57
60
57
57
57
57
42
47
57
57
57
McKesson copes with fallout from data theft extortion attack
McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.
McKesson disclosed that attackers gained access to some of its third-party applications and stole data associated with a subset of customers in its oncology, multispecialty, and medical-surgical business units; the intrusion ran for four days from August 21 and was discovered August 25. ShinyHunters claimed responsibility and listed McKesson on its data-leak site, reportedly demanding more than $55 million with a September 1 deadline. Flashpoint analysts say the group typically uses social engineering and identity weaknesses with valid credentials to access cloud-hosted environments, making the intrusion hard to detect. McKesson, which distributes about one-third of pharmaceuticals used in North America with $403.4 billion in annual revenue, says operations continue and it has reasonable assurance of no ongoing unauthorized activity.
80
57
57
57
57
57
Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads
Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.
HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.
63
ShinyHunters hackers claim breach of Florida "DAVID" DMV database
ShinyHunters claims it breached Florida's DAVID DMV database via a password-reset flaw, stealing 200,000+ driver records including SSNs.
The ShinyHunters extortion gang added Florida FLHSMV to its leak site, claiming theft of over 200,000 driver records from the DAVID platform since September 3. As proof, the group published a screenshot of Jeffrey Epstein's DMV record showing address, Social Security number, driver's license ID, and registered vehicles. The gang says it compromised DMV employee and FBI agent accounts via a password-reset flaw and iterated through records by ID. Access has reportedly been lost and the flaw is being patched, but ShinyHunters expects to announce breaches of other states' DMV platforms.
73
57
57
57
57
57
42
42
42
42
42
42
42
57
57
42
42
42
42
57
57
57