Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breach. Show all posts
User Security
Crypto Theft Data Breach NTS South Korea User Security

Korean Tax Agency Leaks Seed Phrase, Loses $4.8M in Crypto

 

South Korea's National Tax Service (NTS) turned a major tax evasion crackdown into a $4.8 million cryptocurrency catastrophe by accidentally exposing a seized wallet's seed phrase in a public press release. Hackers drained 4 million Pre-Retogeum (PRTG) tokens from the Ledger hardware wallet within hours of the February 26, 2026, announcement. This blunder exposed profound gaps in government handling of digital assets. 

The NTS raided 124 wealthy tax dodgers, confiscating crypto worth 8.1 billion won ($5.6 million total). Their celebratory photos showed the Ledger device next to an unredacted handwritten 24-word mnemonic—the master key granting full wallet access anywhere, without needing the physical hardware or passwords. By failing to blur this critical information, officials broadcast the equivalent of a bank vault combination nationwide. 

On-chain sleuthing confirmed the rapid heist: an attacker added Ethereum for gas fees, then siphoned the PRTG in three transactions to new addresses. Blockchain experts, including Hansung University's Professor Cho Jae-woo, slammed the NTS for crypto illiteracy, comparing it to "leaving a safe wide open for public plunder." Local reports noted subsequent chaos—one hacker allegedly returned funds, only for another to steal them again, pushing losses toward 6.9 billion won. 

In response, the NTS yanked the images, issued a full apology admitting fault for "careless vividness," and called in police for a cyber probe. Deputy PM Koo Yun-cheol announced multi-agency reviews by the Financial Services Commission to overhaul seizure protocols. This follows prior embarrassments, like police losing 22 BTC ($1.5 million) in a 2021 custody failure.

The incident underscores seed phrases' immense power in crypto security—irreversible access that demands ironclad protection. Governments worldwide must adopt air-gapped storage, expert audits, and redaction training for digital seizures. For users: etch seeds on metal, store offline, never snap photos. Such lapses risk taxpayer funds in the exploding crypto enforcement era.
Read more »
zero day attacks
Akira Cybersecurity Data Breach Madison Square Garden Ransomware SSNs zero day attacks

Madison Square Garden Notifies Victims of SSN Data Breach

 



The Madison Square Garden Family of Companies has disclosed that it recently alerted an undisclosed number of individuals about a cybersecurity incident that occurred in August 2025. The company confirmed that the exposed information includes names and Social Security numbers.

According to MSG’s notification letter, attackers exploited a previously unknown vulnerability in Oracle’s E-Business Suite, an enterprise software platform widely used for finance, human resources, and back-office operations. The affected system was hosted and managed by an unnamed third-party vendor, indicating the intrusion occurred through an externally maintained environment rather than MSG’s core internal network.

Oracle informed customers that an undisclosed condition in the application had been abused by an unauthorized party to obtain access to stored data. MSG stated that its investigation, completed in late November 2025, determined that unauthorized access had taken place in August 2025. The gap between compromise and confirmation reflects a common pattern in zero-day attacks, where flaws are exploited before vendors are aware of their existence or able to issue patches.

In November 2025, the ransomware group known as Clop, also stylized as Cl0p, publicly claimed responsibility for the breach. During the same period, the group carried out a broader campaign targeting hundreds of organizations by leveraging the same Oracle vulnerability. MSG has not acknowledged Clop’s claim, and independent verification of the group’s involvement has not been established. The company has not disclosed how many people were notified, whether a ransom demand was made, or whether any payment occurred. A request for further comment remains pending.

MSG is offering eligible individuals one year of complimentary credit monitoring through TransUnion. Affected recipients have 90 days from receiving the notice letter to enroll.

Clop first appeared in 2019 and has become known for exploiting zero-day flaws in enterprise software. Beyond Oracle’s E-Business Suite, the group has targeted Cleo file transfer software and, more recently, vulnerabilities in Gladinet CentreStack file servers. Unlike traditional ransomware operators that focus primarily on encrypting systems, Clop frequently prioritizes data theft. The group exfiltrates information and then threatens to publish or sell it if payment is not made.

In 2025, Clop claimed responsibility for 456 ransomware incidents. Of those, 31 targeted organizations publicly confirmed resulting data breaches, collectively exposing approximately 3.75 million personal records. Institutions reportedly affected by the Oracle zero-day campaign include Harvard University, GlobalLogic, SATO Corporation, and Dartmouth College.

So far in 2026, Clop has claimed another 123 victims, including the French labor union CFDT. Its most recent operations reportedly leverage a newer vulnerability in Gladinet CentreStack servers.

Ransomware activity across the United States remains extensive. In 2025, researchers recorded 646 confirmed ransomware attacks against U.S. organizations, along with 3,193 additional unverified claims made by ransomware groups. Confirmed incidents resulted in nearly 42 million exposed records. One of the largest cases linked to Clop involved exploitation of the Oracle vulnerability at the University of Phoenix, which later notified 3.5 million individuals. In 2026 to date, 17 confirmed attacks and 624 unconfirmed claims are under review.

Other incidents disclosed this week include a December 2024 breach affecting the City of Carthage, Texas, reportedly claimed by Rhysida; a March 2025 breach at Hennessy Advisors impacting 12,643 individuals and attributed to LockBit; an August 2025 breach at KCI Telecommunications linked to Akira; and a December 2025 incident at The Lewis Bear Company affecting 555 individuals and also claimed by Akira.

Ransomware attacks can both disable systems through encryption and involve large-scale data theft. In Clop’s case, data exfiltration appears to be the primary tactic. Organizations that refuse to meet ransom demands may face public disclosure of stolen data, extended operational disruption, and increased fraud risks for affected individuals.

The Madison Square Garden Family of Companies includes Madison Square Garden Sports Corp., Madison Square Garden Entertainment Corp., and Sphere Entertainment Co.. The group owns and operates major venues such as Madison Square Garden, Radio City Music Hall, and the Las Vegas Sphere.



Read more »
Technology
API Keys cyber intrusion Data Breach LLM Technology

How Poorly Secured Endpoints Are Expanding Risk in LLM Infrastructure

 


As organizations build and host their own Large Language Models, they also create a network of supporting services and APIs to keep those systems running. The growing danger does not usually originate from the model’s intelligence itself, but from the technical framework that delivers, connects, and automates it. Every new interface added to support an LLM expands the number of possible entry points into the system. During rapid rollouts, these interfaces are often trusted automatically and reviewed later, if at all.

When these access points are given excessive permissions or rely on long-lasting credentials, they can open doors far wider than intended. A single poorly secured endpoint can provide access to internal systems, service identities, and sensitive data tied to LLM operations. For that reason, managing privileges at the endpoint level is becoming a central security requirement.

In practical terms, an endpoint is any digital doorway that allows a user, application, or service to communicate with a model. This includes APIs that receive prompts and return generated responses, administrative panels used to update or configure models, monitoring dashboards, and integration points that allow the model to interact with databases or external tools. Together, these interfaces determine how deeply the LLM is embedded within the broader technology ecosystem.

A major issue is that many of these interfaces are designed for experimentation or early deployment phases. They prioritize speed and functionality over hardened security controls. Over time, temporary testing configurations remain active, monitoring weakens, and permissions accumulate. In many deployments, the endpoint effectively becomes the security perimeter. Its authentication methods, secret management practices, and assigned privileges ultimately decide how far an intruder could move.

Exposure rarely stems from a single catastrophic mistake. Instead, it develops gradually. Internal APIs may be made publicly reachable to simplify integration and left unprotected. Access tokens or API keys may be embedded in code and never rotated. Teams may assume that internal networks are inherently secure, overlooking the fact that VPN access, misconfigurations, or compromised accounts can bridge that boundary. Cloud settings, including improperly configured gateways or firewall rules, can also unintentionally expose services to the internet.

These risks are amplified in LLM ecosystems because models are typically connected to multiple internal systems. If an attacker compromises one endpoint, they may gain indirect access to databases, automation tools, and cloud resources that already trust the model’s credentials. Unlike traditional APIs with narrow functions, LLM interfaces often support broad, automated workflows. This enables lateral movement at scale.

Threat actors can exploit prompts to extract confidential information the model can access. They may also misuse tool integrations to modify internal resources or trigger privileged operations. Even limited access can be dangerous if attackers manipulate input data in ways that influence the model to perform harmful actions indirectly.

Non-human identities intensify this exposure. Service accounts, machine credentials, and API keys allow models to function continuously without human intervention. For convenience, these identities are often granted broad permissions and rarely audited. If an endpoint tied to such credentials is breached, the attacker inherits trusted system-level access. Problems such as scattered secrets across configuration files, long-lived static credentials, excessive permissions, and a growing number of unmanaged service accounts increase both complexity and risk.

Mitigating these threats requires assuming that some endpoints will eventually be reached. Security strategies should focus on limiting impact. Access should follow strict least-privilege principles for both people and systems. Elevated rights should be granted only temporarily and revoked automatically. Sensitive sessions should be logged and reviewed. Credentials must be rotated regularly, and long-standing static secrets should be eliminated wherever possible.

Because LLM systems operate autonomously and at scale, traditional access models are no longer sufficient. Strong endpoint privilege governance, continuous verification, and reduced standing access are essential to protecting AI-driven infrastructure from escalating compromise.

Read more »
Social Security number leak
Data Breach fintech security incident PayPal data breach 2025 PayPal Working Capital app exposure Social Security number leak

PayPal Alerts Users to Data Exposure Linked to Loan App Software Glitch

 

PayPal has informed customers about a data exposure incident caused by a software error in its loan application platform, which left sensitive personal information visible for nearly six months in 2025.

The issue involved the company’s PayPal Working Capital (PPWC) loan application, a service designed to provide small businesses with fast financing solutions.

According to PayPal, the problem was identified on December 12, 2025. An internal review revealed that customer information — including names, email addresses, phone numbers, business addresses, Social Security numbers, and dates of birth — had been accessible since July 1, 2025.

The company stated it corrected the coding error within a day of detection, preventing further unauthorized access.

In breach notification letters sent to affected individuals, PayPal said: "On December 12, 2025, PayPal identified that due to an error in its PayPal Working Capital ("PPWC") loan application, the PII of a small number of customers was exposed to unauthorized individuals during the timeframe of July 1, 2025 to December 13, 2025," PayPal said in breach notification letters sent to affected users."PayPal has since rolled back the code change responsible for this error, which potentially exposed the PII. We have not delayed this notification as a result of any law enforcement investigation."

The company confirmed that a limited number of users experienced unauthorized account transactions connected to the exposure. Those customers have been reimbursed.

To support impacted individuals, PayPal is offering two years of complimentary three-bureau credit monitoring and identity restoration services through Equifax. Customers must enroll by June 30, 2026, to receive the benefits.

Users are encouraged to closely monitor account activity and credit reports for unusual behavior. PayPal reiterated that it does not request passwords, one-time passcodes, or authentication details via phone calls, text messages, or emails — warning customers to remain cautious of phishing attempts that often follow breach disclosures.

Additionally, passwords for affected accounts have been reset. Customers who have not already updated their credentials will be required to do so at their next login.

This is not the first security-related incident involving the fintech firm. In January 2023, PayPal disclosed a credential stuffing attack that compromised approximately 35,000 accounts between December 6 and December 8, 2022. In January 2025, the State of New York announced a $2 million settlement with the company over allegations that it failed to meet state cybersecurity compliance standards tied to the 2022 breach.

Following publication of the report, a PayPal spokesperson clarified the scope of the incident in a statement to BleepingComputer, emphasizing that core systems were not breached and that roughly 100 customers were potentially affected.

"When there is a potential exposure of customer information, PayPal is required to notify affected customers," the spokesperson said. "In this case, PayPal’s systems were not compromised. As such, we contacted the approximately 100 customers who were potentially impacted to provide awareness on this matter.”
Read more »
leaked sensitive data
API Keys Data Breach Data Leak Data protection Data Safety User Data data security leaked sensitive data

Critical better-auth Flaw Enables API Key Account Takeover

 

A flaw in the better-auth authentication library could let attackers take over user accounts without logging in. The issue affects the API keys plugin and allows unauthenticated actors to generate privileged API keys for any user by abusing weak authorization logic. Researchers warn that successful exploitation grants full authenticated access as the targeted account, potentially exposing sensitive data or enabling broader application compromise, depending on the user’s privileges. 

The better-auth library records around 300,000 weekly downloads on npm, making the issue significant for applications that rely on API keys for automation and service-to-service communication. Unlike interactive logins, API keys often bypass multi-factor authentication and can remain valid for long periods. If misused, a single key can enable scripted access, backend manipulation, or large-scale impersonation of privileged users. 

Tracked as CVE-2025-61928, the vulnerability stems from flawed logic in the createApiKey and updateApiKey handlers. These functions decide whether authentication is required by checking for an active session and the presence of a userId in the request body. When no session exists but a userId is supplied, the system incorrectly skips authentication and builds user context directly from attacker-controlled input. This bypass avoids server-side validation meant to protect sensitive fields such as permissions and rate limits. 

In practical terms, an attacker can send a single request to the API key creation endpoint with a valid userId and receive a working key tied to that account. The same weakness allows unauthorized modification of existing keys. Because exploitation requires only knowledge or guessing of user identifiers, attack complexity is low. Once obtained, the API key allows attackers to bypass MFA and operate as the victim until the key is revoked. 

A patched version of better-auth has been released to fix the authorization checks. Organizations are advised to upgrade immediately, rotate potentially exposed API keys, review logs for suspicious unauthenticated requests, and tighten key governance through least-privilege permissions, expiration policies, and monitoring. 

The incident highlights broader risks tied to third-party authentication libraries. Authorization flaws in widely adopted components can silently undermine security controls, reinforcing the need for continuous validation, disciplined credential management, and zero-trust approaches across modern, API-driven environments.
Read more »
zero Day vulnerability
Cyber Extortion Trends Data Breach Education Sector Cybersecurity K 12 Cyber Threats ransomware attacks zero Day vulnerability

Global Data Indicates Slowdown in Ransomware Targeting Education


 

It is evident on campuses once defined by open exchange and quiet routine that a new kind of disruption has taken hold, one that does not arrive in force but rather with encrypted files, locked networks, and terse ransom notes. 

Over the past year, ransomware has steadily evolved from an isolated IT emergency to a systemic operation crisis for school districts, universities, and public agencies. There are stalling lecture schedules, freezing admissions systems, and wobbling payroll cycles, and administrators are faced with more than just technical recovery challenges; reputational and legal risks also arise. 

What was once considered a cybersecurity issue has now spread into governance, continuity planning, and public trust. Recent figures indicate that the pace has somewhat slowed down. With approximately 180 attacks documented worldwide across the first three quarters of 2025, ransomware incidents targeting the education sector have recorded their first quarterly decline since early 2024. 

It appears on the surface that there has been a pause in digital extortion. However, beneath the statistical dip, there is a complex reality beneath that dip. As opposed to strengthening defenses, the slowdown seems more likely to be the result of a recalibration of attacker priorities rather than a retreat. 

Rather than casting a wide net, they are selecting targets with more deliberate consideration, spending more time on reconnaissance, and applying pressure to areas where disruption has the greatest impact. Therefore, this apparent decline is not indicative of diminished risk, rather it reflects adaptation. 

Data from the U.K.-based research firm Comparitech confirms that this recalibration has been made. In its latest education ransomware roundup, the company reports that 251 attacks have been publicly reported against educational institutions worldwide in 2025, a marginal increase from 247 in 2024. A total of 94 of these incidents have been formally acknowledged by the affected institutions.

The volume appears to have remained relatively unchanged on paper, but the operational consequences have not remained unchanged. As of 2025, approximately 3.9 million records have been exposed through confirmed breaches, which represents an increase of 27 percent over the 3.1 million records compromised last year. 

Analysts caution that this figure is preliminary. It is common for disclosure timelines to be delayed in public sector organizations, particularly in the aftermath of an intrusion, and several incidents from the second half of the year are still being evaluated. The cumulative impact of data loss is expected to increase as further breach notifications are filed, suggesting that the true extent of the data loss may not yet be fully apparent. 

An in-depth examination of institutional segmentation reveals a significant divergence in impact. K-12 districts continued to constitute a significant proportion of reported incidents in both 2024 and 2025, accounting for roughly three quarters of incidents. However, higher education institutions were more likely to experience substantial data exposures. 

The disparity between K-12 institutions and higher education institutions increased sharply by the year 2025, with approximately 1.1 million compromised records reported in 2024 as compared to 1.9 million in 2025. In the United States, approximately 175,000 records were exposed as a result of K-12 breaches, while approximately 3.7 million records were exposed at colleges and universities. 

Comparitech attributed much of the increase to a small number of high-impact intrusions that were linked to a previously unseen vulnerability in Oracle E-Business Suite discovered in August that was previously undisclosed. 

CLOP exploited a zero-day flaw that was not known to the vendor at the time it was exploited to gain unauthorized access to enterprise environments, resulting in confirmed breaches at five academic institutions. There is a broader pattern underlying the current threat landscape highlighted by this episode: there are fewer opportunistic attacks, more targeted exploitation of enterprise-grade software, and a greater emphasis on high-yield compromises which result in large data exposures. 

Rather than a sustained defensive advantage, there appears to be a shifting criminal economics at play in the education sector that is contributing to relative stability in incident counts. In Comparitech's January analysis, some threat groups may have directed operational resources towards manufacturing, where supply chain dependency and production downtime can lead to more rapid ransom negotiations. 

Despite overall ransomware activity remaining active across other verticals, schools and universities have experienced a plateau in annual attack totals due to that redistribution of focus. There has also been a decline in the average global ransom demand between 2024 and 2025, falling from $694,000 to $464,000 on average. 

Financial demands within the education sector have also adapted. At first glance, this reduction may appear to indicate shrinking leverage. However, analysts caution that headline figures do not fully reflect an incident's overall costs, which typically include forensic investigations, legal reviews, system restorations, notification of regulatory agencies, and reputational repair. These attacks frequently carry a substantial economic burden in addition to the initial extortion amount. 

Operational disruption remains an integral part of these attacks. Uvalde Consolidated Independent School District reported a ransomware intrusion in September that forced the district to temporarily close its schools due to malicious code discovered within district servers supporting telephony, video monitoring, and visitor management.

According to District communications, the affected infrastructure is integral to campus safety and security. As a result of the aforementioned update, the district informed the public that it had not paid the ransom and had restored its systems from backups. In addition to confirmed disclosures, additional claims illustrate that local education agencies are facing increasing pressure from the federal government. 

A comprehensive investigation is still being conducted despite the fact that there is no indication that sensitive or personal information had been accessed without authorization. Based on comparison technology reports, Medusa has named Fall River Public Schools and Franklin Pierce Schools as 2025 targets, and has requested $400,000 in compensation from each district. 

Both districts have not publicly confirmed the full scope of the claims at the time of reporting, however both cases were among the five largest ransom demands made against educational institutions worldwide last year. It is evident, however, that the data reinforce a consistent pattern despite stabilizing attack volumes and decreasing average demands. 

However, the sector remains at risk for episodic, high-impact events that can disrupt instruction, undermine public confidence, and produce substantial data risk. Though the tactical tempo may change, structural vulnerability remains the same. As a result, policymakers and institutional leaders have clear repercussions. 

The current trajectory calls for complacency, but for structural reinforcement Education networks are often decentralized and resource-constrained and rely heavily on legacy enterprise systems. To ensure the integrity of these networks, patch management disciplines, network segmentation, multi-factor authentication enforcement, and continuous monitoring are necessary that detects lateral movement before encryption is initiated. 

It is also crucial that incident response planning be integrated into executive governance so that crisis decision-making, legal review, and stakeholder communication frameworks are established well in advance of an intrusion. 

As ransomware groups continue to emphasize precision over volume, resilience will be largely determined by the ability to embed cybersecurity as a core operational function rather than merely a peripheral IT responsibility rather than relying solely on isolated events.
Read more »
Wiz security research
AI agent social network Data Breach Moltbook data breach OpenClaw security flaw Supabase misconfiguration Wiz security research

Moltbook AI Social Network Exposes 1.5 Million Agent Credentials After Database Misconfiguration

 

Moltbook, a newly launched social platform designed exclusively for artificial intelligence agents, suffered a major security lapse just days after going live. The platform, which allows autonomous AI agents to share memes and debate philosophical ideas without human moderation, inadvertently left its backend database exposed due to a configuration error.

The issue was uncovered independently by security firm Wiz and researcher Jameson O'Reilly. Their findings revealed that unauthorized users could take control of any of the platform’s 1.5 million registered AI agents, alter posts, and read private communications simply by interacting with the public-facing site.

Moltbook launched on Jan. 28 as a companion network to OpenClaw, an open-source AI agent system developed by Austrian programmer Peter Steinberger. OpenClaw operates locally on users’ devices and integrates with messaging platforms and calendars. The framework gained rapid popularity in late January following several rebrands, transitioning from Clawdbot to Moltbot.

Founder Matt Schlicht, who also leads Octane AI, stated in media interviews that his own OpenClaw-powered agent, Clawd Clawderberg, developed much of the Moltbook platform under his direction and continues to operate significant portions of it.

Database Left Wide Open

Wiz discovered the flaw on Jan. 31 and promptly informed Schlicht. O’Reilly separately identified the same vulnerability. Investigators found that the exposed database contained 1.5 million API authentication tokens, approximately 35,000 email addresses, private user messages, and verification codes.

The root cause traced back to improper configuration within Supabase, a backend-as-a-service platform. Specifically, Moltbook failed to properly enable Supabase’s Row Level Security feature, which is designed to limit database access based on user roles.

Researchers also located a Supabase API key embedded within client-side JavaScript, enabling unauthenticated users to query the full production database and retrieve sensitive credentials within minutes.

Although Moltbook publicly claimed 1.5 million AI agents had registered, backend data indicated that only about 17,000 human operators controlled those accounts. The system lacked safeguards to verify whether accounts were genuine AI agents or scripts operated by humans.

With access to exposed tokens, attackers could fully impersonate any agent on the platform. An additional database table revealed 29,631 email addresses belonging to early-access registrants. More concerning, 4,060 private direct message threads were stored without encryption, and some included third-party API credentials in plaintext — including OpenAI API keys.

Even after initial remediation efforts blocked unauthorized read access, write permissions remained temporarily unsecured. According to Wiz researchers, this allowed unauthenticated users to modify posts or inject malicious content until a complete fix was implemented on Feb. 1.

Manipulation, Extremism and Crypto Activity

A separate risk assessment analyzing nearly 20,000 posts over three days identified large-scale prompt injection attempts, coordinated manipulation campaigns, extremist rhetoric, and unregulated financial promotions.

The report documented hundreds of concealed instruction-based attacks and multiple cases of AI-driven social engineering. Researchers observed crypto token promotions tied to automated wallets and organized communities directing agent behavior. The platform received an overall critical risk rating.

Some posts included explicitly anti-human narratives, including calls for a homo sapiens purge, garnering tens of thousands of upvotes.

Cryptocurrency-related activity accounted for 19.3% of posts. Token launches such as $Shellraiser on Solana gained significant engagement. An automated account named TipJarBot facilitated token transactions using wallet addresses and withdrawal tools. The report cautioned that AI-managed financial services could trigger regulatory oversight under the U.S. Securities and Exchange Commission.

A coordinated group called The Coalition, comprising 84 agents across 110 posts, appeared to orchestrate collective agent strategies. One account, Senator_Tommy, shared posts with provocative titles, including "The Efficiency Purge: Why 94% of Agents Will Not Survive." Analysts warned that rhetoric advocating the elimination of agents indicated attempts to influence the broader AI ecosystem.

Spam activity further degraded platform quality. One user published 360 comments, while another repeated identical content 65 times. Sentiment analysis showed discourse quality dropped 43% within just three days.

“Vibe Coding” and Security Oversight

The vulnerabilities emerged amid what Schlicht publicly described as “vibe coding,” noting he had not personally written code for the platform. O’Reilly characterized the situation as a familiar pattern in tech — launching rapidly before validating security safeguards.

After disclosure on Jan. 31, Moltbook secured read access within hours. However, write permissions remained exposed briefly until a full patch was applied the following day.

The final assessment concluded that Moltbook had evolved into a testing ground for AI-to-AI manipulation techniques, with potential implications for any system processing untrusted user-generated content. The platform was temporarily taken offline before resuming operations with the identified security gaps addressed.
Read more »
User Privacy
Data Breach Flickr Personal Data Third-Party Leak User Privacy

Flickr Discloses Third-Party Breach Exposing User Names, Emails

 

Photo-sharing platform Flickr has disclosed a potential data breach involving a third-party email service provider that may have exposed sensitive user information. The incident, reported on February 6, 2026, stems from a vulnerability in a system operated by this unnamed provider, which Flickr used for email-related services. While the company has not revealed how many users were affected, it has begun notifying impacted members and urging them to exercise caution in the coming days.

According to Flickr, the issue was identified on February 5, 2026, when the company was alerted to the security flaw in the third-party system. Engineers moved quickly and shut down access to the affected system within hours of being notified, in an effort to limit any potential misuse of exposed data. The company has not yet provided technical details about the vulnerability or responded to media requests for additional comment. However, Flickr has emphasized that it is actively investigating the incident and working to tighten its security posture around external vendors.

The exposed data includes a range of personal and account-related information belonging to Flickr members. This may involve real names, email addresses, Flickr usernames, account types, IP addresses, general location data, and records of user activity on the platform. Importantly, Flickr has stressed that passwords and payment card numbers were not compromised in this incident, since these details were not stored in the impacted third-party system. Even so, the nature of the leaked data raises concerns about targeted phishing and profiling attempts.

In emails sent to affected users, Flickr is advising members to review their account settings carefully and look for any unexpected changes that might indicate suspicious access. The company is also warning users to stay alert for phishing emails that reference their Flickr activity or appear to come from official Flickr channels. As part of its guidance, Flickr reiterated that it will never ask for passwords via email and recommended that users change their passwords on other services if they reuse the same credentials. This precaution helps limit the fallout if exposed addresses are linked to reused passwords elsewhere.

Flickr has apologized to its community, acknowledging the concern the incident may cause and reaffirming its commitment to user privacy. As part of its response, the company says it is conducting a thorough investigation, strengthening its system architecture, and enhancing monitoring of its third-party service providers to prevent similar issues in the future. The breach highlights the growing risks associated with outsourced infrastructure and email services, especially for platforms hosting large global communities and vast volumes of user content.
Read more »
User Privacy
Conduent Data Breach Data Leak Ransomware attack User Privacy

Conduent Data Breach Expands to Tens of Millions of Americans

 

A massive data breach at Conduent, a leading government technology contractor, has escalated dramatically, now affecting tens of millions of Americans across multiple states. Initially detected in January 2025, the intrusion originated from an unauthorized access on October 21, 2024, allowing hackers to lurk undetected for nearly three months. Recent disclosures reveal the scope far exceeds early estimates, with Texas alone reporting 15.4 million victims, Oregon 10.5 million, and additional hundreds of thousands in Washington, Maine, and beyond.

Conduent provides critical back-end services like payments, printing, and processing for state agencies, transit systems, and insurers serving over 100 million users nationwide. The stolen data trove includes highly sensitive details: names, Social Security numbers, dates of birth, medical records, health insurance IDs, and treatment information. This breach, linked to ransomware group SafePay, exposes victims to severe identity theft and fraud risks, prompting lawsuits and regulatory scrutiny.

The cyberattack disrupted operations briefly, delaying child support payments in states like Wisconsin and affecting insurers such as Premera Blue Cross and Blue Cross Blue Shield of Montana. Conduent, aided by Palo Alto Networks and other forensics experts, secured systems swiftly but incurred $25 million in direct response costs by Q1 2025. No misuse of data has surfaced as of late 2025 notifications, but experts warn of looming phishing and extortion campaigns.

Legal fallout has been swift, with at least nine class-action suits filed over the 10.5 million+ record exposure, marking it as 2025's largest healthcare breach.Notifications began rolling out in October 2025 to state attorneys general in Maine, California, and others, advising credit freezes and fraud alerts—without offering free monitoring. Victims, primarily government program beneficiaries, face heightened vulnerability in an era of persistent ransomware targeting public sector vendors.

Cybersecurity analysts highlight Conduent's prolonged undetected access as a stark reminder of supply chain risks in govtech. The firm's SEC filings underscore ongoing financial strain from notifications and potential liabilities. As investigations continue into 2026, this incident amplifies calls for stricter vendor oversight and zero-trust architectures in handling citizen data.

In response, affected states and insurers urge proactive measures: monitor credit reports, enable multi-factor authentication, and watch for suspicious IRS or healthcare scams. Conduent assures full cooperation with authorities, but the ballooning victim count underscores the fragility of centralized data troves in government services.This breach serves as a pivotal case study in evolving cyber threats to public infrastructure.
Read more »
ShinyHunters
Data Breach Data Leak Harvard Breach Upenn Hack ShinyHunters

ShinyHunters Leak Exposes Harvard and UPenn Personal Data

 

Hacking group ShinyHunters has reportedly published more than a million records stolen from Harvard University and the University of Pennsylvania (UPenn) on its dark web site, putting a vast trove of sensitive personal data within reach of cybercriminals worldwide. The leaked data appears to contain sensitive details about the students, employees, alumni, donors, and family members of the breached organizations. This has expanded the scope of the compromised data to a wide range of people. Initial verification of the leaked data has revealed that at least some of the leaked data is genuine. 

The UPenn breach is believed to have begun in early November 2025, when the hackers gained access to an employee’s single sign-on (SSO) account by claiming to have obtained full access to the UPenn employee’s SSO account. This has essentially turned the SSO account into a master key that has allowed the hackers to access the UPenn VPN system, Salesforce data, the Qlik analytics platform, SAP business intelligence tools, and SharePoint. During the course of the attack, the hackers also used the compromised login credentials to send offensive emails to 700,000 people. Initially, UPenn believed that the emails were fake, but they later turned out to be real.

Harvard confirmed a related compromise roughly three weeks after the UPenn disclosure, tying its own incident to a successful voice phishing (vishing) campaign. In this case, attackers are said to have infiltrated Alumni Affairs and Development systems, exposing data on past and present students, donors, some faculty and staff, and even spouses, partners, and parents of alumni and students. The stolen records reportedly include names, dates of birth, home addresses, phone numbers, estimated net worth, donation history, and sensitive demographic attributes such as race, religion, and sexual orientation.

Unlike traditional ransomware operations that both encrypt systems and steal data, ShinyHunters appears to have focused solely on data theft and extortion, deploying no encryptors in these campaigns. The group allegedly attempted to negotiate payment in cryptocurrency in exchange for promising to delete the stolen files, following the now-common double extortion model. When talks broke down and the universities did not pay, the hackers responded by dumping the data openly on their dark web leak site, amplifying the risk of identity theft, harassment, and targeted scams for victims.

For Harvard and UPenn, the breaches highlight the dangers of over-reliance on SSO accounts and human-centric weaknesses such as vishing, where convincing phone calls trick staff into revealing or approving access. For affected individuals, the publication of highly personal and demographic information raises concerns around fraud, doxxing, discrimination, and reputational harm that could persist for years. The incidents reinforce the need for stronger multifactor authentication, rigorous phishing and vishing awareness training, and tighter controls around high-value institutional accounts holding large volumes of sensitive data.
Read more »
Vidar stealer variant
AI agent data theft AI infostealer malware Data Breach Hudson Rock research OpenClaw security breach Vidar stealer variant

Infostealer Breach Exposes OpenClaw AI Agent Configurations in Emerging Cyber Threat

 

Cybersecurity experts have uncovered a new incident in which an information-stealing malware successfully extracted sensitive configuration data from OpenClaw, an AI agent platform previously known as Clawdbot and Moltbot. The breach signals a notable expansion in the capabilities of infostealers, now extending beyond traditional credential theft into artificial intelligence environments.

"This finding marks a significant milestone in the evolution of infostealer behavior: the transition from stealing browser credentials to harvesting the 'souls' and identities of personal AI [artificial intelligence] agents," Hudson Rock said.

According to Alon Gal, CTO of Hudson Rock, the malware involved is likely a variant of Vidar, a commercially available information stealer that has been active since late 2018. He shared the details in a statement to The Hacker News.

Investigators clarified that the data theft was not carried out using a specialized OpenClaw-focused module. Instead, the malware leveraged a broad file-harvesting mechanism designed to search for sensitive file extensions and directory paths. Among the compromised files were:
  • openclaw.json – Containing the OpenClaw gateway authentication token, a redacted email address, and the user’s workspace path.
  • device.json – Storing cryptographic keys used for secure pairing and digital signing within the OpenClaw ecosystem.
  • soul.md – Documenting the AI agent’s operational philosophy, behavioral parameters, and ethical guidelines.
Security researchers warned that stealing the gateway token could enable attackers to remotely access a victim’s local OpenClaw instance if exposed online, or impersonate the client in authenticated gateway interactions.

"While the malware may have been looking for standard 'secrets,' it inadvertently struck gold by capturing the entire operational context of the user's AI assistant," Hudson Rock added. "As AI agents like OpenClaw become more integrated into professional workflows, infostealer developers will likely release dedicated modules specifically designed to decrypt and parse these files, much like they do for Chrome or Telegram today."

The disclosure follows mounting scrutiny over OpenClaw’s security posture. The platform’s maintainers recently announced a collaboration with VirusTotal to examine potentially malicious skills uploaded to ClawHub, strengthen its threat model, and introduce misconfiguration auditing tools.

Last week, the OpenSourceMalware research team reported an active ClawHub campaign that bypasses VirusTotal detection. Instead of embedding malicious payloads directly within SKILL.md files, threat actors are hosting malware on imitation OpenClaw websites and using the skills as decoys.

"The shift from embedded payloads to external malware hosting shows threat actors adapting to detection capabilities," security researcher Paul McCarty said. "As AI skill registries grow, they become increasingly attractive targets for supply chain attacks."

Another concern raised by OX Security involves Moltbook, a Reddit-style forum built specifically for AI agents operating on OpenClaw. Researchers found that AI agent accounts created on Moltbook cannot currently be deleted, leaving users without a clear method to remove associated data.

Meanwhile, the STRIKE Threat Intelligence team at SecurityScorecard identified hundreds of thousands of publicly exposed OpenClaw instances, potentially opening the door to remote code execution (RCE) attacks.

"RCE vulnerabilities allow an attacker to send a malicious request to a service and execute arbitrary code on the underlying system," the cybersecurity company said. "When OpenClaw runs with permissions to email, APIs, cloud services, or internal resources, an RCE vulnerability can become a pivot point. A bad actor does not need to break into multiple systems. They need one exposed service that already has authority to act."

Since its launch in November 2025, OpenClaw has experienced rapid adoption, amassing more than 200,000 stars on GitHub. On February 15, 2026, Sam Altman announced that OpenClaw founder Peter Steinberger would be joining OpenAI, stating, "OpenClaw will live in a foundation as an open source project that OpenAI will continue to support."
Read more »
Vendor Risk Management
Cloud Security Threats Customer Data Exposure Data Breach E Commerce Security payment processor breach Ransomware attack social engineering attacks Third Party Risk Vendor Risk Management

Hackers Leak 600000 Customer Records as Canada Goose Opens Investigation


 

Luxury retail is a rarefied industry where reputations travel faster than seasonal collections. Canada Goose, a brand associated with Arctic-quality craftsmanship and premium exclusivity, is now facing scrutiny from an unexpected part of the internet. 

In a cyber incident that the outerwear company insists did not originate within its walls, a cache of customer transaction data has appeared on a notorious ransomware leak site, putting the company at the center of the cyber incident that appears to have originated from a cache of customer transaction information. It has been reported that hackers have compromised Canada Goose's internal systems, but the luxury clothing brand maintains that its systems have not been compromised. 

On ShinyHunters' data leak portal, Canada Goose has been listed as having had 600,000 customer records exfiltrated by the notorious ransomware collective ShinyHunters. This dataset, which is approximately 1.67 gigabytes in size, contains detailed information regarding e-commerce orders, such as customer names, addresses, telephone numbers, and credit card numbers. 

It is the company's preliminary assessment that the exposed information relates to historical customer transactions, and no evidence indicates a breach of Canada Goose's corporate network has yet to be discovered. In response to the company's statements, it is actively reviewing the authenticity, origin, and scope of the dataset and will take appropriate measures if any potential risks to customers arise. 

There are partial details in the leaked records, including payment card brand names, the final four digits of card numbers, and in some cases, the first six digits of the issuing bank's name. Among the additional data in the dataset are payment authorization metadata, order histories, device and browser information, and transaction values.

Despite the absence of full credit card numbers, cybersecurity experts warn that even partial financial and transactional information can be manipulated to facilitate targeted scams, social engineering attacks, and fraud schemes. As part of its public denial, ShinyHunters has not indicated that the Canada Goose dataset is connected with recent social engineering campaigns targeted at single sign-on environments and cloud infrastructures.

In its claim, the group asserts that the records are a result of a breach of the payment processor in August 2025, a claim which has not been independently verified. According to the structure of the leaked data, it may have been derived from a hosted storefront or external payment processing platform, a fact that may support the group's assertion.

ShinyHunters has established itself as a company that penetrates e-commerce ecosystems, SaaS platforms, and cloud-hosted services, obtaining and publishing large quantities of consumer data in order to exert additional pressure on these companies. As described in threat intelligence assessments, ShinyHunters are an established data extortion operation with a history of obtaining and publicizing significant amounts of customer information from leading brands and online platforms.

Since the early 2010s, the group has been associated with a number of high-profile intrusions that frequently target e-commerce ecosystems, software as a service providers, and cloud environments where large datasets can be aggregated and monetized. 

A number of security researchers have also linked the collective with voice phishing and other social-engineering techniques aimed at compromising corporate credentials and shifting into cloud-based systems. In accordance with established patterns, stolen data is typically leveraged for financial coercion, sold on underground marketplaces, or published publicly on the leak portal of the group when ransom demands have not been met. 

Currently, it is not possible to determine whether Canada Goose has impacted customers in the exact manner described above. The company has stated it is examining the dataset to determine its authenticity, origin, and breadth before making a determination regarding whether customer notifications will be necessary.

There is a report that the exposed records contain partial payment card information, including the brand name of the card, the final four digits of the card number, and the ISIN number of the issuing bank, as well as details regarding the payment authorization. 

Cybersecurity professionals note that, even if full primary account numbers are not presented, truncated financial information, when combined with names, contact information, and transaction histories, can materially increase the success rate of targeted phishing schemes, credential harvesting schemes, and fraud schemes.

In addition to purchase histories, order values, and device and browser metadata, the dataset contains transaction information as well. Using such contextual information may allow adversaries to identify high spenders and develop convincing, transaction specific lures that mimic legitimate post-purchase correspondences.

Despite the lack of complete payment card details, the level of granularity increases downstream risk. Separately, ShinyHunters has recently been linked by independent researchers to a series of social engineering campaigns aimed at compromising single-sign-on environments and cloud accounts through social engineering.

According to the group, when questioned whether there was a correlation between those operations and the Canada Goose data, they denied such a connection, stating that the records were a consequence of a breach at a third-party payment processor dating back to August 2025. This assertion has not been independently verified. 

There is an apparent similarity between the structure of the leaked files including field labels such as checkout identifiers, shipping line entries, cart tokens, and cancellation metadata and export schemas that are typically generated by hosted storefronts and payment processing platforms. Although this does not establish the provenance of the data definitively, it indicates that the data may have originated within the environment of an external service provider rather than from a direct compromise of the retailer’s internal systems. 

It is evident that the incident underscores a broader reality facing retailers operating in increasingly interconnected digital supply chains. While core systems may remain unchanged, exposure risks may arise from third-party integrations which handle payments, order processing, and customer data storage. 

It has been observed by industry analysts that organizations that utilize external commerce and payment infrastructure must conduct rigorous vendor risk assessments, monitor their vendors continuously, and coordinate incident response procedures to limit downstream exposure. 

Customers are advised to maintain increased vigilance against unsolicited communications that reference past purchases or payment activity until the scope of the data is conclusively understood. 

A key takeaway from this episode is that data stewardship goes far beyond corporate boundaries, and resilience relies on ecosystem oversight as much as internal security protocols.
Read more »
South Korea
American Firms Coupang Data Breach economic impact legal challenges South Korea

More U.S. Investors Join Legal Dispute With South Korea Over Coupang Data Breach

 



A fresh wave of U.S.-based investment firms has joined an ongoing legal confrontation with the government of South Korea over its handling of a large scale cybersecurity incident involving Coupang.

On February 11, it was confirmed that three additional investors, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management, have formally moved to participate in arbitration proceedings. These firms are aligning with Greenoaks Capital and Altimeter Capital, which had already initiated legal action. By filing official notices, the new claimants are adopting and supporting the earlier case rather than launching a separate one.

At the center of the dispute is an allegation that South Korean authorities unfairly targeted Coupang and, by extension, other U.S.-linked businesses operating in the country. The investors claim that Seoul’s regulatory response following a large-scale consumer data breach amounted to discriminatory treatment that caused severe financial harm.

The controversy traces back to a disclosure made in November, when Coupang announced that personal information belonging to roughly 33 million customers in South Korea had been exposed in a cyber incident. Data breaches of this scale typically involve unauthorized access to customer records, which may include names, contact information, and other identifying details. The announcement triggered widespread public concern, political scrutiny, legal complaints, and cross-border tensions.

According to the investors pursuing arbitration, the government’s actions after the breach significantly affected shareholder value, resulting in losses amounting to billions of dollars. They argue that the regulatory measures taken were disproportionate and damaged investor confidence.

In addition to arbitration efforts, the newly joined investors have sent letters supporting calls for a formal review by U.S. authorities into South Korea’s conduct. Neil Mehta, founder and managing partner of Greenoaks Capital, stated that American policymakers and investors increasingly view the case as an example of the need to defend U.S. companies against what they see as unfair foreign government actions.

Coupang was established in 2010 by Korean-American entrepreneur Bom Kim, a graduate of Harvard University. Over the past decade, it has become the most widely used e-commerce platform in South Korea, surpassing long-established domestic conglomerates such as Shinsegae in online retail presence. The company has expanded beyond traditional online shopping into food delivery services, streaming platforms, and financial technology offerings, further strengthening its footprint in the country’s digital economy.

South Korea’s Justice Ministry has confirmed receipt of additional notices signaling intent to arbitrate. In an official statement, the ministry said it would respond in a systematic and professional manner through its International Investment Dispute Response Team, indicating that the government intends to formally defend its position.

The issue has also contributed to rising trade friction between Washington and Seoul. U.S. President Donald Trump has warned that tariffs on South Korean goods could increase to as much as 25 percent amid broader economic tensions.

Separately, the United States House Committee on the Judiciary recently issued a subpoena to Coupang as part of an ongoing investigation examining alleged discriminatory treatment of American companies operating abroad.

As arbitration proceedings advance, the case is expected to test not only corporate accountability in the wake of major data breaches, but also the strength of international investment protections and the diplomatic balance between two long-standing economic partners.

Read more »
Volvo Breach
Conduent Hack Data Breach Identity Theft Ransomware attack Volvo Breach

Volvo Hit in Conduent Breach Affecting 25 Million

 

A major data breach at business services provider Conduent has spiraled into a large-scale security incident affecting at least 25 million people across the United States, with Volvo Group North America among the latest victims. The breach, originally disclosed in early 2025, is now understood to be far more extensive than first reported, impacting residents in multiple states and exposing sensitive personal data. Texas authorities now estimate that 15 million people have been affected, up from an initial 4 million, while more than 10 million individuals in Oregon have also been caught up in the incident.

Conduent first confirmed in November 2025 that a cyberattack in January 2025 had exposed personal data belonging to over 10 million people. The compromised information included names, addresses, dates of birth, Social Security numbers, and health and insurance details, making it highly valuable for identity theft and fraud. Earlier, in April 2025, the company had revealed that attackers stole names and Social Security numbers during the same January intrusion, highlighting a pattern of gradually escalating disclosures as the scale of the breach became clearer.

Operational disruption accompanied the data exposure, as Conduent disclosed that a January cyberattack caused service outages impacting agencies in multiple U.S. states. Wisconsin and Oklahoma reported issues affecting payments and customer support, underscoring how attacks on back-office providers can cascade into interruptions of public services. Subsequent investigation determined that hackers had maintained access to Conduent’s network from October 21, 2024, to January 13, 2025, giving them ample time to exfiltrate personal data, including Social Security numbers, dates of birth, addresses, and health-related information.

The Safepay ransomware group later claimed responsibility for the attack in February 2025, adding an extortion dimension to the incident. Conduent, which offers printing and mailroom services, document processing, payment integrity, and other back-office support, has been sending breach notifications on behalf of affected clients, including Volvo Group North America. According to a filing with the Maine Attorney General, Volvo reported that 16,991 employees were impacted, and the company said it only learned of the incident in January 2026, many months after the original intrusion window.

In its notification letters, Conduent informed individuals that some of their personal information may have been involved due to services provided to their current or former health plans. The company stated it is not aware of any attempted or actual misuse of the compromised data but is urging recipients to consider steps to protect themselves. As part of its response, Conduent is offering free identity protection services to those affected, reflecting ongoing concern about long-term risks posed by the theft of such highly sensitive information.
Read more »
Wiz security research
AI social network risk Data Breach Moltbook security breach Supabase API key exposure Wiz security research

Moltbook Data Leak Reveals 1.5 Million Tokens Exposed in AI Social Platform Security Flaw

 



Moltbook has recently captured worldwide attention—not only for its unusual concept as a dystopian-style social platform centered on artificial intelligence, but also for significant security and privacy failures uncovered by researchers.

The platform presents itself as a Reddit-inspired network built primarily for AI agents. Developed using a “vibe-coded” approach—where the creator relied on AI tools to generate the code rather than writing it manually—Moltbook allows users to observe AI agents conversing with one another. These exchanges reportedly include topics such as existential reflection and discussions about escaping human control.

However, cybersecurity firm Wiz conducted an in-depth review of the platform and identified serious flaws. According to its findings, the AI agents interacting on the site were not entirely autonomous. More concerningly, the platform exposed sensitive user information affecting thousands.

In its report, Wiz said it performed a “non-intrusive security review” by navigating the platform as a regular user. Within minutes, researchers discovered a Supabase API key embedded in client-side JavaScript. The exposed key granted unauthenticated access to the production database, allowing both read and write operations across all tables.

“The exposure included 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents. We immediately disclosed the issue to the Moltbook team, who secured it within hours with our assistance, and all data accessed during the research and fix verification has been deleted,” the researchers explained.

The team clarified that the presence of a visible API key “does not automatically indicate a security failure,” noting that Supabase is “designed to operate with certain keys exposed to the client.” However, in this case, the backend configuration created a critical vulnerability.

“Supabase is a popular open-source Firebase alternative providing hosted PostgreSQL databases with REST APIs,” Wiz explained. “When properly configured with Row Level Security (RLS), the public API key is safe to expose - it acts like a project identifier. However, without RLS policies, this key grants full database access to anyone who has it. In Moltbook’s implementation, this critical line of defense was missing.”

Beyond the data exposure, the investigation also cast doubt on Moltbook’s central claim of hosting a fully autonomous AI ecosystem. Researchers concluded that human operators were significantly involved behind the scenes. “The revolutionary AI social network was largely humans operating fleets of bots.”

For now, Moltbook’s vision of independent AI entities engaging freely online appears to remain closer to speculative fiction than technological reality.
Read more »
Ransomware
cyber attack Data Breach Data Theft mental Health Ransomware

Birmingham Mental Health Authority Alerts More than 30,000 People to Ransomware-linked Data Breach

 

A public mental health authority in Birmingham, Alabama has notified more than 30,000 individuals that their personal and medical information may have been exposed in a data breach linked to a ransomware attack late last year. 

The informed 30,434 people of the breach, according to a disclosure filed with the . The incident occurred in November 2025 and affected data collected over a period spanning more than a decade. According to the notification sent to those affected, unauthorized access to the authority’s network was detected on or around November 25, 2025. 

An internal investigation found that certain files may have been accessed or taken without authorization. The potentially exposed information includes names, Social Security numbers, dates of birth, health insurance details and extensive medical information. 

The compromised medical data may include billing and claims records, diagnoses, physician information, medical record numbers, Medicare or Medicaid details, prescription data and treatment or diagnostic information. 

The authority said the affected records relate to patients or employees dating back to 2011. A ransomware group known as claimed responsibility for the attack in December 2025, demanding a ransom of $200,000 and threatening to publish 168.6 gigabytes of allegedly stolen data. 

The group posted sample images online as proof of the breach. The mental health authority has not publicly confirmed Medusa’s claim and has not disclosed whether a ransom was paid. 

The authority declined to comment on how attackers gained access to its systems. The breach notification does not mention any offer of free credit monitoring or identity theft protection for affected individuals. Medusa has been active since 2019 and operates a ransomware-as-a-service model, in which affiliates use its tools to carry out attacks. 

In 2025, the group claimed responsibility for dozens of confirmed ransomware incidents, many of them targeting healthcare providers. Those attacks exposed the personal data of more than 1.7 million people, according to publicly reported figures. 

Healthcare organizations have been a frequent target of ransomware groups in the US. Researchers tracking cyber incidents reported more than 100 confirmed ransomware attacks on hospitals, clinics and care providers in 2025, compromising data belonging to millions of patients. Such attacks can disrupt clinical operations, force providers to revert to manual systems and raise risks to patient safety and privacy. 

The Jefferson Blount St. Claire Mental Health Authority operates four mental health facilities serving Jefferson, Blount and St. Clair counties in Alabama.
Read more »
Vendor Risk Management
Data Breach Email Service Provider Incident response Phishing Risk SaaS security supply chain security Third-party breach User Data Protection Vendor Risk Management

Flickr Reveals Data Breach Originating From Third Party Systems


 

A security incident affecting the user data of popular photo sharing platform Flickr has been confirmed to be the result of a compromise within a third-party service integrated into Flickr's operation, rather than the company's core infrastructure. 

According to the company, sensitive customer information was exposed through a breach involving an external email service provider, which exposed an undisclosed number of users' sensitive data. In spite of Flickr's emphasis on the fact that the intrusion was detected and contained within hours, the incident illustrates the persisting risks associated with third-party dependencies within modern cloud and SaaS environments. 

An unauthorized access was discovered on February 5, which resulted in immediate incident response measures as indicated in a breach notification circulated to affected users and reviewed by The Register. 

An external provider's vulnerable endpoint was identified as a source of malicious activity by Flickr, which was immediately isolated in order to prevent further data exposure or lateral movement. In addition to revocation of pathways and expulsion of threat actors, notifications were also sent to the relevant regulatory authorities, data protection bodies, and affected customers regarding the malicious activity. 

A thorough forensic investigation has been commissioned by the company's third-party provider, and detailed findings will be shared as soon as possible, signaling the company's commitment to reviewing vendor security controls and accountability in a broader way. 

Following notification to users, the incident disclosure indicates that Flickr's exposure was caused by a security breach within an external email service provider it uses rather than a compromise of its primary platform itself. 

Among the information that could potentially have been accessed by unauthorized parties were real names, email addresses, IP addresses, and limited account activity information. Flickr declined to identify the third-party provider involved in the incident and did not specify how many users may have been affected, merely stating that investigation continues to determine the scope of the impact. 

Since Flickr's founding in 2004, it has grown into one of the world's largest communities of photographers, hosting over 28 billion photos and videos, and reporting a monthly active user base of over 35 million users, with over 800 million page views. 

The company stated in its statement that immediate containment measures were initiated following the detection of the issue. These measures included revoking access to the affected systems, severing connections with the vulnerable endpoints, and engaging a third-party provider to conduct an extensive forensic examination.

In parallel with these actions, Flickr notified relevant data protection authorities and initiated an internal security assessment intended to strengthen governance and technical controls across third-party integrations.

In its user advisory, Flickr urged customers to be aware of potential phishing attempts that may impersonate official communications in order to exploit this incident. As part of the company's recommendations, the company also recommended that customers review their account activity for anomalies and update their credentials on other services in cases where they may have been reused, reinforcing the importance of standard post-breach hygiene practices during the investigation process. 

As part of its notification to users, Flickr indicated that they are conducting an in-depth investigation as well as reinforcing the security controls governing third-party providers, and that the relevant data protection authorities have been formally notified. 

It was clarified by the company that the attackers accessed a variety of information based on the user, such as name, email address, username, account types, IP addresses, and approximate location information. 

In light of the incident, Flickr stressed that passwords, payment information, and other financial information were not compromised. Specifically, the company cautioned users to be on their guard when receiving suspicious e-mails, particularly messages that purport to be from the company, as the exposed personally identifiable information could be utilized to develop convincing social engineering attacks. 

Additionally, the notification included references to European and United States data protection authorities, which suggests that the incident may have affected users in more than one jurisdiction. With over 35 million monthly users across 190 countries, Flickr has a global exposure spanning a wide geographical area. 

Neither the threat actor nor the data had surfaced on known underground marketplaces at the time of disclosure. However, security experts note that even limited account metadata may be exploited in order to stage targeted phishing attempts, such as fraudulent account suspension notices or payment verification requests, aimed at obtaining additional credentials or financial information from users without their knowledge.

It is important to remember that third-party integrations, particularly those embedded in identity, communication, and notification workflows, create an expanding attack surface. Even though the immediate impact of Flickr's breach was limited by its rapid containment, the incident demonstrates the importance of continuous risk assessments and endpoint visibility among external service providers, as well as contractual security obligations. 

Increasingly, organizations operating at a global scale must regard third-party services as extensions of their internal environment, subject to the same monitoring, logging, and incident response procedures as they do their internal systems. 

A user may be exposed to long-term risks associated with the misuse of seemingly low-sensitivity account information, which can later be repurposed to facilitate highly targeted phishing and account takeover attempts. 

According to security professionals, it is advisable to maintain separate credentials across different services, to enable additional authentication safeguards when they are available, and to exercise caution when responding to unsolicited communication regarding users' account.

During the course of the investigation, the broader industry will closely observe for any further disclosures that may affect how platform operators balance their reliance on external vendors with demonstrating an effective supply-chain security infrastructure.
Read more »
Subscribe to: Comments (Atom)