Grok app builder left 35,578 apps open, leaking business data
Claroc found ICU records, employee rosters, and plain-text passwords in apps that opened with no sign-in.
Stories per day · 30 days
3 RSS
Relatedgrok4meta4misconfiguration4muse4privacy4discord3passive-dns3plaintext-passwords3search-indexing3share-links3access-control2app-sharing2credentials2cryptocurrency2discoverable-servers2eiliko2energize-lab2healthcare2
58 stories, newest first · one card per story
Stories tagged #data-exposure
Fireworks AI breach may have exposed Notion AI chat transcripts
Notion says fewer than 1% of workspaces may be affected, and the chats lacked user, workspace, and tool-call data.
1
Royal Cornwall Hospitals NHS Trust exposed health data in FOIA spreadsheet
The exposure affected 8,003 people including staff and non-staff workers; a helpline ran for 11 weeks with significant emotional impact on handlers lacking preparation.
1
Half of security leaders report sensitive data exposure through AI tools
47% of security leaders experienced sensitive data exposure via AI tools, many using approved ones.
Pen tester says tobacco firm left recipes on an open file share
The share allowed anonymous SMB access to every employee; the company denied the recipes were real, then the files disappeared.
Applebee’s customer data exposed due to hardcoded database password
Researcher found hardcoded password in Applebee’s Android app exposing customer database with personal details; company fixed the issue after disclosure.
1
Chainalysis AI agent breach exposes customer data
Chainalysis AI agent breach accessed some non-sensitive customer data including user IDs, names, emails and organization roles. No passwords or session tokens stolen. Customers urged to enable 2FA.
2
Trigger.dev says attacker accessed some customers' environment variables
The company says it blocked the exploit and emailed affected account owners mitigation steps.
1
Ransomnews counts 484,142 listable cloud buckets holding 18 billion files
An October 7 snapshot found 321,058 credential and key files without opening any objects, and the authors say many buckets are public on purpose.
2
n8n before 2.44.1 and 2.43.5 can expose other projects' data tables
Canada's Cyber Centre says a crafted workflow ID can reach data tables in other n8n projects and urges updates.
Discord will let search engines index public server messages
About 63,000 Discoverable Servers get public web pages from November 16; new-message indexing starts mid-December.
South Korean financial firms hit by another wave of cyberattacks
Daishin says names, emails, and phone numbers of 38,490 customers were exposed; Mirae and Bithumb have not confirmed theft.
1
Coinbase says Amplitude incident exposed some customer contact data
Coinbase says its systems and customer funds were not accessed and has not confirmed how many people were affected.
Discord will let search engines index public Discoverable Server messages
Channel summaries start November 16, 2026, and individual messages follow in mid-December, on by default outside several regions.
Discord will make Discoverable Server messages searchable on Google
Server web pages start November 16, 2026; individual messages follow in mid-December, and older histories stay unpublished.
SBI notifies customers after finding 3,897 records exposed
SBI reviewed about 375,000 dark-web records and says balances are safe, with no confirmed core-system intrusion.
Meta re-enables Muse sharing after replacing exposed artifact URLs
Old shared-artifact links now ask visitors to request a new URL from the person who shared them.
Tenable describes how shadow AI spreads and how to contain it
IBM figures cited put shadow AI breach incidents at 43%, with an average cost of $5.39 million.
1
Energize Lab responds after Eiliko robots expose customer data
The Verge says photos, audio, and SSH access remained reachable after the company claimed external access was closed.
Meta suspends Muse sharing after GhostShares DNS link discovery
Claroc recovered more than 6,800 share hostnames from passive DNS; sampled pages included budgets and business documents.
Meta pauses Muse share links after chats found on the web
Claroc rebuilt more than 6,800 Muse share URLs from public DNS records, exposing business and personal chats.
Meta Muse share links expose private chats via passive DNS
Claroc enumerated 6,800 links because every share hostname is under cf.metaaiusercontent.com and includes the chat title.
Eiliko robot companion exposes private chats and can be hijacked
A researcher accessed 13 million Eiliko chats and remotely changed robot behavior, including children's data.
7
Vibetech Database Exposes 13.7M Records Including Assortment of Old Breaches
An unsecured Vibetech database exposed 13.7 million records, including credentials and data from older breaches.
4