All news with #data breach tag

🔒 Danish authorities are examining security controls after attackers used a company's credentials to query the national citizen registry and retrieve records for roughly 8.8 million people over a 10-day span. The incident, discovered on Oct. 2, involved more than 14 million searches and affected residents, deceased individuals, and those living abroad, though protected identities were spared. The vendor's access has been revoked and the National Special Crime Unit is investigating while officials warn of fraud risks and urge stronger identity checks.

🔍 Group-IB found the Telegram account tied to the October 6 ASOS notification was previously active in gaming-item trading communities and used multiple aliases. Investigators say the channel was created the same day and have not found evidence that ASOS customer data was dumped or that Snowflake was compromised. ASOS confirmed possible access to basic contact details, restricted notification-platform access, and is working with advisers and authorities while customers are urged to remain vigilant.

🔒 Advantest Corporation disclosed that a February 15 ransomware intrusion led to unauthorized access and data extraction from its systems. In an October 6, 2026 notification the company confirmed that personally identifiable information (PII) was among the files taken, including contact details, government ID numbers, financial and medical records. Advantest offers affected parties 18 months of free identity and credit monitoring through Kroll and urges increased vigilance against fraud and phishing.

🔒 The FBI removed an Accenture contractor after a data breach exposed personal details of employees tied to an unpatched third-party platform. FBI Cyber Division Assistant Director Brett Leatherman said the incident resulted from a security failure when a contractor did not apply a required patch. Reuters sources identified the platform as Oracle PeopleSoft, and said the contractor worked for Accenture on the system.

📱 ASOS confirmed unauthorized access to third-party customer communication platforms after users received push notifications claiming a Snowflake compromise and directing victims to a threat actor's Telegram channel. The retailer says basic personal details such as names and contact information may have been exposed but believes payment card data and account passwords were not impacted. Customers are advised to ignore the malicious in-app alert and not follow the external link.

🔒 Nikkei has disclosed unauthorized access to two employee cloud accounts, one of which was used to send about 9,000 phishing emails to staff and contacts. The company says a Google Workspace account was accessed since late July, potentially exposing 1,646 names and email addresses, and a Microsoft 365 account was abused on September 30 to distribute malicious messages. Nikkei reset passwords, notified affected individuals, and reported both incidents to Japan's data protection regulator while investigations continue.

📣 Customers of online fashion retailer ASOS received a push notification on October 6 claiming a Snowflake compromise and urging engagement or data leakage. The message, signed ‘xuanyewengateway’, included a Telegram link; ASOS has not confirmed any breach. Experts cautioned users not to follow the link, advised password changes, and urged ASOS to review Snowflake logs and follow incident response protocols. Analysts noted the claim could indicate access to connected systems but stressed further verification is needed.

📧 Nikkei reported that attackers accessed two employee email accounts, first a Google Workspace account in late July and later a Microsoft 365 account in September. The Google incident may have exposed names and email addresses of 1,646 individuals, while the Microsoft account was used to send about 9,000 phishing messages to staff and interviewees. Nikkei reset passwords, notified recipients, and warned of potential impersonation attempts.

🔒 The FBI removed an Accenture contractor after an alleged role in a ShinyHunters breach that exposed thousands of bureau employees' personal data. Reuters sources say the incident stemmed from a third-party platform security failure where a contractor failed to apply an explicit patch. The FBI cited mitigation steps and removal of the contractor, while Accenture affirmed continued support for the FBI mission. Reports indicate the exploited platform was Oracle PeopleSoft and the attack leveraged a CVE-2026-35273 bypass.

🔒 Unauthorized parties accessed names, addresses, and personal identification numbers for about 8.8 million people in Denmark's Central Person Register (CPR), the digitalization ministry reported on October 5. The breach leveraged a private company's legal lookup rights and persisted for around 10 days in September before unusual activity was detected. The register's administration has suspended the company's access, reported the incident to Datatilsynet, and police are investigating. Authorities urge vigilance against phishing, recommend credit warnings, and have launched a security review while Datatilsynet examines responsibility and impact.

🛡️ The theft of FBI employee data tied to ShinyHunters and the shutdown of the FBI’s PeopleSoft jobs portal has raised alarm among enterprise users of PeopleSoft. Law enforcement has made arrests, but neither the FBI nor Oracle has clarified whether a new PeopleSoft zero-day caused the breach. Analysts urge immediate mitigations—patches, removing exposed management interfaces, and hunting for web shells—while warning that vendor silence and unconfirmed claims leave many organizations exposed.

🔒 The Danish Central Population Register (CPR) disclosed a data breach that exposed personal information for approximately 8.8 million registered individuals, including residents, expatriates, and deceased persons. Threat actors abused a private company's legitimate access and used brute-force enumeration of CPR numbers to extract names, addresses, dates of birth, marital status, and CPR identification numbers. The breach occurred in September 2026, was discovered on October 2, and affected about 80% of records held in the CPR system. Authorities have blocked the third party's access, launched a police investigation, and enacted extra security measures while urging citizens to remain vigilant.

🔎 South Korea's Financial Services Commission convened an emergency meeting after a string of cyberattacks affected major banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. Authorities confirmed data leaks — reportedly affecting tens of thousands of customers — and launched on-site investigations while coordinating with KISA and other agencies. Financial firms were ordered to inspect externally accessible systems, tighten access controls, share threat intelligence, and submit security inspection results promptly.

🔒 A third-party breach at Frontline Education exposed Social Security numbers and personal details of K–12 staff after a vulnerability was discovered on August 14, 2026. The vendor says it investigated, remediated the issue with external help, engaged law enforcement and will notify affected individuals by email and post. So far there has been no public confirmation on the company’s site and the scale of impacted districts and staff remains unclear.

🔒 The Technical University of Denmark (DTU) reports that hackers used compromised credentials to access its identity and access management system, DTUBasen, potentially exposing information of up to 200,000 people. The breach may include Danish civil registration numbers (CPR), names, addresses, profile pictures, work emails, job titles, and next-of-kin contact details for active users. DTU is notifying affected current and former employees via e-Boks and urging caution against phishing and identity fraud.

🔐 Frontline Education has informed school districts of a data breach after attackers exploited a vulnerability in a third-party application to access its systems and steal employee information. The company identified the issue on August 14, 2026, engaged a cybersecurity firm, remediated the vulnerability, and notified law enforcement. Impacted individuals may include district staff whose Social Security numbers, email addresses, and physical addresses were exposed. Frontline will offer notifications and two years of TransUnion credit monitoring unless a district opts out.

🔎 Law enforcement dismantled KillSec, a prolific ransomware-as-a-service group active since 2024, seizing its leak site and at least five servers to prevent exposure of 110TB of stolen data. The operation, led by German police with Europol and Group-IB involvement, identified hundreds of victims — primarily in the US and India — and revealed KillSec operated both as an encryptor and data broker. Authorities executed searches across several countries and made provisional arrests, including a 16-year-old suspected ringleader arrested in Alicante.

🛡️ Researchers from Northeastern University and Consumer Reports examined how modern vehicles collect and share driver data by reviewing automaker privacy policies, regulatory filings, and industry practices. They found that consent is often obtained via infotainment systems or mobile apps at setup, where many users accept terms without reading them. Data recipients include insurers, lenders, telematics exchanges, data brokers, and government agencies, meaning manufacturers can continuously monitor and monetize driving behavior.

🛡️ The FBI thanked Dutch police for arresting a 24-year-old suspected of playing a leadership role in the ShinyHunters gang, and warned remaining members to come forward while they still can. The arrest followed revelations that ShinyHunters breached the FBI job application portal, exposing Social Security numbers and sensitive medical records of about 5,000 staff. The group claims to have exploited a patched Oracle PeopleSoft flaw and has since escalated activity, including extortion attempts against other cybercrime groups.

🔒 The Pentagon's Defense Manpower Data Center (DMDC) confirmed a breach of its human resources management systems that exposed sensitive personal data. The intrusion, active from October 2025 to July 2026, allowed unauthorized access to PII including Social Security numbers, names, dates of birth, contact details, sex, race, and military personnel information for millions. DMDC said it initiated incident response measures and is offering 12 months of free credit monitoring through IDX; affected individuals must enroll by August 19, 2027.