Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

French Energy Giant ENGIE Hit by Data Breach, Customer Records Accessed Through Partner Platform

  ENGIE, one of the world's largest energy companies, has notified customers in France that an unauthorized third party accessed their p...

All the recent news you need to know
Healthcare Data
Cyber Networks Cyber Security Cyberattacks cybersecurity in healthcare Data protection data security Data Theft Healthcare Data

Cybersecurity Incident Disrupts New Mexico Hospital Network, Forcing Patient Diversions and Clinic Closures

 

A cybersecurity incident caused ambulance diversions, cancelled appointments and disruptions to medical facilities around the state on Monday October 26, leaving New Mexico with no emergency departments able to treat the most severe traumatic injuries. The University of New Mexico Health System provides the only level 1 trauma centre in the state. 

The health system advised patients not to attend the main hospital in Albuquerque and cancelled appointments at over 30 clinics whilst they tried to resolve the issue. Although officials did not immediately say what exactly had happened, later in the day it was announced that parts of the hospital and clinics were beginning to get back up and running. Presbyterian Healthcare Services and Lovelace Health System are also large healthcare providers in the state and worked with the network to prepare to take in extra patients. 

The University of New Mexico Health System sees around 900,000 outpatients and 100,000 emergency department patients per year (University of New Mexico Health System website), meaning this is a large part of the healthcare system. Multiple staff reported seeing messages on their computers late Monday morning stating that student, staff and patient data had been stolen. A spokesperson for the health system did not want to comment as they said there was an ongoing police investigation. 

An FBI spokesperson confirmed that they were assisting a partner organisation but did not give any further details. Attempts to comment were also sent to the Bernalillo County Sheriff’s Office and Albuquerque Police Department. This incident comes as there has been ongoing concerns about attacks on digital systems within essential services such as healthcare. Ransomware requests and other cyber incidents have been seen with hospitals for around a decade, however it is unusual for messages to be shown on computer systems due to the breach (Josephine Wolff, Professor of Cybersecurity Policy at Tufts University). 

This shows how difficult it can be for organisations to protect their networks. The impact could be seen throughout Albuquerque and surrounding areas. At the main hospital, staff in turquoise uniforms were directing patients away from the waiting area and advising they may have their appointments cancelled. Patients arriving at a medical centre in Rio Rancho were also told by security guards to rearrange their appointments. 

The University of New Mexico’s Health Sciences Centre, the largest academic medical centre in the state, cancelled Monday and Tuesday classes. Staff working in the hospital and medical group will be returning on Tuesday. It has not been confirmed what caused the incident, if data has been extracted or if there was a ransom request. The investigation is ongoing.
Read more »
Warp Breach
Agent Logs AI Security Data Breach Telemetry Exposure Warp Breach

Warp Breach Exposes AI Agent Logs and Telemetry

 

Warp has disclosed a security incident involving a third party infrastructure vendor that exposed AI agent decision logs and user telemetry. Chief executive Zach Lloyd estimated that approximately 1% of users could be affected, while emphasizing that the investigation remains ongoing. The disclosure identifies an exposure of operational records rather than establishing a compromise of every component in Warp’s development environment. The vendor, initial access mechanism, affected infrastructure components, and precise data boundaries have not been publicly identified, limiting independent assessment of the incident. 

Warp combines terminal functionality, a code editor, task orchestration, and agent activity review within an agentic development environment. Developers use its AI agents to generate code, execute tests, and deploy software. Consequently, agent traces and telemetry represent records associated with automated development workflows, although their exact contents vary with implementation. Warp reports at least 800,000 users, but its preliminary estimate of affected users does not establish the number of exposed records, compromised sessions, or affected organizations. Those measurements describe different dimensions of a security incident.

According to Lloyd, Warp detected what it believed was active, narrowly targeted exploitation of an infrastructure vendor on Friday and intervened within hours. The company described an attacker operation involving an “agent swarm,” sophisticated penetration techniques, and privilege escalation. However, the disclosure does not provide enough technical detail to reconstruct the attack chain or verify individual exploitation stages. No publicly identified vulnerability, authentication bypass, compromised identity, or execution mechanism has been specified. Claims about particular exploit classes would therefore exceed the available evidence. 

The exposed data categories were agent traces and telemetry. Warp has not established publicly whether these records included source code, user prompts, credentials, or other sensitive content. This uncertainty prevents a definitive assessment of confidentiality impact or potential secondary compromise. Exposure of operational logs should not automatically be equated with theft of API keys or unauthorized access to customer repositories. Warp notified identified affected users, informed the vendor, engaged CrowdStrike to assist with investigation, and contacted law enforcement. Further findings are needed to establish scope. 

A separate incident involving AI coding platform OpenCode illustrates why data classification matters when comparing breaches. That compromise exposed stored API keys for external providers, affected approximately 1.4% of users, and resulted in unauthorized charges reaching $1,700 for some victims. Equivalent credential exposure or financial abuse has not been established for Warp. The technical questions remain which records were accessible, what sensitive fields they contained, and how vendor access enabled their exposure. Until those details emerge, conclusions about downstream exploitation must remain provisional.
Read more »
Plausible Vulnerability
Brazilian Cybercrime Credit Card Theft Cyber Attacks e-commerce security Magecart Attack Online Payment Security Payment Card Skimming Plausible Vulnerability

Brazilian Magecart Group Exploits Plausible Installation to Steal Checkout


Data Magecart, a Brazilian group of hackers, compromised the analytics script used by e-commerce platform Convertr, potentially revealing payment information provided by customers to dozens of Brazilian fashion brands. During the attack, which was detected by cybersecurity firm Sansec on October 24, 2026, malicious code was injected into Convertr's Plausible analytics tracker. 

By modifying a JavaScript file loaded into Convertr's merchant checkouts, the attackers allowed the card skimmer to collect sensitive information during online purchases by modifying the JavaScript file. The data obtained was comprised of card numbers, expiration dates, CVV security codes, cardholder names, and Brazilian CPF taxpayer identification numbers. 

The information was transmitted to a server controlled by the attacker at 1x0.is. Online shopping and checkout services are provided by Convertr to dozens of Brazilian fashion retailers. According to the platform, its merchants have processed more than R$2 billion in sales. Due to the fact that the affected analytics tracker was distributed throughout its merchant network, compromising one file created a potential supply chain risk that extends beyond one individual online store. 

The malicious script was detected by Sansec after a clean version was captured earlier on October 24th. In October, the attackers modified the skimmer in order to target Convertr's payment API field names, making it more effective in capturing payment information. Researchers also reported that the compromised tracker continued to serve on October 26, despite efforts to notify Convertr. 

As Sansec has been tracking the Brazilian Magecart group since July 2024, the incident represents a significant development in its activities. The group has previously targeted individual online stores using Magento, OpenCart and WooCommerce, mainly in Brazil. With the Convertr compromise, Sansec has shifted from infecting individual stores to compromising a service shared by multiple businesses, resulting in the first supply chain attack attributed to the group. 

An unpatched installation of Plausible Community Edition, an open-source web analytics platform, is believed to have been the source of the attack. Versions 3.0.0 through 3.2.0 were affected by CVE-2026-8467, a critical vulnerability that could allow unauthenticated command execution through an exposed component of the /storybook component. 

Convertr reported installing version 3.0 in 2025 and not updating it prior to the incident. On May 15, 2026, Plausible released version 3.2.1 which fixed the vulnerability. Since researchers were not able to access the platform’s server logs, Sansec has not confirmed that the vulnerability was exploited to gain access. Therefore, it remains unclear what specific method was used to compromise the analytics server. Furthermore, the group has consistently targeted Brazilian payment systems as a focus for their methods. 

According to Sansec, its skimmers exhibit recurring characteristics, including the use of short-lived domains as recipients of stolen information, and endpoints containing Portuguese names related to card payments. Other variants have also been developed to attack payment services, including e.Rede, PagSeguro, Pagar.me and Mercado Pago. 

Another version is reported to replace genuine PIX payment QR codes with malicious codes. Convertr confirmed on October 27 that Plausible had been updated with a patched version following the discovery of the malicious script. In addition to notifying affected merchants, payment providers, and relevant authorities, the company also verified that the tracker hosted on Convertr's analytics server was free of infection. 

While it is important to remove malicious code, it does not necessarily eliminate all immediate risks for all shoppers. Sansec stated that browsers may retain cached copies of infected scripts for up to 24 hours following the server-side cleanup, potentially allowing the malicious code to remain active during that period. 

Payments made by Brazilian customers through checkout addresses containing checkout.convertr from October 24 onward should be blocked and replaced by their banks. It is also recommended to monitor transactions for suspicious activity involving CPF identification numbers in order to identify suspicious activity. 

A Sansec recommendation for organizations using Plausible Community Edition is to update the version to 3.2.1 or later and to review server access logs for requests to the exposed path of /storybook. Upon detecting evidence of exploitation, the affected server should be rebuilt, secrets rotated, tracker files checked against the official release, and a more thorough investigation conducted. The incident emphasizes the wider risks associated with shared web infrastructure. 

Multiple businesses can be affected by compromised analytics scripts without the attacker having to breach each merchant individually. To reduce the risk of similar attacks, it is vital that software be updated, scripts loaded on payment pages are monitored, and unauthorized outbound connections are restricted. 

This incident illustrates the dangers posed by compromised third-party scripts used on checkout pages. Preventing digital skimming attacks requires timely software updates, continuous script monitoring, and stronger protection of payment infrastructure.

Read more »
User security
Customer Data Cyber Attacks Data Leak Genesys User security

Genesys Hack Exposes Customer Data From Internal Systems

 

Genesys, a California-based provider of customer experience and call-center technology, has disclosed a cyberattack in which unauthorized actors accessed data from internal business systems. The company said the incident affected a learning management system and a customer relationship management environment, but stressed that its core customer-facing platforms were not compromised. 

According to Genesys, attackers likely downloaded business and account information used to manage relationships with current and prospective customers. The exposed information may include names, phone numbers, business email addresses, job titles, company and account details, and other customer-interaction data. While such records can be valuable for phishing and social-engineering schemes, Genesys has not said how many individuals or organizations were affected. 

The company said it acted quickly to contain the breach, including suspending the LMS platform. By October 23, Genesys announced that the incident had been fully contained, although its investigation into the scope and impact remains ongoing. It has promised further updates as it reviews the accessed information and confirms material facts. 

Importantly, Genesys stated that its Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected. It said there was no unauthorized access to those platforms, customer and partner environments, or the data stored and processed within them. That distinction is significant because the company’s core platforms handle sensitive communications and operational data for enterprise clients. 

Genesys has not identified the attacker, but a newly emerged group called ScarlettGroup has claimed responsibility on its leak site. The company is urging customers to stay alert for suspicious messages impersonating Genesys and emphasized that it will never request sensitive information, such as passwords, through unsolicited email or other channels. The episode is a reminder that even when primary production platforms remain secure, internal systems holding customer-relationship data can still create meaningful privacy and fraud risks.
Read more »
money laundering
California cryptocurrency Cyber Fraud FBI money laundering

Chinese National Extradited to Face Charges in $36.9 Million Cryptocurrency Fraud

 


A 44-year-old Chinese national has been brought to the United States from the Netherlands to answer federal charges tied to a cryptocurrency investment scheme that drained nearly $37 million from 174 American victims.

Zhen Zhao was arraigned in California after his extradition, prosecutors said, following a federal indictment handed down in August 2025 charging him with conspiracy to commit money laundering. If convicted, he faces up to 20 years in federal prison.

Zhao is accused of running what investigators call a "pig butchering" operation, a type of confidence scam that has become one of the fastest-growing financial crimes in the world. The name reflects how the fraud works: operators spend weeks or months cultivating trust with their targets before stealing everything from them at once.


How the scheme worked

According to court documents, Zhao and his co-conspirators reached victims through unsolicited text messages, social media platforms, phone calls, and online dating services. The initial contact was typically low-stakes, a misdirected text, a friendly exchange that seemed accidental, or a casual introduction through a dating app. Over time, the operators steered conversations toward investment opportunities, eventually directing victims to what appeared to be functioning cryptocurrency trading platforms.

The platforms were fabricated. Built to resemble real exchanges, they showed account balances growing steadily over time, giving victims every reason to keep putting money in. When victims eventually tried to withdraw their funds, they were blocked, hit with invented fees, or simply cut off. Their money was already gone.

The ring funneled more than $36.9 million from U.S. bank accounts into an account at Deltec Bank in the Bahamas, registered under the name Axis Digital Limited. From there, the bank was directed to convert the deposited money into Tether, a dollar-pegged stablecoin widely used in fraud for its stability and ease of transfer. That Tether was then moved to a digital asset wallet controlled in Cambodia, where it was passed up to the leaders of scam centers operating in the region.

Cambodia has become a significant hub for this type of operation. Criminal syndicates there have turned large-scale cryptocurrency fraud into core business, often staffing compound facilities with trafficked workers from across Asia who are forced to run these schemes under threat of violence. The money chain in the Zhao case reflects that geography directly.


Eight accomplices, two already sentenced

Zhao was not running the operation alone. Eight co-conspirators have already pleaded guilty in connection with the same scheme. Two have been sentenced so far, one to 51 months and another to 46 months in federal prison. The remaining cases are moving through the courts.

The extradition itself was the result of months of legal coordination between U.S. prosecutors, the State Department, and Dutch authorities. The Netherlands, which maintains a functioning extradition treaty with the United States, processed Zhao's transfer back to face trial in California.


A problem that keeps growing

This case sits inside a much larger crisis. The FBI's 2025 Internet Crime Report recorded more than $8.6 billion in losses from investment scams over the course of a single year, up from $6.5 billion the year before. Those figures came from roughly 73,000 complaints, and investigators routinely note that reported numbers reflect only a portion of real losses, since many victims never file a report out of embarrassment or because they do not know where to turn.

Pig butchering has become the dominant form of cryptocurrency fraud in the United States. The FBI ran a proactive victim notification program that reached more than 4,300 pig butchering victims in a single year, warning people before they lost everything. Despite those efforts, the dollar figures keep climbing.

The Department of Justice has treated these cases as a priority. In December 2023, federal prosecutors in California charged four people with laundering more than $80 million connected to similar cryptocurrency investment scams, using shell companies and hundreds of individual banking transactions to move stolen money internationally. Prosecutors at the time described the mechanics as nearly identical to what Zhao and his network allegedly ran.


What victims should do

Anyone who believes they were targeted by a pig butchering scam can file a report with the FBI's Internet Crime Complaint Center at IC3.gov. Investigators ask that victims preserve all records of communications, platform names, cryptocurrency wallet addresses, transaction IDs, and any banking information they shared during the fraud.

For Zhao, the arraignment in California is the start of what will likely be a long legal process. With eight alleged co-conspirators already pleading guilty, prosecutors appear to have a functioning case built around his network. Whether he opts for trial or takes a similar path remains to be determined.




Read more »
Web Hosting
Account Compromise Cyber Security Data protection DreamHost Password Reset DreamHost Security Incident email security FTP Security Hosting Security Web Hosting

DreamHost Forces Password Resets Amid Ongoing Security Incident


Due to a disruption of access to DreamHost's File Manager and webmail services as a result of an incident, certain email and FTP/SFTP accounts were forced to reset their passwords. Although the hosting provider described the action as a precautionary security measure, it has not yet revealed the cause of the incident or confirmed whether any accounts have been accessed without authorization. 

When DreamHost first detected connectivity problems affecting its file manager on the web at files.dreamhost.com on October 23, 2026, the disruption was initially reported. As a consequence, some webmail users experienced login failures, while FTP/SFTP access was also affected by the issue. As a result, the company reset passwords for affected accounts and temporarily restricted access until new credentials could be established. 

When a DreamHost account owner assigns a replacement password to the affected mailbox and file transfer users, the users cannot sign in. By the weekend, DreamHost mailed recovery instructions to all affected account holders in stages and confirmed to all affected account holders that all were notified by October 25. 

In October, the company reported that engineers had deployed a fix and had restored File Manager functionality. Monitoring continued to ensure that the service continued to operate, however password changes for affected accounts continued to be required. Since limited information has been released by the company about the incident, customers have expressed concern. 

Neither DreamHost nor the company has identified the root cause, disclosed the number of accounts affected, or confirmed whether any email messages, stored files, or login credentials have been compromised. Also, the provider advised users to review their mailbox forwarding settings and remove any unfamiliar destinations. This setting can be abused in order to redirect sensitive communications outside a company, thereby making it a crucial element of account security. 

DreamHost has, however, not confirmed that unauthorized forwarding rules have been created in this incident. Additionally, customers have expressed concern about the lack of detailed explanations for the disruptions in service as well as mandatory password changes. Despite speculation about a possible compromise, no publicly available confirmation has been provided to indicate that an attack or data breach has occurred. 

According to DreamHost, account owners should update stored credentials across connected applications and review account settings in order to complete the recovery process. Email clients, FTP/SFTP software, website backup tools, deployment systems and plugins relying on previously stored credentials may be affected by password changes. 

In order to avoid the possibility of affected users losing access to their hosted mailboxes, the company recommends that replacement passwords be shared through private channels, such as telephone calls or secure text messages. The recovery guidance provided by DreamHost specifies that mailbox passwords can be changed under “Mail > Manage Email” in the control panel, and FTP/SFTP credentials can be updated under “Websites > SFTP Users & Files”. 

If you changed your password before the reset process was completed, you should verify that your new password remains valid as well. Password changes may take up to 15 minutes to become effective. There is no indication that incoming email is reaching affected mailboxes, and that FTP/SFTP data is still stored on the provider's servers. 

In addition to these assurances concerning service and data availability, it is also recommended that website owners conduct routine site checks to determine whether unauthorized access occurred prior to the password reset. Considering that FTP/SFTP credentials provide access to website files, it is important to identify suspicious changes by reviewing recently modified files, unfamiliar administrator accounts, and unforeseen scheduled tasks.

There has been no evidence published to indicate that DreamHost-hosted websites were altered as a result of the incident. This episode also underscores the importance of using third-party hosting providers for security reasons. When a hosting company encounters a disruption, several connected services may be affected at once, especially when email addresses and file transfer credentials are handled by the same provider.

In order to ensure that essential operations are resumed after the password change, DreamHost has repeatedly warned customers that it will never send customers passwords by email. Businesses using DreamHost may need to check integrations and automated processes reliant on these accounts. Rather than logging into the control panel through unsolicited messages, account owners should access the control panel directly. 

No public explanation has yet been provided by the company as to what triggered the incident or the number of affected customers has been confirmed. In the interim, a central question remains as to whether the incident involved unauthorized access, how many accounts were affected, and if any customer information was revealed. Despite DreamHost's password reset process and restoration of File Manager access, the broader issues associated with the incident haven't been resolved. 

DreamHost's restoration of File Manager access marks progress in the recovery process, but the absence of an identified root cause leaves the incident's broader security implications unresolved. While the company has yet to clarify the cause of the incident, and whether any customer accounts or data has been accessed, it remains unclear how the incident will impact the security of the company.

Read more »
Subscribe to: Posts (Atom)

Featured