OpenAI appears to be testing a new subscription and experience for science use cases, but it's unclear if it'll be available to everyone regardless of their background. [...]
A large-scale compromise of over 75,000 Fortinet device administrator credentials has been reported. The compromised credentials appear to be recent and include devices that are still online. The data was reportedly obtained from device configuration exports, containing sensitive information visible only from the devices themselves. This incident affects a significant portion of Fortinet firewall devices exposed to the internet, estimated at around 15% based on Shodan polling. The compromised devices include many with fairly recent patches. The source of this information is a Reddit post linking to a LinkedIn profile of a security researcher involved in the discovery.
Attendees will learn how attackers evade conventional detection methods, why legacy MFA alone is no longer sufficient, and how organizations can strengthen their defenses. The post Webinar Today: How Modern Breaches Bypass MFA and Evade Detection appeared first on SecurityWeek .
Kodak confirmed a data breach involving unauthorized access to a limited amount of company data. The ShinyHunters extortion gang claimed responsibility, stating they stole over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data. Kodak is investigating the incident with external cybersecurity experts and cooperating with law enforcement. The company has not disclosed how the attackers gained access or whether the internal network was breached. ShinyHunters has a history of targeting multiple organizations and extorting data. Kodak has not yet provided details on remediation or mitigation.
Kodak has confirmed that it's working with external cybersecurity experts to investigate a security breach after hackers gained access to some of the company's data. [...]
A user reported installing a malicious application disguised as a James Bond 007 game from a fake site, resulting in multiple account compromises including Microsoft and Steam accounts. The attacker changed the victim's personal information and gained unauthorized access despite Google 2FA blocking some attempts. The incident was shared on Reddit's cybersecurity subreddit with minimal technical details and no known exploit or patch information.
Digital healthcare company iRhythm Holdings has disclosed a data breach after hackers stole patients' personal and health information stored on third-party-hosted business applications. [...]
An Iranian threat actor group known as Ababil of Minab left a staging server publicly accessible, exposing over 5 GB of data related to multiple victims including LA Metro. The exposed data includes SQL backups, SCADA configurations, attacker tooling, and victim names. LA Metro confirmed their breach in April, but additional victims were only revealed due to this server exposure. This incident reveals operational security failures by the attacker, leading to unintended disclosure of sensitive information.
WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack impacting Awesome Motive-s content distribution network (CDN). [...]
The Council of Europe, the continent's oldest intergovernmental body, is probing claims of a data breach made by the ShinyHunters extortion group over the weekend. [...]
A China-linked espionage campaign targeted exposed REDCap servers, deploying the InfiniteRed malware to steal sensitive medical research data from a North American institution. The attack involved breaching vulnerable REDCap servers to gain unauthorized access and exfiltrate confidential information. No specific affected software versions or patches are identified. There is no indication of known exploits in the wild beyond this campaign. The threat is assessed as medium severity based on the sensitive nature of the stolen data and the targeted espionage activity.
The ShinyHunters extortion gang stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the widely used Infinite Campus K-12 student information system in March. [...]
The pharmaceutical giant says the attackers gained access to personal data stored on the compromised systems. The post Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems appeared first on SecurityWeek .
French officials say roughly 73,000 government accounts were affected, while the threat actor claims to have stolen messages and user data from the sovereign Tchap platform. The post French Government Messaging Platform Breached by Mysterious ‘Misere’ Hacker appeared first on SecurityWeek .
The extortion group threatens to leak 297 GB of data allegedly stolen from the Council of Europe, including employee personal information. The post ShinyHunters Claims Council of Europe Hack appeared first on SecurityWeek .
Someone posted fake VRChat and Discord data breach reports on the system, prompting the Maine AG to take action. The post Maine Disables Data Breach Portal Due to Fake Submissions appeared first on SecurityWeek .
This entry references a service called Breach Detective, which is a search engine for breached credentials aggregated from multiple data leaks. The information provided is promotional and describes the service's capabilities to help users discover if their data has been compromised. There is no specific vulnerability or exploit detailed in the provided data. The source is a Reddit post linking to the Breach Detective website, with no technical details or evidence of an active breach or exploit.
Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future. [...]
Danish pharmaceutical giant Novo Nordisk, the world's largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials. [...]
The French government revealed that a recent breach of its Tchap encrypted messaging platform affects the accounts of over 73,000 employees in the French public sector. [...]
