Tag: leak
-
New Study Warns Several Free iOS and Android VPN Apps Leak Data
A Zimperium zLabs analysis of 800 free Android and iOS VPN apps exposes critical security flaws, including the Heartbleed bug, excessive system permissions, and non-transparent data practices. Learn how these ‘privacy’ tools are actually major security risks, especially for BYOD environments. First seen on hackread.com Jump to article: hackread.com/studyfree-ios-android-vpn-apps-leak-data/
-
US Auto Insurance Platform ClaimPix Leaked 10.7TB of Records Online
Cybersecurity researcher Jeremiah Fowler discovered a massive 10.7TB ClaimPix leak exposing 5.1M customer files, vehicle data, and Power of Attorney documents. Read the full details. First seen on hackread.com Jump to article: hackread.com/us-auto-insurance-claimpix-leaked-10tb-records/
-
Datenleck bei Kido-Kindergärten
Eine Ransomware-Bande hat die Daten von mehr als 8.000 Kindern der Kido-Kindergärten gestohlen.Die Ransomware-Bande Randiant veröffentlichte kürzlich einen Darknet-Post mit Hinweisen auf einen Angriff auf den britischen Kindertagesstättenbetreiber Kido. Berichten zufolge haben die Täter als Beweis dafür Namen, Fotos, Adressen und familiäre Kontaktdaten von zehn Kindern hochgeladen, die eine der 18 Kido-Kitas im Großraum London…
-
New Harrods Data Breach Leaks Personal Information of 430,000 Customers
Luxury department store Harrods has become the latest victim of a significant cybersecurity incident after hackers successfully accessed personal data belonging to 430,000 customers. The prestigious London retailer confirmed that threat actors contacted the company following the breach, though Harrods has stated it will not engage with the attackers. Limited Data Exposure The compromised information was obtained from…
-
Google Project Zero Discloses Apple Vulnerability Allowing ASLR Bypass
Google Project Zero researcher Jann Horn has disclosed a novel vulnerability in Apple’s macOS and iOS systems that could potentially allow attackers to bypass Address Space Layout Randomization (ASLR) protections through pointer leaks in serialization processes. Vulnerability Overview The vulnerability exploits a technique that leverages pointer-keyed data structures in Apple’s NSKeyedArchiver serialization framework to leak…
-
Google Project Zero Discloses Apple Vulnerability Allowing ASLR Bypass
Google Project Zero researcher Jann Horn has disclosed a novel vulnerability in Apple’s macOS and iOS systems that could potentially allow attackers to bypass Address Space Layout Randomization (ASLR) protections through pointer leaks in serialization processes. Vulnerability Overview The vulnerability exploits a technique that leverages pointer-keyed data structures in Apple’s NSKeyedArchiver serialization framework to leak…
-
Cloud Posture for Lending Platforms: Misconfigurations That Leak PII
We have witnessed a surge in cloud adoption and data exposures, with a similar trajectory. A cloud security report highlights that 95% of organizations experienced cloud-related breaches in an 18-month period. Among them, 92% of breaches exposed sensitive data. It is important to note that most incidents do not germinate from exploits that fall under……
-
Archer Health Data Leak Exposes 23GB of Medical Records
California-based Archer Health exposed 23GB of patient records, including SSNs, IDs, and medical files, after an unprotected database was found online. First seen on hackread.com Jump to article: hackread.com/archer-health-data-leak-23gb-medical-records/
-
Salesforce AI Agents Forced to Leak Sensitive Data
Yet again researchers have uncovered an opportunity (dubbed ForcedLeak for indirect prompt injection against autonomous agents lacking sufficient security controls, but this time the risk involves PII, corporate secrets, physical location data, and so much more. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/salesforce-ai-agents-leak-sensitive-data
-
Threatsday Bulletin: Rootkit Patch, Federal Breach, OnePlus SMS Leak, TikTok Scandal & More
/* ===== Container ===== */.td-wrap {}/* ===== Section ===== */.td-section {}.td-title { margin: 16px 0 4px; font-size: 32px; line-height: 1.2; font-weight: 800; }.td-subtitle { margin: 0 0 24px; color: #64748b; font-size: 16px; }/* ===== Timeline ===== */.td-timeline { position: relative; margin: 0 !important;padding: 0!important; list-style: none; }/* spine */.td-timeline:before { First seen on thehackernews.com Jump…
-
Threatsday Bulletin: Rootkit Patch, Federal Breach, OnePlus SMS Leak, TikTok Scandal & More
/* ===== Container ===== */.td-wrap {}/* ===== Section ===== */.td-section {}.td-title { margin: 16px 0 4px; font-size: 32px; line-height: 1.2; font-weight: 800; }.td-subtitle { margin: 0 0 24px; color: #64748b; font-size: 16px; }/* ===== Timeline ===== */.td-timeline { position: relative; margin: 0 !important;padding: 0!important; list-style: none; }/* spine */.td-timeline:before { First seen on thehackernews.com Jump…
-
AI coding assistants amplify deeper cybersecurity risks
Tags: access, ai, api, application-security, attack, authentication, business, ceo, ciso, cloud, compliance, control, cybersecurity, data, data-breach, detection, fintech, flaw, governance, injection, leak, LLM, metric, open-source, programming, radius, risk, risk-management, service, software, startup, strategy, threat, tool, training, vulnerability‘Shadow’ engineers and vibe coding compound risks: Ashwin Mithra, global head of information security at continuous software development firm Cloudbees, notes that part of the problem is that non-technical teams are using AI to build apps, scripts, and dashboards.”These shadow engineers don’t realize they’re part of the software development life cycle, and often bypass critical…
-
Chrome High-severity Flaws Expose Sensitive Data, Trigger System Crashes
Google has released an urgent security update for its Chrome browser, addressing three high-severity vulnerabilities that could allow attackers to leak sensitive information and cause system instability. The latest Chrome version 140.0.7339.207/.208 for Windows and Mac, and 140.0.7339.207 for Linux, patches critical flaws in the V8 JavaScript engine that powers the browser’s web content processing.…
-
$150K awarded for L1TF Reloaded exploit that bypasses cloud mitigations
Researchers earned $150K for “L1TF Reloaded,” combining L1TF and half-Spectre to leak VM memory from public clouds despite mitigations. Researchers from Vrije Universiteit Amsterdam earned $150K for exploiting L1TF Reloaded, a flaw combining L1TF (Foreshadow) and half-Spectre. The attack bypasses prior mitigations, showing that transient CPU vulnerabilities remain practical and can leak memory from VMs…
-
EV charging biz zaps customers with data leak scare
Names, emails unplugged in DCS support snafu but ‘billing is safe’ First seen on theregister.com Jump to article: www.theregister.com/2025/09/23/dcs_data_breach/
-
EV charging biz zaps customers with data leak scare
Names, emails unplugged in DCS support snafu but ‘billing is safe’ First seen on theregister.com Jump to article: www.theregister.com/2025/09/23/dcs_data_breach/
-
2 Clinics Notify 700,000 Patients of Alleged BianLian Hacks
Now-Dormant Gang Claimed North Carolina, Florida Groups on Data Leak Site This Year. Two medical practices – in North Carolina and Florida – are notifying a total of more than 700,000 patients whose information was potentially stolen in separate hacks earlier this year. The now-dormant ransomware gang BianLian had claimed both organizations as victims on…
-
Closing the Visibility Gap: Corporate Exposure Analytics in the Infostealer Era
Co-authored by Constella Intelligence and Kineviz As infostealer malware continues to scale in reach, automation, and precision, organizations face an increasingly urgent challenge: a lack of comprehensive visibility across their identity exposure landscape. While credential leaks and cookie thefts are often detected in isolation, without centralized and time-aware analytics, security teams cannot understand the true extent……
-
BlackLock Ransomware Targets Windows, Linux, and VMware ESXi Systems
BlackLock, a rebranded ransomware group formerly known as El Dorado, has emerged as a formidable threat to organizations worldwide. First identified in June 2024 when its Dedicated Leak Site (DLS) began exposing victim data, the gang is believed to have been active since March 2024. The latest analysis by AhnLab Security Intelligence Center (ASEC) sheds…
-
ShadowLeak Exploit Exposed Gmail Data Through ChatGPT Agent
Radware researchers revealed a service-side flaw in OpenAI’s ChatGPT. The ShadowLeak attack had used indirect prompt injection to bypass defences and leak sensitive data, but the issue has since been fixed. First seen on hackread.com Jump to article: hackread.com/shadowleak-exploit-exposed-gmail-data-chatgpt-agent/
-
ShadowLeak Zero-Click Flaw Leaks Gmail Data via OpenAI ChatGPT Deep Research Agent
Cybersecurity researchers have disclosed a zero-click flaw in OpenAI ChatGPT’s Deep Research agent that could allow an attacker to leak sensitive Gmail inbox data with a single crafted email without any user action.The new class of attack has been codenamed ShadowLeak by Radware. Following responsible disclosure on June 18, 2025, the issue was addressed by…
-
Neue Ransomware-Gruppe Yurei: Open-Source-Code erleichtert weltweite Angriffe
Check Point Software Technologies warnt vor einer neuen Ransomware-Bedrohung namens Yurei, ein Begriff aus der japanischen Folklore für rastlose Geister. Check Point Research hat die Gruppe am 5. September 2025 erstmals entdeckt. Bereits in der ersten Woche konnte Yurei drei Unternehmen auf seiner Leak-Seite im Darknet aufführen: Sri Lanka: Ein Lebensmittelhersteller wurde als erstes Opfer kompromittiert.…
-
How Top CISOs Approach Exposure Management in the Context of Managing Cyber Risk
Tags: ai, attack, best-practice, business, ciso, control, cvss, cyber, cybersecurity, data, framework, group, intelligence, leak, metric, monitoring, risk, software, strategy, threat, update, vulnerability, vulnerability-managementWondering what your peers think of exposure management? New reports from the Exposure Management Leadership Council, a CISO working group sponsored by Tenable, offer insights. Key takeaways The CISOs who make up the Exposure Management Leadership Council see exposure management as a strategic and game-changing approach to unified proactive security. They believe exposure management can…
-
BMW Reportedly Hit by Everest Ransomware, Internal Files Stolen
The Everest ransomware group has claimed a major breach at Bayerische Motoren Werke AG (BMW), alleging the theft of 600,000 lines of sensitive internal documents. The group has posted BMW on its leak site, complete with a countdown timer and instructions that threaten to make the stolen audit reports, financial records, and engineering files public…
-
1 in 3 Android Apps Leak Sensitive Data
One third of Android and over half iOS apps shown to be leaking insecure APIs and hardcoded secrets First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/android-apps-leak-sensitive-data/
-
SonicWall Advises Users to Reset Logins After Config Backup Leak
SonicWall has alerted its customers to reset all login credentials after a recent leak exposed firewall configuration backups. The vendor emphasizes three critical stages”, containment, remediation, and monitoring”, to minimize risk and restore secure access. Users should follow each stage in order, beginning with containment to block further exposure, proceeding to remediation to reset passwords…
-
SonicWall Advises Users to Reset Logins After Config Backup Leak
SonicWall has alerted its customers to reset all login credentials after a recent leak exposed firewall configuration backups. The vendor emphasizes three critical stages”, containment, remediation, and monitoring”, to minimize risk and restore secure access. Users should follow each stage in order, beginning with containment to block further exposure, proceeding to remediation to reset passwords…
-
Detect Secrets in GitLab CI Logs using ggshield and Bring Your Own Source
Discover how to automatically detect secrets in GitLab CI logs using ggshield and GitGuardian’s Bring Your Own Source initiative. Learn to set up real-time scanning to prevent credential leaks, enhance compliance, and secure your entire CI/CD pipeline from hidden risks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/detect-secrets-in-gitlab-ci-logs-using-ggshield-and-bring-your-own-source/
-
Microsoft OneDrive Auto-Sync Flaw Leaks Enterprise Secrets from SharePoint Online
A new report from Entro Labs reveals that one in five exposed secrets in large organizations can be traced back to SharePoint. Rather than a flaw in SharePoint itself, the real culprit is a simple convenience feature: OneDrive’s default auto-sync. When OneDrive silently backs up key folders like Desktop and Documents to SharePoint Online, it…
-
Threat Actors and Code Assistants: The Hidden Risks of Backdoor Injections
AI code assistants integrated into IDEs, like GitHub Copilot, offer powerful chat, auto-completion, and test-generation features. However, threat actors and careless users can exploit these capabilities to inject backdoors, leak sensitive data, and produce harmful code. Indirect prompt injection attacks exploit context-attachment features by contaminating public data sources with hidden instructions. When unsuspecting developers feed…