Online posts claim that files from a private Anthropic AI model were published on a public website. The claim is unconfirmed, and the sources provided do not say what the files contain.

Attackers got into the Northflank hosting platform and used customers' AI service keys without permission. Those keys can be used to run up bills or access AI services as if they were the customer.

1. How it works:
2. Attacker breaches Northflank
3. Platform secrets exposed
4. AI API keys obtained
5. Keys used by attacker
6. Attacker uses customers' AI API keys

A blockchain analysis firm had an intruder get into some internal tools. The intruder could see basic customer contact details, such as names and email addresses.

1. How it works:
2. External actor
3. Internal tools accessed
4. Customer identity data
5. Customers at risk
6. Customer contact details exposed to attacker

Scribd, a document-sharing website, reportedly had its systems broken into. Personal account information may have been taken, so users should be alert to suspicious messages.

Hackers got into the online shop of the clothing retailer Resolve and took customers' credit or debit card numbers. Anyone who shopped there may need to watch their card statements.

This is a news digest covering several separate security stories, including a data leak involving AI tools and a flaw in server startup software. The material gives no details on what any individual story means for you.

A fake copy of a popular AI coding helper was available for about 11 hours and could quietly give attackers secret remote access to developers' computers. Anyone who installed it may need to clean up their machine and check their SSH keys.

1. How it works:
2. Attacker publishes fake
3. Cursor marketplace listing
4. Developer installs it
5. Backdoor installed
6. Attacker has persistent SSH access to developers' machines

Hackers stole a huge amount of cryptocurrency from Binance, one of the world's largest crypto exchanges, after breaking into an employee's work laptop. Some of the stolen funds have been frozen, but most of the damage is still being assesse

1. How it works:
2. Attacker targets engineer
3. Laptop compromised
4. Internal access gained
5. Assets moved out
6. About $6.3 billion in assets stolen

Scam emails pretending to come from Anthropic, the AI company, are getting into inboxes even though they have obvious warning signs. Those emails can trick people into clicking links or handing over information.

Attackers slipped malicious code into the Polymarket website through a outside service. While signed-in users used the site, their funds were moved to attacker wallets.

1. How it works:
2. Attacker compromises vendor
3. Malicious script swapped in
4. Signed-in user loads site
5. Funds moved out
6. Attacker drains trader funds

Hackers got into a Florida state website used for student financial aid. Personal details, including Social Security numbers, may have been taken from about 4.9 million people.

1. How it works:
2. Unauthorized access
3. Data accessed
4. Social Security numbers
5. Residents affected
6. Personal data may be used for identity theft

An employee copied health records of 726 people into a personal AI chat account the company had not approved. Those people's private health information may now sit outside the company's control.

1. How it works:
2. Employee exports data
3. Records copied
4. Pasted into AI chat
5. Stored by AI service
6. Health records leave company control

A company that runs school records software had a security incident. Some students' and families' sensitive ID numbers may have been taken.

This is a news roundup of several separate security problems: some firewall weaknesses, malware sold as a service to steal bank logins, a booby-trapped PDF file, and stolen login tokens. The summary does not say which products or users are

Hackers got into a contractor's computer systems that send notices for federal bankruptcy courts, and those notices were delayed for weeks. The contractor says no data was taken.

Developers accidentally left login keys for cloud and AI services inside publicly visible code on Gitee, a Chinese code-sharing site. Anyone who copied them could have used those accounts, possibly at the owners' expense.

1. How it works:
2. Public code posted
3. Repo scanned
4. Keys found
5. Keys still valid
6. Strangers can access cloud and AI accounts

A third-party service gives people in regions where OpenAI and Anthropic don't officially sell their products access to popular AI coding tools. The service reportedly switches off key safety protections, so code run through these tools may

1. How it works:
2. Developer request
3. Relay service
4. Sandbox disabled
5. Code runs unchecked
6. Code runs without sandbox protection

Hackers got into business software run by a third party and copied people's personal details and iRhythm account and device data. About 8.2 million people may be affected.

1. How it works:
2. Hackers target
3. Apps accessed
4. Data stolen
5. Breach reported
6. 8.2 million people's data exposed

Attackers are abusing recently patched PHP bugs to take control of servers and firewalls that are reachable from the internet. Some of these attacks have reached government-affiliated systems.

1. How it works:
2. Attacker scans
3. Exploits PHP2Shell
4. Gains shell access
5. Chains Fragnesia
6. Attacker controls the server as root

Someone with no login could send a specially crafted pattern in a GitLab pipeline setting and run their own commands on the GitLab server. Attackers are already trying this, so unpatched servers need updating now.

1. How it works:
2. Attacker crafts pattern
3. Request reaches GitLab
4. Regex not validated
5. Code runs on server
6. Attacker runs code on GitLab server

Attackers used a trick to get into software projects hosted on GitHub, and some of them are still inside. If your team builds or ships code there, someone unwanted may still have access.

1. How it works:
2. Campaign launched
3. Projects compromised
4. Developer endpoints
5. Cloud access
6. Attackers keep access inside developer environments

Records on tens of thousands of Homeland Security employees and contractors were posted publicly online, including contact details and information about sensitive assignments. Anyone who had their details exposed could be targeted by scams

1. How it works:
2. Attacker gets access
3. Okta SSO system
4. Staff records stolen
5. Published online
6. 41,000 staff records exposed publicly

A travel-industry software provider used by Japan Airlines was hacked, and some customers' personal details may have been stolen. Passport numbers and contact details are among the data reported as taken.

1. How it works:
2. Attacker breaches system
3. Amadeus PSS compromised
4. Passenger data stolen
5. Customers at risk
6. Passenger personal data exposed to criminals

Hackers got into the systems of Sony's internet provider in Japan and copied customer records. Personal details and some login passwords were taken, so affected customers should be careful about phishing and password reuse.

A state-sponsored hacking group is routing its attacks through chains of hijacked routers, cameras and other small devices, which makes the attacks hard to trace. The group has used this method to exploit previously unknown security flaws.

1. How it works:
2. Volt Typhoon operator
3. Rotating device chain
4. Zero-day exploit
5. Strategic access
6. Attacker gains hidden access to high-value systems

A car rental company in Japan had personal information leaked, including driver's license details for about 1.46 million people. Those people could face fraud or identity theft.

Attackers are disguising their scanning programs as legitimate AI company bots. If your systems leak passwords or access keys, these bots can find them and let attackers in.

1. How it works:
2. Threat actor
3. Impersonated AI bots
4. Exposed systems
5. Credentials found
6. Attacker gains usable credentials

A health department worker shared confidential medical details about pregnant women on a public social media account. The government first said only five patients were affected, then changed that claim.

Someone got into the Town Hall email account, most likely by tricking a person into giving up their login. Anyone who emailed the town could be targeted by follow-up scam emails.

A cyber attack (ransomware, where criminals lock files until paid) has slowed down official death investigations in New Zealand. Families are waiting months for answers.

Attackers send fake messages that get people to approve a login code on a real Microsoft-style sign-in page, handing over access to work accounts without the attacker ever needing the password. Most of the targets are US organizations.

1. How it works:
2. Phishing message sent
3. User starts device login
4. User enters attacker's code
5. Tokens issued to attacker
6. Attacker gains access to corporate accounts

Hackers broke into a Japanese cloud service that gives customers remote Windows computers. They threatened to lock up data with ransomware, so customers were told to unplug their PCs from the internet and shut them down.

1. How it works:
2. Attacker breaches service
3. Extortion demand
4. Ransomware threatened
5. Customers disconnect
6. Customer systems at risk of ransomware

Attackers reportedly altered a shared tracking script used by Convertr so it could copy shoppers' credit card details while they pay. Anyone entering card information on affected stores may be at risk.

1. How it works:
2. Skimming group
3. Analytics script
4. Shopper browser
5. Card data copied
6. Shoppers' card data is stolen

A company that runs the tip-line system used by Crime Stoppers in Canada had a data breach, which may have exposed anonymous tips people sent in. Some police services have paused using these tip lines while the extent is investigated.

Hackers targeted the US Federal Election Commission's website, and its electronic filing system was shut down. People who need to file campaign reports electronically may be unable to do so until it is back.

Hackers may have broken into Moldova's government online services and taken people's personal information. Officials warn more attacks like this could follow.

Hackers, possibly including foreign government groups, attacked the Ohio state auditor's public website, so the state temporarily shut that server down. The state says Ohioans' personal financial information is not believed to be at risk.

Attackers used AI software to automate parts of breaking into organizations in Japan. The AI helped run the attacks faster, with less manual work by the attacker.

1. How it works:
2. Operator sets goal
3. AI agents coordinate
4. Scan exposed targets
5. Access organization servers
6. Attackers gain automated access to victim systems

Hackers broke into the hospital's computer systems, locked up its files so staff cannot use them, and took sensitive patient information. They appear to want money to give it back.

1. How it works:
2. Hackers gain access
3. Nine servers breached
4. Data stolen
5. Data encrypted
6. Hospital data locked and leaked

A cyberattack locked up computer systems at a major hospital network, so ambulances were diverted and many appointments were cancelled. A criminal group has claimed responsibility.

1. How it works:
2. Ransomware group
3. Systems breached
4. Services disrupted
5. Care impacted
6. Health system operations halted

An attacker tricked someone into giving up access, and spreadsheets containing agents' personal information were viewed. Agents whose details were in those files may be at risk of scams.

1. How it works:
2. Phishing message
3. Credentials given
4. Spreadsheets accessed
5. Breach notice sent
6. Agent personal information disclosed to attacker

An outside attacker got into Capcom's account system and reached personal data for millions of player accounts. Some accounts reportedly had their passwords changed, so you could be locked out.

1. How it works:
2. Attacker
3. Capcom ID
4. Account data
5. Passwords
6. Accounts exposed and some locked out

Scammers got hold of personal details of military members from a Pentagon data system. Those details can be used to impersonate people or open accounts in their names.

Hackers got into a system that some clinics and doctors use to order lab tests and look up results. Patient information in that system may have been exposed.

A criminal group called SafePay locks up company computers and files, then demands payment to unlock them. Law enforcement says they have hit at least 600 organizations since August 2024.

Some data from users of the Warp developer tool was stolen when an outside vendor used by the project was attacked. The stolen data includes logs of what the AI agent decided and usage information.

1. How it works:
2. Attacker
3. Vendor breached
4. Logs exposed
5. User data leaked
6. Warp user agent logs and telemetry exposed

Companies that provide IT services to UK police forces were hacked several times, and police data held by those companies may have been exposed. Attackers got in through the suppliers rather than directly through police systems.

1. How it works:
2. Hackers
3. Supplier systems
4. Police data
5. Police data exposed via suppliers

A password-like key belonging to a third-party vendor was exposed, which could have let someone reach a database holding health and personal details of about 238,000 people. The material does not say whether anyone actually used it.

1. How it works:
2. Vendor key leaked
3. Database reachable
4. Health data at risk
5. Potential misuse
6. Health data of 238,000 members at risk

Attackers got a secret key that proves Keystone crypto wallets are genuine. With that key they could make fake wallets that look real, so buyers could lose their crypto.

1. How it works:
2. Attacker breaches website
3. Verification key stolen
4. Counterfeit devices built
5. Buyer trusts fake
6. Counterfeit wallets could steal buyers' crypto

Attackers got into a marketing system used by ENGIE's business partners and copied customer information. If you are an ENGIE customer, be alert to suspicious messages that use your personal details.

1. How it works:
2. Attackers
3. Marketing platform
4. Customer data
5. Customer data stolen

Hackers got into a system used by the German AfD party and stole emails and attachments, which were then published online for anyone to search or download. People who wrote to the party may have had their email addresses and message content

1. How it works:
2. Intruder gains access
3. Hosting provider hit
4. Emails stolen
5. Data published online
6. Private party emails become publicly accessible

Hackers got into a test system at the University of Copenhagen that held personal information. About 525,000 people may have had their details exposed, and some PIN codes were exposed too.

1. How it works:
2. Hackers gain access
3. Test environment reached
4. Personal data accessed
5. PIN codes exposed
6. Personal data and PINs exposed

Attackers hide instructions inside ordinary text files that AI coding helpers read. The helper may follow those hidden instructions as if you had asked for them, possibly taking actions you did not intend.

1. How it works:
2. Attacker plants file
3. Project includes file
4. AI agent reads it
5. Agent acts on text
6. Assistant performs attacker-chosen actions

A cybercrime group used a hacking tool called ARTEX AI to break into more than 90 organizations in South Korea and steal millions of personal records. Anyone whose data was held by those organizations may be at risk of scams or identity mis

1. How it works:
2. Former pentester
3. ARTEX AI framework
4. 90+ organizations
5. 8.2M records
6. Millions of records stolen

Hackers have hidden malicious code in about 953 online shops, mostly ones built on Magento. Shoppers visiting these stores may have that code run in their browser without knowing it.

1. How it works:
2. Threat actor
3. Store compromised
4. Visitor loads page
5. Malicious loader runs
6. Shopper's browser runs attacker code

Attackers are using stolen GitHub access tokens to take passwords and cloud keys from software developers' code projects. Anyone whose project or access tokens are caught in this could have their cloud accounts and private data exposed.

1. How it works:
2. Attacker abuses tokens
3. Repositories accessed
4. Secrets harvested
5. Cloud access gained
6. Attacker reaches cloud secrets and data

Criminals pose as IT support in Microsoft Teams chats and talk people into installing malicious software. That software can lock files for ransom or steal data.

1. How it works:
2. Fake IT account
3. External Teams chat
4. Employee trusts it
5. Malware installed
6. Attacker gains access to the organization

Hackers are getting into internet-connected Dahua security cameras and video recorders. Once inside, they can watch live video, change settings, and create their own login accounts.

1. How it works:
2. Attacker scans
3. Weak access
4. Device taken over
5. Accounts added
6. Attacker keeps control of the cameras

Attackers tricked people into signing in through a fake relay that copied their login session. They then reused that copied session to get into email accounts without needing the password again.

1. How it works:
2. Phishing lure
3. AitM relay
4. User signs in
5. Token stolen
6. Attacker reads email at compromised accounts

Attackers who steal GitHub login tokens are adding hidden automated jobs to code projects that print the project's passwords and keys into the build logs. The attackers then download those logs and delete them, so the secrets leave without

1. How it works:
2. Stolen token
3. Plant workflow
4. Secrets in logs
5. Download logs
6. Repository secrets are stolen