Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breach. Show all posts
telegram
CERT-In Data Breach data fiduciaries Data Stolen DPDP Act India Indian Railways Road telegram

India’s Road Ministry Orders Forensic Audit of Four Transport Portals After Vehicle Data Found for Sale on Telegram

 




The Ministry of Road Transport and Highways has directed India's national cybersecurity agency to conduct a forensic security audit of four of its core digital portals, following reports that personal data of vehicle owners was being sold through Telegram bots and mobile applications for as little as ₹5 per lookup.

The ministry ordered the Computer Emergency Response Team of India, commonly known as CERT-In, to audit VAHAN, SARATHI, e-Challan, and the Pollution Under Control Certificate portal. These four platforms collectively hold some of the most sensitive civic data in the country, covering vehicle registrations, driving licences, traffic challans, and vehicle fitness records for hundreds of millions of Indians.

The trigger for the audit was a report documenting an active Telegram-based service that allowed anyone to query a vehicle registration number and receive the owner's full name, father's name, present and permanent addresses, PIN code, and mobile number. The same service also offered driving licence details, challan history, FASTag information, and downloadable copies of registration certificates and driving licences. A cybersecurity firm, Cyderes, traced the service's backup channel to 21,329 subscribers before it was taken down. It rebuilt itself under new handles within weeks.

The scale of commercial access to these government databases is not incidental. As of the latest available figures, 25,314 private corporate entities held active credentials for the four portals, collectively running 1.708 crore searches over a 33-month period. Officials are now reviewing whether daily search limits and usage guidelines were actually enforced during this period or simply existed on paper.

The concern does not stop at the portals themselves. On the Unified Logistics Interface Platform, managed by the National Industrial Corridor Development Corporation, some authorized entities reportedly logged more than five million data transactions in a single month. The National Informatics Centre has been directed to audit these access patterns. Under revised protocols, any government body seeking data through this logistics platform will now require explicit authorization from the Transport Secretary, with requesting officers verified through Aadhaar-based digital signature certificates or video-based KYC procedures.

The ministry has also written to app store operators, including Google, requesting the removal of applications that surface vehicle owner details without adequate safeguards. Two apps drew particular attention: Vehicle Information App, with roughly 10 million downloads, and VehicleSetu, with about 1 million. The largest vehicle information app on the Play Store reportedly carries over 100 million downloads. MoRTH is also reviewing its data-sharing arrangements with the Ministry of Electronics and Information Technology in light of the Digital Personal Data Protection Act, 2023.

What makes this episode harder to dismiss as a simple breach is that no government database was hacked in the traditional sense. Investigators found no sign of a backend intrusion. Instead, Cyderes traced the data flow to credentials held by licensed identity verification companies, with lookups routed through authentication tokens on a third-party platform. As recently as August 4, 2026, one such route was still returning full VAHAN records including mobile numbers. This points less to a technical failure and more to systemic gaps in how credential use is monitored and how downstream sharing by licensed entities is controlled.

The government's relationship with vehicle data predates this episode by several years. In 2019, Transport Minister Nitin Gadkari told the Rajya Sabha that the government had earned ₹65 crore from selling VAHAN and SARATHI data to 87 private companies and 32 government bodies under a bulk data sharing policy. By February 2021, that revenue figure had grown to over ₹111 crore, with more than 170 recipient entities. Recipients included automakers, insurance firms, and second-hand vehicle dealers. The Internet Freedom Foundation noted at the time, and has reiterated since, that the Motor Vehicles Act contains no provision authorising the commercial transfer of this data to private companies.

IFF sent a formal representation to MoRTH, the NIC, and CERT-In on September 23, 2026, asking for the incident to be registered as a cyber incident, for server logs to be preserved, and for a comprehensive forensic audit. It also asked the ministry to publish a register of all entities currently holding access credentials, introduce technical controls to cap and monitor search volumes, and notify affected individuals.

The ministry says "controlled private access will continue to support commercial efficiency," language that suggests the government is not planning to end third-party access to these databases altogether. What it has not yet addressed publicly is how it will verify that the access controls now being introduced will hold in practice, given that the previous framework apparently operated without meaningful enforcement for years.

India's Digital Personal Data Protection Act places compliance obligations on data fiduciaries starting May 2027, with penalties reaching ₹250 crore for violations. The forensic audit ordered by MoRTH will now determine whether the exposure was a question of technical vulnerability, policy failure, or both.



Read more »
FTP Security
Credential Security Data Breach Data Exploit data security DreamHost Security Incident FTP FTP Security

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information

 

DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident. 

The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed. 

According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts. The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure. 

A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion. DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company. 

Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access. Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere. 

To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity. BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.
Read more »
Sensitive Business Data
AI Data Exposure AI Security Artificial Intelligence Security Cloud Security Data Breach Data Privacy Microsoft Azure Misconfiguration Private Chat Logs Sensitive Business Data

Over 18 Million Files Leaked in AI Aggregator Breach, Raising Privacy Concerns


There has been a major data exposure at the AI aggregator 302.ai that has resulted in millions of documents containing private user conversations, personal information and confidential business material becoming publicly accessible. 


Cybernews cybersecurity researchers discovered an unsecured Microsoft Azure storage bucket belonging to this platform, which exposed approximately 22.72 terabytes of information. There were 17.6 million files in the exposed archive, including images, videos, audio recordings, documents and chat histories. The storage bucket was publicly accessible without password protection or encryption, resulting in anyone able to discover its location having access to the information stored there. 

302.ai is a platform that facilitates the interaction between users and a variety of artificial intelligence services, enabling customers to access multiple large language models on one platform. In addition to ChatGPT, Claude, Grok, DeepSeek, and Gemini, the company supports ChatGPT, Claude, Grok, and Gemini. This arrangement permits users to switch between artificial intelligence models without having to access each provider separately. 

According to Cybernews, the exposed storage contained approximately 144,000 JSON-formatted conversation logs. Users' prompts, AI-generated responses, models used to process requests, timestamps, token consumption costs, and other related metadata were part of these records. As part of the conversations, users entered personally identifiable information as they interacted with the platform. 

The records included details about their birthdates, genders, names, contact information, and addresses, among other personal information. A combination of such information and conversation histories and uploaded documents can reveal more details about individuals than their ordinary chatbot activity. The exposure was more extensive than text-based communications.

The archive contained more than 9 terabytes of images, 7.7 terabytes of videos, and another 5.6 terabytes of audio files. The researchers also discovered over 26,000 ZIP archives containing conversation summaries, inputs from users, AI responses, and attachments to individual sessions. According to reports, a number of documents within the storage were related to large language model development research projects and materials reportedly submitted for private analysis. It is evident from the findings that the information exposed was not confined to individuals, but included information related to business activities as well. 

An especially sensitive discovery involved multiple conversations with a chatbot that provided customer support for a prominent manufacturer of sex dolls. These records illustrate the increasing use of third-party artificial intelligence platforms to manage enterprise customer interactions, resulting in potentially exposing confidential and personal information to external storage environments. Cybernews failed to identify the manufacturer or determine whether all of its customer-service records were exposed. 

Despite the discovery, other concerns have been raised regarding the handling of sensitive customer conversations by third-party artificial intelligence services. As opposed to a confirmed cyberattack, researchers stated that the exposure was likely the result of an accidental storage configuration error. Nonetheless, the investigation did not determine whether any unauthorised parties accessed the files prior to the security measures being implemented or if the technical cause could be determined.

The exposed Azure storage was discovered on August 2, 2026, as reported by Cybernews. A team of researchers contacted 302.ai on August 11 and observed that public access had been disabled by September 8. Researchers found no evidence of malicious actors downloading the information, however it was not impossible for unknown parties to obtain access.

Exposed AI Conversations Could Enable Targeted Cyberattacks

Cybercriminals might be able to conduct targeted phishing and social engineering campaigns if these information is obtained by malicious individuals. As a result of chat histories revealing personal details, business relationships, ongoing projects, customer concerns, and other information, attackers are able to make fraudulent communications appear more convincing by using this information. 

Conversations between employees, customers or senior management could be particularly useful for impersonation attempts. An attacker could also use information contained in uploaded documents and interactions with chatbots to identify potential targets and gain an understanding of internal company operations. The incident demonstrates the security risks associated with third-party AI aggregators. 

In addition to providing access to models developed by major technology companies, platforms such as 302.ai also maintain their own infrastructure to handle prompts, conversation histories, and uploaded files. Generally, the security protections offered by the underlying AI providers do not extend to third-party intermediaries. 

Businesses Urged to Review AI Data Handling Practices

For organizations that rely on artificial intelligence platforms to process customer inquiries, internal documents, and other confidential information, the exposure raises significant concerns. Companies using 302.ai should identify which employees and departments have used the service and whether sensitive company information or customer information has been shared. 

A security team should also review all available conversation histories and uploaded files for potential vulnerabilities in credentials, API keys, and confidential documents. Credentials discovered in submitted materials should be rotated, while suspicious account activity should be investigated. In light of the incident, it is important to evaluate third-party AI vendors before incorporating them into business workflows.

Providers should be examined to determine how they restrict access to storage, protect uploaded files, separate customer information, and manage data retention and deletion. 302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020. This exposure illustrates how weaknesses in intermediary platforms can result in sensitive information being compromised, even when the AI models accessed through those services are operated by established technology companies.

It is clear from the 302.ai exposure that there are growing security concerns associated with third-party artificial intelligence platforms and sensitive data they handle. Businesses are increasingly integrating artificial intelligence tools into their operations; however, preventing confidential information from being made public requires strong data protection measures, regular security assessments, and thorough vendor evaluations.
Read more »
Northflank
AI API Data Breach data security Northflank

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage


Cloud application hosting platform Northflank has warned customers to rotate their stored credentials and API keys following a security breach that resulted in unauthorized use of customers' artificial intelligence (AI) API keys.

Northflank provides a cloud-based platform that allows developers to deploy and manage applications, containers, databases and AI applications without having to manage the underlying infrastructure. 

About the incident

After the warning, Northflank advised customers to immediately change their environment variables and API keys stored on the platform. The company later issued a stronger warning, asking users to assume that all environment variables had been decrypted and that the sensitive information stored inside them had been stolen.

Environment variables are commonly used by applications to store sensitive information, including database passwords, cloud service credentials, authentication tokens and API keys. If attackers gain access to these details, they can use them to compromise other services, steal data or misuse accounts to generate unauthorized charges.

Northflank later confirmed that several customers had reported unauthorized use of AI API keys stored on its platform.

"Users have reported unauthorised use of AI API keys supplied to the Northflank platform," the company said in an update. It urged customers who had not yet changed their stored secrets to do so immediately.

The company also advised users to examine their AI service providers' usage and billing records for unusual activity. Any suspicious usage should be reported to Northflank and the relevant AI service provider.

According to the company's incident timeline, Wiz notified Northflank about the security breach at 11:43 UTC on October 30. Its engineering team began investigating the alert one minute later. Northflank initially introduced a network policy patch and deployed additional security updates at 12:50 UTC and 13:05 UTC. The company also requested assistance from Wiz's incident response team.

As part of its response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis databases. It also introduced audit logs for all customers, including users on free accounts, to help them identify suspicious activities.

According to Wiz, attackers are increasingly targeting environment variables that contain AI service credentials. Stolen API keys can be used in a practice known as LLMJacking, in which attackers exploit another organization's AI accounts to access expensive AI models without permission. They may also resell access to these services to other users.

In two cases investigated by Wiz, attackers used compromised enterprise credentials to make approximately 2.5 million requests to Amazon Bedrock, resulting in nearly $100,000 in AI usage charges.

Read more »
Social Security Number Exposure
Data Breach Education Cybersecurity Financial Aid Website Hack Florida Department Of Education Personal Information Leak Social Security Number Exposure

Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants


The Florida Department of Education (FLDOE) has disclosed a data breach involving its student financial aid website that may have exposed the sensitive personal information of approximately 4.9 million individuals. The compromised information reportedly includes Social Security numbers, names, residential addresses, phone numbers, email addresses, genders and dates of birth. According to the department, unauthorized criminal access to the Florida Student Financial Aid website was discovered on October 19, 2026. 

The agency publicly disclosed the incident on October 29, describing it as a security breach involving unauthorized access to a system containing personal information. The exact method used to gain access and the identity of those responsible have not been disclosed. In a statement issued by the Florida Department of Education, it was noted that individuals who had used the state's financial aid portal may have been affected by the incident. 

The website facilitates the application process for scholarship, grant, and other financial assistance programs, including the lottery-funded Bright Futures scholarship program. After identifying the intrusion, the department activated its cybersecurity response procedures. It has been determined that the unauthorized activity was stopped, contained, and the affected systems were secured. 

As part of the response, the Florida Digital Service and the Florida Department of Law Enforcement are also involved, and the issue has been reported to the Attorney General's Office. According to information reported by The Record, the information exposed may pertain to nearly five million Florida students who applied for financial aid. 

This incident is particularly concerning as Social Security numbers and dates of birth are included, as such information can be exploited for identity theft, fraudulent account creation, and other financial crimes. Rather than affecting the entire Florida Student Financial Aid network, the department believes that the breach was limited to the website. Despite this, the investigation is still ongoing, and officials have not confirmed a breakdown of the affected records or explained how the unauthorized party entered the system. 

The FLDOE has taken the financial aid website offline as part of the response. During the recovery process and security measures, other departmental websites and online services may experience temporary disruptions. Although sensitive personal information was exposed in the incident, the department clarified that it did not affect the administration of financial aid.

Scholarship and grant eligibility, as well as student loan services administered by the department, are expected to continue without delay in spite of the exposure of sensitive personal information. A warning has been issued to potentially affected individuals to monitor their financial and online accounts for unusual activity and to regularly review their credit reports. 

In addition, the department recommended that students consider placing an alert or placing a credit freeze with the major credit bureaus to prevent identity fraud. Currently, the investigation has not been able to determine who is responsible for the intrusion or how the financial aid website was accessed. No information has been provided by the Florida Department of Education as to whether the breach involved stolen credentials, exploited software vulnerabilities, or used another approach to attack. 

Additionally, the authorities have not disclosed any further information concerning the nature of the intrusion, but stated that additional information will be provided once verified findings are available. The breach is not the only recent cyberattack involving government educational systems in the United States. 

Separate data breaches were reported by the California Department of Education approximately one week earlier, which involved information associated with children who had been enrolled in public schools for the previous three years. Despite the lack of connection between these two incidents, the disclosures have raised concerns about the security of sensitive educational information. This year, Florida has also experienced several security breaches relating to government organizations. 

During September, the Department of Motor Vehicles reported a breach involving a prominent hacking group. According to The Record, the hackers continued to advertise the stolen DMV information on cybercriminal forums throughout October.

In a separate incident, a central Florida county experienced significant internet service disruption following an alleged cyberattack. The increasing number of incidents involving public institutions emphasizes the risks associated with large amounts of personal information stored in government databases. 

A majority of educational and administrative portals maintain records containing personal information, which may make unauthorized access particularly concerning when the information relates to millions of individuals. In accordance with Florida's law requiring notification of data breaches, Section 501.171 of the state statutes requires organizations covered by the law to implement reasonable measures to protect electronic personal information. 

There is generally a 30 day notification period for a breach that affects 500 or more Florida residents in order for the Department of Legal Affairs to be notified of the breach. According to applicable legal exceptions, affected individuals must also be notified as soon as possible. The incident occurs in the context of a wider increase in reported data exposures. 

At least 3,43 million people were affected by 5,429 breach notification filings in the first half of 2026, according to the Privacy Rights Clearinghouse, which covered 1,969 distinct incidents. As a result, 33.8% of the reported breach incidents were unable to be determined from public filings during this period, compared with 22.6% in 2022. There remains a priority for the Florida Department of Education in determining the extent of the exposure. 

In the ongoing criminal investigation, the final number of affected individuals, the method of intrusion, and the identity of the unauthorized party are still unknown. Public-sector systems that store sensitive personal and financial information face increasing security risks as a result of this incident. 

There will be a continuing need to determine how the attackers gained access to the system as well as ensuring affected individuals are given timely protection as the investigation proceeds.
Read more »
stablecoin
Binance Blockchain Crypto Theft cryptocurrency Data Breach North Korea stablecoin

North Korean Hackers Drain $6.3 Billion from Binance in Record-Breaking Crypto Theft

 



Hackers tied to North Korea stole roughly $6.36 billion from Binance on Wednesday, stripping the world's largest cryptocurrency exchange of funds across ten blockchains in a heist that blockchain intelligence firms are calling the largest crypto theft in history.

The attack, which began at 8:05 p.m. UTC on October 29, moved faster than most exchange security teams could respond. The bulk of the money was gone within 20 minutes.

Binance suspended deposits and withdrawals shortly after detecting the breach and said user funds would be covered in full. "Investigating a potential security issue," the exchange wrote in an early-evening post, adding that user assets were safe. By late that night, a coalition of blockchain infrastructure firms had frozen roughly $3 billion of the stolen assets, though more than $2.4 billion remained in the attacker's control as of press time.


How They Got In

Blockchain intelligence firm TRM Labs, which traced the attack in near real-time, said the intrusion bore the hallmarks of TraderTraitor, the North Korean state-sponsored hacking unit that the FBI also attributed to February's $1.5 billion Bybit breach.

The preparation started at least 36 hours before the theft. TRM Labs found that the attackers funded an operator wallet with small withdrawals from Tornado Cash, a crypto mixing service, then ran test transactions across wallets they controlled. In the day before the main theft, the attackers rehearsed the final version of their code on a third wallet before installing it on a live Binance hot wallet.

The technical method on Ethereum was particularly precise. The attackers used EIP-7702, an account delegation feature introduced in a recent Ethereum upgrade, to effectively convert a Binance hot wallet into a sweeper they controlled. A single transaction carried 50 pre-signed authorizations; one matched the wallet's transaction count exactly, granting the attackers the ability to sweep new incoming deposits for hours after the initial theft, all the way until 11:56 p.m. UTC.

On nine other blockchains, including Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, and several Ethereum layer-2 networks, wallets sent funds through standard signed transfers during the same window. TRM's analysis concluded the most likely explanation was that the attacker had somehow obtained the ability to instruct Binance's hot wallet signing infrastructure to authorize transactions of their choosing. Binance has not yet published a root cause analysis.


What Was Taken

The breakdown by chain is staggering. Ethereum accounts for the largest slice: about $3.79 billion, including 200,630 ETH and roughly 1.875 billion USDT. Bitcoin follows with 18,270 BTC worth approximately $1.47 billion. Tron contributed about $628 million, primarily USDT, and XRP Ledger added 233 million XRP worth around $296 million. The remaining losses were spread across Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

At those figures, the theft dwarfs every previous crypto hack on record by a considerable margin. The Bybit breach in February 2025, which itself broke every prior record, involved $1.5 billion. This attack is roughly four times larger.


The Freeze Race

Within hours of the theft, stablecoin issuers and blockchain governance bodies began freezing assets. Tether moved first, blacklisting 971 million USDT across wallets traced to the attacker at 9:01 p.m. UTC. Circle followed three minutes later with a freeze on $823 million in USDC, acting in coordination with law enforcement. Ripple froze 40.5 million RLUSD at 10:01 p.m. The Arbitrum Security Council executed forced transfers of 8,426 ETH and 74.6 million ARB tokens after midnight.

By 11:35 p.m. UTC, Binance said the verified total of frozen assets had reached $2.54 billion. TRM Labs placed the figure closer to $2.7 billion by 12:30 a.m. the following morning.

The attacker, however, moved quickly to convert portions of the stolen funds. Some USDT was swapped for ETH at a discount of more than 10%, and the attacker used Aave, a decentralized lending protocol, to borrow ETH against frozen stablecoin positions. As of the morning of October 30, the attacker still held more than 420,000 ETH and all 18,270 BTC, assets beyond the reach of any issuer's freeze function.


North Korea's Crypto Playbook

The FBI said it was aware of the incident and working with partners to assess the activity. The U.S. Secret Service had not responded to a request for comment at time of publication.

The timing fits a pattern that intelligence analysts have tracked closely. Chainalysis reported that North Korean operatives stole about $2 billion in cryptocurrency throughout 2025. TRM Labs found that two North Korea-linked groups accounted for three-quarters of all crypto hack losses in the first quarter of 2026 alone. The funds are widely believed to support Pyongyang's weapons programs, which have been cut off from conventional financial markets through international sanctions.

TRM Labs said it expects the attacker to route remaining funds through cross-chain bridges, swap services, and over-the-counter brokers in the coming weeks, and said it was monitoring those flows in real time.



Read more »
ShinyHunters
cisa systems Data Breach DHS Employee Data Hacktivist group ShinyHunters

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation

 



A hacktivist group has published internal records identifying more than 41,000 Department of Homeland Security employees and contractors, in what security researchers are calling one of the most detailed government workforce exposures in recent memory.

The group, which calls itself the "Department of Peace," shared the data with Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked government datasets, and with Swiss hacker-journalist maia arson crimew. The records went public on October 29 and cover staff across nine DHS agencies.

The group tied the release directly to DHS Secretary Markwayne Mullin's July 17 comments, in which he told reporters he was "turning up the heat" on immigration enforcement. That remark, the group said, was the trigger.


What the data contains

The leaked dataset holds 41,191 records spanning employees and contractors across nine DHS sub-agencies, pulled from nearly 7,000 offices and more than 2,200 locations. Each record contains names, job titles, supervisor relationships, direct reports, employment status, workplace addresses, email addresses, phone numbers, and internal group memberships.

CBP accounts for the largest share with 21,329 records, followed by ICE at 6,598 and USCIS at 6,245. Homeland Security Investigations holds 3,421 records, DHS headquarters 1,755, and CISA 980. The Federal Protective Service, FLETC, and the Science and Technology Directorate account for the remainder. Combined, the exposed records represent roughly one-fifth of DHS's reported headcount of 222,538, according to the DOGE website. CISA records were pulled from the public-facing search results but remain in the underlying dataset.


The Icepick tool

Crimew, who faces a U.S. federal indictment tied to prior leaks, built a searchable interface called "Icepick" and hosted it at icepi.cx. The domain registrar pulled the site down shortly after launch. DDoSecrets responded by releasing the tool's source code publicly. By Thursday morning, the searchable site was offline, but the data itself continued to circulate.

DDoSecrets co-founder Emma Best said the dataset extends well beyond contact information. The records, she wrote, identify officials overseeing covert and undercover operations, the government's internal effort to track down leakers, and the now-defunct BlueLeaks investigation. Crimew described it as "a complete game changer for anyone investigating DHS" and said it "provides FOIA material for years to come."

Ryan Shapiro of Property of the People, a government transparency organization, offered a narrower read, noting that staff contact information could prove useful for Freedom of Information Act requests.


Okta in the spotlight

The Department of Peace claimed the data came from an Okta single sign-on service used internally at DHS. Okta said it reviewed the report and found no evidence that its systems or data had been affected.

That denial has not fully closed the question. CyberScoop verified that numerous active CISA employees appear in the dataset alongside former agency leaders who left government years ago. The records also reference internal groups tied to COVID-19 planning and a 2023 internal summit, suggesting the data spans multiple years and may reflect sustained access rather than a single point-in-time pull.

Bluesky moved to block links pointing to the leaked data and flagged them as malicious, according to WIRED. The speed with which journalists and researchers confirmed active employees in the dataset drew particular concern, given that portions of the records appear to touch on undercover personnel.


A pattern of DHS breaches

This is not the first substantial data exposure tied to DHS. In 2014, a breach potentially affected as many as 390,000 current and former employees, applicants, and contractors. In 2018, the department notified nearly 250,000 people after another incident. Earlier this year, security firm GitGuardian found a publicly accessible GitHub repository containing credentials for privileged AWS GovCloud accounts and internal CISA systems, with the exposure dating back to at least November 2025.

Last month, the hacking group ShinyHunters published a separate spreadsheet containing records on roughly 5,000 alleged FBI employees, including home addresses and emergency contacts, framing that release as retaliation for an FBI advisory about the group.

DHS confirmed it is investigating the current incident. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," as mentioned by a spokesperson, adding that the department would release further details as they became available. DHS did not respond to additional requests for comment by publication time.



Read more »
Ransomware
Data Breach energy company France GDPR Ransomware

French Energy Giant ENGIE Hit by Data Breach, Customer Records Accessed Through Partner Platform

 


ENGIE, one of the world's largest energy companies, has notified customers in France that an unauthorized third party accessed their personal data through a marketing platform used by the company's business partners, the company confirmed this week.

The breach notification letters, dated October 23, went to affected customers after ENGIE said it detected "unusual data access activity" on the partner tool. The company has not stated exactly when the intrusion took place or how long the attacker had access before it was caught.

According to the notifications, the data the intruder obtained includes customers' first and last names, mailing addresses, email addresses, and phone numbers. It also includes two types of energy infrastructure identifiers specific to the French grid: the Delivery Point identifier (PDL) and the Metering and Estimation Point identifier (PCE). Both codes are tied to a customer's physical connection to the gas and electricity supply network. Customer IDs and contract numbers were also taken.

ENGIE said no banking data was involved, and that the breach was confined to the partner-facing marketing platform rather than any of its internal systems. The scope of the incident is currently limited to its French customer base, though the company has not said how many customers received notifications.

"We have cut off the attacker's access to the platform, notified the relevant authorities, and are directly informing each affected customer," the company said in a statement.

Customers were advised to stay alert to unsolicited contact and potential phishing attempts in the wake of the exposure.

No ransomware group or extortion actor had publicly claimed responsibility for the breach at the time of publication.


A Company With a Recurring Target on Its Back

ENGIE operates across 30 countries, employs more than 90,000 people, and posted €71.9 billion in revenue last year. Its scale across utilities, renewables, and energy infrastructure makes it a high-value target for threat actors looking for customer data at volume.

This latest breach is not the first time attackers have made it inside ENGIE's wider corporate ecosystem. Approximately a year ago, the Scattered LAPSUS$ Hunters group claimed it had breached a Salesforce instance belonging to Engie Records, the retail energy subsidiary of ENGIE North America, and leaked records from the intrusion. Engie Records appeared on the group's leak site as the 27th of 39 organizations allegedly hit through the same Salesforce-related campaign, with around 3GB of data listed.

Before that, in August 2023, a separate incident affected roughly 110,000 French ENGIE customers. In that case, a hacker known online as "HommedeLombre" reportedly got into ENGIE's systems through an external contractor's network, a technique also used in the Pôle Emploi breach around the same period. That attacker exposed names, email addresses, and phone numbers, and later said the intrusion was meant to demonstrate that "nothing is ever secure," citing rising gas prices as a grievance. ENGIE filed a complaint with authorities following that incident and said it had brought the affected system under control.

If we look closer to understand the link here, the three incidents point to a recurring problem: ENGIE's data, whether held by internal systems, subsidiaries, or third-party partners, keeps ending up in attackers' hands.


Why Energy Sector Customer Data Is Valuable

The combination of contact information and energy-specific identifiers like PDL and PCE codes makes the stolen data more useful to attackers than a standard contact list. Those codes link a name and address to a specific gas or electricity metering point in the French national grid, which means the data could be used to convincingly impersonate ENGIE in phishing campaigns or to target customers with fraudulent offers around energy billing or contracts.

France's energy market also went through a turbulent period of price volatility in recent years, which means many customers have been actively comparing suppliers and receiving legitimate outreach about tariff changes. That context makes it easier for fraudsters to craft believable messages that reference contract numbers, delivery point details, and billing information, exactly the kind of data now in circulation.

ENGIE said it has notified the relevant authorities, as required under GDPR. French data protection rules mandate that breaches of personal data be reported to the CNIL, the national data protection authority, within 72 hours of detection, and that affected individuals be notified without undue delay when the breach poses a risk to their rights and freedoms.

As of now, ENGIE has not attributed the breach to any specific threat actor, and it is unclear whether the platform through which the data was accessed belonged to an external vendor or an internal partner system. The investigation appears to be ongoing.



Read more »
Warp Breach
Agent Logs AI Security Data Breach Telemetry Exposure Warp Breach

Warp Breach Exposes AI Agent Logs and Telemetry

 

Warp has disclosed a security incident involving a third party infrastructure vendor that exposed AI agent decision logs and user telemetry. Chief executive Zach Lloyd estimated that approximately 1% of users could be affected, while emphasizing that the investigation remains ongoing. The disclosure identifies an exposure of operational records rather than establishing a compromise of every component in Warp’s development environment. The vendor, initial access mechanism, affected infrastructure components, and precise data boundaries have not been publicly identified, limiting independent assessment of the incident. 

Warp combines terminal functionality, a code editor, task orchestration, and agent activity review within an agentic development environment. Developers use its AI agents to generate code, execute tests, and deploy software. Consequently, agent traces and telemetry represent records associated with automated development workflows, although their exact contents vary with implementation. Warp reports at least 800,000 users, but its preliminary estimate of affected users does not establish the number of exposed records, compromised sessions, or affected organizations. Those measurements describe different dimensions of a security incident.

According to Lloyd, Warp detected what it believed was active, narrowly targeted exploitation of an infrastructure vendor on Friday and intervened within hours. The company described an attacker operation involving an “agent swarm,” sophisticated penetration techniques, and privilege escalation. However, the disclosure does not provide enough technical detail to reconstruct the attack chain or verify individual exploitation stages. No publicly identified vulnerability, authentication bypass, compromised identity, or execution mechanism has been specified. Claims about particular exploit classes would therefore exceed the available evidence. 

The exposed data categories were agent traces and telemetry. Warp has not established publicly whether these records included source code, user prompts, credentials, or other sensitive content. This uncertainty prevents a definitive assessment of confidentiality impact or potential secondary compromise. Exposure of operational logs should not automatically be equated with theft of API keys or unauthorized access to customer repositories. Warp notified identified affected users, informed the vendor, engaged CrowdStrike to assist with investigation, and contacted law enforcement. Further findings are needed to establish scope. 

A separate incident involving AI coding platform OpenCode illustrates why data classification matters when comparing breaches. That compromise exposed stored API keys for external providers, affected approximately 1.4% of users, and resulted in unauthorized charges reaching $1,700 for some victims. Equivalent credential exposure or financial abuse has not been established for Warp. The technical questions remain which records were accessible, what sensitive fields they contained, and how vendor access enabled their exposure. Until those details emerge, conclusions about downstream exploitation must remain provisional.
Read more »
Times Car
Data Breach driver's license details Japan Park24 personal data Times Car

Japan's Largest Car-Sharing Service Exposes 6.6 Million Accounts in Serious Data Breach

 



Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging to more than 6.6 million current and former members of Japan's largest car-sharing service. The final investigation report, released October 23, puts the incident among the most serious personal data exposures Japan has seen in recent years, with identity documents at the center of the damage.

The stolen data covers names, home addresses, dates of birth, phone numbers, email addresses, and driver's license details for 6,628,007 accounts. For 1,464,800 of those accounts, attackers transmitted encrypted images of identity documents outside the company's systems. Those images included driver's licenses, utility bills used to verify home addresses, student IDs from people enrolled in student plans, and family verification documents for members on family plans. Another 891,602 account holders had their images accessed but not transmitted. In total, roughly 2.36 million identity document files were touched in some form.

  • 6.6M: Accounts with personal data accessed
  • 1.46M: ID document images transmitted out
  • ¥5.5B: Projected special loss
  • 64K: Potential class-action claimants

Attackers entered through a vulnerability in the Times Car web application and used what they found there to navigate into the company's underlying database and file storage. Park24 has not named the specific flaw or described the compromised architecture, saying only that the confirmed access path is closed and that systems built the same way were reviewed afterward. The breach was detected at 9:07 a.m. on September 25. By the following morning, the attacker's communication route was cut off.

Times Mobility's Times Club loyalty program was accessed in the same incident. That system contributed 135,436 linked service IDs, 19,510 Times Club card numbers, and the last four digits of 28 credit cards to the exposure. Park24 said it does not store full card numbers or security codes in either system. Four hashed passwords were also transmitted, though the company described them as stored "in a form that cannot be restored."

The financial toll has been significant. Park24 projected a 5.5 billion yen special loss and cut its full-year net profit forecast by 12.5 percent. The company plans to pay 3,000 yen per person, in cash or vouchers, to each of the 1.46 million customers whose encrypted ID images left the system. Daily sales have since returned to pre-incident levels, though the company acknowledged that membership numbers dropped in the immediate aftermath of the disclosure.

A Japanese attorney opened a plaintiff intake site on September 30, and by October 7, roughly 64,000 people had registered as potential claimants. No lawsuit has been filed yet, but the figure is unusually high by the standards of Japan's data-privacy litigation history.

Regulators moved across several agencies. The National Police Agency issued guidance on October 8, warning businesses to tighten identity verification and alerting the public to impersonation scams. The Financial Services Agency followed the next day, asking banks and financial firms to stop accepting uploaded ID photos for account verification ahead of the April 2027 legal deadline and to read IC chips from physical documents instead. Japan's transport ministry instructed the Japan Rental Car Association to survey its members on data protection practices and report back by October 30.

"A reissue is not something that lets you feel safe." [Police official, quoted by Asahi Shimbun, on driver's license replacement]

One consequence without much precedent in Japanese data-protection cases has been a wave of driver's license reissue requests. Because license numbers and photographs are permanent identifiers, prefectural public safety commissions began accepting applications for replacements under the Road Traffic Act. By October 10, at least 16 prefectures, including Aichi, Hiroshima, Miyagi, and Niigata, were processing applications. A reissued license carries a new number and photograph but does not change the holder's name, address, or date of birth, which limits how much protection it actually offers.

Times Mobility changed its retention practices on October 16, announcing it would delete ID images once a registration check is complete for current members and would no longer keep images of former members at all, reversing a policy of retaining them for seven years. The company had cited identity verification needs and the Corporation Tax Act as justification for the extended retention, though tax law does not require keeping license images. All existing images are scheduled for deletion by the end of October.

Times Mobility has held Japan's Privacy Mark certification from JIPDEC since 2021, valid through August 2027. JIPDEC received the incident report and asked for a prompt investigation; its options include issuing a recommendation, suspending the mark, or revoking it.

The breach arrived during a period of rising unauthorized access across Japan. The National Police Agency recorded more than 7,190 such cases in 2025, more than four times the 2021 figure. Nippon Rent-A-Car disclosed a separate intrusion the same week affecting 96 members across two access events, though neither company has suggested any connection between the incidents.

Anyone who ever registered with Times Car, including those who never finished sign-up, should treat their information as having been accessed. The company has said it will never request passwords, SMS codes, or card PINs by phone or message. Its official fraud hotline is 0120-25-8924.


Read more »
railway
API Keys Cloud Platform Data Breach Developers GitHub openAI private credentials railway

Railway Tells 4.8 Million Users to Rotate Secrets After Possible Breach of Environment Variables







Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents.

The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway.

"We strongly recommend that you immediately roll all environment variables, including any API keys."
[Railway, Security Disclosure — October 21, 2026]

By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window.

Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud.

That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet.

What Railway Users Should Do Now
  • Rotate all environment variables stored on Railway, including API keys for every third-party service.
  • Rotate private container registry credentials.
  • Review service logs for any unusual or unauthorized activity since October 21.
  • After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window.
  • Reconnect GitHub integrations if they were created after the freeze began.
Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments.

For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not.

Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.


Read more »
User Security
Data Breach Medical Data Patient Records Quest Diagnostics User Security

Quest Diagnostics Reports Cyber Breach Affecting Patient Records

Quest Diagnostics has disclosed a cyber breach involving its Quanum Lab Services Manager platform, which doctors and other clients use to order tests and access laboratory results. The medical testing company said it discovered unauthorized access on Wednesday and believes that certain patient records were likely accessed, although the exact number of affected people and the specific data exposed remain unknown. 

In a regulatory filing on Thursday, Quest said it had launched cybersecurity incident-response procedures to contain the activity and investigate the breach. The company also notified federal law enforcement and engaged external cybersecurity specialists to support its response. Quest has not said whether the attackers obtained names, contact details, test results, insurance information, or other sensitive health data. 

The incident is significant because the Quanum platform sits at the centre of clinical workflows for some healthcare providers. It allows authorised clients to place test orders and receive or review patient results, meaning a compromise could expose information that is both personal and medically sensitive. Quest said the breach has not materially disrupted its core operations or its ability to serve patients, but the company has paused access to the affected system while it investigates. 

This is not the first time Quest Diagnostics has faced a major data-security incident. In 2016, the company said an online breach exposed lab results and contact information for about 34,000 people. In 2019, personal information belonging to roughly 11.9 million Quest patients was affected through a separate hack at American Medical Collection Agency, a billing collections provider. The latest case is notable because Quest has identified unauthorized access directly within one of its own systems rather than through a third-party vendor. 

The breach comes amid a wider rise in cyberattacks affecting healthcare and other essential industries. Quest confirmed to The Associated Press that this incident was not related to the recently disclosed PHP vulnerabilities that have prompted urgent security patches across much of the internet. For patients and healthcare providers, the case highlights the need for strong access controls, rapid breach detection, and clear communication when medical data systems are targeted. Until Quest completes its investigation, affected individuals should remain alert for suspicious emails, calls, or messages that request personal or medical information.

 

Read more »
Server
AI Server Security Cloud Breach Data Breach desktop Server

Onamae Desktop Cloud Breach Raises Server Security Concerns


Japan’s Onamae Desktop Cloud Hacked, Up to 27,000 Servers Affected The Onamae Desktop Cloud, operated by GMO Internet, a virtual private server (VPS) provider in Japan, has experienced a security breach which resulted in malicious software being installed on as many as 26,739 servers of customers. While investigating the intrusion and assessing the potential impact on customer data, the company has suspended its cloud hosting services. 


The GMO Internet team confirmed the incident on October 20, stating that unauthorized third parties gained access to Onamae.com Desktop Cloud and installed malicious software in some customer environments. In response, the company began progressively shutting down affected customer servers from 4:00 a.m. local time on October 21, 2026. 

All Desktop Cloud plans will be affected, but no time frame has been announced for the restoration of service. A detailed description of how the attackers gained access, what type of malware was deployed, and whether the intrusion affected environments other than those identified as customer environments has not yet been disclosed by the company.

Customer Data Potentially Exposed

A concern has been raised regarding the confidentiality of information stored on the affected servers. According to GMO Internet, customer information held in compromised environments may have been exposed. However, to date, the company has not confirmed any instances of data theft, leakage, or misuse.

In the company's clarification, payment information, including credit card details, is not affected since it is stored on separate infrastructure. Further details are expected as the investigation progresses. It has been advised that customers who stored sensitive information on their servers, including passwords and other credentials, should change them as soon as possible. It is possible that such information may have been accessed during the intrusion.

In addition to cautioning customers about potential phishing attempts and unsolicited communications related to this incident, GMO Internet has also warned them against fraudulent communication designed to obtain account credentials or other sensitive information during the breach. Onamae.com emphasizes that they will not be asking for passwords or credit card information via email or telephone. 

The company is one of the largest domain registration providers in Japan, offering web hosting, DNS and other internet infrastructure services as well. Desktop Cloud byGMO supports virtual server workloads, including MetaTrader 4 for automated foreign exchange trading. Several customer-hosted environments are being scrutinized following this incident, as well as the potential consequences of unauthorized access to cloud infrastructure. 

An investigation is currently underway, and it is unclear what the extent of the compromise and how it was accomplished. Neither the company nor its subsidiary has provided technical information about the intrusion, including the malware family, initial access method, or attacker's identity. There have been no public indications of compromise, such as malicious IP addresses, domains, file hashes, or filenames, that indicate a compromised system. 

The available information does not provide information about whether the attackers exploited vulnerabilities, stolen credentials, or used another technique to access the infrastructure. This disruption may have implications beyond the immediate disruption of service, particularly for customers who use the platform to run automated foreign exchange trading software. 

While the provider investigates the incident and works to restore operations, businesses and individual users may face interruptions while servers are taken offline across all plans. The company has requested that customers update their authentication details, including their account IDs and passwords, stored on the affected servers. It is important to change passwords for other services that were reused to reduce the risk of unauthorized access if credentials were exposed during the breach.

In addition to the company's warning about phishing, cybercriminals may use the incident to send fraudulent messages masquerading as service notifications or technical support requests. Cybercriminals may also utilize the incident to conduct follow-on attacks. It is recommended that customers verify communications through official channels and not share login information when responding to unsolicited requests for the time being. 

The full extent of the incident remains unclear at this time, although 26,739 servers have been identified as potentially infected, but this figure does not indicate that every server has been infected. There have been no confirmed instances of customer information being leaked or misused by the company. As part of the investigation, it is anticipated that details will be disclosed regarding how the attackers entered the environment, what malicious programs were intended to accomplish, and whether any customer data was accessed or removed. 

While more information about the incident is awaiting release, it remains a significant security concern for users who rely on Onamae Desktop Cloud for hosting and other online services.
Read more »
SBI
Customer Data Dark Web Data Breach Data Leak SBI

SBI Probes Suspected Exposure of 3,897 Customer Records

 

State Bank of India (SBI) is investigating a suspected data exposure after identifying personal information in 3,897 customer records reportedly found on the dark web. The country’s largest lender said it received alerts about the issue last week and has initiated cyber incident response procedures. The bank has also appointed an independent cybersecurity agency to assess the suspected compromise and determine the source, scope, and potential impact of the exposure. 

According to SBI’s October 21 stock-exchange filing, the bank first received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). Its initial review covered around 375,000 records found on the dark web. Of these, 3,897 records were found to contain personal customer information. SBI is now verifying whether the exposed records are genuine and complete, while also attempting to trace their origin and assess the risks for affected customers and the bank. 

The exposed records reportedly included customers’ names, dates of birth, gender, registered mobile numbers, email addresses, and home addresses. They also contained branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records. Although the information does not appear to include banking passwords or transaction credentials, personal and loan-related details can still be misused for phishing, identity fraud, targeted scams, and social-engineering attacks. 

SBI said it activated its cyber incident response and containment procedures after receiving the alerts. The bank has engaged a CERT-In-empanelled independent cybersecurity agency to investigate the matter and is working on remedial and preventive measures in line with regulatory requirements. SBI added that it is continuing to monitor the situation and will take appropriate steps to prevent similar incidents in the future. 

The bank has sought to reassure customers that the incident has not materially affected its financial performance, core business operations, or ability to continue services. Core banking functions are reportedly running normally, with no disruption reported. However, customers should remain cautious: avoid clicking unexpected links claiming to be from SBI, never share OTPs, passwords, or card details, and verify suspicious communications directly through the bank’s official app, website, or customer-care channels. The investigation is ongoing, and further clarity is expected once SBI confirms whether the dark-web data is authentic and identifies how it was exposed.
Read more »
Zeabur Shutdown
Cloud Hosting Security Cloud Security Data Breach Environment Variables Exposed Credentials Zeabur Security Breach Zeabur Shutdown

Second Zeabur Breach Exposes Cloud Infrastructure Weaknesses


Zeabur, a cloud development platform, has announced plans to shut down their services following a second major security breach in less than two months. A malicious attack occurred on October 14-15, 2026, which resulted in unauthorized access to internal systems, compromised hosting infrastructure, and the reading of sensitive information belonging to more than 321,000 accounts. 

As stated by Zeabur's preliminary incident report, the attacker was able to gain access to shared hosting clusters in nine regions as well as several dedicated servers by using leaked administrator credentials and cloud access keys. An internal configuration repository contained plaintext credentials, and administrator tokens were still active without expiration and had not been rotated since January 2024. 

Approximately 3.2 million environment-variable records including application settings, API keys, and other secrets were exposed in the breach, along with account information for 321,810 users. Zeabur further confirmed that 92 Google Cloud Platform (GCP) servers were accessed unauthorizedy by root accessers. In addition to adding their own SSH keys to 50 servers, hackers attached 16 copies of customer server disks to virtual machines that were under their control with their own SSH keys. 

During the investigation, records indicate that the attacker compromised both shared infrastructure as well as dedicated servers, and gained access to the production database through their internal network. Insufficient audit logs, Zeabur observed, prevent the full extent of data exposure from being confirmed. The attacker read service configurations, searched for API keys, and accessed data within hundreds of database services. 

Security Failures Linked to Earlier Breach

A separate security breach occurred in August 2026, when attackers exploited a vulnerability in the NextChat application of a customer, then migrated through internal systems that were insufficiently isolated. 

In the incident, Amazon Web Services credentials, API keys, and other sensitive information were exposed Zeabur believes the credentials used in the latest attack may have been obtained during the earlier breach, although a connection has not been confirmed. In its August response, the company acknowledged that not all affected credentials were addressed, resulting in the activation of certain administrator tokens and cloud keys.

As part of the investigation, the investigator identified public administrator interfaces, plaintext storage of sensitive credentials, and excessive cloud permissions as factors contributing to the severity of the attack. 

The attack began on October 14, but was only identified following a user report on October 15. In response to discovery, the company revoked compromised access tokens and cloud keys, blocked public SSH access to affected GCP servers, and restricted internal access to internal systems. 

Users have been advised to replace passwords, API keys, and other secrets, revoke existing sessions, and rebuild compromised servers. There is also concern about the security of shared cloud hosting environments following the breach, which can expose multiple customer workloads with only a single compromised set of credentials. 

Zeabur's shutdown program will commence on December 1, when renewals are disabled and services running on shared clusters are paused. However, all remaining infrastructure is scheduled to cease operation by December 31, 2026, despite remaining dedicated servers remaining available until their respective expiration dates.

As the company has not yet provided a final date for data export or deletion, customers who need additional time to migrate their data are advised to contact customer service for further assistance. During the investigation, Zeabur also revealed gaps in its monitoring and incident response systems. It took 36 hours for the investigation to begin after the attacker's first known use of credentials on October 14 was revealed.

During that time, no alerts were triggered; a user report was the cause of the investigation. A two-part attack converged within Zeabur's internal network as the attacker gained access to shared clusters and Google Cloud servers managed by customers. The attacker is believed to have acquired root passwords stored in plaintext in server initialization settings by using an older Google Cloud key.

It was then the attacker's responsibility to add SSH keys to 50 servers to maintain access, as well as attach copies of customer disks to virtual machines within Zeabur's own cloud project. These disk copies have since been deleted by Zeabur, which believes the credentials used in October were obtained during the August incident, during which an attacker accessed Zeabur's GitHub private key. 

With that key, access was granted to code repositories, including a private repository containing the exposed credentials and administrator tokens. Despite Zeabur replacing the GitHub App key on August 31st, the credentials stored in the repository were not altered, making it possible to retrieve previously copied secrets. 

There is no evidence of a direct connection between the two incidents, nor did the IP addresses of the attackers overlap. All users were notified that Zeabur has revoked their access tokens in response to the latest security breach. Customers were advised to replace credentials and secrets stored on the platform, including those changed after the August incident, and to re-create their access tokens. 

The owners of affected Google Cloud servers were also advised to make a backup of their data and rebuild their systems to prevent any unauthorized access remaining. Following 3.5 years of growth, the company decided to close after citing increasing operational complexity and difficulty maintaining its platform as factors. 

As a result of these two breaches, credential management, infrastructure isolation, and security monitoring vulnerabilities were also exposed, raising concerns concerning the potential risks associated with maintaining sensitive deployment secrets across shared cloud environments. Zeabur's incidents highlight the risks associated with unrotated credentials, publicly exposed administrative interfaces, and inadequate security monitoring in cloud computing facilities. 

A shutdown like this also emphasizes the importance of securing resources, managing secrets securely, and detecting incidents promptly in order to ensure that customer data is protected.
Read more »
Student Data Security
Compromised Login Credentials Data Breach Education Cybersecurity identity theft protection Personal Information Exposure Student Data Security

Millions of Student Records Exposed After a Single Login Is Compromised


An educational assessment management company, Educational Testing Service (ETS), has disclosed personal information about millions of current and former California public school students as a result of a data breach. 

A secure file transfer system has been accessed by an unauthorised individual, using compromised login credentials, and files containing student records have been copied by that individual. During the early morning hours of September 25, 2026, ETS noticed suspicious activity on its secure file transfer protocol server (SFTP), resulting in the discovery of the incident.

A CDE report indicates that multiple instances of unauthorised access occurred between May 22 and September 18, allowing the attackers to gain access to student information for several months before the incident was discovered. It is not known how many individuals were affected by the breach. 

The compromised records, however, contain information about all students registered in California schools over the past three years, and the potential impact extends to students whose records date back to 2006. As of the 2025–2026 academic year, California reported more than 5.7 million students enrolled in its public schools, suggesting that the incident may be of a large scale. This information includes names, dates of birth, home addresses, school and district details, grade levels, and state or local identification numbers for students. 

There may also be information regarding gender, race, ethnicity, primary language, country of origin, and English learner status included in the records. A variety of sensitive educational information, including information regarding disabilities, accommodations for testing, English proficiency, and assessment results, may also be accessed. 

Education databases are under considerable threat from security breaches and compromised credentials pose a number of risks. Although the attacker reportedly used one compromised login to access the system, the breach affected student records maintained by a third-party service provider responsible for handling sensitive student information. Additionally, students with school records going back more than three years are affected by the breach. 

A California Department of Education representative stated that former students who left public schools as early as 2006 may also be affected if their transfer to another school has not been confirmed. Neither the department nor the Department of Education have released a final number of victims, and the information exposed varies from individual to individual. 

Social Security numbers, passwords, financial account information or payment card information were not contained in the stolen records. However, exposing disability-related information, demographic details, and academic results presents privacy concerns, particularly since these records are based on minors. Following the discovery, ETS disabled the account used to access the files and took the SFTP site offline. 

In order to strengthen security, a replacement system is being developed by the organization. Moreover, it has enhanced its monitoring processes, tightened access controls, and arranged additional third-party reviews of its security practices. However, the company has not disclosed how the login credentials were compromised nor identified the attacker. In order to limit the risk that the stolen information might become publicly accessible, ETS has worked with law enforcement and cybersecurity specialists. 

There has been no evidence of the files being published online as of yet, however, the absence of such confirmation does not imply that the data has been deleted or that it will not be abused later. In addition to disrupting education-related operations, ETS suspended routine enrollment processing and paused certain assessment activities while security checks were conducted on its systems.

In a statement issued by the California Department of Education, it stated that it was working to restore affected services and minimize disruption to schools and assessment programs. On October 16, 2026, notification will begin for affected students and families, and will continue throughout early November. In addition to two years of free identity protection services, eligible current and former students can be enrolled by parents or legal guardians. 

There is an increased risk associated with relying on third-party providers to handle large volumes of sensitive educational information, as highlighted by this breach. Although the initial access was linked to compromised credentials rather than a publicized software vulnerability, the incident demonstrates the difficulty in preventing unauthorised activity from occurring when access controls and monitoring fail to prevent access to extensive records. 

It illustrates the potential threats associated with compromised credentials and inadequate access controls in systems that handle sensitive student information. Stronger authentication, continuous monitoring, and regular security reviews remain important in order to protect educational data and prevent similar incidents from occurring again.
Read more »
Subscribe to: Posts (Atom)