All news in category “Incidents and Data Breaches”

🛡️ Anthropic says threat actors are using common infostealer malware to capture active Claude login sessions from infected PCs, then access accounts and consume usage. The company is signing affected users out, removing saved payment methods, and refunding unauthorized charges while its investigation continues. Anthropic identified families such as Vidar, LummaC2, StealC, RedLine and others on Windows, and Atomic Stealer variants on some Macs.

🔒 Berlin's state government confirmed an extortion attempt after its state administrative network was compromised in August and said it will not pay the attackers. Forensics found further data exfiltration from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and 12, 2026, and the scope may include personal or non-public records. Authorities, including state police, the public prosecutor and federal security agencies, are investigating while the Senate continues forensic work and coordination with data protection and security bodies.

🔍 A 68-year-old UK resident, Milan Ibrahim, has been sentenced to over six years in prison after running an illegal IPTV service that generated £980,812 over three years. The Police Intellectual Property Crime Unit (PIPCU) described the operation as sophisticated, involving 80 servers and offering pirated broadcasts from major rights holders including BBC, ITV, Sky, the Premier League and the Motion Picture Association. Authorities seized and shut down all servers, potentially exposing users who accessed the service to fines or other consequences, and will pursue Proceeds of Crime Act actions to recover funds.

🔒 Hasbro has confirmed that attackers accessed personal and financial details of an undisclosed number of employees. The company filed notification letters with the Massachusetts Attorney General's Office but did not initially specify how many individuals were affected or when the intrusion was detected. Hasbro said it disabled the compromised account, terminated unauthorized access, and deployed additional safeguards while investigating the incident.

🛡️ Police in Australia have charged two men over alleged roles in TeamPCP, the gang behind the Shai‑Hulud worm that poisoned open source packages. The AFP, working with the FBI and WA Police, says the suspects — a 21‑year‑old and a 23‑year‑old — face multiple offences including data intrusion and unauthorised modification. Authorities attribute compromises at over 1,000 organisations and theft of more than 500,000 credentials and 300GB of data to the group.

🚨 PaperCut warned customers that attackers are actively exploiting a zero-day affecting all versions of PaperCut NG and PaperCut MF. The vendor issued emergency patches for v25 and v26 and confirmed known customer incidents while an investigation continues. Indicators include suspicious post-exploitation activity by "pc-app.exe," missing or truncated server.log files, and specific error entries such as ERROR No suitable driver found for jdbc:no:x. Users with internet-exposed PaperCut servers are urged to immediately restrict access to trusted IPs and apply network controls.

🛡️ Recorded Future's Insikt Group has identified campaigns from late September 2025 to April 2026 that delivered a newly observed Windows batch backdoor named HOOKEDGE via macro-enabled Word documents targeting government and diplomatic entities in Romania, Spain, and Türkiye. The activity is attributed with moderate confidence to APT28 (aka Fancy Bear), with HOOKEDGE exhibiting significant overlap with the group's earlier HEADLACE tooling and abusing webhook[.]site for C2, staging, and exfiltration.

🔒 Boston Scientific disclosed a cyber incident identified on August 25 that caused network outages and disrupted access to certain operating systems and business applications. The company activated incident response protocols with third-party cybersecurity experts and reported impacts to order processing and shipping, while a full restoration timeline remains unknown. The SEC filing described the disruption as "global," and security experts warned of potential downstream effects on patient care and the importance of robust containment and segmentation.

🔒 The US Navy has instructed its 340,000 active-duty members, 58,000 reservists, and 210,000 civilian employees to clean up social media profiles following a bulletin titled "Epic Vigilance: Immediate Actions for Force Protection and Personal Security." The advisory warns of a "coordinated, multi-domain campaign" by adversaries collecting intelligence and exploiting online posts and geolocation data. Personnel and families are urged to enable privacy settings, remove Navy links, report suspicious activity, and avoid sharing patterns of life that could be exploited.

🔒 A recent cyber incident that took a small UK electricity generator offline for days — without causing national outages — highlights a weakness across Western critical infrastructure: thousands of small, internet-exposed industrial control devices lack the security protections of larger utilities. Governments and security firms are investigating attribution and impacts while urging operators to remove PLCs from direct internet access, secure cellular modems, and test manual-operation procedures. The episodes mirror attacks on US water systems and underscore how modest targets can create disproportionate disruption.

🔒 The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a breach of a standalone system after the Qilin ransomware gang added the agency to its dark web leak portal. The ATF says the compromised system is separate from its enterprise network and critical systems, and it immediately terminated connections and launched an incident-response and forensic investigation with the Department of Justice. The agency reported no operational impact and requested public tips while the investigation continues.

🔒 The U.S. Department of Justice and FBI announced the disruption of two hacking platforms, QScan and QTRouter, used by the China-linked group QTFY to target U.S. critical infrastructure and sensitive networks. Lumen Black Lotus Labs, which tracked the group since 2018, collaborated with the FBI after observing extensive targeting of research and public sector organizations. QScan infected IoT devices to build a proxy mesh while QTRouter and associated services obfuscated attack origins using compromised routers, commercial proxy services, and leased VPSs. The court-authorized seizure of hard-coded domains caused the platforms to cease operations.

🔒 Boston Scientific reported a cyberattack detected on August 25 that disrupted IT systems and caused global operational impacts, including difficulties processing and shipping customer orders. The company activated its incident response plan and engaged external cybersecurity experts to investigate and contain the intrusion. Boston Scientific said it does not yet know when all affected systems will be fully restored and continues to assess the scope and consequences of the incident. The SEC filing offered no details on the attacker, initial access, or whether data was exposed.

🛡️ Defused warns attackers are chaining two Microsoft SharePoint flaws — CVE-2026-55040 and CVE-2026-63520 — to achieve remote code execution on unpatched servers. Public proof-of-concept exploits were published in August and were quickly weaponized, with probes observed against honeypots and large-scale internet-exposed SharePoint instances. CISA has issued directives to secure SharePoint servers while Microsoft monitors exploitation activity.

🛡️ Group-IB identified new Tortoiseshell activity, uncovering a reverse SSH tunneling utility and a C++ backdoor disguised as wtsapi32.dll. The SSH tool leverages Windows OpenSSH to create reverse tunnels into compromised networks, while the backdoor supports HTTPS C2 communications, file and shell execution, and in-memory DLL loading. Researchers also linked domains resolving to servers with regional subdomains, suggesting possible targeting across Europe and the Middle East and urging enhanced threat hunting and monitoring.

🛡️ CISA released dual red team reports showing two critical infrastructure organizations were fully domain-compromised using similar tradecraft. Organization A suffered extensive undetected access due to default machine account quotas, misconfigured AD CS templates, cleartext credentials, static cloud keys, and fragmented SOC visibility. Organization B detected and isolated initial footholds quickly, limiting spread despite similar underlying weaknesses, illustrating the decisive role of people and processes.

🛡️ An eight-month INTERPOL operation has led to 58 arrests and the identification of 263 suspects linked to West African organized crime groups, including Black Axe. The effort, involving 22 countries across six continents, targeted cyber-enabled fraud, romance and investment scams, and money laundering. Investigations uncovered a major crime-as-a-service network and disrupted call-center and syndicate operations responsible for large-scale thefts and laundering.

📣 SOCRadar researchers uncovered a PhaaS platform called AnonyMousKIT that uses rented AI voice agents and multi-channel lures to trick owners of recently lost or stolen Apple devices into revealing passcodes, Apple ID credentials, and live 2FA codes. The service is credit-metered across email, SMS, WhatsApp, recorded calls, and AI calls, and its capture pages show device model and Find My status to increase believability. Calls—mostly to Brazil—ran between August 2025 and May 2026, and the kit is offered through multiple storefronts with shared infrastructure and operational features resembling a small criminal SaaS business.

🔒 The Los Angeles County Museum of Art (LACMA) disclosed a data breach discovered in July 2025 after suspicious activity began four days earlier. The investigation, updated in February 2026 and finalized over a year later, determined that attackers may have accessed sensitive customer and employee records. Exposed elements include full names, dates of birth, Social Security numbers, government IDs, partial financial and card data, health insurance details, and medical treatment information. LACMA has notified law enforcement and affected individuals, offered one year of identity protection through Financial Shield, and set up a dedicated support line while recommending monitoring and credit protections.

📄 Threat actors are abusing npm packages and public mirrors to host malicious HTML that impersonates Cloudflare CAPTCHA pages and redirects visitors to attacker-controlled sites. Security researchers found multiple npm packages containing a single index.html that, when served through mirrors like unpkg, renders from legitimate domains and executes obfuscated JavaScript to redirect users. Some payloads fetch remote configuration (via api.keyval.org) allowing attackers to change redirect targets without republishing packages. OX Security warns mirrors can act as free frontend hosts for phishing content and recommends treating direct HTML requests to npm mirrors as suspicious.