All news with #sensitive data exposure tag

🔒 The Legal Aid Agency (LAA) confirmed an April 2025 cyberattack resulted in theft of sensitive records, with the earliest verified record dating to 1978. The breach affected applicant and recipient data from 2010 onward and included provider details, payment information, and portal credentials. The Ministry of Justice said millions are being invested to modernize systems, improve resilience, and strengthen cyber security across legal aid services.

🔍 Norway’s Data Protection Authority fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive Grindr user data. The authority found that between July 2018 and April 2020 Xandr ran real-time ad auctions that exposed sexual orientation and other profiling data to thousands of advertisers without verifying valid consent. The decision, the largest fine issued by Datatilsynet, was praised by privacy groups and Xandr has three weeks to appeal.

🔒 Unauthorized parties accessed names, addresses, and personal identification numbers for about 8.8 million people in Denmark's Central Person Register (CPR), the digitalization ministry reported on October 5. The breach leveraged a private company's legal lookup rights and persisted for around 10 days in September before unusual activity was detected. The register's administration has suspended the company's access, reported the incident to Datatilsynet, and police are investigating. Authorities urge vigilance against phishing, recommend credit warnings, and have launched a security review while Datatilsynet examines responsibility and impact.

🛡️ The US Department of Defense confirmed a breach at the Defense Manpower Data Center (DMDC) exposing just over three million records, including Social Security numbers, names, birth dates, contact details, and some job information. Unauthorized access occurred between October 2025 and July 16, 2026, remaining undetected for nine months until a file‑sharing vulnerability was patched. The Pentagon says it has seen no evidence of misuse and is offering 12 months of identity protection and credit monitoring to those affected. The incident raises concerns about espionage, targeted spear‑phishing, and the risks posed when personnel records include job details.

🔍 Researchers discovered more than 16,000 misconfigured Supabase databases that publicly exposed readable tables containing personally identifiable information, passwords, or authentication tokens. Analysis of around 300,000 domains showed AI-assisted development accounted for a majority of new databases, and exposures ranged from plaintext passwords to customer records and private messages. UpGuard notified affected owners and urged users to review Supabase security guidance.

🔒 Security experts warned that a Gyazo breach disclosed on September 11 exposed nearly 24 million customer records and an additional 490 million image metadata entries after attackers exploited an upload-server vulnerability. The exposed metadata included image IDs, source IPs, user agents, EXIF location data, OCR-extracted text, titles, source URLs, and hashed passphrases, potentially allowing unauthorized access to images. Gyazo's developer, Helpfeel, said some image viewing was temporarily disabled while remediation occurred and urged password changes and vigilance against phishing.

🛡️ A database of 153 million drivers licenses is reported for sale on the dark web, raising urgent privacy and security concerns. The post argues that current AI LLM systems accelerate attacks on ID document databases, making holdings of such data increasingly risky. It questions the wisdom of widespread storage of primary ID documents and urges limiting access to only those tasks that truly require ID verification. The piece criticizes recent trends toward mandatory ID collection and calls for treating ID verification data as crown-jewel assets.

🔒 Thomson Reuters disclosed that unauthorized access to its C-Track court case management platform occurred in March 2026, impacting courts across 11 U.S. states, the U.S. Virgin Islands, and Ontario. West Publishing detected the activity on June 30 and says some records may include names, SSNs, driver's license numbers, dates of birth, and medical or insurance details. Affected individuals are being offered credit monitoring services and vendor and court notices have been issued while investigations continue.

🔍 The FBI is investigating a reported breach tied to a service called Nexus that allegedly exposed over 153 million driver’s licenses and other identity documents across the US and Canada. The trove was first reported by journalist Brian Krebs, who traced activity to identity verification provider IDScan.net, which is investigating. Security experts warn the breach could have long-lasting consequences because government IDs are immutable and widely used for verification.

🔒 The Los Angeles County Museum of Art (LACMA) disclosed a data breach discovered in July 2025 after suspicious activity began four days earlier. The investigation, updated in February 2026 and finalized over a year later, determined that attackers may have accessed sensitive customer and employee records. Exposed elements include full names, dates of birth, Social Security numbers, government IDs, partial financial and card data, health insurance details, and medical treatment information. LACMA has notified law enforcement and affected individuals, offered one year of identity protection through Financial Shield, and set up a dedicated support line while recommending monitoring and credit protections.

🔒 CISA warns that the Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT suffers from vulnerabilities allowing cleartext transmission of sensitive data and missing authorization. An attacker within BLE range can passively intercept glucose readings or monopolize the device's single BLE connection, blocking legitimate users. Users are urged to follow Bluetooth security guidance and contact Apollo Pharmacy for vendor-specific information.

🔒 Novo Nordisk disclosed an unauthorized access incident affecting internal IT systems and pseudonymized patient data from some clinical trials. The breach exposed trial participant IDs and health, biomarker, lifestyle, and demographic details, while the company says direct identifiers were not accessed. Healthcare professionals' contact details were also compromised, prompting warnings about phishing and impersonation risks. Novo Nordisk has isolated affected systems, engaged external cybersecurity experts, and is investigating the scope and impact.

🩺 Generative AI chatbots are increasingly used for health questions, but they carry significant risks ranging from incorrect diagnoses to privacy exposures. Users may unknowingly share sensitive medical details that could be used for model training or passed to third parties. Health-focused services vary in their data-handling promises, and most consumer chatbots are not covered by HIPAA. Follow practical precautions and always verify AI advice with qualified medical professionals.

🔒 ABB disclosed a vulnerability in MConfig affecting versions listed by the vendor that allows sensitive data to be stored in cleartext in memory. An attacker with physical or local host access could export a memory dump that may include plaintext passwords. ABB released MConfig version 1.4.9.22 to remediate the issue and recommends applying defensive measures from the product manual.

🔒 Microsoft will change Edge so saved passwords are not loaded into process memory in clear text at startup. Security researcher Tom Jøran Sønstebyseter Rønning disclosed on May 4 that Edge decrypted all stored credentials at launch and released a proof-of-concept showing how attackers with Administrator privileges could dump other users' passwords. Microsoft initially described the behavior as "by design" but now says a defense-in-depth change will roll out across Stable, Beta, Dev, Canary and Extended Stable; the fix is live in Canary and will be in build 148 and newer.

🔒 A Norwegian researcher discovered that Microsoft Edge decrypts saved passwords at startup and keeps them resident in process memory, leaving credentials retrievable in plain text on shared or compromised machines. German publication Heise reproduced the finding, locating passwords even after a browser restart. Microsoft reportedly treats the behavior as 'by design,' prompting calls for using alternative password managers.

🔒 Navia Benefit Solutions says an unauthorized actor accessed its systems between December 22, 2025 and January 15, 2026, potentially exposing records for nearly 2.7 million people. The company discovered the activity on January 23, 2026 and launched an investigation, which found the actor acquired names, dates of birth, Social Security numbers, phone numbers, email addresses, plus HRA, FSA and COBRA enrollment details. Navia says claims and financial account information were not exposed. Affected individuals are being offered 12 months of identity protection and credit monitoring through Kroll, and federal law enforcement has been notified; no ransomware group has claimed responsibility.

🧠 In February 2026, cybersecurity firm Oversecured audited 10 popular Android mental‑health apps and found 1,575 vulnerabilities — 54 rated critical — across apps with a combined 14.7M+ installs. Findings include insecure local storage, hardcoded API endpoints, weak token generation using java.util.Random, and no root detection, contradicting many apps’ claims of full encryption. The report highlights the real risk of exposure of therapy transcripts, mood logs, and medication data and urges users to review permissions, update apps, and avoid third‑party sign‑ins.

🔒 Rockwell Automation reported two high-severity vulnerabilities in Verve Asset Manager affecting legacy components: the ADI server and the Ansible playbook. Both issues can result in unencrypted sensitive information being stored in environment variables or during playbook execution and are rated CVSS 7.2 and 7.9. Rockwell states the flaws are resolved in 1.42; organizations should upgrade and contact Rockwell TechConnect for assistance. CISA also recommends minimizing network exposure and using secure remote access such as up-to-date VPNs.

🔒 Cisco has disclosed a vulnerability (CVE-2026-20029) in Cisco ISE and ISE-PIC that could allow an authenticated administrator to read arbitrary files on the server due to improper XML parsing. Proof-of-concept exploit code exists though no active attacks are reported. Cisco assigns CVSS 4.9 (medium). Administrators should rotate credentials, limit who and what can reach ISE, and install the vendor patch as soon as service downtime allows.