🔴BreachesHIGH
Anviz Multiple Products
Anviz systems have critical authentication flaws (CVSS 5.3-9.8) exposing camera feeds, credentials, and root access. Vendor declined CISA's patching efforts, leaving systems unprotected.
🔴Breaches955 stories · page 29 of 32
Breaches
Latest cybersecurity breaches news, analysis, and intelligence.
🔴BreachesHIGH
Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest
Microsoft paid $2.3M in record bounties at Zero Day Quest 2026 to identify zero-day vulnerabilities. The competition demonstrates the company's commitment to proactive security research and sets new standards for corporate bug bounty programs.
🔴BreachesHIGH
[Webinar] Find and Eliminate Orphaned Non-Human Identities in Your Environment
** Compromised service accounts and forgotten API keys drove 68% of 2024 cloud breaches. With 40-50 non-human identities per employee, orphaned NHIs are now the top cloud attack vector.
🔴BreachesHIGH
ThreatsDay Bulletin: Defender 0-Day,SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories
** A Microsoft Defender zero-day, ongoing SonicWall SSL-VPN brute-force attacks, and a 17-year-old Excel RCE headline a packed threat week. Patch urgently, enforce MFA, and assume endpoint tooling is
🔴BreachesHIGH
Data breach at edtech giant McGraw Hill affects 13.5 million accounts
McGraw Hill's Salesforce environment was breached by ShinyHunters extortion group, exposing 13.5 million user accounts including students, educators, and institutions. The threat actors leaked data samples online to pressure the company into ransom negotiations.
🔴BreachesHIGH
Smashing Security podcast #463: This AI company leaked its own code. Its also built something terrifying
Hackers breached Venice's flood defense for $600 ransom, exposing critical infrastructure vulnerabilities. Combined with AI tools automating exploit discovery, incidents reveal an asymmetric security advantage now favoring attackers across the board.
🔴BreachesHIGH
WordPress plugin suite hacked to push malware to thousands of sites
30+ WordPress plugins in EssentialPlugin were compromised with obfuscated malware, granting attackers backdoor admin access and enabling data theft on thousands of sites in a critical supply chain attack.
🔴BreachesMEDIUM
Microsoft pays $2.3M for cloud and AI flaws at Zero Day Quest
Microsoft awarded $2.3M to researchers for critical cloud and AI vulnerabilities enabling privilege escalation and data access. The record bounty underscores the severity of enterprise security threats in cloud-native environments.
🔴BreachesHIGH
Crypto-exchange Kraken extorted by hackers after insider breach
Kraken faces extortion from hackers claiming insider access to internal systems storing customer data. The exchange confirmed the threat but found no evidence customer funds were compromised, and law enforcement is investigating the breach.
🔴BreachesHIGH
McGraw-Hill confirms data breach following extortion threat
McGraw-Hill suffered a breach via misconfigured Salesforce, exploited by extortionists demanding payment. It exposed personal data and underscores risks of cloud misconfigurations.
🔴BreachesHIGH
5 Ways Zero Trust Maximizes Identity Security
Stolen credentials are in 60% of breaches. Zero Trust shifts from trusting the firewall to validating every access request, making identity verification the new security perimeter.
🔴BreachesHIGH
Europes Largest Gym Chain Says Data Breach Impacts 1 Million Members
**Europe's largest gym chain disclosed a breach affecting 1 million members across 12+ countries, exposing personal data including health metrics, payment information, and identity documents. Unauthorized access persisted for approximately 8-10 months before detection.** (186 characters, 2 sentence
🔴BreachesHIGH
European Gym giant Basic-Fit data breach affects 1 million members
Dutch fitness chain Basic-Fit exposed approximately 1 million gym members' personal data across Europe after attackers breached its systems. The intrusion was discovered during routine security monitoring, making it one of the largest incidents targeting the fitness industry.
🔴BreachesHIGH
Stolen Rockstar Games analytics data leaked by extortion gang
ShinyHunters breached Anodot's analytics platform, exposing Rockstar Games customer data. After failed ransom demands, the gang published the stolen files, demonstrating third-party vendor risks.
🔴BreachesHIGH
New Booking.com data breach forces reservation PIN resets
Booking.com disclosed a data breach exposing millions of users' reservation data and credentials, prompting mandatory password resets. The breach may have persisted undetected for an extended period before discovery through unusual account activity and unauthorized login attempts.
🔴BreachesMEDIUM
OpenAI rotates macOS certs after Axios attack hit code-signing workflow
OpenAI rotated macOS code-signing certificates after malicious Axios ran in its CI/CD pipeline. Stolen certs could let attackers sign trojanzied software appearing legitimate, bypassing user trust.
🔴BreachesHIGH
Booking.com Says Hackers Accessed User Information
Booking.com confirmed a breach without disclosing how many customers were affected. The incident raises concerns about unauthorized access to sensitive payment and personal information.
🔴BreachesHIGH
North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware
APT37 uses Facebook to slowly build fake friendships before delivering RokRAT malware to high-value targets, exploiting social media's normalized trust mechanisms for advanced cyber espionage.
🔴BreachesMEDIUM
OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident
OpenAI revoked its macOS certificate after a compromised Axios dependency infiltrated its code-signing workflow. No user data was exfiltrated, but the incident exposes supply chain vulnerabilities in modern software development.
🔴BreachesHIGH
CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads
Threat actors breached CPUID in April 2025 for 19 hours, distributing STX RAT malware via trojanized CPU-Z and HWMonitor downloads. Millions of IT professionals and system administrators unknowingly received compromised hardware monitoring tools in the supply chain attack.
🔴BreachesHIGH
Hims Breach Exposes the Most Sensitive Kinds of PHI
Hims' breach exposed sensitive PHI for hundreds of thousands—prescriptions, diagnoses, payment data, genetic info—creating major fraud and identity theft risks.
🔴BreachesHIGH
Your Next Breach Will Look Like Business as Usual
Modern breaches hide in plain sight by mimicking routine business activity. Attackers now prioritize stealth and long-term access (averaging 204 days undetected) over dramatic exploits, using legitimate credentials to evade traditional security defenses.
🔴BreachesHIGH
CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads
CPUID was compromised, redirecting CPU-Z and HWMonitor downloads to serve malware. This supply chain attack impacted millions of users relying on official software sources.
🔴BreachesCRITICAL
Nearly 4,000 US industrial devices exposed to Iranian cyberattacks
Iranian state-linked threat actors have mapped ~4,000 Internet-exposed Rockwell Automation industrial controllers controlling US critical infrastructure like power grids and water systems. The systematic targeting suggests strategic staging for future large-scale cyberattacks on essential services.
🔴BreachesCRITICAL
Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday
Iran-attributed groups escalate ICS attacks on critical infrastructure. They've shifted from random scanning to highly targeted intrusions with sophisticated multi-stage operations.
🔴BreachesMEDIUM
Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor
CPUID's distribution was compromised, injecting malware into official CPU-Z and HWMonitor packages. Users downloading these widely-trusted system tools unknowingly received malicious versions.
🔴BreachesMEDIUM
Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers
Nextend's update servers were compromised, distributing backdoored Smart Slider 3 Pro to thousands of WordPress sites. Attackers exploited the trusted update mechanism to inject malware undetected.
🔴BreachesMEDIUM
Google Rolls Out Cookie Theft Protections in Chrome
Google is launching cookie theft protections in Chrome to prevent session hijacking. Stolen cookies enable attackers to bypass authentication and access user accounts without passwords.
🔴BreachesHIGH
Do Ceasefires Slow Cyberattacks? History Suggests Not
Ceasefires rarely curb state-sponsored cyberattacks due to attribution challenges and weak international agreements. Iranian cyber actors like IRGC Cyber Command operate in diplomatic gray zones, continuing operations despite military truces.
🔴BreachesHIGH
Smart Slider updates hijacked to push malicious WordPress, Joomla versions
Attackers hijacked Smart Slider 3 Pro's update system to distribute backdoors affecting 100,000+ WordPress/Joomla sites, granting persistent administrative access through legitimate-appearing updates. This supply chain attack exemplifies the trend of targeting popular CMS plugins for maximum impact.