Sekoia says APT29 used compromised sites, lookalike domains and a hijacked Plerdy analytics script to hit Ukrainian and Western targets with patched iOS and Android...
DreamHost confirmed an attacker exploited its web File Manager to steal FTP and SFTP passwords and some webmail sessions between August and October 23, 2026.
Muji operator Ryohin Keikaku says about 1.09 million Muji Card records, including full numbers of 345,000 valid credit cards and birth dates, may have been...
mSecure maker mSeven says an unauthorized actor took an encrypted copy of a customer database and urges users to change passwords, 2FA and passkeys.
Attackers hijacked OpsShield's cPGuard update channel, pushing a fake update that stole root SSH keys and password hashes from about 2,950 hosting servers.
WorkOS confirmed an attacker accessed an internal sales tool holding CRM contacts, account histories and customer conversation excerpts, using an AI-assisted offensive framework.
Bitdefender says a 3AM ransomware affiliate likely used an AI agent in a loop to steal credentials, build domain trusts and encrypt 37 machines at...
Chainstack confirmed an attacker reached its development and production environments via a third-party component, exposing customer names, emails, password hashes and possibly node credentials.
Suntory says a third party downloaded files from an external cloud service, exposing names and emails of about 90,000 employees plus customer and job applicant...
Paycloud Holdings says attackers breached its Arara Message email service, took up to 77 million addresses from about 380 clients, and sent 7.13 million phishing...
Have I Been Pwned added about 851,000 email addresses from Harvard's 2025 alumni and donor system breach, which was later tied to ShinyHunters extortion.
The BYOD ransomware gang claims data on more than 1 million Michigan State students. MSU calls it a potential credential compromise with no evidence other...
Google and partners dismantled the XCPE botnet, a backdoor in 1.3 million Android TV boxes that Google says the maker Videostrong built and sold to...
Tools and intelligence from BreachNews.
