Tag: breach
-
Critical SAP S/4HANA vulnerability now exploited in attacks
A critical SAP S/4HANA code injection vulnerability is being leveraged in attacks in the wild to breach exposed servers, researchers warn. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-sap-s-4hana-vulnerability-now-exploited-in-attacks/
-
South Carolina School District Data Breach Affects 31,000 People
An investigation has revealed that files were stolen in a data breach affecting a South Carolina school district First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/south-carolina-school-district/
-
Knock-on effects of software dev break-in hit schools trust
Affinity Learning Partnership warns staff after Intradev breach First seen on theregister.com Jump to article: www.theregister.com/2025/09/05/uk_schools_intradev_breach/
-
61% of US Companies Hit by Insider Data Breaches
The OPSWAT report found that insider breaches cost impacted firms $2.7m on average due to factors such as regulatory fines and diminished productivity First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/us-companies-insider-data-breaches/
-
Behind the Salesforce OAuth Drift Breach
In recent weeks, major companies like Palo Alto Networks, Zscaler, Cloudflare, and SpyCloud have all confirmed they were affected by a string of cyberattacks that began with Salesforce. Or at least, that is how the headlines read. This is not a case of Salesforce being hacked. Nor is it a flaw in any single product….…
-
Behind the Salesforce OAuth Drift Breach
In recent weeks, major companies like Palo Alto Networks, Zscaler, Cloudflare, and SpyCloud have all confirmed they were affected by a string of cyberattacks that began with Salesforce. Or at least, that is how the headlines read. This is not a case of Salesforce being hacked. Nor is it a flaw in any single product….…
-
File security risks rise as insiders, malware, and AI challenges converge
Breaches tied to file access are happening often, and the costs add up quickly. Many organizations have faced multiple file-related incidents over the last two years, with … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/05/file-security-risks-challenges/
-
File security risks rise as insiders, malware, and AI challenges converge
Breaches tied to file access are happening often, and the costs add up quickly. Many organizations have faced multiple file-related incidents over the last two years, with … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/05/file-security-risks-challenges/
-
Chess.com Confirms Data Breach After Hackers Exploit External System
Chess.com, the world’s leading online chess platform, has confirmed a significant data breach that compromised personal information of thousands of users after hackers successfully exploited an external system connected to their network. The Orem, Utah-based company disclosed that the security incident affected4,541 individualsacross the United States, including one Maine resident. The breach occurred onJune 5,…
-
Sitecore zero-day configuration flaw under active exploitation
__VIEWSTATE and can be signed and encrypted with keys, called ValidationKey and DecryptionKey, stored in the application configuration file.If these keys are stolen or leaked, attackers can use them to craft malicious ViewState payloads inside POST requests that the server will then decrypt, validate, and execute by loading them into the memory of its worker…
-
ISC2 Aims to Bridge DFIR Skill Gap with New Certificate
The Nonprofit organization launched the Threat Handling Foundations Certificate amid mounting incident and breach disclosures. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-careers/isc2-aims-to-bridge-dfir-skill-gap-with-new-certificate
-
Breach Roundup: Scattered Lapsus$ Hunters Behind Jaguar Hack
Also, Disney Pays $10M to Settle Child Privacy Case, Spain Scraps Huawei Deal. This week, Jaguar hack, Disney settled a child privacy case, Texas sued PowerSchool and federal prosecutors sued a toy maker. Spain voided a Huawei contract, Pennsylvania AG confirmed a ransomware attack. U.S. immigration enforcement resumed a spyware contract and Baltimore lost $1.5…
-
Chess.com says 4,500 people had data stolen during June breach
In breach notifications submitted to regulators in Maine and Vermont, Chess.com explained that 4,541 people had personal information exposed to hackers who breached an unnamed file transfer application between June 5 and June 18. First seen on therecord.media Jump to article: therecord.media/chess-platform-data-breach-file-transfer-tool
-
Q2 2025 Bot Attack Trends: AI Scraping, Scalper Bots, and Travel Fraud
Kasada’s Q2 2025 Threat Report breaks down the top bot attack trends: from AI scraping bots hammering infrastructure, to scalper bots flipping hype-driven inventory, to stolen travel accounts surging in underground value. Learn how adversaries made money last quarter and what your team can do to stop them. First seen on securityboulevard.com Jump to article:…
-
Identity-First Security: Mitigating the Cloud’s Greatest Risk Vector
Tags: access, ai, attack, best-practice, breach, business, cloud, credentials, data, defense, exploit, framework, google, iam, identity, infrastructure, least-privilege, microsoft, phishing, ransomware, risk, service, strategy, threat, vulnerabilityCompromised credentials are now the leading cause of cloud breaches, making identity your most critical attack surface. A new IDC white paper explores why this shift is happening and where traditional defenses fall short. Read on to learn how Tenable’s identity-first approach turns this risk into your strongest defense. Hack the user, own the cloud.…
-
Texas sues PowerSchool for breach exposing the data of students and teachers
More than 880,000 Texans were affected by the breach at education tech provider PowerSchool, state Attorney General Ken Paxton noted in filing a lawsuit against the company. First seen on therecord.media Jump to article: therecord.media/powerschool-data-breach-texas-lawsuit-ken-paxton
-
Texas sues PowerSchool over breach exposing 62M students, 880k Texans
Texas Attorney General Ken Paxton has filed a lawsuit against education software company PowerSchool, which suffered a massive data breach in December that exposed the personal information of 62 million students, including over 880,000 Texans. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students/
-
BSidesSF 2025: BSidesSF 2025 Light In The Labyrinth: Breach Path Analysis For Anyone
Creator, Author and Presenter: Parker Shelton Our deep appreciation to Security BSides – San Francisco and the Creators, Authors and Presenters for publishing their BSidesSF 2025 video content on YouTube. Originating from the conference’s events held at the lauded CityView / AMC Metreon – certainly a venue like no other; and via the organization’s YouTube…
-
Iran-Nexus Hackers Impersonate Omani MFA to Target Governments Entities
Tags: breach, communications, cyber, cybersecurity, exploit, government, group, hacker, intelligence, iran, malicious, mfa, phishing, spear-phishingCybersecurity researchers uncovered a sophisticated, Iran-linked spear-phishing operation that exploited a compromised Ministry of Foreign Affairs (MFA) mailbox in Oman to deliver malicious payloads to government entities worldwide. Analysts attribute the operation to the “Homeland Justice” group, believed to be aligned with Iran’s Ministry of Intelligence and Security (MOIS). Leveraging stolen diplomatic communications, encoded macros,…
-
Blast Radius of Salesloft Drift Attacks Remains Uncertain
Many high-profile Salesloft Drift customers have disclosed data breaches as a result of a recent supply-chain attack, but the extent and severity of this campaign are unclear. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/salesloft-drift-attacks-blast-radius-uncertain
-
6 browser-based attacks all security teams should be ready for in 2025
The browser is now the frontline for cyberattacks. From phishing kits and ClickFix lures to malicious OAuth apps and extensions, attackers are targeting the very place your employees access business-critical apps. Push Security explains how to defend where breaches begin. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/6-browser-based-attacks-all-security-teams-should-be-ready-for-in-2025/
-
Scattered Spider-Linked Group Claims JLR Cyber-Attack
JLR said it is investigating following claims by the actor “Scattered Lapsus$ Hunters” that it had stolen data from the firm and had issued an extortion demand First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/scattered-spider-claims-jlr-cyber/
-
Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690)
A threat actor is leveraging a zero-day vulnerability (CVE-2025-53690) and an exposed sample ASP.NET machine key to breach internet-facing, on-premises deployments of several … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/04/sitecore-zero-day-vulnerability-cve-2025-53690-exploited/
-
Scattered Lapsus$ Hunters Demand Google Fire Security Experts or Face Data Leak
Scattered Lapsus$ Hunters threaten Google, demanding that two security experts, Austin Larsen of Google’s Threat Intelligence Group and Charles Carmakal of Mandiant, be fired or they will leak alleged stolen Google data. First seen on hackread.com Jump to article: hackread.com/scattered-lapsus-hunters-google-fire-experts-data-leak/
-
Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690)
A threat actor is leveraging a zero-day vulnerability (CVE-2025-53690) and an exposed sample ASP.NET machine key to breach internet-facing, on-premises deployments of several … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/04/sitecore-zero-day-vulnerability-cve-2025-53690-exploited/
-
Palo Alto Networks disclosed a data breach linked to Salesloft Drift incident
Palo Alto Networks hit by Drift-linked supply-chain attack, exposing Salesforce customer data and support cases via stolen OAuth tokens. Palo Alto Networks is another victim of the Salesloft Drift incident, which allowed attackers to access its Salesforce account, as per BleepingComputer. The company discloses a breach after attackers used stolen OAuth tokens from Salesloft Drift,…
-
Why Compliance-First Cybersecurity Programs Fail (And What Actually Works)
Most B2B companies build cybersecurity programs backwards – starting with compliance instead of real security. Learn why this approach fails and how fractional CISO services can help you build effective security that actually prevents breaches while achieving compliance. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/why-compliance-first-cybersecurity-programs-fail-and-what-actually-works/
-
Critical Linux UDisks Daemon Vulnerability (CVE-2025-8067) Exposes Privileged Data to Local Attackers
A newly disclosed security flaw in the Linux UDisks daemon has been reported. Tracked as CVE-2025-8067, the out-of-bounds read vulnerability allows local, unprivileged users to access files and data owned by privileged accounts, a serious breach with potentially far-reaching implications. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/linux-daemon-vulnerability-cve-2025-8067/