Collecting Cyber-News from over 60 sources

Tag: data-breach

Navia discloses data breach impacting 2.7 million people

Mar 19, 2026 10:10 PM

Tags: breach, data, data-breach

Navia Benefit Solutions, Inc. (Navia) is informing nearly 2.7 million individuals of a data breach that exposed their sensitive information to attackers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/navia-discloses-data-breach-impacting-27-million-people/
Ransomware crims abused Cisco 0-day weeks before disclosure, says Amazon security boss

Mar 19, 2026 7:10 PM

Tags: cisco, data-breach, exploit, ransomware, zero-day

Interlock’s post-exploit toolkit exposed First seen on theregister.com Jump to article: www.theregister.com/2026/03/18/amazon_cisco_firewall_0_day_ransomware/
Bolster your defenses and close the codecloud gap with Tenable and OX

Mar 19, 2026 6:10 PM

Tags: access, ai, application-security, attack, business, ciso, cloud, container, control, data, data-breach, defense, detection, endpoint, exploit, framework, identity, infrastructure, intelligence, Internet, risk, service, software, strategy, technology, threat, tool, training, vulnerability

Today, cloud security teams face fragmented visibility and the challenge of prioritizing risks while identifying fix owners. A new joint solution from Tenable and OX helps you close the code-to-cloud gap from development through runtime. By combining CNAPP with deep AppSec, this integration is designed to eliminate visibility gaps and accelerate remediation. Key takeaways Bridge…
The multi-billion dollar mistake: Why cloud misconfigurations are your biggest security threat

Mar 19, 2026 12:10 PM

Tags: access, authentication, breach, cisa, ciso, cloud, control, cyber, data, data-breach, flaw, google, government, group, hacker, Hardware, infrastructure, Intruder, leak, login, mfa, monitoring, network, password, ransom, risk, service, switch, threat, tool, training, update, zero-day

Most cloud setup errors, 8 out of 10, happen because people slip up, not because code fails.One out of three cloud setups sits empty, ignored by any oversight. A third of online storage spaces get zero attention from monitors.Almost one out of every two hundred storage units on Amazon’s cloud sits open, per a 2024…
The multi-billion dollar mistake: Why cloud misconfigurations are your biggest security threat

Mar 19, 2026 12:10 PM

Tags: access, authentication, breach, cisa, ciso, cloud, control, cyber, data, data-breach, flaw, google, government, group, hacker, Hardware, infrastructure, Intruder, leak, login, mfa, monitoring, network, password, ransom, risk, service, switch, threat, tool, training, update, zero-day

Most cloud setup errors, 8 out of 10, happen because people slip up, not because code fails.One out of three cloud setups sits empty, ignored by any oversight. A third of online storage spaces get zero attention from monitors.Almost one out of every two hundred storage units on Amazon’s cloud sits open, per a 2024…
900,000 contact records exposed in Aura data breach

Mar 19, 2026 12:10 PM

Tags: breach, data, data-breach, email, service, tool, unauthorized

Aura, the online safety service, confirmed that an unauthorized party accessed about 900,000 records, mostly names and email addresses from a marketing tool linked to a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/19/aura-data-breach-900000-records/
Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network

Mar 19, 2026 9:10 AM

Tags: apt, botnet, cyber, data-breach, iran, leak, network, tool

A misconfigured open directory on an Iranian server has exposed a live censorship-bypass relay and SSH-based botnet operation, revealing how a single actor stitched together a 15-node network across Iran and Finland using commodity tools and sloppy operational security. The discovery shows how financially or personally motivated actors can reuse tradecraft seen in Iranian APT…
Aura Confirms Data Breach Exposing 900,000 Customer Records

Mar 19, 2026 8:10 AM

Tags: breach, cyber, data, data-breach, defense, exploit, incident response, network, phishing, social-engineering, threat, unauthorized

Digital security provider Aura has confirmed a data breach affecting approximately 900,000 user records following a targeted social engineering attack. The incident highlights the ongoing threat of sophisticated phishing campaigns aimed at bypassing technical defenses by exploiting human elements within an organization. Aura immediately initiated its incident response protocol upon detecting the unauthorized network activity.…
Aura confirms data breach exposing 900,000 marketing contacts

Mar 19, 2026 1:10 AM

Tags: access, breach, data, data-breach, email, identity, unauthorized

Identity protection company Aura has confirmed that an unauthorized party gained access to nearly 900,000 customer records containing names and email addresses. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/aura-confirms-data-breach-exposing-900-000-marketing-contacts/
Amazon security boss says crims abused max-security Cisco firewall flaw weeks before disclosure

Mar 18, 2026 7:10 PM

Tags: cisco, data-breach, exploit, firewall, flaw

Interlock’s post-exploit toolkit exposed First seen on theregister.com Jump to article: www.theregister.com/2026/03/18/amazon_cisco_firewall_0_day_ransomware/
Everyone Is Deploying AI Agents. Almost Nobody Knows What They’re Doing.

Mar 18, 2026 6:10 PM

Tags: access, ai, api, attack, ceo, ciso, credentials, data, data-breach, finance, infrastructure, Internet, LLM, risk, service, tool, vulnerability, waf

One constant I hear from CISOs I speak with is that AI agents are not coming. They are already inside organizations, reasoning through goals, selecting tools, and taking action through the same APIs that connect your most sensitive systems. And most security teams have no idea what those agents are doing. The problem Is not…
Everyone Is Deploying AI Agents. Almost Nobody Knows What They’re Doing.

Mar 18, 2026 6:10 PM

Tags: access, ai, api, attack, ceo, ciso, credentials, data, data-breach, finance, infrastructure, Internet, LLM, risk, service, tool, vulnerability, waf

One constant I hear from CISOs I speak with is that AI agents are not coming. They are already inside organizations, reasoning through goals, selecting tools, and taking action through the same APIs that connect your most sensitive systems. And most security teams have no idea what those agents are doing. The problem Is not…
FancyBear Server Leak Exposes Stolen Credentials, 2FA Secrets, NATO Targets

Mar 18, 2026 3:10 PM

Tags: 2fa, breach, credentials, cyber, data-breach, espionage, government, infrastructure, leak, military, russia

FancyBear’s latest operational security failure has exposed a live Russian espionage server packed with stolen credentials, 2FA secrets, and detailed insight into the ongoing targeting of European government and military networks. The exposed infrastructure, tied to APT28/FancyBear and previously reported by CERT”‘UA and Hunt.io, reveals both the scale of the compromises and the carelessness of…
Robotic surgery firm Intuitive reports data breach after targeted phishing attack

Mar 18, 2026 11:11 AM

Tags: attack, breach, corporate, data, data-breach, phishing

Intuitive suffered a phishing attack leading to a data breach exposing customer, employee, and corporate information. Intuitive is an American company that designs, manufactures, and sells robotic systems for minimally invasive surgery. Its most well-known products include the da Vinci Surgical System for general surgery and the Ion endoluminal system for precise procedures inside the…
Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure

Mar 18, 2026 9:10 AM

Tags: access, api, data-breach, infrastructure, LLM, risk, unauthorized

Learn how exposed Ollama servers can allow unauthorized model access, prompt abuse, and GPU resource consumption when LLM inference APIs are publicly accessible. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/exposed-ollama-servers-security-risks-of-publicly-accessible-llm-infrastructure/
Exposed Ollama Servers: Security Risks of Publicly Accessible LLM Infrastructure

Mar 18, 2026 9:10 AM

Tags: access, api, data-breach, infrastructure, LLM, risk, unauthorized

Learn how exposed Ollama servers can allow unauthorized model access, prompt abuse, and GPU resource consumption when LLM inference APIs are publicly accessible. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/exposed-ollama-servers-security-risks-of-publicly-accessible-llm-infrastructure/
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Researchers disclose vulnerabilities in IP KVMs from four manufacturers

Mar 17, 2026 7:10 PM

Tags: access, data-breach, Internet, vulnerability

Internet-exposed devices that give BIOS-level access? What could possibly go wrong? First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/03/researchers-disclose-vulnerabilities-in-ip-kvms-from-4-manufacturers/
Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web

Mar 17, 2026 12:11 PM

Tags: ai, attack, data-breach, phishing, phone, scam

Customer conversations with chatbots can include contact information and personal details that make it easier for scammers to launch phishing attacks and commit fraud. First seen on wired.com Jump to article: www.wired.com/story/sears-exposed-ai-chatbot-phone-calls-and-text-chats-to-anyone-on-the-web/
Millions of UK firms on alert after Companies House data exposure

Mar 17, 2026 11:10 AM

Tags: data, data-breach, service

Companies House, the UK’s official company registry, said its WebFiling service is back online after being shut down on Friday to fix a security issue that may have exposed … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/17/companies-house-webfiling-service-vulnerability/
WebFiling Flaw at UK Companies House Exposed Director Data for Months

Mar 17, 2026 10:09 AM

Tags: cyber, data, data-breach, flaw, service, update, vulnerability

The UK Companies House recently disclosed a significant security vulnerability in its WebFiling service that exposed sensitive director information for several months. Chief Executive Andy King confirmed that the flaw was initially introduced during a system update in October 2025. This vulnerability allowed authenticated users to potentially view and alter the private details of other…
Inside Nevada’s Push for Secure Digital Government

Mar 17, 2026 12:09 AM

Tags: ai, attack, cio, cybersecurity, data-breach, governance, government, identity, ransomware, resilience

State CIO Tim Galluzi on Identity Modernization, AI and Resident Services. The State of Nevada is accelerating its cybersecurity and digital modernization efforts after a major ransomware attack exposed the importance of resilience, workforce readiness and strong governance, said State CIO Tim Galluzi. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/inside-nevadas-push-for-secure-digital-government-a-31037
UK’s Companies House confirms security flaw exposed business data

Mar 16, 2026 7:10 PM

Tags: business, data, data-breach, flaw, government, service

Companies House, a British government agency that operates the registry for all U.K. companies, says its WebFiling service is back online after it was closed on Friday to fix a security flaw that exposed companies’ information since October 2025. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/uks-companies-house-confirms-security-flaw-exposed-business-data/
Companies House Restores WebFiling After Flaw Exposed Director Details

Mar 16, 2026 6:11 PM

Tags: data-breach, flaw, service

Companies House fixed a WebFiling flaw that allowed users to view director details and alter company records before the service was taken offline and restored. First seen on hackread.com Jump to article: hackread.com/companies-house-webfiling-flaw-director-details/
UK Agency Exposed Corporate Executive Data

Mar 16, 2026 6:11 PM

Tags: access, corporate, data, data-breach, flaw, government, service, vulnerability

Directory Traversal Flaw Found in Companies House. The British government’s company register service temporarily deactivated its online filing service after someone found a serious vulnerability that allowed people to access directors’ sensitive personal data and potentially even amend companies’ records or file bogus accounts on their behalf. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/uk-agency-exposed-corporate-executive-data-a-31033
Don’t confuse asset inventory with exposure management

Mar 16, 2026 4:10 PM

Tags: access, ai, api, attack, breach, business, chatgpt, cloud, compliance, control, credentials, cyber, cybersecurity, data, data-breach, detection, endpoint, flaw, framework, governance, government, identity, infrastructure, intelligence, Internet, leak, least-privilege, metric, mfa, monitoring, network, regulation, risk, saas, service, software, threat, tool, update, vulnerability, vulnerability-management

Asset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can’t connect vulnerabilities, identities, misconfigurations, and AI systems into real attack paths, you don’t have exposure management. You have inventory. Key takeaways True exposure management requires more than asset inventory. It’s about merging…
Don’t confuse asset inventory with exposure management

Mar 16, 2026 4:10 PM

Tags: access, ai, api, attack, breach, business, chatgpt, cloud, compliance, control, credentials, cyber, cybersecurity, data, data-breach, detection, endpoint, flaw, framework, governance, government, identity, infrastructure, intelligence, Internet, leak, least-privilege, metric, mfa, monitoring, network, regulation, risk, saas, service, software, threat, tool, update, vulnerability, vulnerability-management

Asset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can’t connect vulnerabilities, identities, misconfigurations, and AI systems into real attack paths, you don’t have exposure management. You have inventory. Key takeaways True exposure management requires more than asset inventory. It’s about merging…