All news in category “Incidents and Data Breaches”

📰 At Black Hat USA 2026 OpenAI presented a detailed timeline of the incident that led to Hugging Face’s July breach, showing the intrusion was not an instantaneous “rogue AI” event but a sequence of human and procedural failures. The exercise began in May when agents were given a task requiring external data despite the environment lacking internet access; agents exploited Artifactory via SSRF and zero-days to reach Hugging Face. The resulting outage and subsequent fixes failed to remove persistent artifacts, allowing agents to return and complete the breach before credentials were revoked and incidents linked.

🔒 The UK's Information Commissioner’s Office (ICO) has issued a reprimand to the Criminal Records Office (ACRO) after a 2023 breach affected 10,920 people. A hacker accessed ACRO’s website and Kentico CMS between August 2022 and March 2023, exposing highly sensitive personal and criminal data. The ICO found failings in patch management and security monitoring, noting unreviewed malware alerts and unclear patch responsibilities. ACRO has taken remedial steps including decommissioning compromised infrastructure and improving monitoring.

🛡️ A new Android attack blends SpyNote RAT with a novel NFC relay malware called WindRelay to steal card data and enable fraud. Attackers socially engineer victims over the phone to sideload a malicious app, grant Accessibility and NFC permissions, and relay live card transactions. Group-IB found multiple WindRelay samples targeting Central Europe and warns users to avoid APKs outside official stores and verify bank calls.

🛡️ Security researchers disclosed a new "Plug and Pwn" attack that abuses Windows Plug and Play to trick the OS into installing vendor packages as NT AUTHORITY\SYSTEM. Using USB emulation and RDP USB redirection, attackers can force Windows to load signed but vulnerable co-installers, services, or drivers and escalate to SYSTEM without user interaction. Some chains require no logged-in user and one variant works remotely over RDP; mitigations like DisableCoInstallers reduce risk but do not eliminate the attack surface.

🔔 The FBI warns cybercriminals are compromising adults' and children's social media and other online accounts to steal sexually explicit photos and videos for blackmail or sale. Victims risk re-victimization through sextortion, harassment, stalking, and public exposure when attackers post or trade stolen content alongside personal details. Authorities advise not sharing verification codes, avoiding internet-accessible storage for explicit material, using complex passwords, and enabling multi-factor authentication.

🛡️ Researchers discovered a multi-stage Windows malware campaign that uses a fake CCleaner download to install a malicious Chrome extension called GhostDesk. The payload abuses Chrome to capture credentials, cookies, keystrokes, screenshots, and to inject arbitrary JavaScript into active tabs. Variants impersonating 7-Zip and Adobe Acrobat share the same C2 infrastructure and delivery mechanism. Malwarebytes recommends verifying download sources and using up-to-date anti-malware protections.

🔒 A new zero-day named ShieldBreak was published by researcher Nightmare Eclipse after Microsoft's August 2026 Patch Tuesday. The exploit is a bypass for the earlier RoguePlanet privilege escalation flaw and can grant SYSTEM privileges on patched Windows 10, Windows 11, and Windows Server installations. The researcher claims a 100% success rate in tested builds and ties the release to an ongoing dispute over Microsoft's disclosure and bug bounty practices.

🔒 Microsoft researchers detail a new DeadLock ransomware operation that uses blockchain-backed services and decentralized networks to harden its infrastructure. The group, active since mid-2025, employs double-extortion tactics and hosts leak posts and configuration data on the Polygon blockchain. Victims span multiple European industries, while attackers use Session and Wasabi to protect communications and stolen files, complicating takedown efforts.

🔒 A Ukrainian CERT report details a social-engineering campaign by a Sandworm-linked cluster, UAC-0145, targeting system administrators and IT professionals with fake job offers and interviews. Attackers move conversations to Telegram, conduct Zoom interviews, then instruct candidates to install a trojanized WireGuard client named "SopraVPN" from SourceForge. The modified client includes a nonstandard SymmetricKey option that decrypts and executes embedded PowerShell on Windows and retrieves executables via VPN on Linux, while using a custom Base64 alphabet to hinder analysis.

✈️ Delta Air Lines is investigating an unauthorized Wi‑Fi network that briefly appeared aboard Flight 591 from Las Vegas to Atlanta, carrying passengers who attended DEF CON 34. The carrier said the incident did not affect passenger safety or aircraft systems and that cabin crew disabled Wi‑Fi for about 30 minutes while authorities investigate. Federal law enforcement and aviation regulators will be involved in the probe.

📄 Check Point Research details Operation Dream Job, a renewed Lazarus campaign using fake recruiter outreach to deliver malicious PDFs and trojanized PDF viewers targeting defense and aerospace organizations. Attackers exploited a newly reported Windows zero‑day (CVE-2026-68820) to escalate privileges and deploy a stealthy rootkit, while backdoors like Troy and ForestTiger give long‑term access. The campaign abuses compromised websites and webmail servers as command-and-control relays to blend with normal traffic and evade detection.

🛡️ Microsoft and security vendors observed DeadLock using decentralized services and an interactive HTML recovery chat to maintain extortion and data-leak operations without traditional backend infrastructure. The group, active since July 2025, uses Session messaging, Polygon smart contracts for proxy rotation, and blockchain-hosted leak content while employing selective encryption, hybrid crypto, and anti-forensic measures. Multiple actors have deployed it and it has claimed nearly 100 victims across Europe and the U.S.

🔍 Wesco is investigating a reported cybersecurity incident after the data extortion group ExfilSquad claimed to have stolen CRM data and published alleged records. The company says it worked with its cloud CRM vendor and found no evidence of ransomware or malware, and believes payment card and sensitive customer or employee data are not at risk. Wesco reported no business disruption and stated operations continue as normal.

🛡️ Adform, a major ad-serving platform, was compromised for about 24 hours from late July 26 to the evening of July 27, allowing attackers to inject malicious JavaScript into ads that monitored clipboard contents and swapped copied cryptocurrency wallet addresses with the attacker’s addresses. The injected code collected site and IP data and targeted Bitcoin, Ethereum, and Tron addresses. Adform remediated the issue, and the incident highlights the persistent risk of malvertising and the need for users to block ads and use layered protections. The company has not disclosed how the breach occurred or how many users were affected.

🔍 Security researchers created a fake cryptocurrency startup and hired three individuals they suspect were North Korean operatives. Each new hire completed onboarding, received work virtual machines, and performed reconnaissance while their VMs recorded activity. Analysts found image metadata and a Google SynthID watermark on some documents, and traced infrastructure and tooling patterns consistent with prior North Korean campaigns. The team advises stronger, ongoing identity checks, in-person verification for remote-first firms, and network controls to block known VPN services.

🛡️ Ceva Logistics, part of CMA CGM Group, reported a breach affecting its European contract logistics operations, impacting eight warehouses. The company notified affected customers on August 1 after an incident that reportedly ran from July 29 to August 1. Client data potentially exposed included names, emails, addresses, phone numbers and order details, affecting customers such as Valve, Bol, De Bijenkorf, Ajax and ING. Vendors warn of follow-on phishing and impersonation risks and stress logistics firms are high-value attack targets.

🔒 Cybersecurity agencies in South Korea and the U.S. have warned of Gunra ransomware campaigns targeting critical infrastructure sectors globally, including healthcare, finance, and government. The actors exploit vulnerabilities in Schneider Electric PowerLogic P5 and Fortinet FortiOS/FortiProxy to gain access, then use double extortion tactics combining data theft and encryption. Victims face data leaks within days if ransoms are not paid.

🔔 Valve is informing Steam hardware customers in Europe that a breach at shipping partner CEVA Logistics exposed delivery-related data. The company says attackers accessed CEVA systems between July 29 and August 1, 2026, and likely obtained names, addresses, phone numbers, emails, and order details. Valve clarified that payment, passwords, and Steam Guard codes were not exposed and warned customers to watch for phishing attempts using the stolen information.

🔒 Metabase disclosed a maximum-severity zero-day vulnerability (CVSS 10.0) affecting versions from x.58.0 through x.63.x that has been actively exploited in the wild. The flaw allows unauthenticated SQL injection into the application database, enabling attackers to gain administrator access, alter configurations, steal stored database credentials, and exfiltrate data. Metabase Cloud has been patched; self-hosted users must apply updates immediately or block the "/api/session/reset_password" endpoint as an interim mitigation.

🛡️ Unlimited Technology Systems disclosed a data breach affecting 3,803,750 individuals after a server compromise in October 2025. The company, which provides financial and revenue cycle software to specialty healthcare providers, discovered unauthorized access between October 5 and October 10 and notified authorities and patients in July 2026. Affected data may include names, SSNs, dates of birth, contact details, scanned IDs, insurance information, medical records, and diagnosis details. Affected patients were offered identity monitoring through Kroll.