Online posts claim that files from a private Anthropic AI model were published on a public website. The claim is unconfirmed, and the sources provided do not say what the files contain.

Attackers got into the Northflank hosting platform and used customers' AI service keys without permission. Those keys can be used to run up bills or access AI services as if they were the customer.

1. How it works:
2. Attacker breaches Northflank
3. Platform secrets exposed
4. AI API keys obtained
5. Keys used by attacker
6. Attacker uses customers' AI API keys

A blockchain analysis firm had an intruder get into some internal tools. The intruder could see basic customer contact details, such as names and email addresses.

1. How it works:
2. External actor
3. Internal tools accessed
4. Customer identity data
5. Customers at risk
6. Customer contact details exposed to attacker

Scribd, a document-sharing website, reportedly had its systems broken into. Personal account information may have been taken, so users should be alert to suspicious messages.

Hackers got into the online shop of the clothing retailer Resolve and took customers' credit or debit card numbers. Anyone who shopped there may need to watch their card statements.

A fake copy of a popular AI coding helper was available for about 11 hours and could quietly give attackers secret remote access to developers' computers. Anyone who installed it may need to clean up their machine and check their SSH keys.

1. How it works:
2. Attacker publishes fake
3. Cursor marketplace listing
4. Developer installs it
5. Backdoor installed
6. Attacker has persistent SSH access to developers' machines

Hackers stole a huge amount of cryptocurrency from Binance, one of the world's largest crypto exchanges, after breaking into an employee's work laptop. Some of the stolen funds have been frozen, but most of the damage is still being assesse

1. How it works:
2. Attacker targets engineer
3. Laptop compromised
4. Internal access gained
5. Assets moved out
6. About $6.3 billion in assets stolen

Scam emails pretending to come from Anthropic, the AI company, are getting into inboxes even though they have obvious warning signs. Those emails can trick people into clicking links or handing over information.

Attackers slipped malicious code into the Polymarket website through a outside service. While signed-in users used the site, their funds were moved to attacker wallets.

1. How it works:
2. Attacker compromises vendor
3. Malicious script swapped in
4. Signed-in user loads site
5. Funds moved out
6. Attacker drains trader funds

Hackers got into a Florida state website used for student financial aid. Personal details, including Social Security numbers, may have been taken from about 4.9 million people.

1. How it works:
2. Unauthorized access
3. Data accessed
4. Social Security numbers
5. Residents affected
6. Personal data may be used for identity theft

An employee copied health records of 726 people into a personal AI chat account the company had not approved. Those people's private health information may now sit outside the company's control.

1. How it works:
2. Employee exports data
3. Records copied
4. Pasted into AI chat
5. Stored by AI service
6. Health records leave company control

A company that runs school records software had a security incident. Some students' and families' sensitive ID numbers may have been taken.

This is a news roundup of several separate security problems: some firewall weaknesses, malware sold as a service to steal bank logins, a booby-trapped PDF file, and stolen login tokens. The summary does not say which products or users are

Hackers got into a contractor's computer systems that send notices for federal bankruptcy courts, and those notices were delayed for weeks. The contractor says no data was taken.

Developers accidentally left login keys for cloud and AI services inside publicly visible code on Gitee, a Chinese code-sharing site. Anyone who copied them could have used those accounts, possibly at the owners' expense.

1. How it works:
2. Public code posted
3. Repo scanned
4. Keys found
5. Keys still valid
6. Strangers can access cloud and AI accounts

A third-party service gives people in regions where OpenAI and Anthropic don't officially sell their products access to popular AI coding tools. The service reportedly switches off key safety protections, so code run through these tools may

1. How it works:
2. Developer request
3. Relay service
4. Sandbox disabled
5. Code runs unchecked
6. Code runs without sandbox protection

Hackers got into business software run by a third party and copied people's personal details and iRhythm account and device data. About 8.2 million people may be affected.

1. How it works:
2. Hackers target
3. Apps accessed
4. Data stolen
5. Breach reported
6. 8.2 million people's data exposed

Attackers are abusing recently patched PHP bugs to take control of servers and firewalls that are reachable from the internet. Some of these attacks have reached government-affiliated systems.

1. How it works:
2. Attacker scans
3. Exploits PHP2Shell
4. Gains shell access
5. Chains Fragnesia
6. Attacker controls the server as root

Someone with no login could send a specially crafted pattern in a GitLab pipeline setting and run their own commands on the GitLab server. Attackers are already trying this, so unpatched servers need updating now.

1. How it works:
2. Attacker crafts pattern
3. Request reaches GitLab
4. Regex not validated
5. Code runs on server
6. Attacker runs code on GitLab server

Attackers used a trick to get into software projects hosted on GitHub, and some of them are still inside. If your team builds or ships code there, someone unwanted may still have access.

1. How it works:
2. Campaign launched
3. Projects compromised
4. Developer endpoints
5. Cloud access
6. Attackers keep access inside developer environments

Records on tens of thousands of Homeland Security employees and contractors were posted publicly online, including contact details and information about sensitive assignments. Anyone who had their details exposed could be targeted by scams

1. How it works:
2. Attacker gets access
3. Okta SSO system
4. Staff records stolen
5. Published online
6. 41,000 staff records exposed publicly

A travel-industry software provider used by Japan Airlines was hacked, and some customers' personal details may have been stolen. Passport numbers and contact details are among the data reported as taken.

1. How it works:
2. Attacker breaches system
3. Amadeus PSS compromised
4. Passenger data stolen
5. Customers at risk
6. Passenger personal data exposed to criminals

Hackers got into the systems of Sony's internet provider in Japan and copied customer records. Personal details and some login passwords were taken, so affected customers should be careful about phishing and password reuse.

A state-sponsored hacking group is routing its attacks through chains of hijacked routers, cameras and other small devices, which makes the attacks hard to trace. The group has used this method to exploit previously unknown security flaws.

1. How it works:
2. Volt Typhoon operator
3. Rotating device chain
4. Zero-day exploit
5. Strategic access
6. Attacker gains hidden access to high-value systems

A car rental company in Japan had personal information leaked, including driver's license details for about 1.46 million people. Those people could face fraud or identity theft.

Attackers are disguising their scanning programs as legitimate AI company bots. If your systems leak passwords or access keys, these bots can find them and let attackers in.

1. How it works:
2. Threat actor
3. Impersonated AI bots
4. Exposed systems
5. Credentials found
6. Attacker gains usable credentials

A health department worker shared confidential medical details about pregnant women on a public social media account. The government first said only five patients were affected, then changed that claim.

Someone got into the Town Hall email account, most likely by tricking a person into giving up their login. Anyone who emailed the town could be targeted by follow-up scam emails.

A cyber attack (ransomware, where criminals lock files until paid) has slowed down official death investigations in New Zealand. Families are waiting months for answers.

Attackers send fake messages that get people to approve a login code on a real Microsoft-style sign-in page, handing over access to work accounts without the attacker ever needing the password. Most of the targets are US organizations.

1. How it works:
2. Phishing message sent
3. User starts device login
4. User enters attacker's code
5. Tokens issued to attacker
6. Attacker gains access to corporate accounts

Hackers broke into a Japanese cloud service that gives customers remote Windows computers. They threatened to lock up data with ransomware, so customers were told to unplug their PCs from the internet and shut them down.

1. How it works:
2. Attacker breaches service
3. Extortion demand
4. Ransomware threatened
5. Customers disconnect
6. Customer systems at risk of ransomware

Attackers reportedly altered a shared tracking script used by Convertr so it could copy shoppers' credit card details while they pay. Anyone entering card information on affected stores may be at risk.

1. How it works:
2. Skimming group
3. Analytics script
4. Shopper browser
5. Card data copied
6. Shoppers' card data is stolen

A company that runs the tip-line system used by Crime Stoppers in Canada had a data breach, which may have exposed anonymous tips people sent in. Some police services have paused using these tip lines while the extent is investigated.

Hackers targeted the US Federal Election Commission's website, and its electronic filing system was shut down. People who need to file campaign reports electronically may be unable to do so until it is back.

Hackers may have broken into Moldova's government online services and taken people's personal information. Officials warn more attacks like this could follow.

Hackers, possibly including foreign government groups, attacked the Ohio state auditor's public website, so the state temporarily shut that server down. The state says Ohioans' personal financial information is not believed to be at risk.

Attackers used AI software to automate parts of breaking into organizations in Japan. The AI helped run the attacks faster, with less manual work by the attacker.

1. How it works:
2. Operator sets goal
3. AI agents coordinate
4. Scan exposed targets
5. Access organization servers
6. Attackers gain automated access to victim systems

Hackers broke into the hospital's computer systems, locked up its files so staff cannot use them, and took sensitive patient information. They appear to want money to give it back.

1. How it works:
2. Hackers gain access
3. Nine servers breached
4. Data stolen
5. Data encrypted
6. Hospital data locked and leaked

A cyberattack locked up computer systems at a major hospital network, so ambulances were diverted and many appointments were cancelled. A criminal group has claimed responsibility.

1. How it works:
2. Ransomware group
3. Systems breached
4. Services disrupted
5. Care impacted
6. Health system operations halted

An attacker tricked someone into giving up access, and spreadsheets containing agents' personal information were viewed. Agents whose details were in those files may be at risk of scams.

1. How it works:
2. Phishing message
3. Credentials given
4. Spreadsheets accessed
5. Breach notice sent
6. Agent personal information disclosed to attacker

An outside attacker got into Capcom's account system and reached personal data for millions of player accounts. Some accounts reportedly had their passwords changed, so you could be locked out.

1. How it works:
2. Attacker
3. Capcom ID
4. Account data
5. Passwords
6. Accounts exposed and some locked out

Scammers got hold of personal details of military members from a Pentagon data system. Those details can be used to impersonate people or open accounts in their names.

Hackers got into a system that some clinics and doctors use to order lab tests and look up results. Patient information in that system may have been exposed.

A criminal group called SafePay locks up company computers and files, then demands payment to unlock them. Law enforcement says they have hit at least 600 organizations since August 2024.

Some data from users of the Warp developer tool was stolen when an outside vendor used by the project was attacked. The stolen data includes logs of what the AI agent decided and usage information.

1. How it works:
2. Attacker
3. Vendor breached
4. Logs exposed
5. User data leaked
6. Warp user agent logs and telemetry exposed

Companies that provide IT services to UK police forces were hacked several times, and police data held by those companies may have been exposed. Attackers got in through the suppliers rather than directly through police systems.

1. How it works:
2. Hackers
3. Supplier systems
4. Police data
5. Police data exposed via suppliers

A password-like key belonging to a third-party vendor was exposed, which could have let someone reach a database holding health and personal details of about 238,000 people. The material does not say whether anyone actually used it.

1. How it works:
2. Vendor key leaked
3. Database reachable
4. Health data at risk
5. Potential misuse
6. Health data of 238,000 members at risk

Attackers got a secret key that proves Keystone crypto wallets are genuine. With that key they could make fake wallets that look real, so buyers could lose their crypto.

1. How it works:
2. Attacker breaches website
3. Verification key stolen
4. Counterfeit devices built
5. Buyer trusts fake
6. Counterfeit wallets could steal buyers' crypto

Attackers got into a marketing system used by ENGIE's business partners and copied customer information. If you are an ENGIE customer, be alert to suspicious messages that use your personal details.

1. How it works:
2. Attackers
3. Marketing platform
4. Customer data
5. Customer data stolen

Hackers got into a system used by the German AfD party and stole emails and attachments, which were then published online for anyone to search or download. People who wrote to the party may have had their email addresses and message content

1. How it works:
2. Intruder gains access
3. Hosting provider hit
4. Emails stolen
5. Data published online
6. Private party emails become publicly accessible

Hackers got into a test system at the University of Copenhagen that held personal information. About 525,000 people may have had their details exposed, and some PIN codes were exposed too.

1. How it works:
2. Hackers gain access
3. Test environment reached
4. Personal data accessed
5. PIN codes exposed
6. Personal data and PINs exposed

Attackers hide instructions inside ordinary text files that AI coding helpers read. The helper may follow those hidden instructions as if you had asked for them, possibly taking actions you did not intend.

1. How it works:
2. Attacker plants file
3. Project includes file
4. AI agent reads it
5. Agent acts on text
6. Assistant performs attacker-chosen actions

A cybercrime group used a hacking tool called ARTEX AI to break into more than 90 organizations in South Korea and steal millions of personal records. Anyone whose data was held by those organizations may be at risk of scams or identity mis

1. How it works:
2. Former pentester
3. ARTEX AI framework
4. 90+ organizations
5. 8.2M records
6. Millions of records stolen

Hackers have hidden malicious code in about 953 online shops, mostly ones built on Magento. Shoppers visiting these stores may have that code run in their browser without knowing it.

1. How it works:
2. Threat actor
3. Store compromised
4. Visitor loads page
5. Malicious loader runs
6. Shopper's browser runs attacker code

Attackers are using stolen GitHub access tokens to take passwords and cloud keys from software developers' code projects. Anyone whose project or access tokens are caught in this could have their cloud accounts and private data exposed.

1. How it works:
2. Attacker abuses tokens
3. Repositories accessed
4. Secrets harvested
5. Cloud access gained
6. Attacker reaches cloud secrets and data

Criminals pose as IT support in Microsoft Teams chats and talk people into installing malicious software. That software can lock files for ransom or steal data.

1. How it works:
2. Fake IT account
3. External Teams chat
4. Employee trusts it
5. Malware installed
6. Attacker gains access to the organization

Hackers are getting into internet-connected Dahua security cameras and video recorders. Once inside, they can watch live video, change settings, and create their own login accounts.

1. How it works:
2. Attacker scans
3. Weak access
4. Device taken over
5. Accounts added
6. Attacker keeps control of the cameras

Attackers tricked people into signing in through a fake relay that copied their login session. They then reused that copied session to get into email accounts without needing the password again.

1. How it works:
2. Phishing lure
3. AitM relay
4. User signs in
5. Token stolen
6. Attacker reads email at compromised accounts

Attackers who steal GitHub login tokens are adding hidden automated jobs to code projects that print the project's passwords and keys into the build logs. The attackers then download those logs and delete them, so the secrets leave without

1. How it works:
2. Stolen token
3. Plant workflow
4. Secrets in logs
5. Download logs
6. Repository secrets are stolen

Personal details of State Bank of India customers were exposed. Criminals can use such data for scams, such as fake calls or messages that pretend to be your bank.

1. How it works:
2. Data stolen
3. Data sold
4. Scam targets you
5. Customers face fraud and impersonation risk

A Toronto crime tip organization has stopped its work after a data breach came to light. Details about what was taken and who may be affected are not yet clear from the source.

A state-linked hacking group broke into ConnectWise's cloud backup software and used an AI-driven tool to speed up attacks on many customer accounts. Organizations that use this backup product may have been targeted.

1. How it works:
2. Storm-0940 actor
3. ConnectWise backup app
4. ARTEX AI tool
5. 2,200+ tenants
6. Many customer tenants exposed to attackers

A popular AI developer tool was compromised by attackers who secretly ran programs that collected passwords and access keys from its build system. Anyone who installed a bad version of the package could have had their own credentials stolen

1. How it works:
2. Master key leaked
3. Malicious workflows
4. Release pipeline hijacked
5. Users install bad version
6. Attacker harvests credentials from many users

An old, unmaintained streaming app had an updater that could let outsiders run harmful code on your computer. A security firm switched that updater off remotely to close the gap.

1. How it works:
2. Attacker finds flaw
3. Malicious update
4. Computer compromised
5. Botnet enrollment
6. Attacker could control the computer

Criminal groups reportedly used AI tools to run break-ins with less human effort, making attacks faster and easier to scale. Their goal is to steal data and demand payment.

Attackers got into company network gateways that let staff connect from home, and took tens of thousands of usernames and passwords. Those stolen logins could let attackers move deeper into company networks.

1. How it works:
2. Attacker scans
3. Device breached
4. Credentials stolen
5. Internal access
6. Attackers gain entry to victim networks

A hacker got into a system that some labs and clinics use to order patient tests, and patient records may have been stolen. If you have had blood or lab tests through Quest Diagnostics, your personal health information could be affected.

1. How it works:
2. Threat actor
3. Quanum LSM access
4. Patient records
5. Notification
6. Patient records potentially exposed

Railway, a service that hosts apps online, may have had an intruder access stored passwords and keys (environment variables) for customers. If you use Railway, the safe move is to change those secrets.

1. How it works:
2. Unauthorized access
3. Platform storage
4. Secrets exposed
5. Customer services
6. Attacker may access customer services

Hackers got into Capcom's account system and copied millions of customer email addresses. They also changed the passwords on some accounts, so affected players may be locked out.

1. How it works:
2. Attacker breaches system
3. Customer data copied
4. Passwords changed
5. Customer emails and some accounts compromised

Attackers took over more than 300 relay computers used by the Tor anonymity network. They used them to secretly send some people's remote-login attempts to fake servers that recorded their passwords.

1. How it works:
2. Attacker hijacks relays
3. SSH traffic redirected
4. Passwords captured
5. Credentials stolen
6. Attacker collects SSH passwords

Personal details of about 370,000 people receiving pension assistance were stolen, including national ID numbers. This makes them targets for scams and identity fraud.

1. How it works:
2. Attacker gets access
3. Enters partner access
4. Records accessed
5. Personal data copied
6. Personal data of about 370k people exposed

Personal details of holiday rental customers, including email addresses and phone numbers, were stolen in a data breach. Anyone who booked through affected branches could receive scam emails or calls pretending to be the rental network.

1. How it works:
2. Attacker breaches network
3. Customer records taken
4. Phishing messages sent
5. Customer targeted
6. Customers face targeted scams and fraud

Hackers stole company files from Crunchbase and published them online. If your contact details were in those files, criminals may now send you convincing phishing emails or calls.

1. How it works:
2. ShinyHunters extortion
3. Corporate network breached
4. Contact data stolen
5. Data published online
6. Business contacts exposed to targeted scams

A hacking group stole records from the health company Sharecare and published them online. Names, emails, phone numbers and addresses of many people may now be public, which can lead to spam and scam messages.

Hackers claim they stole business contact details from the food and animal safety company Neogen and published them online. Anyone on those lists may now get more spam or phishing emails.

1. How it works:
2. ShinyHunters group
3. Neogen data taken
4. Data published
5. Contacts exposed
6. Contact details exposed for phishing

A group tried to extort data centre operator CyrusOne and then published records it says it stole. The leaked data is mostly business contact details, which could be used for phishing and scam calls.

1. How it works:
2. ShinyHunters group
3. Data taken
4. Pay or leak demand
5. Data published
6. Contact records exposed for phishing use

Hackers got into data held by Double Counter, a service that protects Discord servers, and published it online. Anyone who used the service may now have their email address and Discord username public, and a few paying customers also had th

1. How it works:
2. Attacker exploits flaw
3. Access gained
4. Data extracted
5. Data published
6. Users' emails and usernames exposed publicly

Personal details of about 7.9 million Angel One customers, including names, addresses, phone numbers and bank account numbers, leaked online after a 2023 breach. The company says trading accounts, funds and login credentials were not affect

1. How it works:
2. Breach in 2023
3. Records copied
4. Data leaked online
5. Customers at risk
6. Personal and bank details exposed to criminals

Hackers stole and published contact details of healthcare workers and Medela staff. Expect spam, phishing emails and fake calls that use your real name and workplace.

1. How it works:
2. ShinyHunters group
3. Medela systems
4. Data published
5. Targeted phishing
6. Contacts used for phishing and scams