Tag

data breach

13 stories

DigiCert says a migration exposed archived customer data

DigiCert confirmed a breach in an internal business system that held archived customer contact details and identity documents. The company said the exposed information covered only a small share of its archived data, and its public report did not give a total count of affected people, organizations, or documents. Unauthorised access to archived records The exposure involved names, business email addresses, phone numbers, and business addresses. A small minority of…

Saugata DattaNov 5, 20263 min read41

Compliance and Privacy

DreamHost says File Manager breach exposed customer login details

DreamHost confirmed that attackers used its web-based File Manager to reach customer login details, and in a small number of cases they may also have viewed private mailbox contents. The hosting provider said the exposed data included FTP/SFTP usernames and passwords, plus some webmail credentials. It discovered the unauthorized access on October 23, 2026, and its investigation placed the possible exposure window back to approximately August. What DreamHost found DreamHost…

Saugata DattaNov 5, 20263 min read39

Compliance and Privacy

Harvard’s alumni systems breach exposed data for 850,500 accounts

Hackers broke into Harvard University’s Alumni Affairs and Development systems in November 2025 and took data tied to more than 850,000 unique email addresses. The university later said the exposed records reached students, alumni, donors, staff, and faculty, while the breached systems did not hold Social Security numbers, passwords, payment card information, or financial information. Harvard’s disclosed data loss Klara Jelinkova, Harvard’s Vice President and University Chief Information Officer, said…

Saugata DattaNov 3, 20262 min read73

AI Agents and Frameworks

Chainalysis Confirms Customer Data Exposure After Attackers Used “Offensive Agentic Techniques”

Blockchain analytics firm Chainalysis has disclosed a security incident after attackers used what the company described as "offensive agentic techniques" to gain unauthorized access to internal systems and tools. The company says some customer information—names, email addresses, user IDs, and organizational role labels—was accessed, but it has found no evidence that sensitive investigation data, authentication credentials, or session tokens were exposed. Chainalysis is still determining the full scope of accessed…

Saugata DattaOct 31, 20263 min read111

Compliance and Privacy

CBFC Data Breach: e-Cinepramaan Records for 500+ Films Exposed

India’s Central Board of Film Certification (CBFC) is investigating a reported data exposure that left confidential certification documents for hundreds of films accessible online. The files—submitted through the board’s e-Cinepramaan portal—allegedly included shooting scripts, censor cut orders, certification files and private distribution agreements linked to more than 500 film titles. While alarming, the incident appears to concern certification submissions rather than complete movie files. What was exposed Reports indicate the…

Saugata DattaOct 26, 20263 min read163

Artificial Intelligence

AI-Assisted Intrusion: DeepSeek-Powered Attacker Steals Over 5,200 University Records

A relatively unsophisticated threat actor using the handle BUGSTER leveraged AI tools to undertake a string of intrusions against Indian organizations, including at least two universities, and exfiltrated a MongoDB database with more than 5,200 records, according to researchers at Palo Alto Networks’ Unit 42. The case illustrates how readily available AI assistants, when combined with weak account hygiene and ordinary scripts, can amplify the capabilities of an attacker who…

Saugata DattaOct 23, 20263 min read247

Compliance and Privacy

SBI Leak Exposes How Small Breaches Become Big Risks in India

The State Bank of India recently disclosed a breach that, on the surface, looks tiny: fewer than 4,000 customer records exposed from an institution that serves more than half a billion people. But even a “very, very small” leak can produce outsized harm in India’s tightly connected identity ecosystem. The incident spotlights how peripheral systems, third-party handling of KYC materials, and an active underground market for personal data turn limited…

Saugata DattaOct 23, 20264 min read239

Cybersecurity

PwC Faces Data-Extortion Claim: What We Know and What Organizations Should Do

The Everest ransomware group has publicly claimed to have stolen roughly 590.69 GB of data from PwC, alleging that the haul includes HR records, training materials and internal documents. At the time of the claim the details were unverified and PwC had not issued a public response; the listing appeared on Everest’s leak site on October 22, 2026. This post lays out the factual elements reported so far, what the…

Saugata DattaOct 23, 20264 min read244

Compliance and Privacy

Capcom confirms CAPCOM ID breach affecting 11.7 million accounts — what users need to do

Japanese gaming giant Capcom has confirmed unauthorized access to its CAPCOM ID membership service, exposing the email addresses and related account metadata of roughly 11.7 million users. While the company says passwords for the vast majority of accounts and payment card data were not exposed, a small number of accounts contained additional personal details and a few had their passwords maliciously changed. Capcom detected suspicious activity on October 19, launched…

Saugata DattaOct 23, 20264 min read249

Compliance and Privacy

Mass Exposure: What the CPR Breach Means for 8.8 Million People in Denmark

Denmark's central population register (CPR) was the target of a large-scale data access event: unauthorized parties used a private company's legitimate access rights to query the register and, according to official statements, obtained names, addresses and personal identification numbers for roughly 8.8 million people. The activity lasted about ten days in September and was discovered by the register's administration on October 2; the company account was suspended and the case…

Saugata DattaOct 6, 20265 min read300

Compliance and Privacy

ShinyHunters’ “Rey” Detained in Jordan: What His Cooperation Means for the FBI Probe

A suspected member of the ShinyHunters group who uses the online alias “Rey” has reportedly been detained in Jordan and is cooperating with U.S. law enforcement. Identified in reporting as Saif al‑Din Khader (also known online as ReyXBF), he was allegedly taken into custody on September 29, 2026. Sources say his cooperation is already assisting the FBI and other agencies as they pursue leads to identify and apprehend additional individuals…

Saugata DattaOct 4, 20264 min read298

Compliance and Privacy

Lovable AI App Builder Reportedly Exposes Thousands of Projects’ Source Code and Customer Data

A critical Broken Object Level Authorization (BOLA) vulnerability in Lovable, an AI-powered app builder, has reportedly left thousands of legacy projects accessible to unauthorized users. According to security researchers, an API endpoint returned full project data — including source code, database credentials, AI chat histories, and customer information — for projects created before November 2025. While Lovable appears to have patched newly created projects, the persistent exposure of older projects…

Saugata DattaApr 20, 20264 min read569

Free Tools: IP, DNS, SSL