Threats Tagged 'data breach'

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

HighVulnerabilityBritish Indian Ocean TerritoryIndiaIndonesia+4#cve#cve-2025-8088#cwe-35

The article provides a detailed analysis of the Shell data breach attributed to the Cl0p ransomware syndicate, highlighting the exfiltration of 89GB of sensitive engineering data through a pure extortion attack. It explains Cl0p's shift from traditional ransomware encryption to data theft and extortion, the risks posed to the global energy supply chain, and offers concrete defensive recommendations for critical infrastructure operators.

The article details a significant data breach at SplitVPN exposing 865,336 user emails, hashed passwords, and nearly 58 million connection logs, contradicting the provider's no-logs claim. It provides a verified scope of the leaked data, analyzes the privacy implications, and offers actionable mitigation steps for affected users and organizations.

The article details a significant data breach incident involving Abbott Laboratories, where the ShinyHunters extortion group claims to have stolen 30 million patient records via a vishing attack compromising Microsoft Entra SSO accounts. It provides insights into the attack vector, the scope of data allegedly stolen, Abbott's official response, and mitigation recommendations against vishing-based SSO attacks.

This article provides a detailed analysis of the recent cyber attack involving the Kudankulam Nuclear Power Plant, focusing on a data breach via a third-party contractor's server. It outlines the scope of leaked files, the ransomware group responsible, and NPCIL's official response emphasizing that critical nuclear safety systems were not compromised. The report highlights supply chain risks and ongoing investigations by CERT-In.

In early May 2026, Instructure confirmed a breach affecting its Canvas learning platform after detecting unauthorized activity on May 1. ShinyHunters exploited the Free-For-Teacher account program, compromising the Canvas platform directly and exposing names, email addresses, student IDs, and private messages. The exposure window ran from April 30 to May 7, 2026. ShinyHunters claims 3.6 TB of data covering approximately 275 million users across 9,000 schools globally, including institutions in the US, Australia, and EU. This represents ShinyHunters' second attack against Instructure in eight months. Instructure shut down the Free-For-Teacher program permanently, rotated API keys and privileged credentials, and engaged forensic investigators. The stolen data enables personalized phishing campaigns targeting students and faculty, with attackers potentially having write access sufficient to deface login pages at multiple institutions.

MediumCampaignUnited StatesAustralia#phishing campaign#api compromise#social engineering

A hacker known as "James" leaked the complete user database of BreachForums, a major Dark Web forum for stolen data trading and hacking discussions. The breach exposes detailed user metadata including usernames, hashed passwords, emails, IP addresses, and PGP keys, affecting over 320,000 users and potentially aiding law enforcement investigations. The incident highlights vulnerabilities in cybercriminal infrastructure and provides actionable intelligence on key threat actors and forum operators.

In July-August 2025, India faced a surge of cross-border cyberattacks combining data breaches, DDoS, defacement, phishing, and malware. Pakistani, Bangladeshi, Russian, Indonesian, and likely Chinese actors targeted Indian judicial, defense, and transport systems. High-impact incidents included judicial server breaches, government website disruptions, retaliatory defacements, phishing schemes, and malware campaigns. Indian groups retaliated under 'Operation Vasudev Strike'. The attacks demonstrated the growing scale, sophistication, and multinational nature of hacktivist operations targeting India's digital infrastructure, blending hacktivism and cybercrime to challenge national security and public trust.

MediumMalwareUnited KingdomGermanyFrance+4#india#cross-border#smss.exe

This comprehensive analysis covers cyber threats and security issues affecting financial companies in South Korea and globally. It examines malware and phishing cases targeting the financial sector, including the top 10 malware strains and leaked Korean account statistics on Telegram. The report delves into dark web threats, focusing on credit card data breaches, financial institution database leaks, and ransomware attacks. Notable incidents include the M*** digital payment platform data breach in Indonesia, affecting 44 million users, and the Everest ransomware group's attack on J*** Bank in Jordan, compromising 11.7 GB of internal data. The analysis emphasizes the need for enhanced security measures, including real-time protection systems, account takeover detection, and strengthened internal defense mechanisms in the financial industry.

MediumMalwareSouth KoreaUnited KingdomGermany+7#financial sector#phishing#dark web

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data breaches, database breaches, and ransomware attacks. A notable case involves the Arkana ransomware group's breach of a global online brokerage firm, In***, resulting in the theft of 50 GB of customer data, including KYC submissions and information of over 163,000 customers. The incident highlights vulnerabilities in trading platforms' identity verification and account protection systems, emphasizing the need for enhanced security measures beyond regulatory compliance.

MediumCampaignSouth KoreaUnited KingdomGermany+3#customer data#ransomware#identity theft