Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Japan Airlines Passengers Caught in Amadeus Reservation System Breach

  Japan Airlines has warned roughly 92,000 customers that hackers accessed their personal information through a third-party reservation plat...

All the recent news you need to know
Russian Hackers
Dark Web Data Breach Data Leak Italian Minister Russian Hackers

Italy Minister’s Personal Data Leaked on Dark Web

 

Italy’s Foreign Minister Antonio Tajani has said that cybercriminals circulated his personal data on the dark web, exposing him and his family to threats and intimidation. Prime Minister Giorgia Meloni blamed pro-Russian hackers, although Tajani did not publicly identify the attackers. The episode highlights how digital harassment and data leaks can be used to pressure political leaders. 

Tajani, who is also Italy’s deputy prime minister, announced the breach in a social-media post. He said that for days, cybercriminals had been spreading information about him on the dark web while trying to obtain additional details about him and his relatives. He said the criminals were even prepared to pay for further personal information, creating what he described as new threats and intimidation for his family. 

The foreign minister did not specify exactly what data had been leaked or which group carried out the attack. However, he linked the targeting to Italy’s position on Ukraine, saying that defending a sovereign state’s freedom and supporting democracy and independence had made him a target. He also said the attack appeared to be a reaction to measures Italy had taken to strengthen cybersecurity at its foreign ministry. 

Meloni expressed full solidarity with Tajani and described the alleged sale of confidential information about government officials as a matter of grave concern. She said it must be addressed with the utmost determination, framing the incident as an attack not only on an individual minister but on Italy’s institutions. Her statement came amid wider concern across Europe about cyberattacks, sabotage, drone incidents, and other hybrid threats. 

Tajani rejected the intimidation and vowed to continue his work. “I will not allow myself to be intimidated in any way,” he said, adding that he would keep defending his ministry and Italy while strengthening cooperation with partners to improve collective security. Italy remains a supporter of Ukraine, providing humanitarian and military assistance as the country continues to defend itself against Russia’s invasion. 

The incident follows a series of security disruptions across Europe, including hoax bomb threats that caused flight diversions, threats against broadcasters, attacks on supermarket refrigeration systems, and drone incursions. Authorities have not publicly attributed those threats to a particular group or state, and no evidence has emerged directly linking the hoaxes to a government. Still, the alleged leak of Tajani’s data has intensified concerns that political figures and critical institutions are increasingly vulnerable to online intimidation campaigns.
Read more »
US Treasury
Anti-Money Laundering Crypto Crime Cryptocurrency Regulation Cyber Crime FinCEN Illicit Crypto Transactions MEXC Crypto Exchange Money Laundering Sanctions Evasion US Treasury

MEXC Faces US Restrictions Over Alleged Sanctions Evasion and Cybercrime


US Treasury officials have blocked MEXC Global from the American financial system due to its alleged involvement in sanctions evasion, cybercrime-related payments, and other illicit financial activities. According to findings by the Financial Crimes Enforcement Network (FinCEN), between May 2021 and May 2026, the Seychelles-based exchange facilitates an estimated $16 billion in suspicious transactions. 

Based on Section 9714(a) of the Combating Russian Money Laundering Act, which was issued on November 6, 2026, MEXC was designated as a primary money laundering concern. In the event the order goes into effect, US financial institutions will be prohibited from processing fund transfers, including cryptocurrency transactions, to and from MEXC. Additionally, MEXC's subsidiaries and overseas operations will be restricted. 

A large part of the Treasury Department's Operation Economic Outcast initiative aims to disrupt financial channels used by Iran to circumvent international sanctions, and the actions form part of that initiative. 

While the MEXC order is based on allegations of the exchange's connection to Russian illicit finance, it is also based on FinCEN's finding that the platform processed approximately $1.5 billion in transactions related to Russian sanctions evasion over the past five years. This activity was reported to involve dealings with a sanctioned cryptocurrency exchange Garantex and its successor, Grinex, with transactions continuing until June 2026. 

Moreover, the agency identified approximately $200 million linked to the stablecoin A7A5, which has been associated with Russian sanctions evasion activities. In addition, substantial financial links were discovered involving Iranian entities as part of the investigation. MEXC reported processing over $1 billion in direct transactions with more than 40 Iranian cryptocurrency exchanges, according to FinCEN. Further transactions reportedly included payments related to sanctioned actors, as well as those involving the Iranian central bank and the Islamic Revolutionary Guard Corps. 

Along with to sanctions-related activity, Treasury accused the exchange of processing funds related to ransomware operations, scams online, and darknet marketplaces. As a result of these findings, FinCEN has expressed concerns about the platform's anti-money laundering (AML) procedures and controls on customer identification. 

According to FinCEN, the alleged activity was caused by severe weaknesses in MEXC's compliance systems, which made it possible to conduct transactions involving high-risk entities. It was established in 2018 and operates in over 170 countries, providing access to thousands of cryptocurrencies and tokenized assets. 

As a result of its scale and involvement in illegal financial flows, the enforcement action has been regarded as an important step forward in the US government's efforts to combat cryptocurrency-based sanctions evasion. 

MEXC Says It Is Cooperating With US Regulators

Upon submitting a response to the enforcement action, MEXC confirmed that discussions have begun with US authorities in response to the allegations. On November 10, CEO Vugar Usi announced that the exchange had established a communication channel with FinCEN with the assistance of an international law firm.

According to reports, the regulator acknowledged receipt of MEXC's written request, while MEXC expressed its willingness to cooperate in the ongoing regulatory process. The exchange's services remain operational, and deposits, withdrawals, and cryptocurrency trading have not been disrupted, according to Usi. According to reports, the company has prepared a follow-up plan and intends to provide further updates in the event significant developments arise. 

MEXC had earlier indicated that its legal and compliance teams had begun an independent assessment of its anti-money laundering and sanctions controls, following the November 6 order. According to the exchange, user assets remain secure and the exchange intends to cooperate with FinCEN and other appropriate regulatory authorities as part of its ongoing efforts. 

In order to prevent US financial institutions from processing transfer involving the exchange, this enforcement action does not shut down MEXC's global operations or freeze customer accounts immediately. MEXC is expected to face wider difficulties beyond its direct US financial connections following the publication of the order in the Federal Register. The order is scheduled to take effect 30 days after publication. 

The Blockchain Investigator ZachXBT reported on November 10 that several other offshore centralized exchanges that are either limited or do not have a US presence have started prohibiting MEXC users from transferring assets. However, it was not revealed which exchanges and what the specific scope of these restrictions would be, however it has been suggested that the enforcement action could affect transaction routes outside of the US financial system. 

In addition, this case highlights the increased scrutiny of offshore cryptocurrency platforms that process transactions involving sanctioned entities and cybercriminals. A number of factors may contribute to digital asset exchanges becoming channels for illegal funds to flow across borders, including weak customer verification, inadequate transaction monitoring and limited screening of high-risk counterparties. 

The immediate challenge for MEXC is to address FinCEN compliance concerns while maintaining access to international financial services. It is anticipated that the platform will be able to address the allegations and limit further restrictions based on its engagement with US regulators and independent review of its compliance framework. 

Taking such action marks a significant step forward in efforts of the US government to restrict illicit financial networks operating through cryptocurrency exchange platforms. The extent to which MEXC cooperates with FinCEN and its ability to address the alleged compliance violations will determine the exchange's future access to the US financial market.
Read more »
Google
AI ai agents Cyber Security DeepMind Google

Google DeepMind AI Agents Reduce the Cost of Attacking 1024-Bit RSA Encryption


Artificial intelligence (AI) agents developed by Google DeepMind have shown new ways to make attacks against legacy RSA-1024 encryption systems significantly cheaper. 

The research was conducted by Google DeepMind in collaboration with cryptography researchers from the University of California San Diego and Inria. 

RSA is a widely used public-key cryptographic algorithm that relies on the mathematical difficulty of factoring large numbers. Although RSA-1024 was once considered sufficiently secure, advances in computing and cryptanalysis have made it unsuitable for protecting sensitive information. Modern systems generally use RSA keys of 2048 bits or longer.

The first major finding focused on digital signature forgery involving the PKCS#1 v1.5 padding format. Padding is additional data inserted into a message before signing to ensure that it meets the required block size. Researchers examined how this protection behaves when an attacker can influence the content of the message being signed.

The team found that when an attacker controls approximately half or more of the signed data block, the padding may no longer provide additional protection against forgery. This weakness is relevant to the PKCS#11 signing interface used by cryptographic devices, including hardware security modules.

To show the improvement, DeepMind's AI agents reproduced an earlier academic signature-forgery attack against an RSA-1024 key. The agents reduced the required computing time from approximately 1,380 CPU core-years to 391 CPU core-years, making the process around 3.5 times more efficient.

Two AI agents reportedly designed, executed and debugged the computation in less than four days, with approximately 20 messages from a human researcher, most of which involved approving their actions.

Researchers also developed a more efficient approach for situations where attackers control a smaller portion of the signed message, such as a 32-byte hash. Their theoretical calculations suggest that the proposed method could be approximately 1,600 times more efficient than the previous best approach for certain RSA-1024 signature-forgery scenarios.

The second major finding concerns RSA key factoring. RSA security depends on the difficulty of breaking down a large number into its original prime factors. The researchers developed an algorithm that could make factoring each additional RSA-1024 key approximately 30 times cheaper on average after an expensive initial computation.

However, this technique remains theoretical and has not yet been implemented. The initial computation would also require substantial resources, meaning the findings do not show an immediate practical attack against deployed encryption systems.

The researchers also highlighted important limitations of the signature-forgery technique. It requires approximately four billion signing queries in advance, does not recover the private key and does not work against devices that internally hash messages before signing.

According to Pushmeet Kohli, Vice President at Google DeepMind and Chief Scientist at Google Cloud, modern cryptographic protocols generally use RSA keys of 2048 bits or larger and remain secure against the demonstrated techniques.

Read more »
Information Security
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Healthcare Healthcare Breach Information Security

Amplifon Americas Data Breach Exposes Personal and Medical Information of 1.3 Million People

 

Hearing healthcare company Amplifon Americas has revealed a data breach which has led to personal information being exposed for around 1.33 million people across the United States. The records were reportedly stolen and include personal details, medical histories, health insurance information and in some cases Social Security numbers and financial information. 

The breach occurred at Amplifon Americas, the Minneapolis-based US branch of Amplifon, an Italian-based hearing healthcare company which has over 80 million members across thousands of clinics nationwide. A third party gained unauthorised access to Amplifon’s systems in January 2026 and stole data from specific systems between 18th January and 8th February. A response was made by Amplifon to limit the breach and investigate the incident. 

However, the company found it took a long time to establish how much information had been exposed. It took around eight months to complete its analysis. The investigation revealed a range of information had been stolen, including names, contact details, date of birth, drivers licence numbers and other government issued identification information. Medical information, including hearing information, other medical details, date of medical service and health insurance information had also been exposed. 

Those whose Social Security and financial information had been accessed are at greater risk of identity theft. This could increase their chances of being victims of financial fraud and other issues. Amplifon said they were not aware of any fraudulent activity using the stolen personal information but cannot rule out the possibility of future misuse. A filing was made with the Texas Attorney General’s Office by Amplifon and listed 1,332,826 individuals who had been affected by the data breach across the country. 

The company have not said any further information about who had accessed their information or how they had done so. This shows how at risk healthcare companies can be. They often hold large amounts of personal, medical and insurance information. This can be extremely valuable to cyber criminals as they will have access to a variety of different information which can be used for identity fraud.  

There is not much more information available about the breach. We contacted Amplifon to ask for more information about the breach and how many individuals were affected. More information will be available depending on their response.
Read more »
vpn
Cloud Breach Customer Data Data Breach data security Japan passwords sensitive information vpn

Japanese Homeware Giant Iris Ohyama Says Cloud Breach at Its Online Store May Have Exposed Data of Up to 7.7 Million Shoppers

 



Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its online shopping platform was accessed without authorization, potentially exposing personal data belonging to roughly 7.7 million people, including customers who never created an account.

The company, founded in 1971 and headquartered in Sendai, is best known for plastic storage solutions and home appliances sold across Asia, Europe, and North America. Its e-commerce platform, Iris Plaza, caters to millions of customers in Japan and handles a large volume of household product purchases. The scale of the breach puts it among the larger data security incidents Japan has seen this year, in a period when Japanese companies and government agencies have dealt with a string of serious intrusions.


How the Breach Was Detected

On October 28, 2026, Iris Ohyama staff detected suspicious files inside a cloud service that Iris Plaza relies on for its operations. The company did not name the cloud provider or describe the method the attacker used to get in. Within a day, the company suspended access to Iris Plaza and related systems, reported the incident to Japan's Personal Information Protection Commission, and filed a report with police.

A follow-up disclosure on November 5 gave a clearer picture of the scope: up to 5.8 million registered and former members may have had their data accessed, along with up to 1.9 million non-members, meaning people who had completed a guest checkout without registering. The fact that guest buyers are part of the exposure is insurmountable, since many people assume their data is not retained when they shop without creating an account. In Iris Plaza's case, it was.


What Data Was in the Affected System

The range of information potentially accessed varies depending on the type of account. For registered members, exposed fields can include full name, home address, phone number, email address, gender, and date of birth. Account passwords were also stored in the affected environment, though the company said they were encrypted. It did not specify which encryption method was used, leaving questions open about how resistant those passwords are to cracking.

Former members are in a slightly different position: Iris Ohyama said it does not retain passwords for accounts that have been closed, so that group faces a narrower exposure. For non-members who checked out as guests, the data stored was more limited.

One notable reassurance: the company confirmed that credit card information was not stored in the affected cloud environment, sparing customers from the most immediately damaging form of financial exposure.

As of November 5, Iris Ohyama said it had not received any communication from whoever carried out the intrusion, had not identified any perpetrators, and had not seen reports of fraudulent use or financial damage tied to the breach. The investigation into how many records were actually exfiltrated, as opposed to merely accessible, is still ongoing.


What Iris Plaza Customers Should Do Now

The company has urged customers to change their Iris Plaza passwords and, critically, to change passwords on any other service where they used the same credentials. Password reuse across sites remains one of the most common ways a single breach cascades into wider account takeovers. Anyone who shops with the same email and password combination across multiple retail or financial platforms is at elevated risk.

Iris Ohyama also warned customers to be on guard for phishing attempts. With names, addresses, phone numbers, and email addresses potentially in circulation, attackers have enough to craft convincing messages that appear to come from the company. Iris Ohyama said it will not send emails or SMS messages asking for passwords, PINs, authentication codes, or other sensitive information through links, and customers should treat any such request as fraudulent.


A Year of Costly Data Incidents in Japan

The Iris Ohyama breach lands in the middle of a rough stretch for data security in Japan. This year alone, cloud hosting provider Sakura Internet reported a hack affecting up to 1.36 million accounts, telecommunications giant KDDI disclosed a breach tied to a zero-day vulnerability in third-party software that hit around 12 million accounts across shared email platforms, and Japan's Digital Agency acknowledged that a VPN flaw exposed approximately 246,000 government personnel records. The common thread across several of these incidents is reliance on third-party services and cloud environments where access controls or vendor security fell short.

Iris Ohyama's breach fits that pattern. A third-party cloud provider, an intrusion the retailer only caught when suspicious files turned up, and millions of customer records sitting in an environment the company did not fully control. The investigation remains open, and the company has not said when it expects to restore Iris Plaza to service.



Read more »
Vulnerabilities and Exploits
Plex2Shell QNAP Security Patch Vulnerabilities and Exploits

QNAP Urges Immediate Plex2Shell Update and Remediation

 

QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later. 

Technical scope 

Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process. The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation.

Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again. 

Compromise assessment Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised. This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise. 

Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st. Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure. 

Secure reinstallation 

For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder. Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.
Read more »
Subscribe to: Posts (Atom)

Featured