California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company's failure to protect sensitive customer genetic and personal information. [...]
Noteworthy stories that might have slipped under the radar: Trump Mobile exposes customer data, phishers target the 2026 FIFA World Cup, CISA responds to recent supply chain attacks. The post In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks appeared first on SecurityWeek .
The notorious ShinyHunters extortion group leaked over 42 million records allegedly stolen from Charter in April. The post Charter Communications Data Breach Could Impact Nearly 5 Million appeared first on SecurityWeek .
A report reveals that over 2,000 AI-built applications created on vibe-coding platforms are publicly exposed on the internet without adequate access controls, often granting admin access by default. These applications connect directly to corporate production systems and contain sensitive corporate, operational, or personal data. The exposure results from employees building and deploying these apps without IT or security oversight, exploiting gaps in traditional security tools that do not monitor session-layer activities or custom AI-built applications. This risk surface spans multiple industries and continents and persists despite mature security stacks. The issue is not due to malicious intent but rather the lack of governance and visibility over these new AI-driven development workflows.
Attorney General Rob Bonta filed the lawsuit against Chrome Holding Co., which 23andMe rebranded under after filing for bankruptcy last March. The post California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach appeared first on SecurityWeek .
This report discusses design considerations for a local AI-assisted incident investigation tool used in cybersecurity. The tool is intended to run locally on Linux or Windows hosts to assist first-pass investigations without making production changes. It collects evidence from various system sources and produces reviewable reports without executing potentially disruptive actions like killing processes or changing firewall settings. The discussion focuses on defining safe operational boundaries and trust requirements for such AI tools in incident response workflows. No active exploitation or vulnerability is described.
The ShinyHunters extortion gang stole personal information from 4.9 million accounts after hacking the U.S.telecom giant Charter Communications in early April, according to data breach notification service Have I Been Pwned. [...]
Data breach leaves nearly 6 million Carnival customers navigating identity theft risks. The post Carnival Data Breach Exposed 6 Million People appeared first on SecurityWeek .
Carnival Corporation, the world's largest cruise line operator, has confirmed a data breach affecting nearly 6 million people claimed by the ShinyHunters extortion gang in April 2026. [...]
Unit 42 explores trends in data theft and extortion, outlining key strategies for organizations as frontier AI models advance. The post Out of the Crypt: The Evolving Cyber Extortion Economy appeared first on Unit 42 .
The Python Durable Task client package 'durabletask' from Microsoft was compromised by the threat actor TeamPCP. Malicious versions 1.4.1, 1.4.2, and 1.4.3 were pushed to PyPI using stolen CI/CD credentials. These trojanized packages contained backdoors that harvested credentials at runtime and propagated further through stolen credentials. This compromise is part of a broader supply chain attack campaign by TeamPCP affecting multiple developer tools and SDKs since March 2026.
U.S.telecommunications giant Charter Communications has confirmed it suffered a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom is paid. [...]
Microsoft is testing a new Defender for Endpoint capability that will automatically isolate compromised endpoints to thwart attackers' attempts to move laterally across the network. [...]
The allegedly stolen information leaked by ShinyHunters contains email addresses, names, addresses, and dates of birth. The post 185,000 Likely Impacted by 7-Eleven Data Breach appeared first on SecurityWeek .
Lithuanian authorities are on high alert after a massive data leak involving more than 600,000 entries from national data registers. The post Lithuania Suspects Foreign Involvement in Data Leak of Over 600,000 National Register Entries appeared first on SecurityWeek .
The ShinyHunters extortion gang stole the personal information of over 183,000 people after hacking the systems of convenience store chain giant 7-Eleven in April, according to data breach notification service Have I Been Pwned. [...]
The affected third-party vendor has not been named, but one possible candidate is TriZetto. The post Oncology Institute Discloses Data Breach appeared first on SecurityWeek .
Threat actors stole files containing names and protected health information from the healthcare organization’s systems. The post 266,000 Affected by Data Breach at Radiology Associates of Richmond appeared first on SecurityWeek .
Hackers accessed names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories. The post DocketWise Data Breach Impacts 143,000 appeared first on SecurityWeek .
A CISA contractor intentionally published AWS GovCloud keys and other sensitive agency secrets on a public GitHub repository, leading to a significant data leak. Lawmakers in the U.S. Congress are demanding answers as CISA attempts to contain the breach and invalidate the compromised credentials. The incident involves exposure of critical cloud service credentials and agency secrets, raising concerns about insider threat and credential management. There is no confirmed evidence of exploitation in the wild at this time.