CenterPoint Energy, a Texas-based utility company serving approximately 7 million customers, confirmed a data breach after a hacker claimed to have stolen 7.5 million customer records. The breach involved unauthorized access to an external-facing system, and the company is investigating the incident. The breach has not affected the delivery of electric and gas services, and the company does not expect a material impact from the data exposure. The hacker leaked a 2.5 GB archive allegedly containing the stolen data and threatened further attacks on infrastructure. This is not the first time CenterPoint Energy data has been targeted, with previous incidents linked to third-party breaches. The validity of the leaked data has not been independently confirmed.
Japan's Digital Agency suffered a data breach affecting approximately 240,000 individuals due to exploitation of a vulnerability in a VPN product. The attackers accessed personal information including names, email addresses, phone numbers, and workplace-related addresses. The breach was discovered in late June 2026 and involved unauthorized use of a maintenance employee's account. No sensitive information such as identification numbers or financial data was compromised. The agency blocked external access to the affected server and suspended the compromised account. The exploited VPN vulnerability was publicly disclosed prior to the attack. No other systems or general public information were affected.
Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. [...]
Revolut, a British fintech company, experienced a data breach where personal and financial information of a subset of users was exposed to a third party impersonating a government agency. The attacker used a legitimate government agency domain email to submit fraudulent information requests, which were mistakenly treated as authentic. Exposed data included personally identifiable information such as names, addresses, dates of birth, copies of identification documents, and financial details including IBANs and transaction history. Revolut confirmed the breach, blocked the attacker’s email, and notified relevant authorities. The breach affected only a limited number of users, and Revolut’s systems and customer funds remain secure.
Attackers can combine social engineering with malicious OAuth applications to gain access to Google Workspace data without relying solely on stolen passwords. This webinar examines two attacks to show how these breaches unfold and which security controls can help stop them. [...]
Telus, a major Canadian telecom provider, experienced a multi-month account breach campaign from February 2025 to June 2026. Attackers used stolen credentials to access subscriber personal data and billing records, including names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. The compromised information was used to attempt to convince customers to switch services and, in some cases, to make unauthorized changes to accounts. Telus reset affected credentials and implemented enhanced security monitoring. The Vancouver Police Department was notified, and identity theft protection services were offered to victims. The breach appears linked to credential stuffing or account takeover using credentials possibly obtained from third parties, though this is not confirmed by Telus.
Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. [...]
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach of its DAVID driver database. Attackers accessed the system using credentials stolen from a police department employee. No specific technical details or affected versions are provided. The breach involves unauthorized access to sensitive driver information.
Surfshark VPN experienced a security breach due to a misconfigured internal test server exposed to the internet. Hackers accessed this server and a separate proxy server used for content-accessibility optimization. The breach exposed service configurations, build-related credentials, system binaries, and code history, but did not affect production infrastructure or customer data. Surfshark confirmed no sensitive user information, VPN traffic, or encryption keys were compromised. The incident was detected on August 31, contained by September 2, and fully remediated shortly after. Surfshark rotated credentials, revoked tokens, and enhanced security controls and monitoring. Users are not required to take action but should remain vigilant for suspicious activity.
IDScan, an identity verification company, confirmed a data breach involving unauthorized access to customer data stored on its cloud platform. The breach exposed sensitive information including full names and driver's license or other government-issued ID numbers, with reports indicating that scans of over 153 million U.S. and Canadian driver's licenses were compromised. The incident was discovered around September 1, 2026, and IDScan has engaged third-party specialists and law enforcement to investigate. The company is notifying affected individuals and offering free credit monitoring and identity protection services. Multiple lawsuits have been filed against IDScan following the breach. The stolen data was initially advertised on a dark-web platform called Nexus, which has since been taken offline, though the database may still be accessible to threat actors.
In June 2026, AdaptHealth, a US-based healthcare company operating over 680 facilities, suffered a data breach impacting over 4.1 million individuals. Hackers accessed cloud-based applications, including internal patient management and document storage systems, via social engineering targeting a third-party contractor. The stolen data includes personal, health, and insurance information, but excludes Social Security numbers and financial information. The breach was confirmed by AdaptHealth and reported to the US Department of Health and Human Services (HHS).
AdaptHealth, a healthcare company providing home medical devices and services, confirmed a data breach affecting 4.1 million individuals. The breach, discovered in July 2026 and attributed to the ShinyHunters threat group, involved unauthorized access to cloud-based business applications and internal patient management systems. The attackers gained access through a social engineering attack compromising a third-party contractor's privileged account. Exposed data includes personal and health information. AdaptHealth notified affected individuals and offered free credit monitoring. No evidence of identity theft or fraud has been found so far.
Veradigm, a healthcare technology company, disclosed a data breach resulting from a cybersecurity incident at a third-party vendor. The breach involved unauthorized access to patient personal data, including Social Security numbers, through compromised vendor credentials used to access a limited API interface. Clinical and medical information was not affected. The ransomware group 'The Gentlemen' claimed responsibility, threatening to leak 3.5 million patient records if a ransom is not paid. Veradigm has initiated incident response, notified law enforcement, and is notifying affected individuals with credit monitoring offered where applicable. The investigation is ongoing, and Veradigm does not expect a material impact on its business or operations.
A Redis cryptomining botnet compromised 3,562 Redis servers by exploiting unsecured no-auth configurations. The botnet operator's own files were exposed in an open directory, revealing the full toolkit and detailed campaign logs. The attack leveraged rogue replication commands to deploy a cron job that runs the XMRig miner, targeting Monero mining pools. The issue is due to missing authentication and insecure default configurations, not a software vulnerability. The affected Redis versions range from 2.8.17 to 7.2.0. Mitigation involves configuring Redis securely by enabling authentication and disabling replication features if unused.
The ShinyHunters extortion group claims to have breached the Florida Department of Motor Vehicles' online platform known as "DAVID," stealing over 200,000 driver records. This breach involves unauthorized access to sensitive personal information of Florida drivers. No specific technical details about the vulnerability or attack vector are provided. There is no information on whether the breach has been officially confirmed or if remediation steps have been taken. No patch or fix details are available. The incident affects Florida residents whose data is stored in the DAVID DMV database. The severity is assessed as high due to the exposure of a large volume of sensitive personal data.
Third-party applications connected to Google Workspace can retain access long after their original purpose is forgotten. This webinar examines how overly permissive integrations contribute to breaches and which security controls can help fast-growing companies reduce their exposure. [...]
Mathspace, an online mathematics platform, suffered a data breach impacting over 1 million individuals due to exploitation of a critical SQL injection vulnerability (CVE-2026-72898) in its self-hosted Metabase instance. The breach involved unauthorized access and data exfiltration of personal information including names, user IDs, usernames, email addresses, and related metadata of students, teachers, staff, and parents/guardians primarily from Australia and New Zealand. No sensitive academic records, passwords, or authentication credentials were exposed. The incident was discovered weeks after exploitation began, and remediation was delayed beyond the patch release date. Mathspace has taken steps to secure the environment and is investigating the incident while notifying affected individuals.
Exclusive: An exposed Advance Passenger Information System (APIS) database held 220 million passenger and crew records containing names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. Researchers accessed the Vietnam-linked system through a cloud-based path using default credentials. [...]
Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. [...]
Cryptocurrency hardware wallet maker Trezor says an August data breach at its shipping and logistics provider, ShipMonk, affects an additional 67,000 U.S. customers. [...]
