledged a data breach following public claims by the threat actor group ShinyHunters that it stole hundreds of millions of records containing patient data. The company confirmed a cyber incident occurred but the full scope of the theft has not yet been independently verified. ShinyHunters is known for large-scale data theft and extortion against major organizations. The healthcare sector remains a frequent target for data-theft extortion groups.

Malwarebytes Labs·Aug 31, 14:46 UTC · 16d agoData breach

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.

ANY.RUN research links the Mirage2FA phishing-as-a-service toolkit to 4,532 unique organization email domains between 2024 and 2026, with the US accounting for 63.7% of victims. The kit uses adversary-in-the-middle login flows to harvest credentials and session cookies, bypassing MFA on Microsoft 365 accounts. Researchers recorded more than 9,000 potential compromise events and estimated 48% of targeted email addresses were potentially compromised. Hijacked sessions extend to SSO-connected services, enabling impersonation, fraud and further compromise.

The Hacker News·Aug 25, 11:56 UTC · 22d agoPhishing & fraud in the wild

Revolut confirms customer data breach, falling for fake government requests

Revolut confirmed a breach of sensitive customer data after complying with forged government information requests.

Revolut confirmed that sensitive customer data was exposed after the fintech fell for fake government data requests, Reuters reported. The incident is a form of legal-process fraud in which attackers impersonate law-enforcement or government agencies to trick compliance teams into disclosing user data. The number of affected customers and specific data types were not detailed in the available text.

Hacker News · security·updated Sep 14, 11:20 UTC · 2d ago·first Sep 12, 17:19 UTC · 4d agoData breach 3 sourcesHN 20↑ · 2 comments

Apollo discloses data breach from ongoing wave of attacks hitting financial sector

Apollo Global Management confirmed a breach of cloud platforms by BlackFile-linked social engineering attackers, exposing personal data including Social Security numbers.

Apollo Global Management disclosed that attackers accessed some of its cloud platforms between July 6 and July 10, 2026. The company determined on August 12 that compromised data included names, dates of birth, contact information, home addresses, and Social Security numbers. Google attributed the broader campaign against financial sector organizations to BlackFile, a threat group affiliated with The Com that operates extortion brands Redact, Pink, Helix, and Falcon. Apollo, which manages $1.05 trillion in assets, is the first victim to formally confirm sensitive personal data was compromised in this wave, with Blackstone and Bain Capital also reportedly targeted.

CyberScoop·Aug 21, 19:14 UTC · 26d agoData breach in the wild

Revolut handed customer data to fraudsters using government email account

Revolut handed sensitive KYC data of high-net-worth crypto customers to fraudsters submitting fake emergency data requests from a compromised government email domain.

Revolut confirmed it disclosed sensitive customer data—including passport and driver's license copies, verification selfies, bank statements, IBANs, and Bitcoin transaction histories—to attackers who submitted fraudulent emergency data requests from a legitimate government agency email account, apparently an Italian domain. Targets were high-net-worth individuals involved in crypto, including Marc Karpelès and entrepreneur Marc Zeller. A Telegram account claiming responsibility posted stolen data as proof and demanded an extortion payment; the account has since been suspended. Revolut says only a limited number of customers were affected and has alerted the relevant government agency, law enforcement, and regulators. The technique mirrors 2021-2022 Lapsus$-linked fraudulent emergency data request scams against Apple, Meta, and Discord.

The Record·Sep 14, 12:00 UTC · 2d agoData breach

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackers·Sep 9, 07:05 UTC · 7d agoMalware in the wild1

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net Security·Aug 26, 09:40 UTC · 21d agoIndustry2

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.

GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.

The Hacker News·Aug 18, 17:35 UTC · 29d agoThreat actor in the wild1

Snowflake hacker pleads guilty, faces up to 32 years in prison

Help Net Security·Aug 6, 00:00 UTC · Aug 6, 2026Ransomware

Troy Hunt

Troy Hunt warns ShinyHunters' Carhartt breach claim of 50GB and millions of records is unverified, while Sri Lanka joins Have I Been Pwned.

Troy Hunt's blog roundup centers on a cautionary tale about data breach claims: ShinyHunters claims it compromised Carhartt and stole over 50GB of compressed data containing millions of customer records, employee information and loyalty data, but Hunt stresses criminal claims require verification. The feed also covers Sri Lanka CERT becoming the 48th government onboarded to Have I Been Pwned's free government monitoring service, following Nepal as the 47th. Other commentary addresses ransomware economics, Brinks Home's lawyer-heavy extortion FAQ, and the Origin Energy breach in Australia.

Troy Hunt·Sep 7, 00:00 UTC · 9d agoData breach1