Search: “security-data-lake”

CenterPoint Energy confirms customer data stolen in cyberattack

CenterPoint Energy confirms attackers stole customer personal data, with a threat actor leaking 7.49 million records scraped from an unprotected API.

CenterPoint Energy, a utility serving about 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, confirmed in an SEC filing that an unauthorized third party obtained customer personal information via an external-facing system. A threat actor using the alias "4d722e4d656f77" leaked 7.49 million records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The actor claims the data was exfiltrated by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting and WAF protections. Electric and gas services were not impacted, but multiple federal class-action lawsuits have already been filed.

BleepingComputer·updated Sep 16, 15:32 UTC · 11h ago·first Sep 15, 16:40 UTC · 1d agoData breach 5 sources

Florida says motor vehicle data breach tied to credentials stolen from officer’s personal device

ShinyHunters breached Florida's DMV using credentials stolen from a police officer's personal device; the state confirmed the breach and is investigating.

Florida's Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach after ShinyHunters obtained DMV data using credentials a criminal actor took from a Plant City police officer's personal electronic device. The department learned of the breach on September 4, is investigating with the Florida Digital Service, and ShinyHunters shared a DMV record of Jeffrey Epstein as proof of access. Experts initially speculated a link to the IDScan breach of 153 million driver's licenses. Anthropic reported that suspected ShinyHunters affiliates use AI to scan credentials, map systems, and exfiltrate data, in one case moving from a stolen developer token to cloud admin access in about three hours.

The Record·updated Sep 16, 18:00 UTC · 8h ago·first Sep 11, 20:00 UTC · 5d agoData breach in the wild 3 sources

What the Data Says About AI in Security Operations in 2026

Prophet Security's 2026 survey of 250+ security pros: 40% use AI daily; AI users report 25%+ faster investigations and rising AI-driven attacks.

Prophet Security's State of AI in Security Operations 2026 report, based on a survey of 250+ cybersecurity professionals, found 40% of security teams use AI daily and only 4% have no adoption plans. Teams average 100 daily alerts (up to 1,000 at large firms), leave 28% of alerts uninvestigated, and 60% of respondents said missed alerts led to breaches or downtime. Among AI adopters, 72% report at least 25% faster investigations, 56% observed increased AI-driven attacks, and no respondents grant AI full unsupervised autonomy. Data privacy (44%) and explainability (41%) top the adoption hurdles.

The Hacker News·Aug 27, 11:30 UTC · 20d agoIndustry

Security Data Isn’t the Problem. Security Context Is.

Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.

Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.

Horizon3.ai·Sep 15, 13:12 UTC · 1d agoTools

Cyberattack encrypts systems at Bavarian municipal utility

Hackers encrypted the central IT network of Bavarian utility Stadtwerke Landsberg, disrupting office systems but not electricity or water services.

Stadtwerke Landsberg said hackers encrypted its central IT network overnight on Sept. 1, prompting disconnection from the internet, crisis-team activation and external forensic support. Essential electricity and water services were unaffected, but staff availability was limited and customer data such as names, addresses and bank details may have been accessed. No ransomware group was named and no extortion demand was confirmed. The attack follows a similar late-June encryption incident at a North Rhine-Westphalia municipal utility, and the BSI consistently ranks ransomware among Germany's most serious cyber threats.

The Record·Sep 8, 12:00 UTC · 8d agoRansomware in the wild

Latvian officials resign after cyberattack exposes data on 1.2 million people

Latvia's road traffic agency CSDD confirmed a breach exposing data on 1.2 million people and 200,000 businesses, prompting leadership resignations.

Latvia's Road Traffic Safety Directorate (CSDD) said hackers accessed payment receipt data dating back to 2008, covering over 1.2 million people and 200,000 legal entities, about two-thirds of Latvia's population. Stolen data includes personal ID numbers, license plates, payment amounts and addresses; phone numbers, emails and passwords were not affected. CERT.LV said attackers exploited a vulnerability in an internet-exposed CSDD system, and President Edgars Rinkevics called the breach a significant national security threat. The supervisory board resigned and chief Aivars Aksenoks said he will leave; state police opened criminal proceedings while responsibility with IT contractor Tet is disputed.

The Record·Aug 19, 13:55 UTC · 28d agoData breach

Electric and gas utility CenterPoint Energy warns of data breach after dark web post

CenterPoint Energy confirmed hackers stole customer personal data from an external-facing system after a dark web post claimed 7.5 million records.

Texas utility CenterPoint Energy filed an SEC 8-K disclosing that a dark web post claimed to sell data stolen from the company, and an investigation confirmed personal information was taken from an external-facing system. The criminal post claims about 7.5 million records including customer names, account information, last four Social Security digits and billing data. Electric and gas service was not impacted; the company serves 7 million customers across Indiana, Minnesota, Ohio and Texas, and previously disclosed a 2023 breach via a file-sharing platform.

The Record·Sep 15, 14:22 UTC · 1d agoData breach

Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data

CenterPoint Energy confirmed hackers stole customer personal data from an external-facing system after a forum leak of 7.5 million records.

CenterPoint Energy, a Houston-based utility serving roughly 7 million customers across Indiana, Minnesota, Ohio and Texas, told the SEC that an unauthorized third party obtained customer personal information through an external-facing system. On September 12 a hacker claimed to have stolen nearly 7.5 million records and posted a 2.5 GB archive on a cybercrime forum, threatening to attack main infrastructure next. The company says electric and gas delivery is unaffected and it expects no material impact. Earlier 2024 leak claims were attributed to Cl0p's 2023 MOVEit campaign via a third party.

SecurityWeek·Sep 15, 15:30 UTC · 1d agoData breach

Metabase zero-day exploited to access Framework customer data

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Exploit / PoC

Data access: the hidden cost of security vendor lock-in

Elastic compares SIEM data egress cost, latency, and fidelity across CrowdStrike, Microsoft, Google, and Splunk, arguing vendors engineer lock-in.

Elastic Security Labs published an opinion piece comparing how major SIEM and security vendors handle data egress, based on each vendor's public documentation as of September 2026. It rates CrowdStrike Falcon Data Replicator and Palo Alto Networks XSIAM Event Forwarding as restricted (paid add-ons with batch delays), Microsoft as partially open, Splunk as open, and Elastic as open with no export license. The piece argues frictionless ingestion paired with licensed or delayed egress is an intentional lock-in business model, and cites CrowdStrike's 2026 Global Threat Report eCrime breakout time of 29 minutes to argue real-time telemetry access is now essential.

Elastic Security Labs·Sep 4, 00:00 UTC · 13d agoIndustry

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble·Sep 10, 10:45 UTC · 6d agoMalware1

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security Blog·Sep 9, 21:30 UTC · 7d agoTools

Mathspace breach exposes data on over a million students and parents

Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.

Help Net Security·Sep 8, 08:45 UTC · 8d agoData breach in the wild

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AI·Sep 7, 11:00 UTC · 9d agoAI industry

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputer·updated Sep 16, 14:54 UTC · 11h ago·first Sep 11, 17:26 UTC · 5d agoPhishing & fraud in the wild 9 sources2

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.

CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.

Infosecurity Magazine·Sep 16, 14:00 UTC · 12h agoAdvisory

Metabase Zero-Day Exploited in the Wild, Exposing Admin Access and Sensitive Data

Security Affairs·Aug 8, 11:53 UTC · Aug 8, 2026Exploit / PoC in the wild

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CR·Sep 9, 07:03 UTC · 7d agoResearch

Mathspace Data Breach Exposes Over 1 Million People

Mathspace breach exposed data of 1,079,819 Australian and New Zealand users via exploited Metabase zero-day CVE-2026-72898; ShinyHunters claimed responsibility.

Mathspace disclosed a breach affecting 1,079,819 students, teachers, staff, and parents in Australia and New Zealand. Attackers exploited the Metabase SQL injection zero-day CVE-2026-72898 (CVSS 10), patched August 6, and accessed Mathspace's self-hosted instance from August 10; ShinyHunters claimed the Metabase hacks. Exposed data includes names, usernames, emails, and login dates; no passwords, academic records, or credentials were taken.

SecurityWeek·Sep 8, 10:47 UTC · 8d agoData breach in the wildCVE-2026-72898

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CR·Sep 14, 11:54 UTC · 2d agoResearch1

Mathspace discloses data breach affecting over 1 million people

Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Mathspace confirmed attackers exploited a vulnerability in its self-hosted Metabase reporting system, gaining administrator access without legitimate login and downloading data on over 1 million people (1,079,819 total) in Australia and New Zealand. Access began August 10, data was downloaded August 27, and the theft was confirmed September 3, 2026. No credentials, academic records, or school-account links were exposed, but affected individuals are warned of targeted phishing. The incident joins a broader campaign against Metabase instances, including Trezor's provider ShipMonk, Framework, and Tally, linked to ShinyHunters via extortion emails and leak-site listings.

BleepingComputer·Sep 7, 13:05 UTC · 9d agoData breach in the wild

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security·Sep 15, 05:30 UTC · 1d agoTools1

France’s tax authority admits hackers made off with data on 678,000 individuals

An attacker used stolen credentials and an MFA bypass to steal tax data on 678,000 individuals from France's tax authority DGFiP.

France's General Directorate of Public Finances (DGFiP) disclosed that intrusions into its portals exposed tax data, including reference tax income, family quotient, withholding tax rate, and business identifiers such as company name and SIREN number, on 678,000 individuals and professionals. An attacker using the alias 'ZeroBytes' claimed credit on a cybercrime forum and offered a stolen database for sale, claiming the portal contains data on roughly 20 million citizens. DGFiP suspended the affected accounts, notified the CNIL, and is working with ANSSI and the finance ministry's security office; it said the main online tax portals and their login credentials were not compromised.

Help Net Security·Aug 17, 00:00 UTC · Aug 17, 2026Data breach

ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

Zero Day Initiative disclosed an unauthenticated information disclosure vulnerability (CVSS 5.8) in Microsoft Azure Entra ID's OAuth device code grant flow.

ZDI published advisory ZDI-26-629 describing an information disclosure vulnerability in Microsoft Azure Entra ID related to the OAuth device code grant. Remote attackers can disclose sensitive information without authentication. ZDI assigned a CVSS 3.1 score of 5.8; no CVE identifier is listed in the advisory text.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisory1

Researchers Confirm ExfilSquad’s Access to Sensitive Data Across 13 Organizations

Researchers confirmed extortion group ExfilSquad holds stolen sensitive data from at least 13 organizations, publishing leaked datasets via torrents.

Security researchers verified that the extortion group ExfilSquad possesses sensitive data stolen from at least 13 victim organizations. The group distributed the leaked datasets publicly through torrents rather than a traditional leak site. Independent verification of the stolen data lends credibility to the group's extortion claims against its victims.

Infosecurity Magazine·Aug 14, 14:49 UTC · Aug 14, 2026Ransomware