60
IDScan Confirms Data Breach Following 153 Million Driver’s Licenses Leaked on the Dark Web
IDScan.net confirms a breach after a marketplace advertised over 153 million US and Canadian driver's licenses, possibly exfiltrated continuously for over a year.
The Louisiana identity-verification firm detected unauthorized access on or around September 1, 2026, after the 'Nexus' identity theft service on the Exploit forum began advertising 170M+ people's records, including 153M+ driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000 medical cards. Canadian records exceed 1.1 million, and the trove includes commercial licenses, Common Access Cards, and dispensary IDs, with a record for US Defense Secretary Pete Hegseth reportedly included. Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may be active. The FBI's New Orleans field office has opened a formal inquiry, and IDScan.net is offering free credit monitoring.
92
ShinyHunters claims Florida DMV breach, puts data on the clock
ShinyHunters claims it breached Florida DMV's DAVID database, stole 200,000+ driver records including SSNs, and set a September 11 extortion deadline.
The ShinyHunters extortion group claims it breached the Florida Department of Highway Safety and Motor Vehicles' DAVID driver and vehicle database and stole more than 200,000 records. As evidence it published a screenshot of a Jeffrey Epstein record showing address, Social Security number, date of birth, license number and registered vehicles, and set a September 11 deadline before publication. The group says it obtained access through a password-reset weakness, compromised employee accounts, and queried and downloaded driver records and images. The Florida DMV has not confirmed the claim; it follows a separate confirmed IDScan.net breach exposing over 153 million license scans that prompted an FBI investigation.
68
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
60
CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production
CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.
Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.
62
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
Hardware wallet maker SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers and purchase details of approximately 39,798 customers. No seed phrases, private keys, wallet credentials or financial information were exposed, and SafePal found no evidence of wallet or fund compromise. A separate configuration error left a data-cleanup process broken between September 2025 and April 2026, extending the affected order window back to March 2025. A threat actor has advertised a matching dataset on a cybercrime forum, and the company has fixed the flaw, cut data retention to 90 days, purged affected records, engaged third-party validators and taken down over 30 phishing sites.
48
Week in review: Veeam fixes RCE flaw in backup management platform, Patch Tuesday forecast
60
60
Second flaw found in Swiss election system could change 'valid votes into nonsense,' researchers say
60
Week in review: Malware delivery via Microsoft Teams, law firms under cyberattack, CVSS 4.0 is out
60
SafePal breach affects 39,798 customers, data allegedly for sale
SafePal disclosed a breach exposing order data of 39,798 customers via an order-tracking plug-in flaw; the data appears for sale online.
Cryptocurrency wallet maker SafePal exposed names, phone numbers, addresses and purchase details for 39,798 orders placed between March 2, 2025 and April 11, 2026, due to an authorization flaw in an order-tracking plug-in. Seed phrases, private keys, wallet passwords, payment cards and government IDs were not exposed, and no wallet or fund compromise was found. A threat actor is selling data on a cybercrime forum citing the same order window and count, and SafePal has taken down more than 30 phishing sites and notified customers on August 16.
55
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.
32
60
57
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
60
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
60
60
60