Tag: data-breach
-
Harrods Data Breach Explained
On Friday, September 2627, 2025 (UK time), Harrods warned that a third-party provider suffered an intrusion that exposed some online customers’ basic personal details (names and contact information). Harrods says its own systems weren’t breached, payment data and passwords weren’t taken, and the incident is separate from hacking activity it faced earlier this year. Authorities……
-
Malicious Code in Fake Postmark MCP Server Steals Thousands of Emails
A newly discovered attack on the npm ecosystem has exposed a deceptive backdoor embedded in a malicious package impersonating Postmark. The package, named postmark-mcp, quietly siphoned off thousands of emails from unsuspecting developers and organizations, all with just one line of code. Over the course of 15 incremental releases, the threat actor behind postmark-mcp built…
-
New Harrods Data Breach Leaks Personal Information of 430,000 Customers
Luxury department store Harrods has become the latest victim of a significant cybersecurity incident after hackers successfully accessed personal data belonging to 430,000 customers. The prestigious London retailer confirmed that threat actors contacted the company following the breach, though Harrods has stated it will not engage with the attackers. Limited Data Exposure The compromised information was obtained from…
-
KI-Gefahren rücken Integritätsschutz in den Mittelpunkt
Tags: ai, ciso, cloud, compliance, cyberattack, data, data-breach, DSGVO, exploit, governance, injection, LLM, ml, risk, tool, training, updateData Poisoning gefährdet die Integrität von KI-Modellen.Für CISOs reduziert KI selten die Komplexität, sondern füllt vielmehr ihre ohnehin schon volle Agenda. Neben den traditionellen Sicherheitsprioritäten müssen sie sich nun auch mit neuen KI-bedingten Risiken auseinandersetzen, etwa wenn KI-Lösungen unkontrolliert für geschäftliche Zwecke genutzt, Modelle manipuliert und neue Vorschriften nicht eingehalten werden. Eine der drängendsten Herausforderungen…
-
Harrods Data Breach: 430,000 Customer Records Stolen Via Third-Party Attack
Luxury retailer Harrods confirms 430,000 customer records (names, contacts) were stolen from a third-party provider in the latest UK retail cyberattack wave. First seen on hackread.com Jump to article: hackread.com/harrods-data-breach-records-stolen-third-party-attack/
-
Harrods suffers new data breach exposing 430,000 customer records
UK retail giant Harrods has disclosed a new cybersecurity incident after hackers compromised a third-party supplier and stole 430,000 records with sensitive e-commerce customer information. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/harrods-suffers-new-data-breach-exposing-430-000-customer-records/
-
Harrods alerts customers to new data breach linked to third-party provider
British Department Store Harrods warns customers of a data breach via a third-party provider, exposing some names and contact details. Harrods, the luxury British department store, warned customers of a data breach affecting its online systems. The company confirmed that names and contact details of some e-commerce customers were exposed after one of its third-party…
-
Expired protections, exposed networks: The stakes of CISA’s sunset
Congress needs to reauthorize the information-sharing law and build a modernized framework for collaborative cyber defense. First seen on cyberscoop.com Jump to article: cyberscoop.com/cybersecurity-information-sharing-act-expiration-date/
-
Expired protections, exposed networks: The stakes of CISA’s sunset
Congress needs to reauthorize the information-sharing law and build a modernized framework for collaborative cyber defense. First seen on cyberscoop.com Jump to article: cyberscoop.com/cybersecurity-information-sharing-act-expiration-date/
-
Tile Tracking Tags Can Be Exploited by Tech-Savvy Stalkers, Researchers Say
A team of researchers found that, by not encrypting the data broadcast by Tile tags, users could be vulnerable to having their location information exposed to malicious actors. First seen on wired.com Jump to article: www.wired.com/story/tile-tracking-tags-can-be-exploited-by-tech-savvy-stalkers-researchers-say/
-
Harrods Reveals Supply Chain Breach Impacting Online Customers
Department store Harrods has notified e-commerce customers of a major data breach First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/harrods-supply-chain-breach-online/
-
Harrods Cyberattack Exposes 430,000 Customer Records in Latest Data Breach
Luxury department store Harrods recently disclosed a data breach, in which, hackers stole information linked to approximately 430,000 customer records. The Harrods data breach has prompted the retailer to inform affected individuals and relevant authorities while stressing that no payment details or passwords were compromised during the incident. First seen on thecyberexpress.com Jump to article:…
-
Medusa Ransomware Claims Comcast Data Breach, Demands $1.2M
Medusa ransomware group claims 834 GB data theft from Comcast, demanding $1.2M ransom while sharing screenshots and file listings. First seen on hackread.com Jump to article: hackread.com/medusa-ransomware-comcast-data-breach/
-
Cloud Posture for Lending Platforms: Misconfigurations That Leak PII
We have witnessed a surge in cloud adoption and data exposures, with a similar trajectory. A cloud security report highlights that 95% of organizations experienced cloud-related breaches in an 18-month period. Among them, 92% of breaches exposed sensitive data. It is important to note that most incidents do not germinate from exploits that fall under……
-
Meet LockBit 5.0: Faster ESXi drive encryption, better at evading detection
the Windows binary uses heavy obfuscation and packing: it loads its payload through DLL reflection while implementing anti-analysis techniques like Event Tracing for Windows (ETW) patching and terminating security services;the Linux variant maintains similar functionality with command-line options for targeting specific directories and file types;the ESXi variant specifically targets VMware virtualization environments, and is designed…
-
Salesforce Patches CRM Data Exfiltration Vulnerability
Agentforce Agentic AI Tool Was Exposed to Indirect Prompt Injection Attacks. Salesforce has patched a vulnerability involving its Agentforce agentic artificial intelligence tool, discovered by researchers, that attackers could have exploited using an indirect prompt injection attack to steal sensitive customer data and leads being stored in the CRM system. First seen on govinfosecurity.com Jump…
-
Thousands of Indian bank transfer records found spilling online after security lapse
Security researchers found the exposed Indian bank transfer records, and the data was eventually secured. Indian fintech company NuPay took responsibility for the “configuration” error. First seen on techcrunch.com Jump to article: techcrunch.com/2025/09/26/thousands-of-indian-bank-transfer-records-found-online/
-
Trust in MCP takes first inwild hit via squatted Postmark connector
Risks persist even after package removal: Koi security researchers did not hear back when they reached out to the developer (attacker) of version 1.0.16 for clarification on the added ‘Bcc:’. Instead, they noticed the package promptly removed, even before they could report it to npm.However, deleting the package won’t remove it from the machines it…
-
Trust on MCP takes first inwild hit via squatted Postmark connector
Risks persist even after package removal: Koi security researchers did not hear back when they reached out to the developer (attacker) of version 1.0.16 for clarification on the added ‘BCC’. Instead, they noticed the package promptly removed, even before they could report it to npm.However, deleting the package won’t remove it from the machines it…
-
Trust on MCP takes first inwild hit via squatted Postmark connector
Risks persist even after package removal: Koi security researchers did not hear back when they reached out to the developer (attacker) of version 1.0.16 for clarification on the added ‘BCC’. Instead, they noticed the package promptly removed, even before they could report it to npm.However, deleting the package won’t remove it from the machines it…
-
Archer Health Data Leak Exposes 23GB of Medical Records
California-based Archer Health exposed 23GB of patient records, including SSNs, IDs, and medical files, after an unprotected database was found online. First seen on hackread.com Jump to article: hackread.com/archer-health-data-leak-23gb-medical-records/
-
New Botnet ‘Loader-as-a-Service’ Turns Home Routers and IoT into Mirai Farms
CloudSEK has uncovered a sophisticated Loader-as-a-Service botnet campaign spanning the last six months, leveraging exposed command-and-control logs to orchestrate attacks against SOHO routers, embedded Linux devices, and enterprise applications. The threat actors exploit unsanitized POST parameters”, such as NTP, syslog, and hostname fields”, alongside default credentials and known CVEs in WebLogic, WordPress, and vBulletin systems…
-
Qantas cutting CEO pay signals new era of cyber accountability
Tags: ai, attack, breach, ceo, ciso, cyber, cybersecurity, data, data-breach, finance, governance, incident, incident response, malicious, privacy, ransomware, riskWhat should CISOs and CEOs do now?: CISOs, who have historically borne the brunt of breaches and malicious cyber incidents, should take heed of this emerging trend. “Be aware of the environment and expectations today, and where they’re headed,” Redgraves’ Tully says. “Try to get out in front of that. You need to work with…
-
SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist
Tags: access, ai, attack, breach, corporate, credentials, cybercrime, cybersecurity, dark-web, data, data-breach, defense, endpoint, government, identity, intelligence, jobs, malware, monitoring, ransomware, risk, theft, threat57% lack strong capabilities to invalidate exposed sessionsNearly two-thirds lack repeatable remediation workflowsAbout two-thirds do not have formal investigation protocolsLess than 20% can automate identity remediation across systemsOnly 19% of organizations have automated identity remediation processes in place. The rest rely on case-by-case investigation or incomplete playbooks that leave gaps attackers can exploit.”The defense mission…
-
Volvo Breach: A Closer Look at the Technical and Organizational Gaps
Volvo North America has confirmed a data breach affecting employee records, following a ransomware attack on its HR software provider, Miljödata. The breach did not originate within Volvo’s internal systems but through a third-party platform used for workforce management. The incident appears to involve data exfiltration, not just encryption, and affected other Miljödata clients beyond……
-
SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist
Tags: access, ai, attack, breach, corporate, credentials, cybercrime, cybersecurity, dark-web, data, data-breach, defense, endpoint, government, identity, intelligence, jobs, malware, monitoring, ransomware, risk, theft, threat57% lack strong capabilities to invalidate exposed sessionsNearly two-thirds lack repeatable remediation workflowsAbout two-thirds do not have formal investigation protocolsLess than 20% can automate identity remediation across systemsOnly 19% of organizations have automated identity remediation processes in place. The rest rely on case-by-case investigation or incomplete playbooks that leave gaps attackers can exploit.”The defense mission…
-
Thousands of Indian bank transfer records found online
Security researchers found the exposed Indian bank transfer records and the data was eventually secured, but nobody wants to take responsibility for the security lapse. First seen on techcrunch.com Jump to article: techcrunch.com/2025/09/25/thousands-of-indian-bank-transfer-records-found-online/
-
150,000 Records of Home Health Care Firm Exposed on Web
Researcher Finds Database of Sensitive Patient Info With No Password Protection. An unencrypted database containing nearly 150,000 patient records of a California provider of home health and palliative care services was left exposed on the internet, said a cybersecurity researcher who discovered the unsecured data cache. Why does this keep happening in the healthcare sector?…
-
Callous crims break into preschool network, publish toddlers’ data
Images of toddlers and home addresses leaked in reprehensible landmark attack First seen on theregister.com Jump to article: www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/