NHS breach helpline left staff carrying a 'significant emotional burden'
Team given a day's notice faced distressed callers, safeguarding decisions during project that stretched from 2 weeks to 11
Data BreachData breach
50 storiesClear
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
AI/MLData Breach
In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days
Noteworthy stories that might have slipped under the radar: Synology warns about NAS ransomware attacks, Flowise ‘hello’ attacks, Chainalysis breach impact expands.
RansomwareData BreachHardware/IoT
Chainalysis says breach exposed credentials for all customers
Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.
CryptoData Breach
DigiCert Data Breach Impacts Business Customer Information
Hackers created an account on an internal system and accessed names, email addresses, phone numbers, and business addresses.
Data Breach
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company sai...
AI/MLCryptoData Breach
DigiCert data breach exposes customer information, identity documents
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents.
Data Breach
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some...
CryptoData Breach
DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.
Data Breach
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScri...
AI/MLData BreachHardware/IoT
US charges two Canadians accused of hacking US universities
A federal grand jury indicted two Canadians suspected of hacking multiple US universities and using the compromised systems to mine for cryptocurrency.
CryptoData Breach
Malicious cPGuard Updates Served in OpsShield Supply Chain Attack
Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions.
AI/MLData Breach
Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist
Binance’s first incident report traces the record theft to a months-long campaign that compromised three engineers’ computers.
AI/MLData Breach
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals.
Data BreachApple
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.
MalwareData Breach
WorkOS says attacker used ARTEX AI to breach internal sales app
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.
AI/MLData BreachPassword manager mSecure tells users to change passwords, won't say why
Customers left wondering what's been compromised after vendor advises resetting passwords, 2FA and passkeys
Data Breach
Frontline Education Data Breach Impacts Over 1.3 Million
Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.
Data Breach
Harvard University data breach exposed info of 851,000 accounts
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.
AI/MLData Breach
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown s...
AI/MLMalwareData Breach
Revolve Data Breach Impacts at Least 200,000 People
Hackers accessed its online shopping platform and stole customers’ personal and payment card information.
Data Breach
Revolve Data Breach Impacts at Least 180,000 People
Hackers accessed its online shopping platform and stole customers’ personal and payment card information.
Data BreachChainalysis Discloses Data Breach Following AI-Driven Cyberattack
The attackers used offensive agentic techniques to access the company’s systems and internal tools.
AI/MLData Breach
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted.
AI/MLData Breach
Chainalysis discloses data breach from "offensive agentic techniques"
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles.
AI/MLCryptoData Breach
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can ...
Data Breach
Binance links $6.3 billion crypto theft to compromised DevOps laptop
Binance, the world's largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps engineer's compromised laptop.
CryptoData BreachMicrosoft
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts. The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform C...
AI/MLMalwareData Breach
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop.
AI/MLCryptoData BreachJapan Airlines suffers third-party data breach exposing passenger info
Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers.
AI/MLData Breach
Polymarket halts trading after crypto-draining script breach, $2.5M traced
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet.
AI/MLCryptoData Breach
Leaked DHS employee archive, Icepick, faces challenges to stay online
A DHS contractor requested its removal, while a social media site blocked links to it. It was offline for a spell before finding a new home.
Data Breach
Over 41,000 DHS Employee Records Leaked Online
The personal and work information was allegedly stolen from an Okta single sign-on system earlier this year.
Data Breach
HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications.
Data Breach
Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.
AI/MLData Breach
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online.
AI/MLData Breach
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
The leaked records include the locations of ICE and CBP facilities, workers’ cell phone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot.
AI/MLData Breach
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains of compromised SOHO...
AI/MLZero-DayData Breach
Sony ISP subsidiary data breach exposes 2.5 million customer records
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information.
AI/MLData Breach
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks.
AI/MLData Breach
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.
AI/MLZero-DayData Breach
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout.
Data BreachHardware/IoT
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
Data BreachMicrosoft
Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
A leaked SquareML access key could have been used to access a database containing personal and health information.
AI/MLData Breach
Attack on email hosting provider for German far right party AfD exposed 345k accounts
Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche
AI/MLData Breach
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
Data Breach
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.
AI/MLData Breach
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can...
AI/MLCloud SecurityData Breach
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLL...
AI/MLData Breach
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
AI/MLData BreachHardware/IoT