“Sni5Gect [is] a framework that sniffs messages from pre-authentication 5G communication in real-time,” the researchers from the Singapore University of Technology and Design explained of their work, presented this week at the 34th USENIX security bash, “and injects targeted attack payload in downlink communication towards the UE [User Equipment, i.e. a phone].”

Designed to take advantage of the period just after a device connects to a 5G network and is still in the process of handshaking and authentication – which, the team points out, can occur when entering or leaving a lift, disembarking a plane and turning aeroplane mode off, or even passing through a tunnel or parking garage – Sni5Gect takes advantage of unencrypted messaging between the base station and a target handset.

“Since messages exchanged between the gNB [Next-Generation Node B, the base station] and the UE are not encrypted before the security context is established (pre-authentication state),” the researchers wrote, “an attacker does not require knowledge of the UE’s credentials to sniff uplink/downlink [traffic] nor to inject messages without integrity protection throughout the UE connection procedure.”

That’s a flaw, and one the framework is designed to exploit. The team’s testing showed it capable of sniffing both uplink and downlink traffic with more than 80 percent accuracy, at ranges of up to 20 meters between an off-the-shelf software-defined radio and the target mobile. For packet injection, the success rate varied between 70-90 percent – and delivered, among other things, proof of a novel downgrade attack by which a ne’er-do-well equipped with Sni5Gect could downgrade a connection from 5G to 4G to reduce its security and carry out further surveillance and attacks.

As Sni5Gect works in real-time, its creators have claimed, and can inject attack payloads, including multi-stage attacks, based on protocol state, it’s suited to fingerprinting, denial-of-service attacks, and downgrading.

“To the best of our knowledge,” they wrote in their paper’s introduction [PDF], “Sni5Gect is the first framework that empowers researchers with both over-the-air sniffing and stateful injection capabilities, without requiring a rogue gNB [base station].”

[…]

Not all of the capabilities claimed in the team’s paper have been fully disclosed, however. The team has kept private “other serious exploits leveraging the framework,” in order to “avoid abusing SNI5Gect to launch attacks against people’s smartphones[s].” These exploits, it is claimed, will be made available only to “trusted institutions like universities and research institutions” upon application and verification of their legitimate interest.

[…]

More information, including a link to the open-access paper, is available on the project website.

Source: Boffins release 5G traffic sniffing tool • The Register

Find the git repository here

[…] Zveare, who has found bugs in carmakers’ customer systems and vehicle management systems before, found the flaw earlier this year as part of a weekend project, he told TechCrunch.

He said while the security flaws in the portal’s login system was a challenge to find, once he found it, the bugs let him bypass the login mechanism altogether by permitting him to create a new “national admin” account.

The flaws were problematic because the buggy code loaded in the user’s browser when opening the portal’s login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers’ dealers across the United States, he told TechCrunch.

“No one even knows that you’re just silently looking at all of these dealers’ data, all their financials, all their private stuff, all their leads,” said Zveare, in describing the access.

Zveare said one of the things he found inside the dealership portal was a national consumer lookup tool that allowed logged-in portal users to look up the vehicle and driver data of that carmaker.

In one real-world example, Zveare took a vehicle’s unique identification number from the windshield of a car in a public parking lot and used the number to identify the car’s owner. Zveare said the tool could be used to look up someone using only a customer’s first and last name.

With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars’ functions from an app, such as unlocking their cars.

Zveare said he tried this out in a real-world example using a friend’s account and with their consent. In transferring ownership to an account controlled by Zveare, he said the portal requires only an attestation — effectively a pinky promise — that the user performing the account transfer is legitimate.

“For my purposes, I just got a friend who consented to me taking over their car, and I ran with that,” Zveare told TechCrunch. “But [the portal] could basically do that to anyone just by knowing their name — which kind of freaks me out a bit — or I could just look up a car in the parking lots.”

[…]

Zveare said this was similar to a feature found in a Toyota dealer portal discovered in 2023.

“They’re just security nightmares waiting to happen,” said Zveare, speaking of the user-impersonation feature.

Once in the portal Zveare found personally identifiable customer data, some financial information, and telematics systems that allowed the real-time location tracking of rental or courtesy cars, as well as cars being shipped across the country, and the option to cancel them — though, Zveare didn’t try.

Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker.

[…]

Source: Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere | TechCrunch

However he won’t identify the car maker – which is a real problem with bad responsible disclosure rules.

Russian hackers took control of a Norwegian dam this year, opening a floodgate and allowing water to flow unnoticed for four hours, Norway’s intelligence service has said.

The admission, by the Norwegian Police Security Service (PST), marks the first time that Oslo has formally attributed the cyber-attack in April on Bremanger, western Norway, to Moscow.

The attack on the dam, which which is used for farming fish, released 500 litres (132 gallons) of water a second for four hours until the incident was detected and stopped.

The head of PST, Beate Gangås, said on Wednesday: “Over the past year, we have seen a change in activity from pro-Russian cyber actors.” The Bremanger incident was an example of such an attack, she added.

“The aim of this type of operation is to influence and to cause fear and chaos among the general population. Our Russian neighbour has become more dangerous.”

[…]

Intelligence services in Norway, which produces the majority of its electricity using hydropower dams, had previously warned of the potential risk of such attacks on energy infrastructure.

Norway and Russia share a 123-mile (198km) border, with a crossing at Storskog, Europe’s only open Schengen border with Russia.

The Russian embassy in Oslo said Gangås’s statements were “unfounded and politically motivated”.

It told Reuters news agency: “It is obvious that the PST is unsuccessfully trying to substantiate the mythical threat of Russian sabotage against Norwegian infrastructure this year, which it itself invented in its February (annual) report.”

Last year, Richard Moore, the head of Britain’s Secret Intelligence Service, MI6, accused Russia of a “staggeringly reckless campaign” of sabotage in Europe, in part to frighten countries from helping Ukraine. Moscow denies the allegation.

Source: Russian hackers seized control of Norwegian dam, spy chief says | Russia | The Guardian

European airline giants Air France and KLM say they are the latest in a string of major organizations to have their customers’ data stolen by way of a break-in at a third party org.

The airlines, which share a parent company, Air France-KLM Group, said in a joint statement that they “detected unusual activity on an external platform we use for customer service,” which led to attackers accessing customer data.

“Our IT security teams, along with the relevant external party, took immediate action to stop the unauthorized access,” the statement read. “Measures have also been implemented to prevent recurrence. Internal Air France and KLM systems were not affected.

“No sensitive data such as passwords, travel details, Flying Blue miles, passport, or credit card information was stolen.”

The airlines did not publicly specify the types of data that were stolen, but the exclusion of sensitive data suggests basic personal information was involved.

However, customer notifications circulating online noted that first and family names, along with contact details, Flying Blue numbers and tier levels, and the subject lines of service request emails were accessed.

[…]

The attack marks the latest in a string of data lapses at major organizations that also blamed a third party.

In recent weeks, luxury retailers Dior, Chanel, and Pandora all reported similar leaks at third party providers, as did Google, Qantas, and Allianz.

All of the above declined to identify the third party in question except for Google, which said this week that one of its Salesforce instances was raided.

[…]

Source: KLM, Air France latest major orgs to have data looted • The Register

It’s pretty clear that the customer service portal was looted.

A cyberattack on Russian state-owned flagship carrier Aeroflot caused a mass outage to the company’s computer systems on Monday, Russia’s prosecutor’s office said, forcing the airline to cancel more than 100 flights and delay others.

Ukrainian hacker group Silent Crow and Belarusian hacker activist group the Belarus Cyber-Partisans, which opposes the rule of Belarusian President Alexander Lukashenko, claimed responsibility for the cyberattack.

[…]

Kremlin spokesperson Dmitry Peskov called reports of the cyberattack “quite alarming,” adding that “the hacker threat is a threat that remains for all large companies providing services to the general public.”

Silent Crow claimed it had accessed Aeroflot’s corporate network for a year, copying customer and internal data, including audio recordings of phone calls, data from the company’s own surveillance on employees and other intercepted communications.

“All of these resources are now inaccessible or destroyed and restoring them will possibly require tens of millions of dollars. The damage is strategic,” the channel purporting to be the Silent Crow group wrote on Telegram. There was no way to independently verify its claims.

The same channel also shared screenshots that appeared to show Aeroflot’s internal IT systems, and insinuated that Silent Crow could begin sharing the data it had seized in the coming days.

“The personal data of all Russians who have ever flown with Aeroflot have now also gone on a trip — albeit without luggage and to the same destination,” it said.

[…]

Source: Cyberattack on Russian airline Aeroflot causes the cancellation of more than 100 flights – POLITICO

Financial services biz Allianz says the majority of customers of one of its North American subsidiaries had their data stolen in a cyberattack.

Lawyers acting on behalf of US-based Allianz Life filed a breach notification with Maine’s attorney general on Saturday, saying the intrusion began on July 16 and was detected a day later.

Official filings did not state how many people were affected, or what data was compromised, although in a statement to The Register, Allianz said the majority of its 1.4 million customers were impacted.

“The threat actor was able to obtain personally identifiable data related to the majority of Allianz Life’s customers, financial professionals, and select Allianz Life employees, using a social engineering technique,” a spokesperson said.

Allianz went on to say that the attacker or attackers gained access to Allianz Life’s third-party, cloud-based CRM system, although it did not confirm the vendor supplying that system.

[…]

Source: Majority of 1.4M customers caught in Allianz Life data heist • The Register

What is most amazing is that nowadays 1.4m people affected feels like a small hack.

Hacking is hard. Well, sometimes.

Other times, you just call up a company’s IT service desk and pretend to be an employee who needs a password reset, an Okta multifactor authentication reset, and a Microsoft multifactor authentication reset… and it’s done. Without even verifying your identity.

So you use that information to log in to the target network and discover a more trusted user who works in IT security. You call the IT service desk back, acting like you are now this second person, and you request the same thing: a password reset, an Okta multifactor authentication reset, and a Microsoft multifactor authentication reset. Again, the desk provides it, no identity verification needed.

So you log in to the network with these new credentials and set about planting ransomware or exfiltrating data in the target network, eventually doing an estimated $380 million in damage. Easy, right?

According to The Clorox Company, which makes everything from lip balm to cat litter to charcoal to bleach, this is exactly what happened to it in 2023. But Clorox says that the “debilitating” breach was not its fault. It had outsourced the “service desk” part of its IT security operations to the massive services company Cognizant—and Clorox says that Cognizant failed to follow even the most basic agreed-upon procedures for running the service desk.

In the words of a new Clorox lawsuit, Cognizant’s behavior was “all a devastating lie,” it “failed to show even scant care,” and it was “aware that its employees were not adequately trained.”

“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” says the lawsuit, using italics to indicate outrage emphasis. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over. Cognizant is on tape handing over the keys to Clorox’s corporate network to the cybercriminal—no authentication questions asked.”

I can has password reset?

From 2013 through 2023, Cognizant had helped “guard the proverbial front door” to Clorox’s network by running a “service desk” that handled common access requests around passwords, VPNs, and multifactor authentication (MFA) such as SMS codes.

When a purported Clorox employee called the service desk, protocol demanded that the employee use an internal verification and self-reset password tool called MyID. If that wasn’t possible, the service desk should have verified the person’s identity using their manager’s name and the user’s MyID username, after which the password could be reset but the manager and employee would both be notified by email.

Instead, says Clorox, this happened on August 11, 2023:

Cybercriminal: I don’t have a password, so I can’t connect.
Cognizant Agent: Oh, ok. Ok. So let me provide the password to you ok?
Cybercriminal: Alright. Yep. Yeah, what’s the password?
Cognizant Agent: Just a minute. So it starts with the word “Welcome”…

When this worked, and the caller had a working password, he moved on to asking about an MFA reset:

Cybercriminal: My Microsoft MFA isn’t working.
Cognizant Agent: Oh, ok…
Cybercriminal: Can you reset my MFA? It’s on my old phone … [inaudible] old phone.
Cognizant Agent: [Following a brief hold]. So thanks for being on hold, Alex. So multifactor authentication reset has been done now. Ok. So can you check if you’re able to login …
Cybercriminal: Alright. It let me sign in now. Thank you.

After adopting the ID of a second Clorox user in IT security and calling back later that same day, the hacker tried all the same tricks again. And they worked, even across multiple Cognizant agents.

Cognizant Agent: How can I help you today?
Cybercriminal: Um my password on Okta was not working …
Cognizant Agent: I’m going to have your password reset from my end right away. Ok. And we’ll see how it’s going to work. Ok. [Following a brief hold] Thank you … I’m extremely sorry for the long hold. So … password is going to be Clorox@123.
Cybercriminal: What’s that?
Cognizant Agent: Yeah it was Clorox@123…Ok.
Cybercriminal: Yep.
Cognizant Agent: Want me to wait over the phone while you are trying it?
Cybercriminal: Yes, yes, please.
Cognizant Agent: Sure … sure.

[…]

Source: After $380M hack, Clorox sues its “service desk” vendor for simply giving out passwords – Ars Technica

Multinational grocery and retail megacorp Ahold Delhaize says upwards of 2.2 million people had their data compromised during its November cyberattack with personal, financial and health details among the trove.

Ahold Delhaize operates a network of stores in Europe and the US via brands including Food Lion, Stop & Shop and Giant. It also has a substantial web business. It employs more than 400,000 staff and serves around 63 million customers a week.

The digital break-in late last year caused disruption across its organization, with some Stop & Shop stores struggling to fill prescriptions due to IT issues, while Food Lion employees took to social media complaining about delayed and missing deliveries.

Now Ahold Delhaize has confirmed more details via a notification filed with the Office of the Maine Attorney General, revealing the data of more than 2.24 million individuals was exposed.

Different people will have had different data points compromised, it added, and said the following may be in the wrong hands:

• Names
• Contact information (postal address, email address, and telephone number)
• Dates of birth
• Government-issued identification numbers (Social Security, passport and driver’s license numbers)
• Financial account information (including bank account numbers)
• Health information (workers’ compensation information and medical information contained in employment records)
• Employment-related information

In a “Notice of Data Breach” letter sent to impacted individuals, Ahold Delhaize made no reference to customer data, saying only that investigations revealed “personal information contained in employment records related to you or your family member” may have been accessed.

This indicates the breach involved current and former staff.

[…]

Source: Ahold Delhaize says 2.2M affected after cyberattack • The Register

[…] , the Cybernews research team discovered a plethora of supermassive datasets, housing billions upon billions of login credentials. From social media and corporate platforms to VPNs and developer portals, no stone was left unturned.

Our team has been closely monitoring the web since the beginning of the year. So far, they’ve discovered 30 exposed datasets containing from tens of millions to over 3.5 billion records each. In total, the researchers uncovered an unimaginable 16 billion records.

None of the exposed datasets were reported previously, bar one: in late May, Wired magazine reported a security researcher discovering a “mysterious database” with 184 million records. It barely scratches the top 20 of what the team discovered. Most worryingly, researchers claim new massive datasets emerge every few weeks, signaling how prevalent infostealer malware truly is.

[…]

“This is not just a leak – it’s a blueprint for mass exploitation. With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing. What’s especially concerning is the structure and recency of these datasets – these aren’t just old breaches being recycled. This is fresh, weaponizable intelligence at scale,” researchers said.

The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data. Most of the datasets were temporarily accessible through unsecured Elasticsearch or object storage instances.

[…]

Information in the leaked datasets opens the doors to pretty much any online service imaginable, from Apple, Facebook, and Google, to GitHub, Telegram, and various government services. It’s hard to miss something when 16 billion records are on the table.

[…]

 

Source: 16 billion passwords exposed in colossal data breach​ | Cybernews

https://localmess.github.io/

We disclose a novel tracking method by Meta and Yandex potentially affecting billions of Android users. We found that native Android apps—including Facebook, Instagram, and several Yandex apps including Maps and Browser—silently listen on fixed local ports for tracking purposes.

These native Android apps receive browsers’ metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users’ mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users’ visiting sites embedding their scripts.

This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android’s permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users’ web activity.

[…]

Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs.

[…]

Additional risk: Browsing history leak

Using HTTP requests for web-to-native ID sharing (i.e. not WebRTC STUN or TURN) may expose users browsing history to third-parties. A malicious third-party Android application that also listens on the aforementioned ports can intercept the HTTP requests sent by the Yandex Metrica script and the first, now-unused, implementation of Meta’s communication channel by monitoring the Origin HTTP header.

We developed a proof-of-concept app to demonstrate the feasibility of this browsing history harvesting by a malicious third-party app. We found that browsers such as Chrome, Firefox and Edge are susceptible to this form of browsing history leakage in both default and private browsing modes. Brave browser was unaffected by this issue due to their blocklist and the blocking of requests to the localhost; and DuckDuckGo was only minimally affected due to missing domains in their blocklist.

[…]

According to BuiltWith, a website that tracks web technology adoption: Meta Pixel is embedded on over 5.8 million websites. Yandex Metrica, on the other hand, is present on close to 3 million websites. According to HTTP Archive, an open and public dataset that runs monthly crawls of ~16 million websites, Meta Pixel and Yandex Metrica are present on 2.4 million and 575,448 websites, respectively.

[…]

Disclosure

Our responsible disclosure to major Android browser vendors led to several patches attempting to mitigate this issue; some already deployed, others currently in development. We thank all participating vendors (Chrome, Mozilla, DuckDuckGo, and Brave) for their active collaboration and constructive engagement throughout the process. Other Chromium-based browsers should follow upstream code changes to patch their own products.

However, beyond these short-term fixes, fully addressing the issue will require a broader set of measures as they are not covering the fundamental limitations of platforms’ sandboxing methods and policies. These include user-facing controls to alert users about localhost access, stronger platform policies accompanied by consistent and strict enforcement actions to proactively prevent misuse, and enhanced security around Android’s interprocess communication (IPC) mechanisms, particularly those relying on localhost connections.

[…]

A mystery whistleblower calling himself GangExposed has exposed key figures behind the Conti and Trickbot ransomware crews, publishing a trove of internal files and naming names.

The leaks include thousands of chat logs, personal videos, and ransom negotiations tied to some of the most notorious cyber-extortion gangs —believed to have raked in billions from companies, hospitals, and individuals worldwide.

It’s part of his “fight against an organized society of criminals known worldwide,” GangExposed told The Register via Signal chat. He claims that he’s not interested in the $10 million bounty that the Feds have put up for information about one key Conti leader that he’s already named, as well as a second that he says will soon be identified on Telegram.

“I take pleasure in thinking I can rid society of at least some of them,” GangExposed said. “I simply enjoy solving the most complex cases.”

After creating his latest Telegram channel on May 5 — GangExposed says two earlier accounts were shut down days ago — he published his first “revelation” and outed Stern, the leader of Trickbot and Conti, as 36-year-old Russian named Vitaly Nikolaevich Kovalev. Stern’s identity was later confirmed by German police.

I take pleasure in thinking I can rid society of at least some of them

A couple of days later, GangExposed claimed to identify another key Conti crim who goes by Professor as Vladimir Viktorovich Kvitko, a 39-year-old Russian national who reportedly relocated from Moscow to Dubai. According to chat logs and other communications leaked by GangExposed, Kvitko and other Conti leaders moved to Dubai in 2020 and set up shop in the United Arab Emirates to continue their cyberattacks against Western organizations.

“Kvitko maintains a modest lifestyle, with known property in Moscow and several vehicles registered to family members,” GangExposed posted. “Income mostly originates from RM RAIL Management Company and Rosselkhozbank. In contrast, other Conti leaders (e.g., ‘Target’) display significant luxury assets, including a Moscow City apartment, Ferrari, and 2 multiple Maybach vehicles.”

He also published a video of what GangExposed says is six Conti ransomware members on a private jet, celebrating the birthday of another key leader, Target. 

The US government has offered up to $10 million for information leading to the identification or location of five key Conti operators, including “Professor” and “Target.” GangExposed says he’s going to identify Target next.

“Essentially I burned $10 million when I published Professor,” he told The Register. “And I’m about to burn another $10 million when I publish Target.”

And on Thursday, he posted a whopping 15 photos of alleged Conti members along with a more detailed write-up of Conti’s lead sysadmin Defender, aka Andrey Yuryevich Zhuykov, and Mango, aka Mikhail Mikhailovich Tsaryov, a senior manager within the group.

This is no longer just a leak — it’s a high-stakes intelligence war

“This is no longer just a leak — it’s a high-stakes intelligence war,” FalconFeeds threat intel analysts posted on social media.

Who is GangExposed?

GangExposed calls himself an “independent anonymous investigator” without any formal IT background, and said he hasn’t had “a ‘real’ name in years.”

“My toolkit includes classical intelligence analysis, logic, factual research, OSINT methodology, stylometry (I am a linguist and philologist), human psychology, and the ability to piece together puzzles that others don’t even notice,” he said. “I am a cosmopolitan with many homes but no permanent base — I move between countries as needed. My privacy standards are often stricter than those of most subjects of my investigations.”

GangExposed says he obtained all of the data he leaked via “semi-closed databases, darknet services (for probing state records through corrupt officials), and I often purchase information. I have access to the leaked FSB border control database,” which he says was being sold on the darkweb for $250,000. 

He hopes his investigation can achieve three objectives. First, he wants to publicly identify all of the gangs’ key criminal participants — GangExposed puts this number at around 50 — see them sanctioned, and also named on Interpol’s wanted persons list.

Second, GangExposed says he wants to “disrupt their current enrichment schemes by exposing the organizers of the Blockchain Life forum, which serves as a breeding ground for fraudulent pyramid schemes.” 

Blockchain Life, according to the internal chat logs, was a scheme organized by Khitrov and Kovalev (aka Stern) that aimed to legitimize Trickbot’s and Conti’s illegally obtained cryptocurrency earnings

Finally, GangExposed says he wants to “deprive them of a safe haven in the UAE. The respected authorities of the UAE strictly uphold their laws, and while they lack extradition agreements for cybercriminals, I’ve managed to investigate and prove that Conti used the UAE specifically for carrying out attacks. In other words, they physically committed a series of crimes while being present there.”

Some security researchers think he could in fact be a disgruntled former ransomware criminal looking to burn his bosses or simply resurface the 2022 Conti leaks.

“The data we’ve reviewed provides strong indicators that the source behind the leak is either an ex-member or a disgruntled insider from within the group — given the level of access, context, and internal coordination reflected in the communications,” Technisanct founder and CEO Nandakishore Harikumar told The Register. Technisanct owns FalconFeeds.

Harikumar’s threat-intel group has analyzed all of GangExposed’s leaks, and shared a 34-page analysis with The Register about the massive data dump. He recommends that law enforcement pursue investigative leads from the newly disclosed personally identifiable information about key Conti leaders detailed in the leaks. ®

https://www.theregister.com/2025/05/31/gangexposed_coni_ransomware_leaks/

If you use the internet, you’ve probably had at least some personal information go missing. It’s just the nature of the web. But this latest discovery, as reported by Wired, is something different.

Security researcher Jeremiah Fowler found a public online database housing over 180 million records (184,162,718 to be exact) which amounted to more than 47GB of data. There were no indications about who owned the data or who placed it there, which Fowler says is atypical for these types of online databases. Fowler saw emails, usernames, passwords, and URLs linking to the sites where those credentials belonged. These accounts included major platforms like Microsoft, Facebook, Instagram, Snapchat, Roblox, Apple, Discord, Nintendo, Spotify, Twitter, WordPress, Yahoo, and Amazon, as well as bank and financial accounts, health companies, and government accounts from at least 29 countries. That includes the U.S., Australia, Canada, China, India, Israel, New Zealand, Saudi Arabia, and the UK.

Fowler sent a responsible disclosure notice to the hosting provider of the database, World Host Group. Fowler was able to detect signs that the credentials here were stolen with infostealer malware, which bad actors use to harvest sensitive information from a variety of platforms—think web browsers, email services, and chat apps.

Following Fowler’s notice, World Host Group restricted the database from public access. The provider told Wired that the database was operated by a customer, a “fraudulent user” who uploaded illegal information to the server.

In order to ensure these credentials were real, and not just a bunch of bogus data, Fowler actually contacted some of the email addresses he found in the database. He got some bites, and those users were able to confirm the records that he found associated with their emails.

[…]

Source: Someone Found Over 180 Million User Records in an Unprotected Online Database

A “significant amount of personal data” belonging to legal aid applicants dating back to 2010 in the UK was stolen by cybercriminals, the Ministry of Justice (MoJ) confirmed today.

The announcement follows the initial news from May 6 of an attack on the UK’s Legal Aid Agency (LAA), an MoJ-sponsored organization that allows legal aid workers to record their hours and bill the the government accordingly. The aid is means tested, granted to people on low incomes and with limited savings.

The attack itself was detected on April 23 but investigators found on May 16 that the damage was “more extensive than originally understood and that the group behind it had accessed a large amount of information relating to legal aid applicants.”

Affected data goes back to 2010 and could include applicants’ contact details, home addresses, dates of birth, national ID numbers, criminal histories, employment statuses, and financial data such as contribution amounts, debts, and payments.

[…]

The MoJ didn’t specify the number of people believed to be affected, but publicly available data [PDF] shows the number of legal aid claims made in the last reporting year – April 2023 to March 2024 – stood at 388,888, of which 96 percent were granted. This also represented a 7 percent increase in applications compared to the previous reporting year.

It should also be noted that each application may involve more than one individual.

The PA news agency reported that 2.1 million data points were stolen, although the MoJ has not officially corroborated this.

Other data published by the MoJ shows that over £2 billion ($2.7 billion) was spent on legal aid between April 2023 and March 2024.

All members of the public who applied for legal aid between 2010 and 2025 were advised to be extra vigilant about suspicious activity such as unknown calls and messages, and advised to change their passwords.

Max Vetter, VP of cyber at Immersive, who also spent years at the Metropolitan Police and taught at the GCHQ summer school, said that due to its sensitivity, the data could be used to extort not only the LAA but also the affected individuals.

[…]

Source: Legal Aid Agency attack involved ‘significant’ data theft • The Register

And this is why you clean your data regularly.

Data breaches are most often the work of external bad actors, but sometimes the call comes from inside the house. Cryptocurrency exchange Coinbase has disclosed that hackers paid off support agents—both employees and contractors located outside the U.S.—who had access to company systems to provide customer data and then demanded a $20 million ransom not to leak the information.

Coinbase was notified of the ransom demand on May 11, just a few days before reporting the incident to the Securities and Exchange Commission (SEC). The company has said the staff involved were fired and reported to law enforcement when their unauthorized access was detected, but they were still able to provide information to attackers.

What happened with Coinbase?

The threat actors, with the help of insiders with access to Coinbase systems, were able to collect personally identifiable information on roughly one million individuals (just 1% of Coinbase customers). According to a Coinbase blog post detailing the incident, the compromised data included the following:

• Names, addresses, phone numbers, and emails
• Last four digits of Social Security numbers
• Masked bank account numbers and identifiers
• Government ID images, such as driver’s licenses and passports
• Account data, such as balance snapshots and transaction history
• Corporate data available to support agents

The breach did not include login credentials, two-factor authentication (2FA) codes, or private keys, and hackers do not have access to customer funds, Coinbase Prime accounts, or customer hot or cold wallets.

Coinbase has said they are not paying the $20 million ransom and instead are offering those funds as a reward for information about the attack. The company is also expanding its U.S.-based support to monitor and manage the impact on customer accounts.

What Coinbase customers need to do

Coinbase sent email notifications from the address no-reply@info.coinbase.com to all affected customers—these messages went out at 7:20 a.m. on May 15. Flagged accounts will have to go through several ID checks to make large withdrawals, so you may experience delays with transactions.

First, if you were impacted by the breach, be on the lookout for impersonation scams. The aim of the attack, according to Coinbase, was to acquire customer information, reach out pretending to be from Coinbase, and use social engineering tactics to trick targets into transferring their money. Know that Coinbase will never ask for your credentials (including passwords and 2FA codes) or request that you transfer assets to another “safe” account, vault, or wallet, and they will never call or text you to give you a seed phrase or wallet address. They also will not ask you to contact an unknown number for customer support.

Second, you can also take steps to secure your account, like enabling 2FA using a hardware key and turning on withdrawal allow-listing, which limits transfers to accounts in your address book that you know and trust. If you believe your account has been compromised, lock it down and contact security@coinbase.com.

Finally, take steps to be reimbursed. Coinbase says it intends to reimburse customers who were tricked into sending funds to the attackers. You’ll find more information in the notification email.

Source: Three Steps Coinbase Users Should Take After a Hack Compromised One Million Accounts

Really good response by Coinbase – quick to report to the SEC and offering help to their customers. Unlike some companies who pretend it’s not important (Dell hack but who Dell didn’t think it was a big deal now includes customer phone numbers) or who blame the victims (23andMe tells victims it’s their fault that their data was breached. DNA data, it turns out, is extremely sensitive!) or even change their TOS after they have been hacked (23andMe frantically changed its terms of service to prevent 6.9m hacked customers from suing about losing their (and their entire family’s) DNA)

GlobalX, a charter airline used for deportations by the US government, has admitted someone broke into its network infrastructure.

“On May 5, 2025, Global Crossing Airlines Group learned of unauthorized activity within its computer networks and systems supporting portions of its business applications, which the company determined to be the result of a cybersecurity incident,” an SEC filing from May 9 reads.

“Upon learning of this activity, the company immediately activated its incident response protocols and third-party cybersecurity experts to assist with containment and mitigation activities and to investigate the nature and scope of the incident, and took actions to contain and isolate the affected servers and prevent further intrusion.”

GlobalX is one of the small airlines contracted by Immigration and Customs Enforcement (ICE) to carry out the President’s mass deportation campaign of “illegal aliens.”

[…]

The disclosure, however vague, lends credence to reports that those responsible had stolen flight records and passenger manifests, including ones related to deportation flights, dating back to January.

The alleged perpetrators pitched the news to various outlets, and while the word of a cybercriminal should not be taken as gospel, the timing of the disclosure and its ambiguous wording suggest there is at least some truth to the story.

[…]

GlobalX was quickly identified as one of the main small airlines whose services were called upon by ICE within days of Trump taking office for the second time, although the company doesn’t openly advertise this.

Bloomberg reported that some of the earliest flights it was tasked with making from the US to South American countries such as Brazil, Colombia, Guatemala, and Honduras were mired in technical difficulties.

The airline, which operates a fleet of 19 Airbus planes (A320, A321, and A321F), reportedly tackled various issues ranging from aborted landings, broken air conditioning leading to deportees fainting from high temperatures, to not being able to start engines for hours.

According to its investor presentation [PDF], GlobalX is the fastest-growing charter airline in America, but up-to-date filings show it has yet to turn a profit since being founded in 2018.

[…]

Source: Charter airline helping Trump’s deportation campaign pwned • The Register

TeleMessage, a communications app used by former Trump national security adviser Mike Waltz, has suspended services after a reported hack exposed some user messages. The breach follows controversy over Waltz’s use of the app to coordinate military updates, including accidentally adding a journalist to a sensitive Signal group chat. From the report: In an email, Portland, Oregon-based Smarsh, which runs the TeleMessage app, said it was “investigating a potential security incident” and was suspending all its services “out of an abundance of caution.” A Reuters photograph showed Waltz using TeleMessage, an unofficial version of the popular encrypted messaging app Signal, on his phone during a cabinet meeting on Wednesday. A separate report from 404 Media says hackers have also targeted GlobalX Air — one of the main airlines the Trump administration is using as part of its deportation efforts — and claim to have stolen flight records and passenger manifests for all its flights, including those for deportation. From the report: The data, which the hackers contacted 404 Media and other journalists about unprompted, could provide granular insight into who exactly has been deported on GlobalX flights, when, and to where, with GlobalX being the charter company that facilitated the deportation of hundreds of Venezuelans to El Salvador. “Anonymous has decided to enforce the Judge’s order since you and your sycophant staff ignore lawful orders that go against your fascist plans,” a defacement message posted to GlobalX’s website reads. Anonymous, well-known for its use of the Guy Fawkes mask, is an umbrella some hackers operate under when performing what they see as hacktivism.

Source: Messaging App Used by Mike Waltz, Trump Deportation Airline GlobalX Both Hacked in Separate Breaches | Slashdot

In a recent discovery, SafetyDetectives’ Cybersecurity Team stumbled upon a clear web forum post where a threat actor publicized a database allegedly belonging to Boulanger Electroménager & Multimédia purportedly exposing 5 Million of their customers.

What is Boulanger Electroménager & Multimédia?

Boulanger Electroménager & Multimédia is a French company that specializes in the sale of household appliances and multimedia products.

Founded in 1954, according to their website, Boulanger has physical stores and delivers its products to clients across France. The company also offers an app, which has over 1 million downloads on the Google Play Store and Apple’s App Store.

Where Was The Data Found?

The data was found in a forum post available on the clear surface web. This well-known forum operates message boards dedicated to database downloads, leaks, cracks, and more.

What Was Leaked?

The author of the post included two links to the unparsed and clean datasets, which purportedly belong to Boulanger. They claim the unparsed dataset consists of a 16GB .JSON file with 27,561,591 million records, whereas the clean dataset is comprised of a 500MB .CSV file with 5 million records.

Links to both datasets were hidden and set to be shown after giving a like or leaving a comment on the post. As a result, the data was set to be unlocked for free by anyone with an account on the forum who was willing to simply interact with the post.

Our Cybersecurity Team reviewed part of the datasets to assess their authenticity, and we can confirm that the data appears to be legitimate. After running a comparative analysis, it seems like these datasets correspond to the purportedly stolen data from the 2024 cyberincident.

Back in September 2024, Boulanger was one of the targets of a ransomware attack that also affected other retailers, such as Truffaut and Cultura. A threat author with the nickname “horrormar44” claimed responsibility for the breach.

At the time, the data was offered on a different well-known clear web forum — which is currently offline — at a price of €2,000. Although there allegedly were some potential buyers, it is unclear if the sale was actually finalized. In any case, it seems the data has resurfaced now as free to download.

While reviewing the data, we found that the clean dataset contains just over 1 million rows containing one customer per row and includes some duplicates. While that’s still a considerable number of customers, it’s far smaller than the 5 million claimed by the author of the post.

The sensitive information allegedly belonging to Boulanger’s customers included:

• Name
• Surname
• Full physical address
• Email address
• Phone number

[….]

Source: 27 Million Records from French Boulanger’s Customers Allegedly Exposed Online

[…]The IT break-in occurred between April 20 and April 22, last year, according to a notification filed this month with the US state’s attorney general’s office. California Cryobank spotted unauthorized activity on certain computers on April 21, isolated the affected machines, and launched an investigation.

The sperm bank hasn’t disclosed how many individuals were affected, but says the files potentially accessed or acquired include names, Social Security numbers, driver’s license numbers, financial account details, and health insurance information [PDF].

California Cryobank has touted itself as having the largest sperm supply in the world, distributing to all 50 US states and more than 30 countries internationally.

The biz did not immediately respond to The Register‘s questions about the break-in, including how many customers were affected and if the miscreants deployed ransomware and demanded an extortion payment. One wonders why it’s taken almost a year for this all to come to light, so to speak.

[…]

Source: Personal info feared stolen from sperm bank • The Register

The Pennsylvania State Education Association (PSEA) says a July 2024 “security incident” exposed sensitive personal data on more than half a million individuals, including financial and health info.

The nonprofit, which represents more than 178,000 education professionals in the US state of Pennsylvania, confirmed data was stolen during a July 6 attack. According to The Office of the Maine Attorney General, the breach affected a total of 517,487 people

[…]

The org’s disclosure notice stated: “…we determined that the data acquired by the unauthorized actor contained some personal information belonging to individuals whose information was contained within certain files within our network.

“We took steps, to the best of our ability and knowledge, to ensure that the data taken by the unauthorized actor was deleted. We want to make the impacted individuals aware of the incident and provide them with steps they can take to further protect their information.”

Although PSEA’s disclosure didn’t explicitly mention ransomware or extortion, it did say that steps were taken to ensure the stolen data was deleted — a claim that typically implies some level of communication with the attackers, often seen in double extortion cases.

Adding weight to that suspicion, the Rhysida ransomware gang publicly claimed responsibility for the attack in September 2024, suggesting ransomware was involved.

[…]

PSEA emphasized that not every individual had the same data elements compromised. The exposed information may include an individual’s full name in combination with one or more other type of personal data.

The possible data types stolen include the usual personally identifiable information (PII) such as full names and dates of birth, and identity documents such as driver’s licenses, state IDs, and social security numbers (SSNs).

In addition to basic PII, the nonprofit also said account numbers, account PINs, security codes, passwords, routing numbers, payment card numbers, card PINs, and expiration dates might have been taken.

The list doesn’t stop there: Passport numbers, taxpayer ID numbers, usernames and passwords, health insurance information, and finally medical information are potentially in the hands of cybercriminals.

[…]

Source: Cyberattack on nonprofit affects over 500k PA school workers • The Register

According to a new report from the Cato CTRL team, the Ballista botnet exploits a remote code execution vulnerability that directly impacts the TP-Link Archer AX-21 router.

The botnet can lead to command injection which then makes remote code execution (RCE) possible so that the malware can spread itself across the internet automatically. This high severity security flaw (tracked as CVE-2023-1389) has also been used to spread other malware families as far back as April 2023 when it was used in the Mirai botnet malware attacks. The flaw also linked to the Condi and AndroxGh0st malware attacks.

[…]

The attack sequence is as follows: it starts with a malware dropper, then a shell script designed to fetch and execute the main binary on the target system for various system architectures. When executed, the malware establishes a command-and-control (C2) channel on port 82 to take control of the device.

This allows the malware to run shell commands to conduct further remote code execution and Denial of Service (DoS) attacks; it will also attempt to read sensitive files on the system.

Supported commands include flooder (triggers a flood attack), exploiter (which exploits CVE-2023-1389), start (an optional parameter used with the exploiter to start the module), close (stops the module triggering function), shell (runs a Linux shell command on the local system) and killall (used to terminate the service).

The Ballista malware is additionally capable of terminating previous instances of itself – and erasing its own presence once execution begins. It’s designed to spread to other routers by attempting to exploit the flaw.

[…]

Source: Thousands of TP-Link routers have been infected by a botnet to spread malware | Tom’s Guide