Accenture has confirmed a security breach after a hacker offered stolen data for sale. The incident was publicly reported via a Reddit cybersecurity post linking to a news article. Details about the nature of the breach, the data compromised, or the attack vector have not been provided in the available information. No affected software versions or specific vulnerabilities have been identified. There is no indication that this is related to a cloud service or that known exploits are currently in the wild. The breach is considered high severity due to the involvement of stolen data being offered for sale, but technical specifics remain minimal.
IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company. [...]
In April, ShinyHunters accessed the company’s corporate IT systems and stole patients’ personal and medical information. The post Medtronic Data Breach Impacts 3.8 Million People appeared first on SecurityWeek .
ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them. [...]
Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party. [...]
The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector partners. [...]
An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. [...]
Hackers accessed the insurance giant’s policyholder portal multiple times between June 15 and June 25. The post Aflac Japan Data Breach Impacts 4.38 Million appeared first on SecurityWeek .
Aflac, a major American insurance company, disclosed a data breach affecting its Japan subsidiary after unauthorized access to its systems. The breach occurred between June 15 and June 25, 2026, exposing personal, policy, coverage, and bank account information. The incident is limited to Aflac Japan's systems, with no access to U.S. operations reported. Aflac has taken containment measures, suspended affected systems, and is investigating with external cybersecurity experts. Japanese authorities have been notified, and affected individuals will be informed. The full scope and impact remain under investigation. This follows a previous breach disclosed by Aflac a year earlier, linked to a broader campaign targeting insurance companies.
Only a handful of the 100 organizations targeted in the PeopleSoft campaign have been confirmed. The post Nissan Employee Data Breached in Oracle PeopleSoft Hack appeared first on SecurityWeek .
Nissan is warning that it suffered a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability in data theft attacks previously linked to the ShinyHunters extortion group. [...]
The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. [...]
Japanese telecommunications operator KDDI Corporation disclosed a data breach where threat actors gained access to one of its email systems used by five other internet service providers (ISPs) in the country. [...]
Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact. The post More Klue Breach Victims Identified as Hackers Get Hacked appeared first on SecurityWeek .
Other noteworthy stories that might have slipped under the radar: Russia used Cellebrite to hack activist’s phone, Five Eyes issue urgent AI threat warning, macOS Gaslight backdoor, Scattered Spider guilty pleas. The post In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs appeared first on SecurityWeek .
Mandiant has helped the California water utility investigate the cyberattack launched by Iranian hacker group Handala. The post Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack appeared first on SecurityWeek .
A reseller account compromise allowed an attacker to access and inject malicious content into dozens of unrelated customer websites hosted on a shared cPanel/WHM server. The attacker used the reseller's credentials to propagate Indonesian online-gambling doorway pages across multiple sites without breaching each site individually. This coordinated parasite-SEO attack affected diverse businesses, highlighting the risk posed by reseller account compromises in multi-tenant hosting environments.
Tata Electronics has confirmed in a statement to BleepingComputer that it was the target of a cyberattack that impacted parts of its IT infrastructure. [...]
Healthcare technology company Xsolis says that sensitive data belonging to nearly 1.4 million individuals was compromised in a phishing attack that gave attackers access to its network. [...]
A 29-year-old memory leak vulnerability named Squidbleed was discovered in the Squid open-source caching proxy server. The flaw leaks internal memory, including plaintext HTTP requests and sensitive data such as credentials and session tokens, when Squid handles cleartext HTTP traffic and connects to an attacker-controlled FTP server. The vulnerability stems from a 1997 code commit related to FTP directory listing parsing and was fixed in Squid version 7.6 released in June 2026. Disabling FTP support in Squid is recommended to eliminate the attack surface.
