In files downloaded from the internet, HTML tags referencing external paths could be used to leak NTLM hashes during file previews. The post Microsoft Disables Downloaded File Previews to Block NTLM Hash Leaks appeared first on SecurityWeek .
An individual reported their AWS account was compromised, sharing their experience on a public blog linked from a Reddit NetSec post. The incident highlights risks associated with cloud account security, though specific technical details on the attack vector or exploited vulnerabilities are not provided. No known exploits or automated attacks are currently linked to this breach. The severity is assessed as medium due to potential exposure of sensitive cloud resources, but the lack of detailed indicators limits broader impact assessment. European organizations using AWS should be aware of the risks of credential compromise and ensure robust identity and access management. Countries with high AWS adoption and significant cloud infrastructure usage are more likely to be affected. Mitigation should focus on enforcing multi-factor authentication, monitoring account activity, and securing credentials beyond generic advice. Given the limited technical detail, the threat is rated medium severity based on potential impact and ease of exploitation through credential theft or phishing. Defenders should prioritize cloud account security hygiene and incident response readiness.
Myanmar is notorious for hosting cyberscam operations responsible for bilking people all over the world. The post Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People appeared first on SecurityWeek .
The Everest Gang has claimed responsibility for a high-severity breach targeting Collins Aerospace, a major aerospace and defense supplier. The breach was publicly disclosed through a Reddit InfoSec news post linking to a Security Affairs article. Although technical details are sparse and discussion minimal, the incident is considered newsworthy due to the high-profile nature of the victim and potential implications for aviation and defense sectors. No known exploits or patches have been reported yet. The breach could impact confidentiality and integrity of sensitive aerospace data, potentially affecting supply chains and national security. European organizations involved in aerospace, defense, or supply chain partnerships with Collins Aerospace are at risk. Mitigations should focus on enhanced monitoring, incident response readiness, and supply chain security assessments. Countries with significant aerospace industries and defense sectors, such as France, Germany, Italy, and the UK, are most likely to be affected. Given the high-profile target and potential impact, the suggested severity is high.
Other noteworthy stories that might have slipped under the radar: Capita fined £14 million, ICTBroadcast vulnerability exploited, Spyware maker NSO acquired. The post In Other News: CrowdStrike Vulnerabilities, CISA Layoffs, Mango Data Breach appeared first on SecurityWeek .
Sotheby's has disclosed a data breach impacting personal information, including SSNs. The post Hackers Steal Sensitive Data From Auction House Sotheby’s appeared first on SecurityWeek .
Sotheby’s, a major auction house, suffered a data breach that exposed customer financial information. The breach was publicly disclosed in October 2025 and reported by credible sources including BleepingComputer and Reddit InfoSec News. Although detailed technical specifics of the breach are not provided, the exposure of financial data indicates a significant compromise of sensitive customer information. No known exploits are currently active in the wild, and the discussion level in public forums remains minimal. The breach poses a high risk to affected individuals and organizations due to potential financial fraud, identity theft, and reputational damage. European organizations connected to Sotheby’s or using similar systems may face indirect impacts, especially those involved in luxury goods, auctions, or financial services. Mitigation should focus on enhanced monitoring, customer notification, and strengthening data protection controls. Countries with strong luxury markets and high Sotheby’s client presence, such as the UK, France, Germany, Italy, and Switzerland, are likely to be most affected. Given the sensitivity of the data and the breach context, the severity is assessed as high.
Hackers stole names, addresses, dates of birth, email addresses, Social Security numbers, government IDs, and other information. The post Prosper Data Breach Impacts 17.6 Million Accounts appeared first on SecurityWeek .
A misconfigured NetcoreCloud server exposed approximately 40 billion records totaling 13.4TB of data, leading to a significant data breach. The exposure was due to improper server configuration, allowing unauthorized access to a massive volume of sensitive information. Although no known exploits are currently active in the wild, the sheer scale of exposed data presents a substantial risk to affected organizations and individuals. This breach primarily impacts confidentiality, with potential secondary impacts on integrity and availability if attackers leverage the data for further attacks. European organizations using NetcoreCloud services or handling data processed by this platform are at risk, especially those in sectors with high data sensitivity. Mitigation requires immediate configuration audits, restricting public access, and implementing strict access controls. Countries with high adoption of cloud services and digital marketing platforms, such as the UK, Germany, and France, are more likely to be affected. Given the ease of exploitation through misconfiguration and the vast scope of data exposed, the severity is assessed as high. Defenders should prioritize verifying their cloud configurations and monitoring for any suspicious activity related to this breach.
Hackers have breached F5 Networks and stolen undisclosed vulnerabilities and source code related to their BIG-IP product line. This breach potentially exposes zero-day flaws that could enable remote code execution (RCE) attacks. Although no known exploits are currently observed in the wild, the theft of source code and undisclosed flaws significantly raises the risk of future targeted attacks. European organizations using BIG-IP devices for application delivery and security could face increased threat exposure. Immediate mitigation involves heightened monitoring, applying any forthcoming patches promptly, and reviewing network segmentation around BIG-IP devices. Countries with high adoption of F5 BIG-IP, such as Germany, the UK, France, and the Netherlands, are particularly at risk. Given the sensitivity of the stolen data and the potential for RCE, the severity of this threat is assessed as high. Defenders should prioritize threat hunting for suspicious activity related to BIG-IP and prepare incident response plans for potential exploitation scenarios.
Clothing retailer MANGO has disclosed a data breach that exposed customer information. The breach was recently reported and confirmed by a trusted cybersecurity news source. Although specific technical details and the extent of the breach have not been fully disclosed, the incident is classified as high severity due to the exposure of sensitive customer data. There are no known exploits in the wild linked to this breach at this time. The breach highlights risks related to data confidentiality and potential misuse of personal information. European organizations, especially those in retail and e-commerce sectors, should be alert to similar threats. Mitigation should focus on enhancing data protection, monitoring for suspicious activity, and preparing incident response plans. Countries with significant MANGO customer bases and retail sectors are most likely to be impacted. The overall severity is assessed as high given the potential impact on customer privacy and brand reputation without requiring user interaction or authentication to exploit the breach.
After being named by Discord as the third-party responsible for the breach, 5CA said none of its systems were involved. The post Customer Service Firm 5CA Denies Responsibility for Discord Data Breach appeared first on SecurityWeek .
A large-scale data leak involving an Elasticsearch server has exposed approximately 6 billion records aggregated from web scraping and multiple old and new breaches. The exposed data likely includes sensitive personal and organizational information collected over time, posing significant privacy and security risks. This breach does not specify affected Elasticsearch versions or particular exploited vulnerabilities, and there are no known active exploits in the wild. The leak was reported via Reddit and covered by an external news source, indicating limited technical details and minimal community discussion so far. European organizations could be impacted if their data is part of the leaked records or if they use Elasticsearch servers with similar misconfigurations. The breach severity is assessed as medium due to the large volume of data exposed but lack of direct exploitation details. Mitigation should focus on securing Elasticsearch deployments, including access controls, encryption, and regular audits to prevent unauthorized data exposure. Countries with high adoption of Elasticsearch and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the scale and nature of the leak, the suggested severity is medium, reflecting substantial confidentiality impact but limited direct exploitation evidence.
Unity Technologies’s SpeedTree website was compromised, resulting in the theft of customer payment data. This breach exposes sensitive financial information of users who interacted with the SpeedTree platform. Although no specific technical details or exploited vulnerabilities have been disclosed, the incident highlights risks associated with third-party software vendors. The breach is rated as high severity due to the sensitivity of stolen data and potential for fraud or identity theft. European organizations using SpeedTree or related Unity services should be vigilant about potential follow-on attacks or fraud attempts. Mitigation involves monitoring payment systems, enhancing incident detection, and reviewing third-party security postures. Countries with significant game development industries or large Unity user bases, such as Germany, France, and the UK, are likely more affected. The threat does not require user interaction for exploitation but depends on the attacker’s ability to breach the website. Overall, this incident underscores the importance of securing vendor platforms that handle payment data.
The ShinyHunters hacking group has leaked millions of user records from multiple organizations including Qantas and Vietnam Airlines. This breach involves unauthorized access and exfiltration of sensitive customer data, potentially including personal identifiable information (PII). The leak was reported via a Reddit InfoSec news post linking to an external source. Although no specific technical details or exploited vulnerabilities are disclosed, the breach indicates a significant compromise of corporate data security. The severity is assessed as medium given the scale and sensitivity of the data but lack of details on exploitation methods. European organizations, especially those in the travel and airline sectors, could face indirect impacts such as increased phishing or fraud attempts targeting their customers. Mitigation should focus on enhanced monitoring for suspicious activity, customer notification, and strengthening data protection controls. Countries with strong airline industries and high Qantas or Vietnam Airlines customer presence, such as the UK, Germany, and France, are more likely to be affected. Given the absence of a CVSS score, the threat is rated medium severity due to the impact on confidentiality and potential for identity theft, despite no direct evidence of active exploitation or system availability impact.
A breach was reported at DEF CON 33 detailing how over 1,000 car dealerships across the US were hacked. The information originates from a Reddit NetSec post linking to an external site, with minimal technical details publicly available. The breach appears to target automotive retail infrastructure, potentially exposing sensitive customer and operational data. No specific affected software versions or exploits are identified, and no patches or mitigation details have been provided. The severity is assessed as medium based on the scope and impact described. European organizations operating or partnering with US-based automotive dealerships could face indirect risks, including data privacy and supply chain disruptions. Mitigation requires enhanced network segmentation, monitoring of third-party connections, and thorough security audits of dealership IT systems. Countries with significant automotive industries and close ties to US dealerships, such as Germany, France, and the UK, are most likely to be affected. Given the lack of detailed exploitation data, the threat is rated medium severity due to potential confidentiality and integrity impacts without confirmed widespread exploitation or critical system compromise.
SimonMed Imaging has disclosed a significant data breach affecting over 1.2 million individuals. The breach involves unauthorized access to sensitive personal and possibly medical information, posing serious privacy risks. Although no specific technical details or exploited vulnerabilities have been publicly shared, the scale of the breach indicates a high-impact incident. There is no evidence of known exploits in the wild related to this breach at this time. European organizations should be aware of potential indirect impacts, especially if they have partnerships or data exchanges with affected entities. The breach highlights the critical need for robust data protection and incident response measures in healthcare-related sectors. Mitigation should focus on enhancing access controls, monitoring for suspicious activity, and ensuring compliance with data protection regulations such as GDPR. Countries with significant healthcare infrastructure and data exchange with US-based medical providers are more likely to be affected. Given the sensitivity of healthcare data and the large number of affected individuals, the severity is assessed as high.
SimonMed Imaging was targeted by the Medusa ransomware group, which claimed to have stolen 200 Gb of data. The post SimonMed Imaging Data Breach Impacts 1.2 Million appeared first on SecurityWeek .
A data breach involving Invoicely has exposed approximately 180,000 sensitive records, potentially including personal and financial information. The leak was reported via a Reddit InfoSec news post linking to an external article on hackread.com. There is no indication of known exploits actively leveraging this breach at present. The breach severity is assessed as medium due to the exposure of sensitive data but without evidence of active exploitation or critical system compromise. European organizations using Invoicely or related invoicing platforms could face risks related to data privacy violations and potential phishing or fraud attempts. Mitigation should focus on immediate assessment of exposed data, notification to affected individuals, and strengthening access controls and monitoring. Countries with significant SME sectors and high adoption of cloud invoicing services, such as Germany, France, and the UK, are likely most impacted. Given the breach involves sensitive data exposure without direct system compromise or active exploitation, the suggested severity is medium. Defenders should prioritize data breach response and enhanced monitoring for secondary attacks stemming from leaked information.
The data allegedly pertains to Albertsons, Engie Resources, Fujifilm, GAP, Qantas, and Vietnam Airlines. The post Extortion Group Leaks Millions of Records From Salesforce Hacks appeared first on SecurityWeek .
