SEGA says Arara breach exposed 2.19 million customer emails
Attackers took the addresses from newsletter platform Arara Message between October 28 and October 31; passwords and payment data were not included.
Stories per day · 30 days
3 RSS
Relateddata-breach6arara3dreamhost3ftp3sega3web-hosting3zimbra3afd2command-injection2germany2password-reset2privacy2third-party2aliases1anti-spam1apple1chatgpt1clova1
39 stories, newest first · one card per story
Stories tagged #email
SEGA newsletter breach exposes 2.2 million email addresses
ARARA's email service leaked 77 million addresses from about 380 clients; attackers sent over 7 million impersonation emails.
Essay stresses better email habits over social media
Email survives platform changes and serves official records, asynchronous replies, and searchable history unlike fleeting social apps.
ChatGPT chats steer readers to email journalists for tech help
The visible note says those chats supplied journalist contacts and outreach steps, and similar mail is reaching other reporters.
Hackers steal 2.6 million records from Sony ISP So-net
Intruders hit the member database on October 19, taking subscriber data plus about 54,000 email passwords and 16 bank records.
MIME-tools before 5.521 for Perl fixes 10 CVEs
The visible flaws let one bad Content-Type parameter hide later parameters, including a multipart boundary.
Italy’s Chamber says three parliamentary email accounts were targeted
Public statements do not yet say whether messages were read or any data was taken.
DreamHost resets some email and FTP passwords after systems issue
File Manager was taken offline and later restored; DreamHost has not stated a cause or how many users were affected.
AfD email-host breach exposed 345,000 addresses, HIBP says
Have I Been Pwned confirmed the scale after the party disclosed a September attack on its hosting firm, Alternita.
1
DreamHost resets some email and FTP passwords after service incident
File Manager is back, but DreamHost still has not named a cause or how many accounts needed resets.
1
DreamHost forces email and FTP password resets in ongoing incident
File Manager access is still down, and users cannot log in until account owners set new credentials.
Email PQC support stays under half of measured Tranco domains
Google accounts for about 87% of hybrid-capable relays, and some senders fall back to plaintext SMTP.
CVE-2026-73570 command injection in Zimbra yields remote code execution
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
Safari and WebKit block services that turn emails into tracking IDs
The blocks ship in iOS 27, iPadOS 27, macOS 27, and visionOS 27 and stop pages from sending addresses to identity-resolution servers.
AfD confirms hosting hack as archive posts 421,179 email summaries
hexane.cc publishes AI summaries rather than messages, and none has been matched to a verifiable original email.
Attackers exploit Zimbra zero-click flaw CVE-2026-73570 on email servers
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
5
Microsoft says October Windows updates can break on-premises Exchange email
Four October 13 Windows Server updates can stall mail and webmail; Microsoft says do not uninstall them.
1
Show HN: I wrote an email app that accepts only one sender per inbox
Clova.email offers one-sender and temporary inboxes so a leaked address can be deleted without exposing a real mailbox.
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
Phishing emails are baiting your AI assistant
Phishing emails hide prompt injections that try to make AI inbox assistants endorse fraudulent payment changes.
6
SmarterTools security advisory (AV26-1026)
Canadian Cyber Centre says SmarterMail before Build 9777 is vulnerable and should be patched.
en-html.org is a Scam Site
Scammers email site admins to repoint dead-domain links at en-html.org for later SEO sales.
Attackers Hide AI Prompt Injections Inside Phishing Emails
Barracuda found phishing emails hiding prompt injections aimed at AI inbox assistants and human recipients.
2
Show HN: MailAccess – the true Email OSINT framework
Open-source MailAccess claims to investigate one email across 5,300 platforms and scrape company contacts at scale.