Sony Network Communications has disclosed a data breach exposing more than 2.58 million customer records following unauthorized access to its So-net membership database. The incident also compromised passwords for 54,401 email addresses across four email services. According to the company’s announcement, the intrusion occurred on October 19 but was discovered on October 23. Sony then … The post Sony discloses data br…
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services says British police data has been breach several times this decade through third-party IT suppliers.
The major cyber attacks of September 2026 hit federal law enforcement, a rival cybercrime gang, and the companies that verify identities. ShinyHunters hijacked the Clop ransomware gang’s Dark Web leak site and, four days later, claimed a breach of the Federal Bureau of Investigation (FBI). Identity data drove the month’s biggest numbers, led by adata […]
A leaked SquareML access key could have been used to access a database containing personal and health information. The post Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk appeared first on SecurityWeek.
AI is widening the attack surface of the critical infrastructure facilities and services that state, local, and education (SLED) organizations run. In the final post of our Cybersecurity Awareness Month series, we explain how a whole-of-state security approach can help SLED agencies protect their critical infrastructure.Key takeawaysBecause cyber attackers prey on under-resourced targets, they often go after SLED org…
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach. Hospitals diverted ambulances and canceled appointments The University of New Mexico, located in Albuquerque, New Mexico, is a public research university. Its H…
An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday. The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Ange…
The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a b…
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.Key TakeawaysCVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Goog…
The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected. The post Genesys Hack Exposes Customer Data From Internal Systems appeared first on SecurityWeek.
SOCRadar Dark Web Team identified several underground posts, including an alleged Finaxis.cloud data sale involving 400GB of information, a resurfaced WoWInstaller database containing historical user credentials, and an alleged Argentine Moodle platform data leak. Other posts advertised an alleged MyHairCare Australia customer database and an alleged HT Médica database containing 2.2 million records. Alleged Finaxis.…
Japanese companies are starting to compensate customers after a run of cyberattacks disrupted internet services and stirred concerns about economic stability. GMO Internet is the latest to do so, pledging payouts after hackers breached its foreign exchange trading service. In a blog post on Oct 25, chief executive Masatoshi Kumagai said customers would be compensated for losses caused by unauthorized access, and each…
Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group's leader, who never studied IT, used AI to rapidly expand the range of targets. Seven Suspects Tied to the Cybercrime Ring On the 26th, the Cyber Investigation Division of the Seo…
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Addresses U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known […]
Pizza Hut Japan has disclosed a data breach affecting its online ordering service after an unauthorized third party accessed a payment API and obtained customer information. The company confirmed the unauthorized access on October 19, 2026, and publicly disclosed the incident on October 23. Its investigation into the cause and full scope of the breach … The post Pizza Hut Japan suffers data breach exposing customer i…
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, […]
If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week—and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet. You may find yourself wondering: what is PHP, what just happened, what is the vulnerability apocalypse, and what do I need to do? To fi…
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.
Every security checklist starts with the basics: strong passwords, multifactor authentication, spotting phishing, and keeping software up to date. All four protect what happens after a laptop starts. But some attackers are more focused on what happens before. That’s the domain of the BIOS, the first code that runs when a laptop powers on. It checks the hardware, then hands control to the operating system. Malware pla…
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
The AfD has confirmed that hackers breached its hosting provider. A leak site now claims to offer 421,179 of the party’s internal emails, and shows AI-written summaries rather than the emails themselves. Read more in my article on the Hot for Security blog.
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause
The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts. The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek.
