Search: “BleepingComputer”

150 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 340 Data breach 115 Malware 44 Vulnerability 39 Threat actor 34 Exploit / PoC 31 Phishing & fraud 21 Industry 9 Policy & legal 9 Research 4 Advisory 2 Tools 1 AI safety & security 1

SeverityAll critical 150 high 391 medium 61 low 46 info 2

220 million traveler records exposed in Vietnam-linked APIS leak

Vietnam-linked APIS Elasticsearch leak exposed 220 million passenger and crew records with passport numbers and flight details spanning 2017 to 2026.

Kinryū Labs discovered an exposed Elasticsearch cluster named 'pax-info' holding 210,318,069 passenger records and 10,465,631 crew records (roughly 107 GB across 29 indices) hosted in Viettel-assigned IP space in Hanoi. The database, apparently operated by a Vietnamese organization, was reachable via a chain of two misconfigurations: a cloud-based path that bypassed an HTTP 401 block and acceptance of default credentials. Exposed data included names, dates of birth, nationalities, passport numbers, and detailed flight information for travelers of many nationalities from January 2017 to April 2026. Access was remediated on June 8 after Kinryū Labs notified Vietnamese authorities, airlines, and CERTs, with Singapore Airlines' security team helping coordinate the response; it remains unknown whether any data was copied by malicious actors.

BleepingComputerSep 8, 07:35 UTC · 8d agoData breach1

The European Commission confirmed a cyberattack affecting part of its cloud systems

Security AffairsMar 27, 21:43 UTC · Mar 27, 2026Data breach

Clop ransomware claims the hack of 130 orgs using GoAnywhere MFT flaw

Security AffairsFeb 11, 17:13 UTC · Feb 11, 2023Ransomware in the wildCVE-2023-0669

New variant of ESXiArgs ransomware makes recovery much harder

Security AffairsFeb 9, 17:08 UTC · Feb 9, 2023Ransomware CVE-2021-21974

HelloKitty ransomware gang targets vulnerable SonicWall devices

Security AffairsJul 18, 08:46 UTC · Jul 18, 2021Ransomware CVE-2019-7481 CVE-2021-20016

Netwalker ransomware hit K-Electric, a major Pakistani electricity provider

Security AffairsSep 11, 18:10 UTC · Sep 11, 2020Ransomware

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks

Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.

Cisco confirmed in August 2026 that CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center, is being actively exploited, allowing remote attackers to execute scripts and commands as root via crafted HTTP requests to the web interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch by September 12, 2026. Shared IOCs, identical hot fixes, and a July 23 log entry suggest CVE-2026-20079 was used alongside the separately exploited static-credential flaw CVE-2026-20316 in the same attacks. Cisco released patches and cloud fixes, warns hot fixes do not remediate already-compromised devices, and says there are no workarounds.

BleepingComputerupdated Sep 14, 09:27 UTC · 1d agofirst Sep 9, 21:40 UTC · 6d agoExploit / PoC in the wild 13 sources CVE-2026-20079 CVE-2026-20316

Great responsibility, without great power

Cisco TalosApr 30, 18:00 UTC · Apr 30, 2026Ransomware in the wildCVE-2026-42208

The democratisation of business email compromise fraud

Cisco TalosApr 2, 18:02 UTC · Apr 2, 2026Phishing & fraud in the wildCVE-2025-55182

Pornhub targeted in extortion attempt following Mixpanel breach exposing user activity

Security AffairsDec 16, 09:20 UTC · Dec 16, 2025Ransomware

Pandabuy was extorted twice by the same threat actor

Security AffairsJun 7, 13:26 UTC · Jun 7, 2024Threat actor

City of Toronto is one of the victims hacked by Clop gang using GoAnywhere zero

Security AffairsMar 24, 18:40 UTC · Mar 24, 2023Ransomware CVE-2023-0669

Experts warn of a new eCh0raix ransomware campaign targeting QNAP NAS

Security AffairsJun 19, 07:00 UTC · Jun 19, 2022Ransomware

A new wave of Qlocker ransomware attacks targets QNAP NAS devices

Security AffairsJan 16, 13:31 UTC · Jan 16, 2022Ransomware CVE-2021-28799

Unknown ransomware gang uses SQL injection bug in BillQuick Web Suite to deploy ransomware

Security AffairsOct 25, 21:13 UTC · Oct 25, 2021Ransomware CVE-2021-42258 CVE-2021-42344 CVE-2021-42345+6 CVEs

Evidence suggests that DarkSide and BlackMatter are the same group

Security AffairsAug 2, 09:18 UTC · Aug 2, 2021Ransomware

Netwalker ransomware operators leaked files stolen from K

Security AffairsOct 1, 17:52 UTC · Oct 1, 2020Ransomware

Interpol warns that crooks are increasingly targeting hospitals

Security AffairsApr 7, 07:05 UTC · Apr 7, 2020Ransomware

ShinyHunters claims it stole 284 million patient records from McKesson

ShinyHunters claims theft of 284 million patient records from McKesson via vishing, Okta takeover, and Salesforce/Snowflake access, demanding $55,236,150.

McKesson disclosed in an SEC filing a cybersecurity incident detected August 25, 2026, involving unauthorized access to third-party applications and data exfiltration affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. ShinyHunters told BleepingComputer it entered through vishing calls to employees, used stolen credentials to take over Okta single sign-on accounts, and extracted about a terabyte of data from Salesforce and Snowflake environments over four days. The group claims 284 million database rows including names, addresses, Social Security numbers, Medicaid details, medical record numbers, and medication data, and demanded $55,236,150 with a 72-hour deadline; none of these claims have been independently verified.