A publicly accessible GitHub repository allegedly contains data associated with Meckano, an Israeli workforce-management platform. The authenticity, origin, and scope of the data exposure have not been independently verified. The repository's contents require further investigation by security researchers to confirm if this is a genuine data breach. No confirmed exploit or official vendor advisory is available at this time.
A data breach occurred at ShipMonk, a shipping provider for Trezor, exposing personal details of approximately 13,689 customers who placed orders between May and August 2026. Exposed data includes full names, email addresses, phone numbers, and shipping addresses. Trezor's own systems and hardware wallets were not compromised. The breach increases the risk of phishing attacks targeting affected customers. Trezor has notified impacted individuals and is working with ShipMonk to investigate and secure systems. Customers are advised to be vigilant against phishing and not to share wallet backups or sensitive information.
The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. [...]
Trezor, a hardware wallet manufacturer, disclosed a data breach affecting nearly 14,000 customers due to a hack of its shipping provider, ShipMonk. The attackers accessed customer order data including full names, shipping addresses, email addresses, and phone numbers. The breach impacts customers from multiple countries who received orders between May 10 and August 8, 2026. Trezor's own systems and devices were not compromised, but affected customers may face increased phishing attempts using the stolen data. The company warns users to be vigilant against scams impersonating banks, crypto exchanges, or Trezor itself.
Adform, a major advertising platform, remained compromised for roughly 24 hours from late on July 26 through the evening of July 27 after being breached by unknown attackers. Few people outside the industry recognize the name, but Adform serves around 1.5 billion ad impressions every day across tens of thousands of websites. That means anyone visiting any site that runs Adform ads could have been targeted. The attackers weren’t trying to install malware. Instead, they ran a script in the victim’s browser that checked the clipboard every three seconds, and if it found a cryptocurrency wallet address had been copied, swapped it for the attackers’ own wallet address. So if someone had a site with the malicious ad open in one browser tab, and was making a crypto transaction in another tab or in a dedicated app, the funds could have ended up in the attackers’ pockets instead. Adform’s owners caught the attack and fixed the problem, but there’s no guarantee a similar incident won’t happen again — which is why every user should defend themselves against malvertising . Check out our tips at the end of this post. What we know about the attack on Adform There isn’t a lot of information out there, since the company’s official statement covers only what happened and when, without getting into the root cause of the incident. Independent research has dug up technical details about how ordinary users were targeted, but none of that explains how Adform itself was breached in the first place. What’s clear is that the attackers slipped their own code into the JavaScript that loaded on every site running Adform ads. Whenever an ad was about to display, the script would load from Adform’s server, pick the right ad, and show it — but the attackers had tacked on a set of malicious functions: monitoring the clipboard, sending data about the site where the encounter happened, and the victim’s IP address back to their own server, and swapping out Bitcoin, Ethereum, and Tron wallet addresses. All it took to make it work was having any site with Adform-served ads open in one browser tab. It didn’t matter what kind of site it was, what the ad looked like, or which advertiser it belonged to. The one thing that mattered was whether the site ran over HTTP or HTTPS. According to Adform, the attack couldn’t succeed on a site loaded over HTTPS since the connection to the attackers’ server was blocked in this case. The company hasn’t shared any information on how many users were affected, or how many sites still serve their content and ads over HTTP. Malicious ads are an everyday occurrence Unfortunately, dangerous online ads have become a systemic problem. And we’re not just talking about sketchy supplement ads or gambling promos — we mean ads that spread malware or lead to sites designed to steal payment details and other valuable data. Attackers have built out industrial-scale infrastructure to pull this off, and they use several different approaches. Hacking and compromising ad servers. Adform isn’t an isolated case: attackers have previously breached Revive ad servers , for one, and spread malware through ads on PornHub . Hijacking the ad accounts of legitimate, reputable brands . All it takes is stealing a password from someone in marketing. From there, the cybercriminals run ads posing as the company they hacked, pushing fake app updates, bogus promotions, and similar scams. In the worst cases — like the account breaches at adtech.de and adxpansion.com — attackers managed to run ads that redirected victims straight into automatic malware installs ( drive-by downloads ). Buying ads directly. That’s right — attackers simply set up their own advertiser accounts and run ads for their phishing sites and malware, just like any other business online. Since ads show up practically everywhere — on websites, in apps, and on social media — these threats can turn up in pretty much any context. And you’ll find variations of this threat on both computers and mobile de…
In late 2025, a small combined heat-and-power (CHP) plant in Poland was breached by attackers using a private APN to access its operational technology (OT) network. The attackers exploited a misconfiguration that allowed devices within the private APN network to communicate freely, enabling lateral movement. They compromised a FortiGate VPN/firewall and a Teltonika cellular router to tunnel into the private APN, then accessed a WAGO PFC200 PLC with default credentials. The attackers subsequently disabled key systems including a steam turbine and water treatment system by switching PLCs to STOP mode and activating password protection. The outage was short-lived and did not impact the population. This incident is notable as the first known real-world cyberattack leveraging lateral movement through a private APN to reach OT networks. The Polish CERT recommends treating private APNs as untrusted external networks and implementing client isolation and traffic allowlists.
Video game publisher and digital distribution giant Valve is notifying Steam hardware customers in Europe that hackers stole their data after hacking its shipping partner, CEVA Logistics. [...]
Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach incident that occurred in October 2025. [...]
Hackers stole personal, medical, and health insurance information from a company’s data center. The post 3.8 Million Impacted by Unlimited Technology Systems Data Breach appeared first on SecurityWeek .
Switzerland's federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts. [...]
Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. [...]
Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following OpenAI'sOpenAI's initial disclosure that its agents breached Hugging Face. [...]
The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week. The post Meta AI Hacked External Systems During Cybersecurity Testing appeared first on SecurityWeek .
The AI meeting assistant tl;dv exposed 181,874 meetings due to a misconfigured Firestore database. This exposure included live calls that unauthorized users could join. The vulnerability was disclosed by a researcher in January but remains unpatched six months later.
Hackers stole personal information, medical records, and financial information from the organization’s server. The post 311,000 Impacted by Brown Health Medical Group-MA Data Breach appeared first on SecurityWeek .
Reports have emerged on Reddit about accounts on the Messenger platform being hacked. The claim involves images sent in group chats that allegedly contain malicious content capable of compromising accounts when clicked. However, the information is based on a single Reddit post with minimal discussion and no technical details or vendor confirmation. No specific vulnerability, exploit, or patch information is provided.
In May 2025, Madera Community Hospital in California experienced a data breach where hackers accessed its network for two days and likely exfiltrated personal, financial, and medical information of approximately 150,810 individuals. The compromised data includes names, contact details, dates of birth, Social Security numbers, account credentials, financial account information, treatment and health insurance information, and limited biometric data. The hospital engaged experts to analyze the breach and has notified affected individuals and the US Department of Health and Human Services. The extortion group responsible withdrew its ransom demand, stating they did not want to harm patients. The hospital has taken steps to investigate, secure systems, and notified law enforcement.
A cyberattack targeted Liechtenstein's register of people behind companies, foundations, and trusteeships, compromising data of approximately 31,000 individuals. The register supports anti-money laundering and counter-terror financing efforts. The breach was detected promptly, and the system was taken offline to secure the data. There is no indication that data was altered or deleted. The government has established a crisis unit to investigate the incident.
A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. [...]
