Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label data security. Show all posts
Information Security
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Healthcare Healthcare Breach Information Security

Amplifon Americas Data Breach Exposes Personal and Medical Information of 1.3 Million People

 

Hearing healthcare company Amplifon Americas has revealed a data breach which has led to personal information being exposed for around 1.33 million people across the United States. The records were reportedly stolen and include personal details, medical histories, health insurance information and in some cases Social Security numbers and financial information. 

The breach occurred at Amplifon Americas, the Minneapolis-based US branch of Amplifon, an Italian-based hearing healthcare company which has over 80 million members across thousands of clinics nationwide. A third party gained unauthorised access to Amplifon’s systems in January 2026 and stole data from specific systems between 18th January and 8th February. A response was made by Amplifon to limit the breach and investigate the incident. 

However, the company found it took a long time to establish how much information had been exposed. It took around eight months to complete its analysis. The investigation revealed a range of information had been stolen, including names, contact details, date of birth, drivers licence numbers and other government issued identification information. Medical information, including hearing information, other medical details, date of medical service and health insurance information had also been exposed. 

Those whose Social Security and financial information had been accessed are at greater risk of identity theft. This could increase their chances of being victims of financial fraud and other issues. Amplifon said they were not aware of any fraudulent activity using the stolen personal information but cannot rule out the possibility of future misuse. A filing was made with the Texas Attorney General’s Office by Amplifon and listed 1,332,826 individuals who had been affected by the data breach across the country. 

The company have not said any further information about who had accessed their information or how they had done so. This shows how at risk healthcare companies can be. They often hold large amounts of personal, medical and insurance information. This can be extremely valuable to cyber criminals as they will have access to a variety of different information which can be used for identity fraud.  

There is not much more information available about the breach. We contacted Amplifon to ask for more information about the breach and how many individuals were affected. More information will be available depending on their response.
Read more »
vpn
Cloud Breach Customer Data Data Breach data security Japan passwords sensitive information vpn

Japanese Homeware Giant Iris Ohyama Says Cloud Breach at Its Online Store May Have Exposed Data of Up to 7.7 Million Shoppers

 



Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its online shopping platform was accessed without authorization, potentially exposing personal data belonging to roughly 7.7 million people, including customers who never created an account.

The company, founded in 1971 and headquartered in Sendai, is best known for plastic storage solutions and home appliances sold across Asia, Europe, and North America. Its e-commerce platform, Iris Plaza, caters to millions of customers in Japan and handles a large volume of household product purchases. The scale of the breach puts it among the larger data security incidents Japan has seen this year, in a period when Japanese companies and government agencies have dealt with a string of serious intrusions.


How the Breach Was Detected

On October 28, 2026, Iris Ohyama staff detected suspicious files inside a cloud service that Iris Plaza relies on for its operations. The company did not name the cloud provider or describe the method the attacker used to get in. Within a day, the company suspended access to Iris Plaza and related systems, reported the incident to Japan's Personal Information Protection Commission, and filed a report with police.

A follow-up disclosure on November 5 gave a clearer picture of the scope: up to 5.8 million registered and former members may have had their data accessed, along with up to 1.9 million non-members, meaning people who had completed a guest checkout without registering. The fact that guest buyers are part of the exposure is insurmountable, since many people assume their data is not retained when they shop without creating an account. In Iris Plaza's case, it was.


What Data Was in the Affected System

The range of information potentially accessed varies depending on the type of account. For registered members, exposed fields can include full name, home address, phone number, email address, gender, and date of birth. Account passwords were also stored in the affected environment, though the company said they were encrypted. It did not specify which encryption method was used, leaving questions open about how resistant those passwords are to cracking.

Former members are in a slightly different position: Iris Ohyama said it does not retain passwords for accounts that have been closed, so that group faces a narrower exposure. For non-members who checked out as guests, the data stored was more limited.

One notable reassurance: the company confirmed that credit card information was not stored in the affected cloud environment, sparing customers from the most immediately damaging form of financial exposure.

As of November 5, Iris Ohyama said it had not received any communication from whoever carried out the intrusion, had not identified any perpetrators, and had not seen reports of fraudulent use or financial damage tied to the breach. The investigation into how many records were actually exfiltrated, as opposed to merely accessible, is still ongoing.


What Iris Plaza Customers Should Do Now

The company has urged customers to change their Iris Plaza passwords and, critically, to change passwords on any other service where they used the same credentials. Password reuse across sites remains one of the most common ways a single breach cascades into wider account takeovers. Anyone who shops with the same email and password combination across multiple retail or financial platforms is at elevated risk.

Iris Ohyama also warned customers to be on guard for phishing attempts. With names, addresses, phone numbers, and email addresses potentially in circulation, attackers have enough to craft convincing messages that appear to come from the company. Iris Ohyama said it will not send emails or SMS messages asking for passwords, PINs, authentication codes, or other sensitive information through links, and customers should treat any such request as fraudulent.


A Year of Costly Data Incidents in Japan

The Iris Ohyama breach lands in the middle of a rough stretch for data security in Japan. This year alone, cloud hosting provider Sakura Internet reported a hack affecting up to 1.36 million accounts, telecommunications giant KDDI disclosed a breach tied to a zero-day vulnerability in third-party software that hit around 12 million accounts across shared email platforms, and Japan's Digital Agency acknowledged that a VPN flaw exposed approximately 246,000 government personnel records. The common thread across several of these incidents is reliance on third-party services and cloud environments where access controls or vendor security fell short.

Iris Ohyama's breach fits that pattern. A third-party cloud provider, an intrusion the retailer only caught when suspicious files turned up, and millions of customer records sitting in an environment the company did not fully control. The investigation remains open, and the company has not said when it expects to restore Iris Plaza to service.



Read more »
User Data
Customer Details Cyber Attacks data security DigiCert User Data

DigiCert Hack Exposes Customer Details, Passports, and Driver's Licences


DigiCert has disclosed a data breach after a server migration error exposed an internal business system to the internet, allowing unauthorized users to access archived customer information and sensitive identity documents.

The exposed information included customers' names, business email addresses, phone numbers and business addresses. In some cases, the records also contained personal identification documents, including driver's licences, passports and utility bills.

DigiCert has started notifying affected customers about the incident. The company is also reviewing archived identification documents to identify the individuals whose personal documents may have been accessed.

Server migration error led to unauthorized access

According to an incident report published on Mozilla's Bugzilla platform, the security issue originated in February 2025, when DigiCert migrated an internal business system to a different availability zone. The migration inadvertently made the system accessible from the public internet, although it was previously restricted to users connected through a virtual private network (VPN).

The exposed system contained a self-registration feature designed for other applications. This feature allowed external users to create accounts without requiring the usual internal authorization.

Although these newly created accounts were not assigned to any particular application, an authorization vulnerability allowed them to access archived customer information in read-only mode.

DigiCert discovered unauthorized accounts on the exposed system in June 2026. However, the company initially believed that these accounts could not access customer records because they had not been assigned to an application.

The company received a report through its managed security research program highlighting the possibility of external users creating accounts on the system.

DigiCert implemented security measures to restrict access and address the authorization issue. However, it did not immediately recognize that customer information had already been accessed.

An investigation confirmed that an unauthorized account had accessed archived customer records between June 27 and July 2, 2026. DigiCert confirmed the data breach on October 19, 2026.

The company acknowledged that the incident was initially treated as an account-creation issue rather than a potential data-access incident.

Customer information and identity documents exposed

The compromised records primarily contained business contact information shared with DigiCert during customer verification and other business processes.

However, some archived records also included sensitive identification documents submitted by customers. These documents could include government-issued identification, such as passports and driver's licences, as well as utility bills containing personal information.

DigiCert stated that the unauthorized account had read-only access and could not modify customer records, approve certificate validations or issue digital certificates.

Robust security measures by DigiCert

After the investigation, DigiCert disabled the self-registration feature, restricted access to the affected system and introduced additional access controls to prevent unauthorized users from accessing archived information.

The company also confirmed that its core certificate authority services, including CertCentral and DigiCert ONE, were not compromised. Customer login credentials and previously issued digital certificates also remain secure.

Read more »
FTP Security
Credential Security Data Breach Data Exploit data security DreamHost Security Incident FTP FTP Security

DreamHost Data Breach Exposes FTP Credentials and Webmail Session Information

 

DreamHost has disclosed a security breach in which an unauthorised party accessed its web-based File Manager and potentially obtained sensitive customer information, including FTP/SFTP credentials and webmail session details. The intrusion reportedly began in August 2026 and continued until October 23, when the hosting provider discovered the incident. 

The American web hosting company and domain registrar initially informed customers of a cybersecurity incident that required password resets for email and FTP/SFTP accounts. Its subsequent breach notification provided further details about the compromised system and the information that may have been exposed. 

According to DreamHost, the attacker exploited a vulnerability in the software running its File Manager service at files.dreamhost.com. Customers who logged into the platform during the exposure period may have had their FTP/SFTP usernames and passwords accessed. The company has not disclosed the precise number of affected accounts. The investigation also identified a possible exposure involving DreamHost’s webmail infrastructure. 

A limited number of users may have had session information accessed, potentially including credentials. The company described the incident as appearing deliberate and said its teams had been working continuously to contain the intrusion. DreamHost stated that it had found no evidence of unauthorised access to control panel login credentials or customer billing and payment information. Payment details are handled by an external provider, according to the company. 

Following discovery of the breach, DreamHost said it cut off the attacker’s access and fixed the vulnerability used to compromise the File Manager platform. It also terminated active sessions belonging to potentially affected users and invalidated passwords to reduce the possibility of continued unauthorised access. Customers who received breach notifications are being advised to inspect their website files for unexpected modifications and examine webmail settings for unfamiliar forwarding rules or filters. They should also update passwords on other services if the same credentials were reused elsewhere. 

To support affected customers, DreamHost is offering one year of credit monitoring and identity theft protection through Equifax. Recipients have also been encouraged to consider placing a fraud alert on their credit files or requesting a security freeze to help prevent fraudulent activity. BleepingComputer reported that it had contacted DreamHost multiple times seeking clarification about the breach, including the number of impacted accounts, but had not received a response at the time of publication.
Read more »
Northflank
AI API Data Breach data security Northflank

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage


Cloud application hosting platform Northflank has warned customers to rotate their stored credentials and API keys following a security breach that resulted in unauthorized use of customers' artificial intelligence (AI) API keys.

Northflank provides a cloud-based platform that allows developers to deploy and manage applications, containers, databases and AI applications without having to manage the underlying infrastructure. 

About the incident

After the warning, Northflank advised customers to immediately change their environment variables and API keys stored on the platform. The company later issued a stronger warning, asking users to assume that all environment variables had been decrypted and that the sensitive information stored inside them had been stolen.

Environment variables are commonly used by applications to store sensitive information, including database passwords, cloud service credentials, authentication tokens and API keys. If attackers gain access to these details, they can use them to compromise other services, steal data or misuse accounts to generate unauthorized charges.

Northflank later confirmed that several customers had reported unauthorized use of AI API keys stored on its platform.

"Users have reported unauthorised use of AI API keys supplied to the Northflank platform," the company said in an update. It urged customers who had not yet changed their stored secrets to do so immediately.

The company also advised users to examine their AI service providers' usage and billing records for unusual activity. Any suspicious usage should be reported to Northflank and the relevant AI service provider.

According to the company's incident timeline, Wiz notified Northflank about the security breach at 11:43 UTC on October 30. Its engineering team began investigating the alert one minute later. Northflank initially introduced a network policy patch and deployed additional security updates at 12:50 UTC and 13:05 UTC. The company also requested assistance from Wiz's incident response team.

As part of its response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis databases. It also introduced audit logs for all customers, including users on free accounts, to help them identify suspicious activities.

According to Wiz, attackers are increasingly targeting environment variables that contain AI service credentials. Stolen API keys can be used in a practice known as LLMJacking, in which attackers exploit another organization's AI accounts to access expensive AI models without permission. They may also resell access to these services to other users.

In two cases investigated by Wiz, attackers used compromised enterprise credentials to make approximately 2.5 million requests to Amazon Bedrock, resulting in nearly $100,000 in AI usage charges.

Read more »
Hacker attack
AI Powered Cyber Attacks Cyberattacks Cybersecurity Data Center data centres data security Digital Infrastructure Hacker attack

U.S. Data Centers Face Security Risks From Physical Attacks, Insiders and AI-Powered Hackers

 

Attacks on data centers in other countries are raising concerns about the security of similar facilities in the United States. Although American data centers are unlikely to face the same kind of military strikes seen overseas, cybersecurity experts warn that they remain vulnerable to physical intrusions and cyberattacks. Earlier this week, Ukraine targeted Russian data centers. 

In March, the Iranian military struck Amazon data centers in the United Arab Emirates, leaving the affected facilities out of service for several months. Charles Brooks, an adjunct lecturer in cybersecurity at Georgetown University, told Mashable that data centers are valuable targets because so much of modern life depends on them. Everyday activities such as watching Netflix, using Google Docs and accessing online banking services rely on servers housed in these facilities. 

Data centers also support cloud services used by government agencies, hospitals, financial institutions and businesses, as well as communications between Earth and space. This makes them attractive to state-backed hackers and criminal groups seeking sensitive information or attempting to disrupt essential services. Brooks warned that a serious breach could have catastrophic consequences. He identified three major security concerns for American data centers. 

The first is physical security. Although a drone-powered attack is considered unlikely, facilities could still face attacks involving explosives or unauthorized physical access. Even limited damage could serve as a symbolic victory for terrorist groups or organizations opposed to AI infrastructure. Brooks said security measures should extend beyond surveillance cameras, alarms and barbed-wire fences. He recommended stronger perimeter defenses, security guards and protected areas around sensitive sections, including control centers and water-cooling systems. 

The second concern is the threat posed by insiders. Employees with authorized access to servers and infrastructure could expose sensitive information, reveal security weaknesses or interfere with operations. This could involve a disgruntled worker, someone recruited by an adversary or an employee who makes a costly mistake. Brooks recommended rigorous background checks comparable to those conducted for staff at hospitals and power plants. He also suggested AI-powered surveillance to identify unusual employee behavior, arguing that the potential security benefits could justify occasional false alarms. 

The third threat comes from AI-assisted hacking. Artificial intelligence can help attackers automate cyber operations, identify weaknesses and expand espionage campaigns. Brooks pointed to an Anthropic security report describing how individuals, including foreign government-backed actors, have used AI to automate cyber spying. Hackers could use these tools to scan for vulnerabilities in data center systems or launch phishing attacks against employees to steal login credentials. 

AI allows attackers to conduct these operations at greater scale and identify weaknesses more efficiently. Brooks said protecting data centers should be treated as a national security priority. A breach may not be immediately apparent to the public, but its effects could disrupt businesses, prevent people from working or expose personal information through ransomware attacks. He argued that stronger security requires cooperation between government agencies and the private companies that own and operate these facilities.
Read more »
Government Data Theft
Cyber Attacks data attacks Data Breaches Data protection data security government data Government Data Breach Government Data Theft

Moldova Probes Possible Foreign State Involvement in Major Cyberattack Exposing Government Data

 

The Moldovan authorities are looking into whether the large cyber attack, which caused sensitive personal data to be breached and dozens of state services to be disrupted, could be linked to a larger operation targeting citizen data. Prime Minister Vasile Tofan said on Wednesday.

"We have seen coordinated attacks on a large scale. This shouldn’t be seen as an isolated incident. We’re looking at whether there was any foreign state actors involved," he said. The government has not named any countries or hacking groups. 

In total, hackers targeted vulnerabilities between October 19 and October 23 to gain large amounts of personal data from government services. They made around 11 million requests to access data. Preliminary findings show that information relating to around 750,000 identification numbers was removed but this does not necessarily mean all personal data was compromised. 

This could include personal information such as full names, date and place of birth, family relations, health insurance, social benefits, pensions, disabilities, drivers licences, images and car ownership. Financial information such as bank account numbers, tax liabilities and government payments could also have been accessed. However, authorities said there was no breach of bank cards and no evidence of the attackers attempting to tamper with official government documents. 

Initially the hackers exploited vulnerabilities within services that did not require authentication. This was then used to access more records from the government services that are linked. The government have reviewed 82 digital public services and have disconnected the vulnerable services. Over 30 government information systems and administrative services were also disconnected. Several public services were impacted including applying for building permits, veterinary transport authorisations, importing medicine and food safety registrations. 

Most of the services have now been secured, however they are being gradually reconnected following further security checks. On October 23 the authorities said unauthorised access was stopped. However, they said they identified further attempts on Sunday and Tuesday but these were unsuccessful. The government has warned that criminals could attempt to use the stolen information for fraud and impersonation. They could try to impersonate someone from a bank or public institution to get people to give them passwords or codes or send them money. 

The incident could be part of a larger hybrid attack campaign, government spokesperson Dumitru Ciorici said. Moldova has been constantly targeted by cyber attacks and disinformation since Russia launched a full invasion of Ukraine in 2022. 

Moldovan officials have previously accused Russia of launching disinformation campaigns to destabilise the country and weaken state institutions. They have also undermined confidence in the pro-European government led by President Maia Sandu. The latest incident has raised concerns over the security of Moldova’s digital services.
Read more »
Healthcare Data
Cyber Networks Cyber Security Cyberattacks cybersecurity in healthcare Data protection data security Data Theft Healthcare Data

Cybersecurity Incident Disrupts New Mexico Hospital Network, Forcing Patient Diversions and Clinic Closures

 

A cybersecurity incident caused ambulance diversions, cancelled appointments and disruptions to medical facilities around the state on Monday October 26, leaving New Mexico with no emergency departments able to treat the most severe traumatic injuries. The University of New Mexico Health System provides the only level 1 trauma centre in the state. 

The health system advised patients not to attend the main hospital in Albuquerque and cancelled appointments at over 30 clinics whilst they tried to resolve the issue. Although officials did not immediately say what exactly had happened, later in the day it was announced that parts of the hospital and clinics were beginning to get back up and running. Presbyterian Healthcare Services and Lovelace Health System are also large healthcare providers in the state and worked with the network to prepare to take in extra patients. 

The University of New Mexico Health System sees around 900,000 outpatients and 100,000 emergency department patients per year (University of New Mexico Health System website), meaning this is a large part of the healthcare system. Multiple staff reported seeing messages on their computers late Monday morning stating that student, staff and patient data had been stolen. A spokesperson for the health system did not want to comment as they said there was an ongoing police investigation. 

An FBI spokesperson confirmed that they were assisting a partner organisation but did not give any further details. Attempts to comment were also sent to the Bernalillo County Sheriff’s Office and Albuquerque Police Department. This incident comes as there has been ongoing concerns about attacks on digital systems within essential services such as healthcare. Ransomware requests and other cyber incidents have been seen with hospitals for around a decade, however it is unusual for messages to be shown on computer systems due to the breach (Josephine Wolff, Professor of Cybersecurity Policy at Tufts University). 

This shows how difficult it can be for organisations to protect their networks. The impact could be seen throughout Albuquerque and surrounding areas. At the main hospital, staff in turquoise uniforms were directing patients away from the waiting area and advising they may have their appointments cancelled. Patients arriving at a medical centre in Rio Rancho were also told by security guards to rearrange their appointments. 

The University of New Mexico’s Health Sciences Centre, the largest academic medical centre in the state, cancelled Monday and Tuesday classes. Staff working in the hospital and medical group will be returning on Tuesday. It has not been confirmed what caused the incident, if data has been extracted or if there was a ransom request. The investigation is ongoing.
Read more »
Fortinet firewall attack
Credential Theft Cyber Attacks data security Data Theft FortiGate FortiGate firewall attack Fortinet Fortinet firewall attack

Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials

 

A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches. 

The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed. 

Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together. This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%. 

The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific. The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used. 

Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access. 

The AdaptixC2 framework is also used. Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts. Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link. 

Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.
Read more »
data security
Cyber Security Cyber Security Ransomware Attacks Data Leaked Data Recovery data security

Paying a Ransom Does Not Guarantee Full Data Recovery or Security

 

Paying a ransomware demand does not always lead to the return of an organization's files, the prevention of data leaks, or the eradication of attackers from its network, according to digital forensics and incident response companies. Ransomware is a prevalent cybersecurity risk, and according to a 2025 CrowdStrike report, 78% of 1,100 global IT and cybersecurity leaders asked about attacks in the past year. 

In addition, according to a report by Proofpoint, which appeared in July, 54% of the 1,600 organizations surveyed worldwide said they had paid a ransom within the last year. Joe Hoosech, an executive at the cybersecurity insurance company Cowbell, estimates that paying the ransom retrieves data with no further leaks in 75 to 80% of cases. 

Some hackers do indeed honor their word to deter potential victims by building a reputation as reliable businesspeople, he adds. In addition, they sometimes provide documents describing how they penetrated the network, although experts say this information is often of little value. "Sometimes the decryptor doesn't work," Hosech cautions. "In my experience, maybe one out of four organizations finds that the decryption tool does not completely restore all the data." Andrew von Ramin Mapp of Cyber Centaurs has observed a similar challenge: "Sometimes there is some damage to the database, for example, because the encryption tool was run while the database was open, so the database needs to be fixed." 

Beyond restoring data, organizations must consider whetherransomware attackers have deleted evidence of the breach, experts say, citing an example. "I've had clients where the bad guys took the data, encrypted it, and then left," recalls Eric Taylor of Barricade Cyber Solutions. "The client paid the ransom, the bad guys promised to delete it, and then the client saw the data on the bad guys' website, including the files they had deleted." "Sometimes the bad guys take the data for themselves and sell it to others," Hoosech says. 

Initial access brokers can infiltrate networks and sell that access to other threat groups and stay in the network. "Therefore, just because one gang promises to protect you, it doesn't mean that those who purchased access to your network won't benefit from stealing your data," says Taylor. "Instead, companies should evaluate the value of the data to the organization and the impact on the business of losing or disclosing it," recommends von Ramin Mapp. He advises businesses that have decided to pay a ransom to "test the decryption key before handing over the ransom." 

However, the expert says there is no way for organizations to receive absolute guarantees that the data will be deleted. "By the way, I advise companies to keep their cyber insurance policies on paper and in a safe place," says von Ramin Mapp. "If an attacker accesses your computer system and finds where you keep the documents, he can calculate how much you might be willing to pay to stop them." Still, experts say that while the ransomware payment option does not completely eliminate the need to respond to the attack, organizations should continue to investigate and mitigate ongoing attacks.
Read more »
User Data
Daiichi Kosho Data data security malware User Data

Malware Incident at Karaoke Giant May Expose Data of 8,724,000 People


Daiichi Kosho, a major Japanese karaoke company known for operating the popular Big Echo chain, has disclosed a potential data breach that could affect approximately 8.7 million records. The incident involved malware discovered on a computer belonging to Nippon Columbia Group (NCG), an entertainment company that handles customer information on Daiichi Kosho’s behalf.

In a statement published on October 8, 2026, Daiichi Kosho said it could not rule out the possibility that personal information stored on the affected computer had been exposed to unauthorized parties. But the company has not confirmed that the data was actually stolen or leaked. 

“According to NCG, between October 1 and October 2, 2026, a malware infection was discovered on one of their employees' devices (a PC), and the device was isolated from the network on October 2. Following an investigation into the scope of the impact by NCG, we received a report from NCG on October 5,” read the statement.

Incident details

After an initial investigation, NCG informed Daiichi Kosho about the incident on October 5. The investigation revealed that information collected through outsourced business operations had been temporarily stored on the compromised computer.

NCG has reset affected passwords and is investigating how the malware entered the system, whether information was accessed by unauthorized individuals, and the overall scope of the incident. The available information does not identify the malware. 

What can be leaked?

Daiichi Kosho estimates that approximately 8.724 million records may have been affected. “Based on the information we currently have, approximately 8,724,000 customers who registered or made reservations at our stores may have had their names (registered names), genders, dates of birth, email addresses, and telephone numbers leaked to external parties,” the company warned.

The affected records are linked to customers who registered for membership or made reservations at the company’s establishments. The businesses include Big Echo, DK Dining, Mega Big, Karaoke Club DAM, Banana Club and B-Garage.

How to stay safe?

Daiichi Kosho has warned customers not to open unfamiliar links or attachments and to remain cautious when receiving unexpected emails, text messages or calls. The company has also clarified that passwords and credit card information are not included in the potentially exposed data. 

Read more »
Malware Attack
Customer Data Data Breach Data Leak data security Digital Personal Data Protection Employee Data Breach Malware Attack

Nippon Columbia Malware Incident Puts 8.6 Million Customer Records at Risk

 

Japanese entertainment group Nippon Columbia hit with malware, affecting more than 8.7 million customers and employees' personal data, according to karaoke system maker Daiichi Kosho. The company asked its customers to be cautious, but it is still unclear if their personal information was stolen or leaked. 

Daiichi Kosho, Japan’s biggest karaoke company, owns 521 karaoke places and provides services for the well-known chain of Big Echo. They rely on Nippon Columbia Group (NCG) to provide customer information. NCG’s businesses range from music creation, video and game software development and distribution to artist management, making it an important supplier for the karaoke entertainment sector. 

The issue was raised when NCG notified Daiichi Kosho of the incident on October 5 when the malware was found on one of the staff member's computers, which was then isolated the next day. The company then proceeded to reset all the passwords and other authentication methods and investigate the incident to determine its scope and origin. 

According to Daiichi Kosho's statement, the affected information includes approximately 8,631,000 customers and 93,000 employees of the company, and it may include the full name, gender, date of birth, email address, and phone number of the affected individuals. BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining entertainments' users should be particularly wary of the security breach, as it could affect their data the most. 

Daiichi Kosho reiterated that their information was not at risk and that the data contained in the breach does not include the passwords. Additionally, the company stated that there was no suspicion of unlawful interference with customer loyalty points. On the other hand, they are still not certain if the information was stolen or if it was leaked online. They are investigating the breach to find out if the data was shared, what the scope of the problem was, and if the information was shared. 

The latest statement did not mention anything else about the possible leak. Customers are advised to protect themselves from scams, deception, and unlawful access to their personal information. They should be wary of strange emails, text messages, and phone numbers and avoid providing any personal and financial information. If the crooks managed to collect and compile the data of these users, it would be easy for them to engage in phishing schemes and similar scams. 

BleepingComputer, as of the time of publishing this article, has not been able to find any official statement from Nippon Columbia Group about the incident. They mentioned that they contacted the company for an official comment, and they are still waiting for the response. Until an official statement is issued, the possible data theft remains an issue, as it raises several questions about the safety of the companies' data and the safety of customers' personal information.
Read more »
Venture Capital
AI Security Artificial Intelligence Cybersecurity Acquisitions Cybersecurity Investments Cybersecurity M&A data security Identity Security Technology Venture Capital

AI Race Fuels Surge in Cybersecurity M&A Deals


As companies strengthen their artificial intelligence capabilities, the cybersecurity industry is poised for another record merger and acquisition (M&A) year. Momentum Cyber reported 117 deals in the third quarter of 2026, which represents an increase from 117 deals in the prior year. This increased activity is a reflection of a shift in security companies' purchasing strategies in order to keep up with rapid advances in artificial intelligence. 

There is currently a strong demand for security solutions based on artificial intelligence and tools capable of protecting AI-powered systems, which is contributing to the current wave of acquisitions. Organizations are increasingly adopting agentic artificial intelligence, which can perform tasks with minimal human intervention. However, security has become an increasingly important concern as organizations adopt these systems. 

Among the key areas of investment are identity and access management, nonhuman identity, data security, agentic security, runtime protection, and operational technology security. In 2025, there are estimated to be 404 cybersecurity mergers and acquisitions. This year's activity also set a record in terms of deal value, with companies spending approximately $97 billion on startup acquisitions. 

It is expected that investment funding rounds will decrease slightly from last year's levels, but acquisitions have continued to gain momentum as established companies seek capabilities that would take a considerable amount of time to develop internally. 

Artificial intelligence models have advanced dramatically and automated cyberattacks have increased the urgency of this issue. As a result of these developments, companies are reviewing their security requirements, creating opportunities for startups that are developing AI-based products. In order to expand their capabilities, large corporations are acquiring established startups in emerging security categories and investing in early-stage companies in emerging security categories. 

AI-driven acquisitions have also become increasingly common among established technology companies. As of 2026, Palo Alto Networks acquired CyberArk for $25 billion, while other companies pursued specialized capabilities in identity security, data protection, and artificial intelligence infrastructures. These moves are a result of a wider effort to incorporate emerging technologies into existing security portfolios rather than solely relying on internal developments. 

A growing segment of the market is also emerging outside of traditional cybersecurity vendors. Software providers are seeking ways of securing AI agents within business applications, while organizations managing operational technology need to safeguard the systems and connected devices controlled by increasingly autonomous software. 

As concerns regarding the risks associated with artificial intelligence grow, cloud providers and advanced AI developers are emerging as potential buyers of security technologies. Although acquisitions have increased, Momentum Cyber's analysis indicates that venture capital and private equity firms are scrutinizing their funding decisions more carefully, making fewer deals but more substantial investments in selected companies. 

Investors are assessing which technologies will remain relevant in a rapidly evolving market, attracting attention to startups with proven leadership and specialized capabilities. During the first three quarters of 2026, Momentum Cyber announced 40 AI security acquisitions, up from 10 transactions throughout 2025. These figures indicate the rapid growth of this segment. 

AI is becoming increasingly integrated into a wider variety of cybersecurity products, making it increasingly difficult to distinguish between tools designed to protect AI systems from cyber threats and tools powered by AI. According to industry observers, hyperscale cloud providers and leading AI research companies will have a greater influence on acquisitions in the future. 

Increasing reliance on secure AI infrastructure may make specialised security capabilities more valuable, further affecting the cybersecurity market's competition. In light of the continued transformation of cybersecurity by artificial intelligence, acquisitions are expected to remain a key strategy for companies seeking specialized knowledge and faster innovation. 

As AI security, identity management, and automated threat protection become increasingly important to the security sector, it is expected that future investment decisions and competition will be influenced.

Read more »
data security
blocking unauthorized access Credential Security CVE CVE exploits CVEs Cyber Security Cyberattacks Data Center data security

Atlassian CVE-2026-21589 Exploited Hours After Public Disclosure

 

Attackers started scanning the systems vulnerable to the Atlassian flaw several hours after the researchers published the technical details and proof-of-concept code. Assigned the identifier CVE-2026-21589, the vulnerability impacts several self-hosted Data Center products and could allow unauthorized access to the credentials in some circumstances. 

The problem was disclosed by Atlassian on October 5, 2026, with a CVSS score of 9.3. The products affected by the bug are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The company already released fixes for all software versions. The flaw allows the adversaries to access some files in the application root directory without providing proper authentication. 

However, it is only possible if the attacker knows the exact name and location of the file because the vulnerability does not allow listing the contents of a directory. Therefore, the attack surface is limited, but there is still a potential risk if the adversary somehow manages to guess the file location. The security researchers from WatchTowr posted the proof-of-concept code and technical details of the discovered flaw on October 6, 2026. 

They managed to identify the origin of the issue – a popular library used in all Atlassian products mentioned above. More importantly, they found out that the vulnerability could be chained to get access to the configuration file with Crowd application credentials in some circumstances. According to WatchTowr, Crowd is Atlassian’s identity management system, and the mentioned scenario involves Jira Software connected to it. 

In this case, the attacker could use the credentials to create a new administrative account and assign it to the Jira administration group. As a result, the adversary would be able to attain full privileged access to the targeted Jira Software instance. In addition, the security company showed how the proof-of-concept code could be used to take over a victim’s account in case of success. Moreover, the researcher added that the attacks are not random, but rather targeted. 

Several hours after the publication of the results, the exploitation framework started scanning corporate websites to find the instances of the affected applications. On October 8, 2026, Previdian, the exploitation intelligence company, counted 190 attempts from 32 IP addresses in 10 countries. Although the United States Cybersecurity and Infrastructure Agency (CISA) has not included the vulnerability in the Known Exploited Vulnerabilities list, the attacks indicate that the problem needs urgent attention. 

The companies using Atlassian’s products should make sure that the affected applications are updated to the latest versions. Those who are not able to do it right away should take the vulnerable instances of the software offline or follow the recommendations stated by Atlassian. In particular, the company suggests deploying the blocking rules to the firewalls or using the Web Server rewrite rules. 

In addition, the organizations with Jira Software and Crowd should make sure that the mentioned applications are not at risk of compromise as well. As seen from the recent incident, the response to the exposure of the flaw may take too long. Moreover, the attacks are often launched right after the proof-of-concept code is published. Therefore, it is critical to apply the necessary security updates as soon as possible.
Read more »
Malware attacks
Cyber Attacks data security Information Security Infostealer Malicious Code malicious npm package Malware attacks

MALFEX npm Campaign Uses Three Malware Delivery Chains

 

A long-running malware campaign on the npm registry is using malicious JavaScript packages to compromise Windows systems with remote-access malware, information stealers and additional payloads. Researchers have linked the operation, known as MALFEX, to an apparent single operator active on npm since August 2023. 

The operator has published 12 packages, eight of which were found to contain malicious code. Together, the packages had recorded 40,767 downloads by October 1. However, those figures represent package downloads rather than confirmed infections. MALFEX currently uses three separate infection chains. The first delivers the Overlord Remote Access Trojan through packages including tlxbnhd, tldriver and mxdriver. 

Malicious installation scripts download and execute a Windows payload disguised as an image. Overlord can capture screenshots, keystrokes and clipboard data, search files and provide attackers with remote shell access. It also establishes persistence through a scheduled Windows task named “Maiden.” A second chain involves native-runner, img-to-native and cdn-img-fetch. 

Instead of relying on an npm installation script, the malicious code executes when the package is loaded. Data hidden inside an image is decrypted to produce a downloader, which retrieves movinlike, a Node.js information stealer. The malware targets Discord accounts, browser credentials, Telegram session data and cryptocurrency wallets before sending stolen information to an attacker-controlled Discord webhook. 

The third and longest-running chain revolves around function-flag. Its malicious versions contain code that downloads Windows executables from changing external locations. In version 1.7.3, a hidden routine triggered during installation downloads node.exe and executes it from the user’s application-data directory. function-color serves as a wrapper that installs function-flag. 

Three malicious packages remained installable as of September 29: function-flag, function-color and cdn-img-fetch. function-flag accounted for 37,419 downloads, making it by far the most widely downloaded package in the campaign. Despite that activity, it had no security advisory. function-color also lacked an advisory, while the advisory for cdn-img-fetch covered only versions 1.0.0 and 1.0.1, leaving malicious versions 1.0.2 and 1.0.3 outside its coverage. 

The campaign also uses several techniques to make detection harder. Malicious code can be hidden beyond the visible area of a typical editor, failed downloads may be suppressed without generating installation errors, and the attacker has published benign packages alongside the malicious ones. Security teams should block all eight identified malicious packages and check dependency trees and lockfiles for them. 

Any Windows system where one was installed should be treated as potentially compromised, isolated from the network and investigated. Organizations should also remove persistence mechanisms and rotate credentials from a clean device if sensitive accounts were used on the affected machine. 

MALFEX highlights the risk of relying solely on npm advisory feeds: malicious packages can remain installable even when related packages have been removed, while some dangerous versions may have no advisory coverage at all.
Read more »
data security
AI Attacks AI cybersecurity AI technology Cyersecurity AI Data Data Breach Data protection data security

South Korea Orders Financial Sector Probe After Series of Data Breaches

 

South Korea is gearing up to respond to a string of cyber disruptions that targeted financial institutions, with the President demanding a thorough inquiry about the recent personal data breaches and protection of future incidents.  

The Financial Services Commission (FSC) is leading the response and is holding meetings with industry bodies, regulators, and officials from impacted financial institutions to discuss the next steps. FSC Chairman Lee Eog-weon warned that finance companies must remain on high alert as the authorities trace the source of the cyberattack. The security breach investigation was initiated after Shinhan Bank notified the FSC about the incident on September 30. 

Following that, regulators opened on-site inspections and expanded the probe as more financial institutions reported a cyberattack. Shinhan Bank and KB Kookmin Bank were the two financial firms named by the FSC, while Yonhap News Agency reported that Hana Bank and Woori Bank also experienced data leaks. FSC decided to call an emergency meeting of senior officials to review the situation, moving it from its original date, October 7. 

According to Korean media, the main reason for the emergency meeting was related to the fact that more financial institutions became victims of cyberattacks, and that additional breaches at secondary financial institutions were also suspected. Regulators are also considering the possibility that AI might be involved in the cyberattack. Lee warned that the involvement of AI in the cyberattack cannot be ruled out and that the response should be based on AI-driven cybersecurity solutions. 

In addition, the FSC is considering implementing enhanced cybersecurity measures for the finance sector. Among the first steps taken by the FSC is a recommendation that financial institutions conduct a cyber hygiene review. FSC urged finance companies to implement stricter access controls, reduce the exposure of their systems, and introduce additional measures to protect consumers from potential data abuse. Furthermore, the FSC is pressuring financial institutions to share information about the cyber incidents. 

The information exchange process should include attack methods, internet protocol (IP) addresses, and other details. It would enable financial companies to develop a joint response and recognize other potentially impacted entities. The cyberattack might have been targeting financial hubs rather than the single institution, according to one scenario produced by South Korean regulators and reported by Yonhap. The unnamed regulators believe that the cyber attackers targeted several financial institutions in an attempt to scan the system to find weaker areas.  

According to the information provided by the banks to the National Assembly, the cyberattack came from various IP addresses. Those locations spanned across several countries, including the US, Japan, Singapore, Vietnam, and the UK. South Korea’s opposition People Power Party is demanding that the government investigate whether North Korea was behind the cyberattack. 

The cyberattack could be a retaliation for decades of cyber espionage and economic sabotage by Pyongyang, according to the party. The response from the FSC is to keep investigating the cyber incidents and urge financial institutions to boost their cybersecurity measures and share information about the cyber incidents.
Read more »
Google Microsoft
AI technology China CyberSecurity Credential Security Cyber Attacks Cyber Phishing data security Google Microsoft

China-Aligned TA419 Uses Microsoft AitM Phishing Against U.S. AI Policy Experts

 

A China-linked cyber-espionage group is targeting Microsoft credentials belonging to U.S. policy and regulatory specialists in artificial intelligence, using highly focused social engineering techniques. 

TA419, the threat actor behind the campaign, has diversified its interest from defense, national security, energy, international relations and foreign policy to include those involved in the policy and regulation of AI, a Proofpoint analyst reported. The group has been targeting U.S. and Japan-based think tanks, defense contractors, universities and law firms through credential phishing since at least April 2025. 

One technique, deployed in a February 2026 campaign, involved impersonating prominent figures in economic and AI policy, as well as an Anthropic employee, in an email titled “Request for Feedback on Military Integration of Claude” to influence an AI policymaker at a U.S. think tank. Similarly, around July, the group began targeting individuals including a former White House Office of Science and Technology Policy (OSTP) leadership team member with an impersonation campaign. The attack chain is designed to appear to have come from a trusted source, not direct phishing. 

First, the victim receives an innocuous request designed to gain the confidence of their target by referencing a shared professional interest. If it gets a response, it then replies with a shortened URL. Once the link is clicked, the victim is directed to a Microsoft OneDrive-like adversarial in-the-middle phishing site after several redirections. The Cloudflare Turnstile Captcha is integrated into the attack chain, helping to lend credibility to the link. 

The credential harvesting component of the attack uses a technique called Frameless BitB, which uses a browser-in-the-browser approach to create the illusion of a separate window using only HTML, CSS and JavaScript. This differs from previous use of Bitb by this threat actor, which used an iframe. Proofpoint noted that TA419 has been modifying an open-source iteration of the attack to incorporate its own telemetry and automation components. The campaign uses an in-the-middle proxy to compromise Microsoft authentication by impersonating a legitimate login page.

It appears to be a legitimate login page; however, it is actually using the authentication token from the user’s Microsoft account to gain access to the account. This technique can be challenging to detect because the Microsoft logon page can appear to be authentic while the attacker’s application window is using some of the user’s session information. This allows the attacker to use the credentials to access the Microsoft account. Proofpoint noted that the activity supports Chinese intelligence interests by providing insight into the U.S. regulatory and policy environment around AI. 

The intensifying U.S.-vs-China strategic competition over AI, including issues around model distillation and export controls, appears to be a catalyst for the campaign. Entities should consider implementing phishing-resistant authentication factors such as passkeys, and individuals who received unexpected professional or professional correspondence should take steps to independently verify the request before responding or following any links.  

While the shift to AI policy experts represents a new focus area for TA419, it is not a significant change in the group’s interests. According to Proofpoint, this is an evolution, rather than a revolution, of the group’s current targeting.
Read more »
healthcare data breach
customer data breach cybersecurity in healthcare Data Breach Data Leak data security Healthcare Data healthcare data breach

DC Health Agency Data Exposure Affects Nearly 400,000 Medicaid Beneficiaries

 

Almost 400,000 people who enrolled in Medicaid and the DC Healthcare Alliance may have been affected by a data breach, which occurred on the website of the District of Columbia Department of Health Care Finance. 

The issue concerned the reports published on the organization’s website, which showed aggregated data about the people who enrolled in the programs between 2023 and 2026. DHCF noted that the breach did not involve cybersecurity issues or intentional unauthorized access to the system. The problem was discovered by the agency in July, when it was revealed that two reports on the website contained fields with personally identifiable information that could have been accessed by unauthorized parties. 

The reports included only aggregated data, such as the number of people enrolled in the programs at specific times and other related information. Nevertheless, according to DHCF, the supporting information on its website could have been accessed by unauthorized parties since 2023. The personally identifiable information of the people who enrolled in Medicaid and the DC Healthcare Alliance includes their ID, providers, date of birth, race, gender, ethnicity, and wards. 

According to the agency, the reports do not contain Social Security numbers, names, and financial information of the affected people. DHCF announced that 399,086 people were affected by the issue and notified the United States Department of Health and Human Services (HHS). The latter added DHCF to its website, which keeps track of data breaches. It is unclear whether the affected people’s information was misused or will be misused in the future. Nevertheless, DHCF advised them to remain wary of potential fraudulent activities and unauthorized attempts to gain access to their information. 

According to the agency, the fact that the reports did not include Social Security numbers and financial accounts minimizes the risk of exploitation, but it remains present due to the inclusion of people’s IDs. After the breach was discovered, DHCF removed the reports from its website. In addition, it initiated an internal review process and responded to the problem by checking its systems for vulnerabilities and ensuring that its internal procedures were appropriate for addressing the issue. 

It is important to note that the breach illustrates how people’s information can be exposed even when it should not be. In this case, the data was not hacked or intentionally shared with unauthorized parties. Nevertheless, it became available to anyone who wanted to see it because the reports containing it were publicly available. 

Therefore, it is essential for people who enrolled in Medicaid and the DC Healthcare Alliance to ensure that they are not contacted by scammers and that their information is not misused. It is necessary for them to contact DHCF if they suspect that something is wrong. At the same time, it is important to keep in mind that, according to the agency, there is no information about the affected people’s information being viewed or misused.
Read more »
Social Engineering Attack
Astrana Health Data Breach Cyberattack Data Breach data security Healthcare cybersecurity healthcare data breach Patient Data Security Social Engineering Attack

Astrana Health Data Breach Exposes Private and Confidential Information


In a cybersecurity incident, Astrana Health disclosed, attackers gained access to company servers and obtained confidential and private information. A social engineering attack targeting employees was conducted by the healthcare technology company's subsidiary, Astrana Health Management, to accomplish the intrusion. 

Astrana Health employees were impersonated in the attack and the main corporate telephone number of the company was spoofed by the attackers, according to a filing with the Securities and Exchange Commission. Employees were contacted using the fraudulent number, and eventually the attacker obtained access to the company's servers through the fraudulent number. Because of the potentially sensitive nature of the information involved, the incident was later determined to be material. 

In its investigation, Astrana Health discovered that some private and confidential information stored on its servers had been accessed or acquired without authorization. As of this writing, the company is still investigating the incident in order to determine whether patient, employee, credentialed provider, business, financial, and intellectual property information was affected. There has been no disclosure of the specific information compromised or the number of individuals affected. 

After detecting the intrusion, Astrana Health consulted with a third-party cybersecurity firm, notified law enforcement and regulatory authorities, and informed partners and customers of the incident. As part of the mitigation, credentials have been rotated, remote access tools have been restricted, certain systems were restored from backups, and monitoring, logging, and detection measures have been strengthened. The extent of the exposure has not yet been identified. 

Currently, Astrana Health is investigating whether patient data, employee data, credentialed provider data, confidential business or financial records, and intellectual property were involved. There has been no disclosure of the number of individuals affected or a specific list of the data accessed and taken by the company. As a result of the potentially sensitive nature of the information involved, this incident has been classified as material. In the meantime, Astrana Health does not anticipate the attack will significantly affect its financial position or operations. 

During the investigation, the company has also notified law enforcement, regulators, and relevant customers. There has been no public attribution for the attack. There are no known ransomware or extortion groups that claim responsibility for the attacks at the time of the reports. In addition, Astrana Health has not confirmed the presence of ransomware. 

Due to the wide range of information stored within Astrana Health's systems, the incident is of particular significance as it affects healthcare providers that provide technology and administrative services. As of the last quarter, the company reported revenue of approximately $972.5 million and provides its operations technology platform to approximately 20,000 medical practitioners. 

A preliminary investigation by Astrana Health is ongoing, with the company seeking to determine the full extent of the information accessed as a result of the cyberattack. Further findings may clarify the type of data involved and the number of individuals affected by the cyberattack.
Read more »
Hacker attack
Chinese Hackers Critical Flaws Data Breach data security data stealing data vulnerability Hacker attack

Chinese Hackers Exploit ZyXEL Switch Flaw to Steal Data From Nearly 1,000 Devices

 

A Chinese threat actor has been using the recently discovered vulnerability in ZyXEL GS1900 switches to steal crucial information from the devices around the world, according to GreyNoise, a threat intelligence company.

The vulnerability, tracked as CVE-2026-7273, has a CVSS score of 8.8 and is a stack-based buffer overflow, enabling a remote unauthenticated attacker to execute OS commands via a specially crafted HTTP request. 

ZyXEL has issued security updates for ten GS1900 switch models in June. However, according to GreyNoise, the flaw was actively exploited in August, targeting the devices in 48 countries. The threat actors used a Python script, which was significantly obfuscated to hide its purpose, to extract the hashes of the root credentials, configuration, and network information from 996 affected switches. 

While the script targeted the GS1900-24 switches with firmware versions 2.10 to 2.90, some of the command-line options in the script contained values related to libc base addresses and global offsets. Therefore, it might be possible that the threat actors could use the same vulnerability to target other firmware versions. The information stolen from the switches also showed that 564 devices were using default credentials. This lets the attackers effortlessly compromise these devices. 

On Monday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog. Also, per the Binding Operational Directive 26-04, all federal agencies must remediate this issue within 3 days of its publication. GreyNoise also reported that the same threat actor conducted Ubiquiti attacks, which involved exploiting the zero-day flaws to gain remote access and execute arbitrary code in the devices. 

In addition, the attackers used exploits targeting WordPress flaws to launch attacks against small businesses and government entities in July. The attacks entailed a threat actor compromising a Western government organization, stealing over 18000 sensitive documents from the agency’s backend database, and publishing the results on a Matrix communication service. 

However, the cybersecurity firm is yet to confirm if any of these attacks were conducted by the same threat actor. Acronis, another cybersecurity firm, previously identified threat actors using the Red Heron hacking group, which primarily used Gitea’s zero-day flaw to target more than 100 organizations worldwide.
Read more »
Subscribe to: Posts (Atom)