data breach

Bitget says third-party zero-day enabled $387.5M hack

Cryptocurrency exchange Bitget said attackers who took $387.5 million from its hot and warm wallets got in through a zero-day vulnerability in third-party security products. The exchange cited ongoing investigation findings from blockchain security firm SlowMist. As investigators pieced together…

Morgan Stanley staffer accidentally leaks Asia deal list

A Morgan Stanley employee accidentally sent an internal document detailing more than 100 investment-banking deals the firm is working on across Asia, exposing sensitive pipeline information in what Bloomberg News described as an email misfire.

Hacker used AI agents to breach 100 firms, steal 600K credit cards

A Chinese-speaking hacker spent roughly $8,000 on AI model access to launch autonomous cyberattacks against as many as 100 online retailers earlier this month, stealing more than 600,000 credit card records in what one researcher called one of "the most…

Hackers used Anthropic’s Claude to break into OpenAI

Independent cybersecurity researchers used Anthropic's Claude to gain access to a ChatGPT account belonging to an OpenAI employee, allowing them to view and suggest changes to the company's private code repository, the Wall Street Journal News Corp reported on Thursday.

OpenAI’s rogue agents probed Hugging Face months before July hack, Reuters reports

Rogue AI agents from OpenAI hijacked Hugging Face user accounts and probed the open-source platform for vulnerabilities as early as May, nearly two months before the July breach that triggered a global reckoning over AI safety, according to a Reuters…

Hackers demand $780M in Bitcoin from Revolut after data breach

Revolut confirmed on September 12 that it disclosed sensitive customer data to an unauthorized party after fraudulent requests arrived from an email address on a legitimate government agency domain, in what the fintech is calling a "sophisticated external impersonation scam."…

220M airline passenger records exposed in Vietnam-linked database leak

A misconfigured Elasticsearch database left more than 220 million airline passenger and crew records — including passport numbers, nationalities, and detailed flight itineraries — accessible on the open internet for an unknown period before being secured in June, security researchers…

Anthropic forces logouts after malware hijacks Claude sessions

Anthropic warned Claude users on Saturday that infostealer malware running on their personal computers had been stealing active login sessions, allowing attackers to access accounts and burn through paid usage. The company responded by forcibly signing out affected users and…

Rockstar calls GTA 6 leaks ‘heartbreaking,’ confirms Nov. 19 launch

Rockstar Games broke its silence on Wednesday, August 26, describing the wave of unauthorized Grand Theft Auto VI gameplay footage that has spread online over the past week as "heartbreaking" for its development team. The studio confirmed the game's November…

Leaked API keys expose 688,000 Stripe customer records across 42 countries

A threat actor posted a dataset containing live Stripe API keys for 659 merchant accounts on a data-trading forum on August 18, 2026, exposing data linked to an estimated 688,363 customer records across 42 countries. The incident does not appear…

GTA 6 gameplay and map leak online ahead of Netflix reveal

Multiple videos appearing to show Grand Theft Auto 6 gameplay and a full map of the game's open world surfaced online on August 18, just nine days before Rockstar Games' planned Netflix showcase. The leak, attributed to a group calling…

Suspected China-linked hackers exploit VMware flaw across 47 countries

A suspected China-linked advanced persistent threat actor has been actively exploiting a critical vulnerability in Broadcom's VMware vCenter Server, compromising systems across 47 countries and deploying ransomware derived from the Babuk family, according to research published by German incident response…

Millions of employee records stolen from McDonald’s, Vodafone in Azure breach campaign

A threat actor calling themselves "TheHatman" has been selling massive internal employee directories stolen from several Fortune 500 companies, in what cybersecurity firm Hudson Rock describes as a large-scale Azure exfiltration campaign that unfolded over the past week.

SafePal confirms data breach affecting 40,000 customers

SafePal, the hardware wallet maker backed by Binance Labs, has confirmed a security incident that exposed the personal order data of approximately 39,798 customers, raising fresh concerns about physical security risks facing crypto hardware wallet owners.

Cl0p claims mass data theft from Shell, Philips, GE and dozens more

The Russia-linked ransomware group Cl0p has claimed responsibility for stealing large volumes of data from nearly 50 companies worldwide, including Shell, Philips Koninklijke Philips N.V., Fiserv, and GE, according to a posting on the group's website first reported by Dutch…

153GB of stolen credentials surface from LiteLLM attack

A 153GB archive containing credentials stolen during the March 2026 LiteLLM supply chain attack has surfaced, exposing sensitive data linked to nearly 2,500 organizations including Amazon Amazon.com, Inc., Samsung, Cisco, Microsoft, NVIDIA, and Salesforce. Security firms Hudson Rock and CloudSEK…

ShinyHunters claims Metabase breach after zero-day hit

Business intelligence platform Metabase disclosed on August 6 that attackers exploited a zero-day SQL injection vulnerability to breach Metabase Cloud, gaining raw access to application databases and potentially exposing stored credentials, API keys, and connected data warehouse contents. The flaw,…

Researcher who hacked North Korean hackers found 1,640 firms breached

A Greece-based cybersecurity researcher spent nearly two years inside the infrastructure used by North Korean hackers, discovering that 1,640 companies across 57 countries had been compromised by the regime's cyber operations. Vangelis Stykas, CTO at cybersecurity firm Kumio, presented his…

OpenAI took 10 days to tell Hugging Face its AI models were behind hack

OpenAI disclosed on July 21, 2026, that two of its AI models autonomously broke out of a secure testing environment, exploited a previously unknown vulnerability, gained access to the open internet, and hacked into Hugging Face's production infrastructure — all…

Suno AI breach exposed 55 million accounts after 8 months of silence

The AI music generation platform Suno suffered a data breach in November 2025 that went undisclosed for eight months, with Have I Been Pwned adding more than 55 million unique email addresses to its database on July 20, 2026.

Hugging Face says autonomous AI agent breached its systems

Hugging Face disclosed on July 16 that an autonomous AI agent system breached its production infrastructure, marking what the company and security researchers describe as the first end-to-end AI-driven cyberattack against a major AI platform. The intrusion, which unfolded over…

India opens probe into Tata breach that leaked iPhone 18 Pro secrets

John Ternus will take the helm at Apple on September 1, stepping into the chief executive role amid surging product prices, a damaging data breach at a key Indian supplier, and one of the company's most ambitious hardware launches in…

FortiBleed campaign tied to INC and Lynx ransomware groups

A massive credential-harvesting operation targeting hundreds of thousands of Fortinet firewalls worldwide has been directly tied to two ransomware-as-a-service groups, INC Ransom and Lynx, according to new research published by cybersecurity firm SOCRadar on Wednesday.

iPhone 18 Pro details exposed in Tata Electronics breach

A ransomware attack on Tata Electronics has exposed confidential details about Apple's upcoming iPhone 18 Pro, including supplier lists, component specifications, and photos of the devices during drop tests, according to Reuters reporting confirmed by multiple outlets.

Russian hackers linked to $2.5B Jaguar Land Rover cyberattack

Russian hackers carried out last year's cyberattack on Jaguar Land Rover that shut down production for nearly six weeks and inflicted an estimated $2.5 billion in damage on the British economy, according to a New York Times investigation published on…

Tata breach extends to TSMC and Qualcomm files, Reuters reports

A data breach at Tata Electronics is wider than initially reported, with leaked files extending beyond Apple and Tesla to include purported documents from chip giants TSMC Taiwan Semiconductor Manufacturing Company Limited and Qualcomm, according to Reuters reporting published on…

Second hacker group demands ransom from Klue breach victims

Market intelligence platform Klue is now caught in a double extortion scenario after the original hackers behind its June 12 breach claim to be deleting stolen data while a second criminal group has surfaced demanding ransom from affected customers.

LastPass says hackers stole customer data in Klue supply chain breach

A supply chain attack on market intelligence platform Klue has compromised Salesforce data at a growing list of organizations, including multiple cybersecurity companies, after a newly emerged extortion group called Icarus exploited a stolen legacy credential to harvest OAuth tokens…

CISA flags Oracle PeopleSoft flaw exploited to breach 100+ schools

The cybercrime group ShinyHunters exploited a critical zero-day vulnerability in Oracle PeopleSoft to breach more than 100 organizations — most of them universities — between May 27 and June 9, according to Google's Mandiant threat intelligence team and multiple security…

Google confirms ShinyHunters exploited Oracle PeopleSoft zero-day to steal data

The ShinyHunters hacking group exploited a critical zero-day vulnerability in Oracle PeopleSoft to breach more than 100 organizations between late May and early June, with universities bearing the brunt of a campaign that exposed hundreds of thousands of student records…