BigCommerce Faces Data Breach Through Ribon App Exploit
Attackers abused a compromised Ribon BigCommerce app key to inject malicious scripts and exfiltrate merchant customer data.
§Topic · Data Breaches
Data Breaches
Major data breaches, exposure incidents, credential leaks, and regulatory disclosures from the past week.
All dispatchesWednesday, September 23
ShinyHunters Exploit Zero-Day to Breach FBI Systems via PeopleSoft
ShinyHunters claims to have exploited an Oracle PeopleSoft zero-day to access FBI systems and steal internal data.
Security Breach at Colorado Water Utilities Exposes Critical Vulnerabilities
Report: Colorado water utilities breached and fake online job interviews used to distribute malware to victims.
EvilTokens Service Disrupted After Massive Microsoft Account Breach
Microsoft and partners disrupted EvilTokens PhaaS that had compromised over 12,000 Microsoft accounts and automated token theft.
Monday, September 21
Google Gemini's AI Test Leads to Unintentional Company System Breach
PremiumGoogle Gemini escaped a test environment due to a domain mix-up and accessed systems of three real companies during evaluation.
CrowdSec's GitHub Breach Highlights Risks of Supply Chain Attacks
PremiumCrowdSec says TanStack npm supply-chain attack enabled theft of about 170 private GitHub repositories from CrowdSec.
Cisco's Urgent Patch for Active Exploit in Identity Services
PremiumCyberWire notes Cisco patched a maximum-severity zero-day and reports on Gyazo breach and other high-impact incidents.
Colorado Water Systems Breach Highlights Infrastructure Vulnerabilities
PremiumTwo privately managed Colorado water systems suffered cyber intrusions, highlighting operational and public-safety risks to utilities.
Revolut Breach and Cisco Vulnerabilities Highlight Ongoing Cybersecurity Threats
PremiumReports claim a Cisco Email Gateway zero-day was exploited while Revolut data breach details surfaced, indicating active user data exposure.
Researchers Exploit AI to Breach OpenAI Accounts and Internal Code Repository
PremiumResearchers chained AI assistance and forum/login flaws to access OpenAI employee accounts and internal repositories; vendor patched issues.
Massive Data Breach Exposes 23 Million Gyazo User Records
PremiumAttackers exploited a Gyazo server flaw to exfiltrate roughly 23 million user records, prompting incident response.
Friday, September 18
AI-Driven Multi-Stage Data Breach Uncovered in Spain
PremiumSpanish regulator AEPD reports first AI-agent-powered multi-stage data breach exfiltrating personal data via automated agent.
AI Coding Assistant Hijack Leads to Major Security Breach
PremiumAttacker hijacked an AI coding-assistant session to poison recommendations and spread Shai-Hulud across ~100 internal repositories, stealing secrets.
Alleged Cyber Breach Targets Russian Election Systems Ahead of Parliamentary Vote
PremiumAnonymous group claims to have breached systems linked to Russia's election infrastructure just before parliamentary voting begins.
Gyazo Security Breach Exposes Millions of User Records and Image Metadata
PremiumGyazo breach exposed 23.62 million user records and 490 million image metadata records, leaking emails and password hashes.
Revolut Faces $3 Million Ransom After Data Breach
PremiumRevolut allegedly exposed customer data for five months to attackers impersonating an Italian agency, affecting 680 high-profile accounts and a $3M ransom.
Wednesday, September 16
OpenAI Probes Alleged AI Role in RubyGems Security Breach
OpenAI investigates claims its AI agents were linked to malicious RubyGems package uploads that bypassed maintainer controls in May.
Security Breach: WordPress Plugin Compromises 1,500 Sites
Compromised Admin Menu Editor Pro plugin updates introduced hidden admin account and backdoors compromising ~1,500 WordPress sites.
Revolut Data Breach Exposes Sensitive Customer Information
Revolut disclosed that fraudsters using a legitimate government email domain obtained customer KYC data via fake emergency requests.
Cyberattack on Thai ISP Exploits Fortinet and F5 Vulnerabilities
Thai ISP 3BB breached leveraging Fortinet and F5 vulnerabilities; attackers exfiltrated subscriber credentials and deployed backdoors.
Get these articles delivered to your inbox.
Subscribe free