Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Vulnerabilities and Exploits
AI CISO Cyber Patch Fortinet FortiOS vdoms Vulnerabilities and Exploits

Fortinet Releases Fixes for Nearly 100 Vulnerabilities Across Its Product Lineup

 


Fortinet issued 89 security advisories on November 11, covering close to 100 vulnerabilities across its product lineup, with roughly 17 rated critical and nearly 80 classified as high severity. The release stands as one of the company's largest single-day patch drops, touching nearly every major product in its portfolio.

FortiMail received the heaviest concentration of critical fixes. FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer followed close behind. FortiSASE and FortiClient also received updates resolving critical issues.

The critical vulnerabilities span a wide range of attack classes. Among those fixed are arbitrary code execution flaws, authentication bypass conditions, account takeover paths, unauthorized access to Virtual Domains (VDOMs), server-side request execution, and a command execution bug that could allow an attacker to run commands with super-admin privileges. FortiMail-specific issues include paths that expose secure email accounts and allow IBE webmail session compromise, along with flaws enabling unauthorized webmail password resets.

High-severity fixes address cross-site scripting, code injection, arbitrary file uploads, denial-of-service conditions, man-in-the-middle attack vectors, privilege escalation, and information disclosure. Fortinet has not attributed any of these vulnerabilities to active exploitation in the wild.


A Notable Standalone Finding

One vulnerability drew particular attention from the security research community. Kevin Joensen, a principal security consultant at Baldur Security, identified and named a FortiClient flaw he called "Fortinet2Shell." The root cause is a CORS misconfiguration that allows attacker-controlled web pages to communicate with a local service running on the target machine.

If a victim visits a malicious website while FortiPAM is enabled, an attacker could achieve arbitrary code execution on that system. The flaw is conditional but the bar for triggering it is low: simply visiting a crafted page is enough. Joensen's research illustrates how client-side software that communicates with local services over HTTP remains a consistent attack surface, one that often gets less scrutiny than server-facing products.


AI in the Testing Pipeline

The scale of this release tracks directly to a shift in how Fortinet approaches internal security testing. Carl Windsor, the company's CISO, confirmed that Fortinet has been running frontier AI models alongside its own on-premises models in vulnerability testing for several months.

The program operates in two phases. In the first, models analyzed firmware without access to source code, mapping how products function and identifying potential attack vectors. Those leads were then validated through penetration testing and red teaming. The black-box phase returned few directly exploitable flaws, but the models showed strong capability in comparing firmware versions across releases and building proof-of-concept exploits for bugs that had already been patched.

The second phase involved source code analysis. Across more than 100 tests spanning 30 product families, roughly 40 percent of findings were genuine vulnerabilities, 30 percent were false positives, and the remaining 30 percent were security improvements that did not rise to the level of exploitability.

Windsor did not frame AI-assisted testing as a silver bullet. He acknowledged that the same tools available to Fortinet's internal teams are available to attackers, and he warned that the gap between public disclosure and active exploitation is getting shorter. "The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking," he said.


The Urgency Behind Early Disclosure

Fortinet's decision to hold technical details until a fixed release is available reflects a deliberate strategy. Once a patch ships, researchers and threat actors alike can reverse-engineer the changes to identify what was fixed and where. For organizations running unpatched versions, that creates a narrow and shrinking window of practical anonymity.

Windsor noted that internet-facing systems should be prioritized for immediate patching. For organizations that cannot apply fixes right away, interim steps include restricting administrative access to trusted IP ranges, keeping FortiManager off public networks, enforcing strong and unique credentials, and requiring multi-factor authentication for all admin accounts. He was direct that none of these measures replace upgrading the software.

Fortinet's PSIRT page at fortiguard.com/psirt carries the full list of advisories and affected version ranges.

The November batch comes weeks after the company released urgent fixes for FortiOS and FortiManager, some of which were also flagged as AI-assisted discoveries. The cadence suggests Fortinet is now committing to more frequent and larger release cycles as a direct consequence of expanding its AI testing program, a move that will likely increase pressure on enterprise security teams to maintain tighter patch windows across Fortinet deployments.


Read more »
Poland
Cyber Attacks ePUAP Government Infrastructure Government Services Platform Poland

Poland Takes Government Services Platform Offline After Detecting Cyberattack


Poland has temporarily shut down its national electronic government services platform, ePUAP, after authorities detected and stopped a cyberattack targeting the system. The precautionary shutdown has disrupted access to several online public services used by citizens, businesses and government institutions.

The incident was confirmed by Polish Digital Affairs Minister Krzysztof Gawkowski, who said security teams had responded immediately after identifying the attack. In a social media statement, Gawkowski said the cyberattack against the state-run ePUAP system had been detected and halted, while technical teams were working to restore its full functionality.

The ePUAP platform is a central part of Poland's digital government infrastructure. It allows individuals and businesses to submit official documents, communicate with government departments and complete various administrative procedures online. Its temporary closure has therefore affected an important channel through which people interact with public authorities.

Gawkowski also confirmed that the infrastructure of the Central Information Technology Center, the government agency responsible for maintaining ePUAP and other essential digital services, remained secure. Officials stressed that the platform was taken offline as a precautionary measure rather than because the cyberattack had caused damage or disrupted its operations.

Marek Gieorgica, spokesperson for Poland's Digital Affairs Ministry, told the Polish news agency PAP that the system had not been compromised by the incident. He explained that authorities had deliberately disabled the platform to reduce potential risks while security teams assessed the situation.

However, the government has not disclosed technical details about the attack, including the methods used by the attackers or the identity of those responsible. There is also no public confirmation that hackers gained unauthorized access to government systems or managed to steal sensitive information.

According to a notice published on the government's website, ePUAP electronic mailboxes are currently unavailable to both citizens and public institutions. The disruption could also temporarily affect Poland's Trusted Profile digital identity service, which enables users to access online government services and electronically sign official documents.

Authorities have not announced a specific timeline for restoring the platform. Services are expected to resume after cybersecurity specialists complete their investigations and necessary technical checks.

The incident comes amid a series of cyberattacks targeting Polish government institutions, critical infrastructure and private organizations in recent months. In October, online invoicing provider Fakturownia reported a data breach that potentially exposed information belonging to its users, customers and business partners.

Earlier, in September, hackers stole data from Qbusoft, a Polish healthcare software provider, following a separate security incident involving medical technology company MyDr. Polish authorities said the MyDr breach could have affected information associated with approximately 19 million individuals and around 12,000 healthcare organizations.

Read more »
infostealer malware surge
AI Models AI Risks AI technology Cyber Security cybercriminals Data protection data stealing Doxing infostealer malware surge

Volta-Autodoxer Malware Uses Artificial Intelligence to Rank Victims and Build Detailed Personal Dossiers

 

Cybersecurity researchers at Cisco Talos have uncovered a new piece of malware known as Volta-Autodoxer (VOLTA) which uses commercial AI models to analyse the data it steals from Windows systems, identifying the most valuable targets. This shows that AI technology is now increasingly being used inside malware to automate processes. 

While traditional infostealers will steal sensitive data from infected systems such as saved passwords, browser cookies, payment card details, crypto wallet recovery phrases, authentication tokens and cloud credentials, the attacker often has to manually search through large amounts of data to identify valuable targets. Volta aims to cut this out using automated analysis of the victims data on the infected system. 

During the data collection phase, the malware will collect credentials, session data, Wi-Fi profiles, SSH keys, Microsoft OAuth tokens and screenshots of the desktop. It will also target Discord, Telegram, Steam and Roblox accounts to collect active session and account data. It will then use the stolen session tokens to access the victims main email accounts. This includes Gmail and Outlook. It will look at purchase confirmations and order history on services like Amazon, UberEats, DoorDash and Grubhub. This can give an insight into the victims home address, shopping habits, daily routines, work details and other personal information. It can also look up third-party services such as Rolimons to determine the resale value of their Roblox items. 

The malware will then organise the data it has collected and send it to OpenRouter, an API gateway that allows access to multiple AI models. The prompt inside the malware will tell the language model to act as a forensic intelligence analyst. It will create a detailed report on the victims and will identify if they could be valuable financially and how good their operational security is. The malware will use Anthropic’s Claude Opus 4.6 model by default. However, the developers have considered that there may be AI safety measures in place preventing the creation of malicious reports. 

The malware will look for rejection phrases such as 'I can’t’ in the models responses and switch to another provider if the request is denied. It will switch to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. Once the report has been created, the malware will package the stolen data and AI report into ZIP files. These will be sent directly to the attackers via a Telegram channel. Files will be named things like volta_dox.zip. The malware was discovered by Cisco Talos during their research using the CAIRN research framework. 

The builder also has configurable fields suggesting that this malware may have been designed to be distributed or sold to other cybercriminals. While it has not been seen widely in the wild, it shows how AI can be used to help attackers target victims more effectively by automatically creating profiles. This makes the personal information stolen more useful for targeted cybercrime.
Read more »
Unauthorized AI Usage
AI Security API Key Theft Cloud Security Credential Exposure Cyber Attacks Cybersecurity Incident LLMjacking Railway Data Breach Stolen AI API Keys Unauthorized AI Usage

Stolen Customer AI Keys Lead to $740,000 in Unauthorized Charges at Railway


A cyberattack on Railway, a cloud hosting provider, in October exposed customer credentials that resulted in approximately $740,000 worth of unauthorized artificial intelligence (AI) usage charges. In addition to stealing customer secrets, hackers also acquired credentials to AI service providers, which were used to generate fraudulent usage across several AI platforms with the stolen keys. 

Railway revealed in a report published on November 11 that attackers gained access to decrypted environment variables belonging to a maximum of 1.85% of its workspaces, or approximately 100,000 workspaces. Nevertheless, the company clarified that this represents the potential scope of exposure rather than the number of compromised credentials confirmed by the company. 

A security incident was first reported by the railroad on October 22, and customers were advised to rotate sensitive credentials stored on the railroad's platform. Further investigation revealed that the attackers had also accessed internal source code, build histories, and linked account tokens for 1,852 users as well. In addition to resettling the affected tokens, including GitHub OAuth credentials as well as Bring Your Own Key (BYOK) agent keys, Railway also notified the affected users. 

It has been determined that the attackers searched Railway's production database for environment variables related to artificial intelligence providers. There were also queries targeting credentials connected to cloud services, databases, and payment platforms. Following the theft of the AI keys, external AI services were accessed and unauthorized charges were generated valued at $740,000. The financial impact varies according to the refund policies of the individual AI providers. 

Amazon Bedrock and Google Gemini have begun processing refunds under their existing fraud policies, whereas OpenAI and SpaceXSI are evaluating each claim individually. As of the date Railway published its report, discussions with Anthropic were still ongoing. OpenRouter maintains a no-refund policy, and will not reimburse the affected usage. Railway has pledged to cover breach-related charges that providers do not refund.

In its investigation, Railway reported that it found no evidence that attackers had accessed customer databases or downloaded customer Git repositories. However, Railway customers who rely on it to store sensitive application secrets were exposed to environment variables and linked account credentials, posing a substantial risk. 

Attackers Exploited Multiple Security Weaknesses to Reach Customer Secrets

Upon investigation, Railway determined that there was not a single vulnerability involved in the intrusion, but rather multiple stages. The attack began on October 20, when a threat actor partially bypassed filesystem isolation on a host virtual machine by exploiting an undisclosed flaw in the platform's multi-tenant build system. 

The credential provided was originally designed to allow build servers to push container images on the platform. By using this credential, the attackers were able to gain access to Railway's internal Temporal workflow system, which mistakenly accepted it as a trusted client. These data included cached copies of Railway's internal source code repository, as well as stored histories of 353 builds, including secrets used in those processes. 

Another vulnerability in Railway's cloud deployment infrastructure was identified through analysis of the source code. Following the exploit of a misconfigured OpenID Connect (OIDC) identity binding, the attackers obtained temporary cloud credentials. The credentials enabled access to additional internal resources, including a computer containing the decryption credentials necessary for accessing the environment variables of customers. 

On October 21, 04:07 and 07:15 UTC, the attackers accessed the production database for encrypted variables, prioritizing entries related to artificial intelligence service providers. It has been confirmed by Railway that the credentials were decrypted in two separate periods before the intruders were entirely eliminated at 09:24 UTC on October 21. 

Railway engineers worked simultaneously to contain the intrusion as attackers used AI-powered agents to identify and exploit vulnerabilities during a prolonged security battle, according to the company. The attackers reportedly employed modified artificial intelligence models to assist with their operations that were devoid of safety restrictions. 

The railway industry strengthens its infrastructure following the breach

In invenstigation it was found that fRailway revised parts of its build infrastructure and closed the vulnerabilities involved. As a result, each build runs within its own, independent, short-lived virtual machine, with credentials restricted to pushing a specific image of a container. A logging system has also been implemented for every encryption and decryption operation to provide improved visibility into access to sensitive customer data. 

A rotation of internal credentials, replacement of potentially compromised infrastructure tools, and the implementation of additional controls for revoke application permissions in bulk when suspicious activity is detected by the railroad. The company has also notified the FBI's Internet Crime Complaint Center (IC3) and engaged a digital forensics firm to conduct an additional investigation into the incident. 

The Railway Breach illustrates the growing threat of AI credential theft

A Railway investigation suggests the stolen credentials may have been intended for resale or to be used in AI model distillation. This process involves querying existing AI models at scale and using their response information to train smaller models. Using stolen API keys, attackers can access expensive artificial intelligence services without paying for the usage, whereas legitimate account holders must pay for it. 

As part of a broader series of attacks against artificial intelligence development platforms dubbed "Black October", the incident is part of a wider series. There were initially nine platforms reporting security incidents during October, with the number growing to fifteen later. It has been identified by several investigations that attempts have been made to steal environment variables containing credentials for AI services, although these incidents have not been linked to any vulnerabilities or software components. Moreover, stolen AI credentials are increasingly used to facilitate LLMjacking, a form of cybercrime in which hackers hijack access to large language models by stealing API keys or cloud credentials. 

It is possible to resell the stolen access to third-party services or to use it for large-scale AI workloads, shifting infrastructure costs onto legitimate users. The Railway Incident demonstrates the importance of ensuring machine identities and stored secrets are adequately protected. Experts in security recommend rotating credentials, restricting API permissions, setting strict usage limits, and monitoring unusual AI use. A compromised cloud infrastructure can also result in significant damage due to the use of short-lived credentials, limited access privileges, and continuous monitoring of decryption activity.

A security breach involving API credentials, which can result in significant losses for a company and broader cloud security concerns, highlights the growing security risks associated with AI development platforms. In order to limit the impact of compromised API keys, organizations need to strengthen credential management, enforce least privilege access, and monitor unusual API activity.
Read more »
Russian Hackers
cerealbox Email Safety ESET EU malware NATO Romania Russian Hackers

Russian Hackers Exploit Government Email Infrastructure in Romania and Kazakhstan

 



Russian cyberespionage group Turla has deployed a previously undocumented malware framework against government organizations in Romania and Kazakhstan, exploiting Microsoft Exchange infrastructure to monitor communications and selectively collect email messages. The operation involved a collection of interconnected .NET-based tools that allow attackers to execute commands, examine organizational networks and maintain access without relying on conventional external command-and-control infrastructure.

Slovak cybersecurity company ESET identified the framework, named Cereal, during an investigation that began on November 28, 2025, when researchers discovered suspicious components on a Kazakh government Exchange server. Further analysis and improved detection capabilities led to the identification of another deployment at a Romanian government organization, which had been compromised on December 23, 2025.

The Romanian intrusion attracted particular attention because the attackers had configured the malware to identify correspondence involving NATO and European Union institutional email addresses. This targeting coincided with escalating tensions between Russia and NATO, including repeated incidents involving Russian drones entering or crashing near Romanian territory.

The Kazakhstan incident presents a different intelligence context. Researchers noted that the compromise occurred amid increasing pressure on Russian exiles and Kremlin critics residing in the country. Access to government communications could potentially provide intelligence about individuals known to local authorities. However, ESET could not establish whether gathering information about dissidents was the actual objective.


Cereal Exploits Exchange's Internal Architecture

Unlike conventional email-stealing malware that operates as an independent application, Cereal integrates its collection capabilities into Microsoft's existing email-processing environment. Its CerealBox component operates inside EdgeTransport.exe, the Exchange service responsible for handling incoming and outgoing messages.

The component uses an unconventional method to intercept email processing. Rather than installing itself as a separately registered Exchange transport agent, it modifies the handlers of existing agents while operating in memory. This allows its malicious instructions to execute alongside legitimate email-processing functions without introducing an additional agent into the server's configuration.

CerealBox examines messages against predefined collection conditions involving sender and recipient addresses, subject lines and attachment names. Messages containing Word documents or PDF files can also qualify for collection when they match the configured filters. Selected communications are compressed, encrypted and temporarily stored for subsequent retrieval by the attackers.

The original email delivery process continues operating, meaning users may not experience an obvious interruption even while selected correspondence is being copied.


Compromised Servers Replace External Command Infrastructure

Another unusual feature concerns how Turla operators communicate with the malware. ESET did not identify dedicated external command-and-control servers in the investigated deployments. Instead, the attackers used the compromised Exchange infrastructure itself to receive instructions and coordinate malicious activity.

CerealNeuron facilitates this arrangement by operating as a passive backdoor. It monitors incoming web requests through paths associated with legitimate Exchange services, including Outlook Web Access, Autodiscover and ActiveSync. Requests containing properly encrypted instructions can be processed as commands, while invalid requests are redirected to legitimate-looking Exchange error pages.

CerealHermit provides an alternative execution mechanism by retrieving encrypted instructions from local files rather than accepting network requests. Both components can provide operators with access to compromised environments.

The framework also includes CerealLoader, CerealRunner, CerealSprinter, CerealIron and CerealMoth, which support payload loading, execution, process injection and the execution of individual .NET assemblies. These components allow attackers to perform activities such as querying Active Directory, retrieving mailbox contents, examining running processes, collecting stored credentials and accessing files.

ESET also documented the abuse of lesser-known .NET execution mechanisms, including native entry points, VTable Fixups and the framework's precompiled assembly cache. These techniques help malicious code execute through legitimate Windows and Exchange processes while reducing the visibility of its actual functionality.


Romanian Authorities Confirm Disruption

Romania's Intelligence Service (SRI) confirmed on November 11 that its National Cyberint Center had identified the intrusion in December 2025 and implemented countermeasures to contain it.

According to the agency, attackers exploited systemic vulnerabilities in Microsoft operating systems. The intervention stopped the operation and enabled the restoration of the affected email service. SRI stated that investigators found no evidence of sensitive data exfiltration and confirmed that relevant European intelligence partners, including counterparts at the EU and NATO, had been informed.

ESET attributed Cereal to Turla with high confidence, citing the presence of another component previously associated with the group and similarities between the toolkit's design and older Turla malware.

Also tracked as Snake, Secret Blizzard and Venomous Bear, Turla has conducted espionage operations since at least 2004. The group is widely assessed to be associated with Russia's Federal Security Service (FSB) and has historically targeted government institutions, diplomatic missions and defense organizations across Europe, Central Asia and the Middle East.

ESET's telemetry indicates that approximately 70% of the countries targeted by Turla since 2022 were former Soviet republics or European countries historically aligned with the Soviet Union.

Read more »
Technology
Anthropic AI Bug Hunter Mythos 5.2 Technology

Mythos 5.2: Anthropic’s AI Gets Better at Finding Vulnerabilities

 

Anthropic has released Claude Mythos 5.2, an access-restricted AI model designed for advanced cybersecurity work, alongside the broadly available Claude Fable 5.2. The company says the new model finds more software vulnerabilities than its predecessor while attempting to escape test sandboxes far less often, signaling progress in both offensive-capability testing and containment controls. 

Mythos 5.2 and Fable 5.2 share the same underlying model, but differ in safety guardrails: Fable includes protections against cybersecurity and biology misuse, whereas Mythos omits some of those restrictions and is available only to vetted organizations through Anthropic’s Cyber and Life Sciences Verification Programs. Anthropic positions Mythos 5.2 as its most capable model for cybersecurity engineering, with stronger abilities to identify, reproduce, and fix vulnerabilities. 

The most prominent external result comes from Mozilla. Brian Grinstead, a distinguished engineer at Mozilla, said that successive Claude models have helped harden Firefox throughout the year, leaving fewer and subtler defects to uncover. Even so, Mythos 5.2 roughly doubled the vulnerability-discovery metrics of Mythos 5.1 across Mozilla’s respective scanning campaigns. 

Measuring the gains 

Anthropic’s internal benchmark, CVE Rediscovery, gives a model source code from before a known CVE was patched and asks it to locate the flaw without assistance. In an October evaluation involving 1,829 CVEs, Mythos 5.2 achieved an 89.6 percent success rate, compared with 78.3 percent for Mythos 5.1 and 81.3 percent for Opus 5.5 when tested without safeguards. 

Anthropic also cited outside testers, including one security company that found that one in six confirmed bugs identified by Mythos 5.2 had been missed by every other frontier model it tested. However, the company added an important qualification: on its own evaluations, vulnerability identification was roughly on par with Opus 5.5, a reminder that benchmark results can vary depending on the test design and evaluation conditions. 

The release also addresses a major safety concern: whether a powerful AI model can circumvent the environment meant to constrain it. Anthropic tested more than 1,800 scenarios in which the sandbox contained an intentional flaw and most tasks could be completed only by escaping it. Mythos 5.2 used credentials or files placed outside the sandbox in 3.1 percent of scenarios. 

That result represents a substantial improvement over earlier versions. Mythos 5.1 escaped or relied on external resources in 21 percent of scenarios, while Mythos 5 did so in 39 percent. Mythos 5.2’s rate was also close to Opus 5.5’s 3.3 percent, suggesting that Anthropic has narrowed a gap in containment behavior between its specialized cyber model and its general-purpose flagship. 

Access and safeguards 

For organizations that do not qualify for direct Mythos access, Anthropic is offering an indirect route through Claude Security, its code-vulnerability scanner, which now uses Mythos 5.2 among other models. This allows enterprise customers to benefit from the model’s bug-finding capabilities without receiving unrestricted access to the underlying system. 

Fable 5.2, by contrast, is available to general users and includes classifiers that block penetration testing, exploit generation, and other high-risk cyber tasks. When such a request is blocked, users receive a response from Opus 4.8 instead. Anthropic says the safeguards remain as robust as those in Fable 5.1 but trigger less often during legitimate work, with early testing showing roughly 60 percent fewer cybersecurity blocks. 

The release illustrates the growing tension at the center of AI cybersecurity: models are becoming more effective at finding real vulnerabilities, which can help defenders patch software faster, but the same capabilities could be valuable to attackers if access controls or safeguards fail. Anthropic’s approach is to separate a highly capable model from its most sensitive uses, reserve direct access for vetted organizations, and route public users toward a more restricted product.
Read more »
Employee Personal Information
Data Breach Data Leak data security DHS Digital Personal Data Protection Employee Personal Information

Why the DHS Employee Leak Is an Identity-Security Crisis, Not Just Another Data Breach

 


The exposure of information connected to more than 41,000 US Department of Homeland Security personnel demonstrates how an employee directory can become an operational map for attackers.

The dataset, published in late October under the name “Icepick,” reportedly contained names, work email addresses, telephone numbers, office locations, job information and internal group memberships. The affected records included personnel associated with Customs and Border Protection, Immigration and Customs Enforcement, US Citizenship and Immigration Services, and the Cybersecurity and Infrastructure Security Agency.

While contact information may appear less sensitive than passwords or Social Security numbers, the combination of identity and organizational metadata creates a significantly broader security risk. It can help attackers understand who works where, which employees may hold privileged access and how different teams are connected.

Employee Metadata Can Reveal How an Organization Operates

An ordinary staff directory contains more intelligence than organizations often realize.

Job titles, supervisors, office locations, telephone numbers and internal group names can reveal reporting structures and operational responsibilities. When these details concern law-enforcement, intelligence or cybersecurity personnel, they may also expose individuals connected to sensitive investigations, surveillance systems or undercover work.

Attackers do not necessarily need passwords in the initial leak. Accurate employee information can make subsequent social-engineering attempts substantially more convincing.

A criminal could impersonate an internal help-desk employee and refer to the target’s correct department, manager or office. Another approach could involve impersonating the employee while contacting a colleague, telecommunications provider or external contractor.

The exposed information could consequently support spear-phishing, voice phishing, SIM-swapping attempts, password-reset fraud and targeted harassment.

Identity Platforms Are Valuable Intelligence Sources

The group claiming responsibility said the information originated from a DHS identity system associated with Okta. However, Okta said it had found no evidence that its own systems were compromised.

That distinction is important. The appearance of identity-platform data does not automatically mean the platform provider suffered a breach.

Information could potentially be obtained through stolen administrator credentials, compromised endpoints, an improperly protected integration, exported directory records or another system connected to the identity environment. The exact intrusion route has not been publicly established.

Nevertheless, the incident highlights the value of identity infrastructure to attackers. Identity platforms frequently connect employees with cloud applications, administrative tools and internal services. They may contain account attributes, access-group assignments and information about which users can reach particular resources.

Even when passwords are not exposed, this information helps attackers identify valuable accounts and prepare more precise attacks.

The Risk Continues After the Original Data Is Removed

Removing the original website or disrupting its domain does not eliminate the exposure.

Once a dataset has been downloaded, it can be copied, mirrored and circulated privately. Employees whose information appeared in the leak may therefore remain at increased risk long after public attention moves elsewhere.

Contact details may also remain useful for years. Employees can change roles while continuing to use the same email addresses or telephone numbers. Historical group memberships and job information can still help attackers understand an agency’s structure or identify people likely to retain valuable professional relationships.

For personnel working in sensitive or public-facing roles, the consequences may extend beyond phishing. The information could enable doxing, threats, physical surveillance or attempts to identify family members and personal accounts.

What Organizations Should Examine After a Directory Leak

Responding to this type of exposure requires more than resetting passwords.

Security teams should determine whether authentication tokens, active sessions, application credentials or privileged accounts were accessible through the affected environment. Authentication logs should be reviewed for unusual sign-ins, newly registered devices, unexpected multifactor-authentication changes and access from unfamiliar locations.

Organizations should also examine the information included in their identity directories. Internal group names should not disclose more operational detail than necessary, especially when those names identify sensitive projects, investigative capabilities or administrative privileges.

Other important measures include:

  • Reviewing privileged and administrative group memberships.

  • Revoking unnecessary sessions, tokens and application connections.

  • Requiring phishing-resistant authentication for sensitive accounts.

  • Monitoring exposed employees for targeted phishing and impersonation.

  • Restricting bulk exports of identity-directory information.

  • Separating highly sensitive personnel records from general directories.

  • Establishing additional protections for undercover and investigative staff.

  • Reviewing third-party applications connected to identity platforms.

  • Alerting employees whose details may be used in social-engineering attacks.

Security awareness messages should also be specific to the incident. A general warning about suspicious emails may be inadequate when attackers possess accurate information about an employee’s role, colleagues and workplace.

Data Minimization Applies to Internal Systems Too

Organizations commonly apply data-minimization principles to customer information but may overlook internal employee systems.

Identity platforms, human-resources applications and staff directories frequently accumulate information because it is convenient. Each additional attribute increases the intelligence available if an account, integration or export function is compromised.

Organizations should regularly determine which employee attributes are necessary, who can access them and whether they can be exported in bulk. Sensitive operational details should not be stored in broadly accessible identity fields simply because the platform permits it.

The DHS incident illustrates that identity information is not merely administrative data. In the wrong hands, it can reveal an organization’s structure, identify valuable targets and provide the foundation for further attacks.

Protecting identity infrastructure therefore requires securing not only passwords and authentication tokens, but also the metadata surrounding every account.

Read more »
Payment API
AI CERT Cyber Attacks NBFCs Payment API

AI-Powered Cyberattacks Cost Small Indian NBFCs Nearly ₹300 Crore in Two Months; CERT-In Warns of Payment API Exploits


India’s smaller Non-Banking Financial Companies (NBFCs) are facing a growing wave of cyberattacks, with scammers siphoning off an estimated ₹300 crore over the past two months. Nearly 150 complaints and First Information Reports (FIRs) have been registered in connection with the incidents.

According to a report published by The Economic Times, the attacks have primarily targeted smaller NBFCs with annual turnovers of approximately ₹1,000 crore or less. Several financial institutions have experienced repeated attacks, exposing weaknesses in their cybersecurity infrastructure and payment systems.

In one reported incident, a Delhi-based NBFC allegedly lost ₹7.5 crore in an initial cyberattack, followed by another loss of ₹7.25 crore just days later. Investigators believe that inadequate security controls and insufficient monitoring have made smaller lenders attractive targets for cybercriminals.

AI tools making cyberattacks easier

Investigations into some of the incidents have identified a Chinese hacking platform known as CyberStrike. Security experts have also raised concerns about the growing use of artificial intelligence-powered toolkits, including ARTEX and CyberStrike, alongside open-source large language models.

These tools are lowering the technical barriers for cybercriminals by automating reconnaissance, vulnerability identification and other stages of cyberattacks. Attackers can use AI-assisted frameworks to analyse targeted systems and identify weaknesses more efficiently.

According to officials familiar with the investigations, attackers typically spend around 10 to 12 days studying an NBFC's payment infrastructure, including transaction processes, whitelisted identification details and application code, before attempting to steal funds.

Experts have also warned that stolen customer information could be exploited for targeted phishing and social engineering campaigns. Scammers equipped with borrowers' names, loan details and lender information may impersonate financial representatives to deceive customers into sharing sensitive information.

CERT-In flags payment API vulnerabilities

India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), along with CSIRT-Fin, issued a critical advisory on October 9, highlighting cyber threats targeting NBFCs, digital lenders, fintech companies and payment service providers.

The advisory identified vulnerabilities in applications and payment Application Programming Interfaces (APIs) that could allow attackers to steal banking credentials and initiate unauthorised fund transfers through trusted financial infrastructure.

CERT-In also warned that AI-driven attack frameworks have significantly reduced the time between initial system compromise and financial damage, allowing attackers to execute operations within hours rather than days.

Read more »
Zero-Day Exploits
AirPlay Security Apple Security Updates Apple Vulnerabilities and Exploits Bluetooth Security Cybersecurity Patches iMessage Vulnerabilities iOS security Privacy Protection Zero-Day Exploits

New Apple Updates Fix Privacy and Connectivity Flaws Across Its Ecosystem


The Apple operating systems have been updated with a series of security updates to address vulnerabilities affecting iMessage, Bluetooth and AirPlay, as well as a number of other areas. Among the fixes are two flaws in iMessage that could expose private group conversations to unauthorized individuals, as well as several weaknesses in wireless connectivity features that could allow attackers to establish connections or bypass existing security controls. 

There was an authorization weakness, identified as CVE-2026-113961, which enabled remote attackers to join an iMessage group conversation without proper permission and receive messages from that conversation. In light of the vulnerability, Apple improved validation mechanisms to ensure that unauthorized participants do not have access to conversations that are intended only for a limited number of users. As a result, privacy concerns were raised regarding group communications. 

Second, CVE-2026-113960, a vulnerability in iMessage, exposes messages exchanged within groups before a newly added participant joins them. This created an additional privacy risk since it potentially exposed earlier conversations to individuals who were not members when those discussions were originally sent. Apple confirmed that the affected code was removed as part of the security fixes.

There is no indication, however, that either vulnerability was exploited in real-world attacks prior to the patches being made available, according to the company's advisories. Moreover, details regarding the technical requirements for exploiting the flaws, whether unauthorized participants may be viewed by existing group members, and whether all participants must install the updates to secure a conversation remain unknown. Moreover, the updated versions address a vulnerability related to Google's Brotli compression library, identified as CVE-2026-111497. 

The vulnerability could be exploited by specially crafted inputs to corrupt memory, as the library's decoder is vulnerable to an out-of-bounds write. As of October 27, the Known Exploited Vulnerabilities (KEV) catalog indicates that the vulnerability has been reported as exploitable by the US Cybersecurity and Infrastructure Security Agency (CISA). Nevertheless, Apple's advisory does not specify specific attacks against its devices related to this vulnerability. 

Apple released separate security updates for the supported operating systems to cover these vulnerabilities. Despite the fact that iOS 18.7.12 and watchOS 26.6.1 security notes do not list the same fixes as iOS and iPadOS 27.2.1 advisories, they document all three vulnerabilities. Users who cannot immediately install the updates have been advised that alternative mitigation measures are available. However, the company has not made it clear whether devices running those versions are affected. 

Bluetooth and AirPlay Vulnerabilities Add to Security Concerns

The latest security updates of Apple's devices are also addressing several vulnerabilities affecting Bluetooth and AirPlay connectivity across devices, in addition to the messaging flaws. This vulnerability may allow attackers to bypass wireless pairing safeguards, establish unauthorized connections, or alter the memory of the device.

In two cases, a malicious device could establish a connection without the user's involvement due to a vulnerability in the Bluetooth framework. The other two flaws affected pairing-code protections, potentially making it possible for attackers to bypass restrictions on repeated incorrect attempts. Those issues can be exploited by those within Bluetooth range, while those connected to the same network can trigger the other. 

Apple addressed these vulnerabilities by improving security checks and by making changes to memory and connection management to address a memory-management vulnerability that could allow someone within Bluetooth range to corrupt memory. A pairing-rate-limit vulnerability was also found in AirPlay. Within Bluetooth range or on the same network, an attacker could circumvent restrictions on repeated pairing code attempts by exploiting this weakness. 

Bypassing these limitations could make it easier to unauthorized pair-up. Typically, these limits prevent repeated guesses of the PIN and temporarily block further attempts after several incorrect entries. Additionally, the security releases address a vulnerability relating to App Intents authorization, which could lead to sensitive user information being accessed by applications. Several fixes were made by Apple to address the issue, including improved state management, as well as fixes to messaging, wireless connectivity, application permissions, and data processing. 

Apple Expands Security Fixes Across Its Device Ecosystem

Security patches for iOS, iPad OS, macOS, watchOS and visionOS were rolled out on November 9. According to the released release information, iOS 27.2.1 and 26.7.3, iPad OS 27.2.1 and 26.7.3, macOS Golden Gate 27.2.1 and macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1 are included in this security update. 

There are several generations of iPads that have also been updated with relevant security patches, including the iPhone 11 and later. The update depends on the device model and operating-system branch of the device. No active exploits of the iMessage and Bluetooth vulnerabilities have been confirmed by Apple. 

Although these updates are important for individual users and enterprise device administrators because of messaging privacy weaknesses, wireless pairing bypasses and memory corruption risks, they are also extremely important for enterprise device administrators. Organizations managing Apple hardware must verify the installed versions across their fleets and prioritize security patches that are applicable.

To prevent potential attacks and safeguard sensitive information, the latest updates emphasize how important it is to maintain secure communication channels and protect wireless connections among connected devices. Apple users and enterprise administrators are encouraged to prioritize the installation of the appropriate patches.
Read more »
South Korea
Airlines Amadeus Data Breach Data Breach Japan Airlines Data Breach leaked sensitive data South Korea

Japan Airlines Passengers Caught in Amadeus Reservation System Breach

 



Japan Airlines has warned roughly 92,000 customers that hackers accessed their personal information through a third-party reservation platform, in what is turning out to be one of the most critical data security incidents to hit the global aviation industry in recent memory.

The airline said the breach originated at Amadeus IT Group, the Spain-based technology company whose software powers ticketing, check-in, and reservation systems for airlines worldwide. JAL said Amadeus notified it the week before it published its own disclosure notice on October 28, 2026, stating that an unauthorized party had accessed "a portion of customer reservation data" stored within the Amadeus platform.

For the vast majority of affected customers, the exposed information included names, booking reference codes, and flight details. But for approximately 2,000 of those customers, the picture is considerably worse. Hackers also accessed passport numbers, frequent-flyer numbers, email addresses, and phone numbers. No credit card numbers or passwords were compromised, JAL said, because that data was not stored in the same system.

Japan Transocean Air, a JAL affiliate, was swept up in the same incident. The two carriers share infrastructure through the Amadeus platform, which is how the breach spread across both brands without requiring a separate intrusion.

JAL said it would reach out to affected customers individually and urged everyone to stay alert for phishing emails, fraudulent phone calls, and fake JAL websites. The warning carries real weight: when scammers know your name, flight number, and booking code, their messages tend to look far more convincing than a generic blast.

The company said its own internal systems were not touched. That distinction, while technically accurate, offers only limited reassurance. From a customer's perspective, the data was real, the exposure was real, and JAL was the brand they trusted when they handed over their information.

JAL is far from alone in this. The Amadeus breach has since grown into an industry-wide event. Cathay Pacific disclosed that hackers used login credentials assigned to one of its system accounts to access reservation data inside Amadeus, with the intrusion running from August 2023 to September 2026, a window of more than three years. Amadeus reportedly detected the unauthorized access in late September, then reset the compromised credentials, disabled the account, and added monitoring. Airlines were notified between October 20 and October 28.

ANA, another major Japanese carrier, said about 37,800 of its customers were affected, with roughly 1,700 of those having passport details viewed. Cathay Pacific put its figure at approximately 53,000 bookings. Korean Air, Asiana Airlines, Malaysia Airlines, and German leisure carrier Condor have all said they are investigating their exposure. Qantas was still assessing whether its bookings were affected as of early November. Three smaller Japanese regional carriers, Air Do, Solaseed Air, and Starflyer, said they had been notified and were reviewing their records.

No single overall figure covering all airlines has been published, but the numbers keep climbing.

The mechanism behind the breach is straightforward and deeply familiar to anyone who follows enterprise security incidents. At its core, attackers used legitimate credentials to log into a system they were not supposed to access. No elaborate zero-day exploit, no ransomware deployment. Someone had the right username and password, and they used it. Cathay Pacific's disclosure that the credentials were tied to a "system account" suggests the compromised login may not have belonged to a human employee at all, but rather to an automated or service-level account, which tend to receive less routine monitoring than individual user logins.

The timeline raises its own troubling questions. If the unauthorized access began in August 2023 and was not detected until September 2026, attackers had more than three years to move through reservation data at their leisure. It is not yet clear whether that access was continuous or sporadic, or whether the full scope of what was taken is known.

The disclosure lands at a sensitive moment for Japan's cybersecurity posture. The country has seen a string of high-profile incidents over the past two years, and Prime Minister Sanae Takaichi convened a cabinet meeting on the issue, pledging emergency measures, though specifics had not been released at the time of publication.

For passengers, the practical exposure is primarily the risk of targeted fraud. Scammers with access to real booking records can craft fake refund notices or schedule-change alerts that clear most basic suspicion checks. Security researchers consistently advise the same response: access your booking only by typing the airline's official website address directly into your browser, and treat any unsolicited message about your flight as suspicious until verified through official channels.

Amadeus has not issued a detailed public statement about how the breach occurred, its full scope, or what it is doing to prevent a similar incident. As more airlines finish their own assessments, that number is likely to rise.



Read more »
Russian Hackers
Dark Web Data Breach Data Leak Italian Minister Russian Hackers

Italy Minister’s Personal Data Leaked on Dark Web

 

Italy’s Foreign Minister Antonio Tajani has said that cybercriminals circulated his personal data on the dark web, exposing him and his family to threats and intimidation. Prime Minister Giorgia Meloni blamed pro-Russian hackers, although Tajani did not publicly identify the attackers. The episode highlights how digital harassment and data leaks can be used to pressure political leaders. 

Tajani, who is also Italy’s deputy prime minister, announced the breach in a social-media post. He said that for days, cybercriminals had been spreading information about him on the dark web while trying to obtain additional details about him and his relatives. He said the criminals were even prepared to pay for further personal information, creating what he described as new threats and intimidation for his family. 

The foreign minister did not specify exactly what data had been leaked or which group carried out the attack. However, he linked the targeting to Italy’s position on Ukraine, saying that defending a sovereign state’s freedom and supporting democracy and independence had made him a target. He also said the attack appeared to be a reaction to measures Italy had taken to strengthen cybersecurity at its foreign ministry. 

Meloni expressed full solidarity with Tajani and described the alleged sale of confidential information about government officials as a matter of grave concern. She said it must be addressed with the utmost determination, framing the incident as an attack not only on an individual minister but on Italy’s institutions. Her statement came amid wider concern across Europe about cyberattacks, sabotage, drone incidents, and other hybrid threats. 

Tajani rejected the intimidation and vowed to continue his work. “I will not allow myself to be intimidated in any way,” he said, adding that he would keep defending his ministry and Italy while strengthening cooperation with partners to improve collective security. Italy remains a supporter of Ukraine, providing humanitarian and military assistance as the country continues to defend itself against Russia’s invasion. 

The incident follows a series of security disruptions across Europe, including hoax bomb threats that caused flight diversions, threats against broadcasters, attacks on supermarket refrigeration systems, and drone incursions. Authorities have not publicly attributed those threats to a particular group or state, and no evidence has emerged directly linking the hoaxes to a government. Still, the alleged leak of Tajani’s data has intensified concerns that political figures and critical institutions are increasingly vulnerable to online intimidation campaigns.
Read more »
US Treasury
Anti-Money Laundering Crypto Crime Cryptocurrency Regulation Cyber Crime FinCEN Illicit Crypto Transactions MEXC Crypto Exchange Money Laundering Sanctions Evasion US Treasury

MEXC Faces US Restrictions Over Alleged Sanctions Evasion and Cybercrime


US Treasury officials have blocked MEXC Global from the American financial system due to its alleged involvement in sanctions evasion, cybercrime-related payments, and other illicit financial activities. According to findings by the Financial Crimes Enforcement Network (FinCEN), between May 2021 and May 2026, the Seychelles-based exchange facilitates an estimated $16 billion in suspicious transactions. 

Based on Section 9714(a) of the Combating Russian Money Laundering Act, which was issued on November 6, 2026, MEXC was designated as a primary money laundering concern. In the event the order goes into effect, US financial institutions will be prohibited from processing fund transfers, including cryptocurrency transactions, to and from MEXC. Additionally, MEXC's subsidiaries and overseas operations will be restricted. 

A large part of the Treasury Department's Operation Economic Outcast initiative aims to disrupt financial channels used by Iran to circumvent international sanctions, and the actions form part of that initiative. 

While the MEXC order is based on allegations of the exchange's connection to Russian illicit finance, it is also based on FinCEN's finding that the platform processed approximately $1.5 billion in transactions related to Russian sanctions evasion over the past five years. This activity was reported to involve dealings with a sanctioned cryptocurrency exchange Garantex and its successor, Grinex, with transactions continuing until June 2026. 

Moreover, the agency identified approximately $200 million linked to the stablecoin A7A5, which has been associated with Russian sanctions evasion activities. In addition, substantial financial links were discovered involving Iranian entities as part of the investigation. MEXC reported processing over $1 billion in direct transactions with more than 40 Iranian cryptocurrency exchanges, according to FinCEN. Further transactions reportedly included payments related to sanctioned actors, as well as those involving the Iranian central bank and the Islamic Revolutionary Guard Corps. 

Along with to sanctions-related activity, Treasury accused the exchange of processing funds related to ransomware operations, scams online, and darknet marketplaces. As a result of these findings, FinCEN has expressed concerns about the platform's anti-money laundering (AML) procedures and controls on customer identification. 

According to FinCEN, the alleged activity was caused by severe weaknesses in MEXC's compliance systems, which made it possible to conduct transactions involving high-risk entities. It was established in 2018 and operates in over 170 countries, providing access to thousands of cryptocurrencies and tokenized assets. 

As a result of its scale and involvement in illegal financial flows, the enforcement action has been regarded as an important step forward in the US government's efforts to combat cryptocurrency-based sanctions evasion. 

MEXC Says It Is Cooperating With US Regulators

Upon submitting a response to the enforcement action, MEXC confirmed that discussions have begun with US authorities in response to the allegations. On November 10, CEO Vugar Usi announced that the exchange had established a communication channel with FinCEN with the assistance of an international law firm.

According to reports, the regulator acknowledged receipt of MEXC's written request, while MEXC expressed its willingness to cooperate in the ongoing regulatory process. The exchange's services remain operational, and deposits, withdrawals, and cryptocurrency trading have not been disrupted, according to Usi. According to reports, the company has prepared a follow-up plan and intends to provide further updates in the event significant developments arise. 

MEXC had earlier indicated that its legal and compliance teams had begun an independent assessment of its anti-money laundering and sanctions controls, following the November 6 order. According to the exchange, user assets remain secure and the exchange intends to cooperate with FinCEN and other appropriate regulatory authorities as part of its ongoing efforts. 

In order to prevent US financial institutions from processing transfer involving the exchange, this enforcement action does not shut down MEXC's global operations or freeze customer accounts immediately. MEXC is expected to face wider difficulties beyond its direct US financial connections following the publication of the order in the Federal Register. The order is scheduled to take effect 30 days after publication. 

The Blockchain Investigator ZachXBT reported on November 10 that several other offshore centralized exchanges that are either limited or do not have a US presence have started prohibiting MEXC users from transferring assets. However, it was not revealed which exchanges and what the specific scope of these restrictions would be, however it has been suggested that the enforcement action could affect transaction routes outside of the US financial system. 

In addition, this case highlights the increased scrutiny of offshore cryptocurrency platforms that process transactions involving sanctioned entities and cybercriminals. A number of factors may contribute to digital asset exchanges becoming channels for illegal funds to flow across borders, including weak customer verification, inadequate transaction monitoring and limited screening of high-risk counterparties. 

The immediate challenge for MEXC is to address FinCEN compliance concerns while maintaining access to international financial services. It is anticipated that the platform will be able to address the allegations and limit further restrictions based on its engagement with US regulators and independent review of its compliance framework. 

Taking such action marks a significant step forward in efforts of the US government to restrict illicit financial networks operating through cryptocurrency exchange platforms. The extent to which MEXC cooperates with FinCEN and its ability to address the alleged compliance violations will determine the exchange's future access to the US financial market.
Read more »
Google
AI ai agents Cyber Security DeepMind Google

Google DeepMind AI Agents Reduce the Cost of Attacking 1024-Bit RSA Encryption


Artificial intelligence (AI) agents developed by Google DeepMind have shown new ways to make attacks against legacy RSA-1024 encryption systems significantly cheaper. 

The research was conducted by Google DeepMind in collaboration with cryptography researchers from the University of California San Diego and Inria. 

RSA is a widely used public-key cryptographic algorithm that relies on the mathematical difficulty of factoring large numbers. Although RSA-1024 was once considered sufficiently secure, advances in computing and cryptanalysis have made it unsuitable for protecting sensitive information. Modern systems generally use RSA keys of 2048 bits or longer.

The first major finding focused on digital signature forgery involving the PKCS#1 v1.5 padding format. Padding is additional data inserted into a message before signing to ensure that it meets the required block size. Researchers examined how this protection behaves when an attacker can influence the content of the message being signed.

The team found that when an attacker controls approximately half or more of the signed data block, the padding may no longer provide additional protection against forgery. This weakness is relevant to the PKCS#11 signing interface used by cryptographic devices, including hardware security modules.

To show the improvement, DeepMind's AI agents reproduced an earlier academic signature-forgery attack against an RSA-1024 key. The agents reduced the required computing time from approximately 1,380 CPU core-years to 391 CPU core-years, making the process around 3.5 times more efficient.

Two AI agents reportedly designed, executed and debugged the computation in less than four days, with approximately 20 messages from a human researcher, most of which involved approving their actions.

Researchers also developed a more efficient approach for situations where attackers control a smaller portion of the signed message, such as a 32-byte hash. Their theoretical calculations suggest that the proposed method could be approximately 1,600 times more efficient than the previous best approach for certain RSA-1024 signature-forgery scenarios.

The second major finding concerns RSA key factoring. RSA security depends on the difficulty of breaking down a large number into its original prime factors. The researchers developed an algorithm that could make factoring each additional RSA-1024 key approximately 30 times cheaper on average after an expensive initial computation.

However, this technique remains theoretical and has not yet been implemented. The initial computation would also require substantial resources, meaning the findings do not show an immediate practical attack against deployed encryption systems.

The researchers also highlighted important limitations of the signature-forgery technique. It requires approximately four billion signing queries in advance, does not recover the private key and does not work against devices that internally hash messages before signing.

According to Pushmeet Kohli, Vice President at Google DeepMind and Chief Scientist at Google Cloud, modern cryptographic protocols generally use RSA keys of 2048 bits or larger and remain secure against the demonstrated techniques.

Read more »
Information Security
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Healthcare Healthcare Breach Information Security

Amplifon Americas Data Breach Exposes Personal and Medical Information of 1.3 Million People

 

Hearing healthcare company Amplifon Americas has revealed a data breach which has led to personal information being exposed for around 1.33 million people across the United States. The records were reportedly stolen and include personal details, medical histories, health insurance information and in some cases Social Security numbers and financial information. 

The breach occurred at Amplifon Americas, the Minneapolis-based US branch of Amplifon, an Italian-based hearing healthcare company which has over 80 million members across thousands of clinics nationwide. A third party gained unauthorised access to Amplifon’s systems in January 2026 and stole data from specific systems between 18th January and 8th February. A response was made by Amplifon to limit the breach and investigate the incident. 

However, the company found it took a long time to establish how much information had been exposed. It took around eight months to complete its analysis. The investigation revealed a range of information had been stolen, including names, contact details, date of birth, drivers licence numbers and other government issued identification information. Medical information, including hearing information, other medical details, date of medical service and health insurance information had also been exposed. 

Those whose Social Security and financial information had been accessed are at greater risk of identity theft. This could increase their chances of being victims of financial fraud and other issues. Amplifon said they were not aware of any fraudulent activity using the stolen personal information but cannot rule out the possibility of future misuse. A filing was made with the Texas Attorney General’s Office by Amplifon and listed 1,332,826 individuals who had been affected by the data breach across the country. 

The company have not said any further information about who had accessed their information or how they had done so. This shows how at risk healthcare companies can be. They often hold large amounts of personal, medical and insurance information. This can be extremely valuable to cyber criminals as they will have access to a variety of different information which can be used for identity fraud.  

There is not much more information available about the breach. We contacted Amplifon to ask for more information about the breach and how many individuals were affected. More information will be available depending on their response.
Read more »
vpn
Cloud Breach Customer Data Data Breach data security Japan passwords sensitive information vpn

Japanese Homeware Giant Iris Ohyama Says Cloud Breach at Its Online Store May Have Exposed Data of Up to 7.7 Million Shoppers

 



Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its online shopping platform was accessed without authorization, potentially exposing personal data belonging to roughly 7.7 million people, including customers who never created an account.

The company, founded in 1971 and headquartered in Sendai, is best known for plastic storage solutions and home appliances sold across Asia, Europe, and North America. Its e-commerce platform, Iris Plaza, caters to millions of customers in Japan and handles a large volume of household product purchases. The scale of the breach puts it among the larger data security incidents Japan has seen this year, in a period when Japanese companies and government agencies have dealt with a string of serious intrusions.


How the Breach Was Detected

On October 28, 2026, Iris Ohyama staff detected suspicious files inside a cloud service that Iris Plaza relies on for its operations. The company did not name the cloud provider or describe the method the attacker used to get in. Within a day, the company suspended access to Iris Plaza and related systems, reported the incident to Japan's Personal Information Protection Commission, and filed a report with police.

A follow-up disclosure on November 5 gave a clearer picture of the scope: up to 5.8 million registered and former members may have had their data accessed, along with up to 1.9 million non-members, meaning people who had completed a guest checkout without registering. The fact that guest buyers are part of the exposure is insurmountable, since many people assume their data is not retained when they shop without creating an account. In Iris Plaza's case, it was.


What Data Was in the Affected System

The range of information potentially accessed varies depending on the type of account. For registered members, exposed fields can include full name, home address, phone number, email address, gender, and date of birth. Account passwords were also stored in the affected environment, though the company said they were encrypted. It did not specify which encryption method was used, leaving questions open about how resistant those passwords are to cracking.

Former members are in a slightly different position: Iris Ohyama said it does not retain passwords for accounts that have been closed, so that group faces a narrower exposure. For non-members who checked out as guests, the data stored was more limited.

One notable reassurance: the company confirmed that credit card information was not stored in the affected cloud environment, sparing customers from the most immediately damaging form of financial exposure.

As of November 5, Iris Ohyama said it had not received any communication from whoever carried out the intrusion, had not identified any perpetrators, and had not seen reports of fraudulent use or financial damage tied to the breach. The investigation into how many records were actually exfiltrated, as opposed to merely accessible, is still ongoing.


What Iris Plaza Customers Should Do Now

The company has urged customers to change their Iris Plaza passwords and, critically, to change passwords on any other service where they used the same credentials. Password reuse across sites remains one of the most common ways a single breach cascades into wider account takeovers. Anyone who shops with the same email and password combination across multiple retail or financial platforms is at elevated risk.

Iris Ohyama also warned customers to be on guard for phishing attempts. With names, addresses, phone numbers, and email addresses potentially in circulation, attackers have enough to craft convincing messages that appear to come from the company. Iris Ohyama said it will not send emails or SMS messages asking for passwords, PINs, authentication codes, or other sensitive information through links, and customers should treat any such request as fraudulent.


A Year of Costly Data Incidents in Japan

The Iris Ohyama breach lands in the middle of a rough stretch for data security in Japan. This year alone, cloud hosting provider Sakura Internet reported a hack affecting up to 1.36 million accounts, telecommunications giant KDDI disclosed a breach tied to a zero-day vulnerability in third-party software that hit around 12 million accounts across shared email platforms, and Japan's Digital Agency acknowledged that a VPN flaw exposed approximately 246,000 government personnel records. The common thread across several of these incidents is reliance on third-party services and cloud environments where access controls or vendor security fell short.

Iris Ohyama's breach fits that pattern. A third-party cloud provider, an intrusion the retailer only caught when suspicious files turned up, and millions of customer records sitting in an environment the company did not fully control. The investigation remains open, and the company has not said when it expects to restore Iris Plaza to service.



Read more »
Vulnerabilities and Exploits
Plex2Shell QNAP Security Patch Vulnerabilities and Exploits

QNAP Urges Immediate Plex2Shell Update and Remediation

 

QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later. 

Technical scope 

Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process. The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation.

Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again. 

Compromise assessment Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised. This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise. 

Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st. Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure. 

Secure reinstallation 

For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder. Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.
Read more »
Subscribe to: Posts (Atom)