Breaches, vulnerabilities, and attack techniques — explained in plain language, with the part most headlines skip: what an admin should actually do next. Every story here is checked against the primary research or vendor advisory behind it, and the identity lessons run through all of them: exploits get in, but identity decides how far they get.
Start here
- Exploits Get In. Identity Decides How Far They Get.
- MFA Is On. Attackers Walk Around It. Passkeys Close the Door.
- 2026 in Breaches: The Attacks Were Different. The Mistakes Were the Same.
125 Million Texts. Your Bank Code Was in There.
For nearly four years, a database holding more than 125 million text messages sat open on the internet. Anyone who found it could read bank alerts, login codes, password resets, medical results, and travel bookings — for customers of two of the Baltics’ biggest banks, the main airline, and the national emergency hotline. The database…
Two Million Texans. One Unproven Claim.
A ransomware gang says it stole the personal records of about two million Texans from the state agency that runs Medicaid, food assistance, and disaster aid. The gang has shown no proof. The agency has said nothing. And the claim is still worth taking seriously — because of who is making it, and what they…
Twenty Minutes to Steal It. Meme Coins to Wash It.
It took North Korea-linked hackers twenty minutes to steal as much as $6.4 billion in cryptocurrency from Binance, the world’s largest crypto exchange. Washing it is taking a little longer — and the laundry method is almost insulting in its simplicity: they are minting joke coins with Elon Musk’s face on them. According to blockchain…
The Breach Lasted Three Years. Finnair Just Found Out.
Finnair has just told its passengers something no airline wants to say: about 116,000 of its bookings were caught up in a data breach — and the breach had been running quietly for three years. The airline says Amadeus, the company that supplies its booking and flight management systems, informed it that flight lists for…
The Private Room Had a Hole. The Attacker Walked In.
NEAR AI built a private room for its users’ AI requests — a locked-down environment where even the company itself was not supposed to be able to see what was being processed. Last Sunday, an attacker walked straight through the wall. The break-in did not come through a stolen password or a phishing email. It…
The Store Looked Fine. 37.6 Million Records Were Gone.
Japan’s biggest furniture chain looked fine from the outside. Inside, an intruder had been moving through its systems for weeks. Nitori — often called the “IKEA of Japan” — disclosed on November 10 that an attacker may have stolen up to 37.62 million customer records, and that the company only discovered the break-in on November…
Your Backup Server Let Them In. They Never Left.
Backup servers exist for the worst day of your life — the day everything else is gone. Attackers know that. And in October, according to research from Huntress, an unknown threat actor broke into backup servers on purpose, using two zero-day flaws in AhsayCBS, and then stayed to mine cryptocurrency, plant backdoors, and steal the…
The Newsletter Leaked. 2.2 Million Inboxes Exposed.
SEGA has disclosed that a data breach at its newsletter provider exposed the email addresses of 2.2 million subscribers — and the company that lost the data is not the company that was breached. The data lived with a third party. So did the risk. The breach hit ARARA, a Japanese email distribution provider. SEGA…
The Provider Was Breached. Fireworks Got Hit Twice.
Fireworks AI has been breached twice in a month — and the second time, the attackers did not even have to break into Fireworks directly. They broke into a cloud provider that hosted the company’s development machines, then walked through the open door. Fireworks runs a high-performance inference platform that lets developers deploy and run…
The Mail Server Was Listening. So Was Russia.
Your mail server was never supposed to be the spy. But according to new research from ESET, a Russian state-backed hacking group turned Microsoft Exchange servers at government organizations into listening posts — reading selected emails as they passed through, leaving almost no trace. The group is Turla — also known as Snake, Secret Blizzard,…
A Whole Campus Told to Power Off.
Vanderbilt University told its entire campus to shut down. On Monday, the university confirmed it is responding to an active cybersecurity incident and warned students, faculty, and staff that university devices, systems, and cloud-based services may be affected. The instruction was unusually direct: power off university devices, disconnect from university Wi-Fi, and watch for suspicious…
The Patch Was Ready. The Attacks Came Anyway.
The patch was ready. The attacks came anyway. Barracuda Networks warned on Monday evening that attackers have begun exploiting two recently patched Email Security Gateway vulnerabilities — the same two flaws this blog covered last week — to gain root access on customer systems. Barracuda released the security updates one week ago. On Monday, the…
It Arrives as a Shortcut. It Stays as a Backdoor.
Nothing in this attack looks like an attack. A shortcut file. A disk image that opens a spreadsheet. An installer doing what installers do. But researchers at Fortinet’s FortiGuard Labs say the espionage group known as Bitter is using exactly those unremarkable objects to plant a brand-new backdoor, PapRAT, inside South Asian organizations. Bitter —…
They Say a Password Change Won’t Save You. Nobody Has Proven It.
Here is the claim, stated plainly so we can be honest about what follows: the developers of an infostealing malware called Remus Stealer say that for $1,000 a month, their customers can read a victim’s Gmail inbox — search it, browse it, even share access to it — and keep that access after the victim…
Nineteen Years of Forms. One Breach Took Them.
Every form a university collects feels harmless in the moment: an email address here, a phone number there, a date of birth for the record. York University in Toronto has just learned what happens when nineteen years of those forms end up in the wrong hands. The school has confirmed that an intruder accessed personal…
The Wiper Hit at Night. The Cloud Is Being Rebuilt by Hand.
There was no ransom note. Nobody demanded payment, and investigators found no sign that data was stolen. On the night of November 1, someone got inside the systems that manage Beget — one of Russia’s largest cloud and hosting providers — and simply erased everything they could reach. More than a week later, the company…
700 Stores. 15 Fires. France Names the Attackers.
France has named the attackers behind the October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations: Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps. The attacks caused tens of millions of euros in food losses and sparked at least…
One Vendor Key. Every Customer’s Cloud.
An attacker broke into the Amazon Web Services accounts of multiple Qubole customers and stole stored secrets and data. The break-in ran October 14–26, according to cloud security company Wiz, which disclosed the campaign on Monday. The attacker did not break into Qubole itself. It used credentials for the AWS account Qubole’s platform uses to…
Thirty Zero-Days in One Night. The Platform Went Dark.
Late on Sunday night, a security researcher published more than 30 alleged zero-day vulnerabilities in N-able’s N-central platform, complete with working proof-of-concept exploits. By Monday afternoon, N-able had taken its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific, and told customers running the software on their own servers to shut them down until…
$16 Billion in Dirty Crypto. The U.S. Just Cut the Cord.
The United States just cut one of the world’s biggest crypto exchanges off from the American financial system. The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) issued an order on November 6 barring U.S. financial institutions from doing business with MEXC Global, a Seychelles-based exchange with more than 40 million users in over 170 countries.…
The CEO on the Call Wasn’t Real. $129 Million Walked Out.
The chief executive was on the video call. His face was right. His voice was right. He had an urgent, confidential transaction that needed the employee’s help, and he had a lawyer ready to walk them through it. None of it was real. The executive was a deepfake. The lawyer was a deepfake. And by…
Shut It Down. The Wallets Are Under Attack.
If you run an LNbits server, the project has one message for you: turn it off. Not later. Now. On Saturday, November 8, LNbits — the free, open-source wallet system that lets anyone run a Bitcoin Lightning wallet — told every operator to shut down their servers amid a wave of attacks. The project is…
The List Is Public. The Bounty Is for Their Families.
A pro-Kremlin hacking group has published the personal data of 18 European politicians, police officials, and journalists — and is offering cryptocurrency bounties for more information about the targets and their families. The group, NoName057(16), posted the list on a dark web page reachable only through Tor, calling the targets citizens “hostile to the Russian…
A Suspicious File. 7.7 Million Shoppers Exposed.
A suspicious file in a cloud service. A store shut down the same day. And now as many as 7.7 million people may have had their personal information exposed. Japanese manufacturer Iris Ohyama, which runs the Iris Plaza shopping platform, disclosed this week that unauthorized access to a third-party cloud service it used may have…
The Password Was ‘admin’. The Cars Unlocked Anyway.
Two car brands left the keys to every customer’s account — and every connected car — sitting behind a password anyone could guess. The password was “admin.” The username was “admin” too. Security researchers Shubham Shah and Sam Curry found the opening in the login systems behind the two brands’ mobile apps. Both apps sign…
They Stole Your AI Keys. You Paid the Million.
Your AI bill arrived a million dollars heavy, and nobody in your company ran a single extra prompt. That is the new shape of cloud theft. Google’s Threat Intelligence Group and Mandiant warned this week that criminals are stealing enterprise access to large language models, running up enormous bills on someone else’s account, and reselling…
The Freezers Were Hacked. The Food Spoiled.
Hackers are not just stealing data from supermarkets anymore. They are turning up the heat — literally. The FBI and CISA have issued a joint warning that attackers are actively targeting industrial refrigeration and cold-chain monitoring systems around the world, forcing freezers into defrost, raising temperatures to 50°C (122°F), and in some cases shutting the…
The Alert Was Fake. The Danger Was Real.
Imagine the alert on your phone telling you a disaster is coming. You trust it instantly — that is the whole point of a disaster alert system. Now imagine the alert itself is the attack. That is what happened in Japan, where hackers broke into a disaster alert service used by hundreds of local governments…
An Aid Agency’s Portal. 20,614 Users Exposed.
Norway’s national aid agency has confirmed a cyberattack on the portal that distributes billions in development funding — and the attackers got in through just 27 user accounts. The names and email addresses of 20,614 registered users were compromised, and data was stolen from at least three organizations. Norad, the Norwegian Agency for Development Cooperation,…
The Backdoor Was Built In. 1.3 Million TVs.
Your TV box did not get hacked. It arrived hacked. Google has dismantled a botnet of more than 1.3 million Android TV streaming boxes — and the malware was not slipped in by an attacker after the sale. The manufacturer built it in at the factory, on purpose, and rented the infected boxes out to…
Something went wrong. Please refresh the page and/or try again.
Follow My Blog
Get new content delivered directly to your inbox.