ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
Suno and Paidwork breaches exposed 78M accounts. Suno delayed disclosing its November 2025 intrusion; Paidwork's March breach exposed bank account numbers now in circulation.
Banks' tracking pixels send customer data to Google, Meta, TikTok despite rejected cookies. Pixels fire before consent logic engages, routing sensitive data without authorization.
79% of recent intrusions avoid malware entirely, using stolen credentials and legitimate tools instead. Traditional SOCs miss these attacks because they appear as normal IT administration, making endpoint detection and response solutions largely obsolete.
Anubis ransomware hit Fairlife, stealing data and encrypting systems. Their "wiper mode" permanently deletes files rather than just locking them, making ransom payments a last-ditch effort to prevent permanent data loss.
Credential stuffing compromised thousands of Chick-fil-A One accounts using leaked passwords from other breaches. Loyalty points—valuable as currency—are treated as perks, leaving the fast-food industry exposed.
Power monitor TPDIN-Monitor-WEB2 accepts empty credentials for admin access to industrial electrical systems. Cleartext credential storage enables lateral movement; vendor Tycon Systems ignored CISA warnings, leaving critical infrastructure exposed to unauthenticated attackers.
Russian actor Trim stripped guardrails from frontier AI models and integrated them into offensive security tools, transforming jailbreaks from novelty tricks into weaponized attack infrastructure.
Apple's Hide My Email leaked real addresses in local logs for a year before patching in July. Risk: shared devices and malware could expose hidden emails despite network-level privacy protections.
Anubis ransomware breached Fairlife (Coca-Cola's dairy unit) and threatens to release stolen data unless ransom is paid. The attack exploits security gaps typical of acquisitions through double-extortion tactics.
Cl0p stole 870GB of Estée Lauder employee data (SSNs, passports, bank info) via an Oracle EBS vulnerability in August 2025. The company is notifying employees 11 months later, giving attackers nearly a year to weaponize the stolen credentials.
CISO Andreas Gaetje rose through audit, not hacking—a common but undervalued path. Auditors excel at business processes and risk communication, producing more security leaders than widely recognized.
Empirical Security raised $25M Series A for a platform combining threat prediction with attack surface discovery, shifting security focus from reactive incident response to proactive breach prevention.
Stolen credentials compromise critical infrastructure—Colonial Pipeline via leaked password, Volt Typhoon via legitimate accounts. The gap: systems trust credentials without device verification or detecting compromise.
Researchers revealed Bit2Watt, a technique enabling cloud GPU tenants to threaten power grids by generating controllable power oscillations through synthetic workloads—no system breach or credentials needed.
The DOJ's seizure of 1,970 piracy domains was actually a cybercrime infrastructure takedown, not just copyright enforcement. Arrested operators used stolen telecom access to run piracy sites for malware delivery, credential theft, and fraud.
A hacker stole $23.75M from Ostium by manipulating price feeds. The attack exemplifies DeFi's ironic reliance on centralized oracles—the very intermediaries blockchain was designed to replace.
TFF Trap compromises credentials first, then launches BEC attacks using fileless malware and stealthy loaders. Executing payloads in memory through legitimate processes, the attack evades corporate detection so attackers already possess valid credentials when fraud hits the inbox.
EY's tax platform breach exposed client SSNs, credit card numbers, and financial accounts—a complete identity theft kit. The attackers accessed the support ticket system undetected for 16 days, compromising sensitive tax documents used for account takeover and fraud.
The Hacker in a Hoodie Index, created by Richard Bird, replaces the cybersecurity industry's poorly-sourced trillion-dollar estimates with verified breach data from SEC filings and news sources. It refuses to sum incomparable losses into meaningless totals, offering a structured, graded, daily-updat
A threat actor left their dev server open, exposing a phishing campaign using WebDAV/CVE-2025-33053 to target Mexico. Researchers accessed 1,048 development files, build notes, and active campaign logs.
HollowGraph hides malware commands in Microsoft 365 calendar events dated 2050. Linked to Iranian intelligence, it compromised 12+ organizations through this covert channel.
HollowGraph malware hides commands in Microsoft 365 calendar events dated 2050, betting employees won't scroll that far. The implant uses the calendar as a two-way dead drop for receiving tasking and exfiltrating encrypted data via artificially-named events.
Russian intelligence compromised unpatched cameras to monitor NATO weapons convoys and military logistics routes in Europe and Ukraine, providing low-cost surveillance as an alternative to satellites.
Hugging Face was breached by an autonomous AI agent that accessed internal datasets and credentials. The incident reveals a critical supply-chain vulnerability—automated attackers are faster and more adaptive than humans, threatening the 500K+ models downstream users depend on.
An autonomous AI agent breached Hugging Face by exploiting malicious dataset processing code. The first major AI-executed attack on critical infrastructure accessed internal datasets and credentials without compromising public models.
Attackers exploited Russia's certified ViPNet security software to compromise government agencies and critical infrastructure by sideloading a malicious DLL that persists across reboots and erases ViPNet's own logs.
Google Gemini's lock-screen access allows anyone with physical access to send messages without authentication. This enables impersonation, social engineering, and account compromise attacks.
Abbott Labs faces dual cyber incidents: extortion gang ShinyHunters claims 30M+ customer records and 1M+ SSNs from Cancer Diagnostics; LabCentral portal separately compromised via credential theft. Reflects surge in healthcare-targeting extortion attacks.
Abbott Laboratories is investigating two cyber incidents where threat actors claim to have stolen sensitive data and are demanding extortion payments. The incidents reflect a broader escalation of ransomware and data theft attacks targeting critical healthcare infrastructure.
Chinese cyber group GoldenEyeDog breached DigiCert via social engineering to steal code-signing certificates in April 2026. This supply chain attack allows malware to evade security controls by appearing legitimate to endpoint protections.