Nostr notes by Dissent Doe :cupofcoffee:

The Norwegian data protection authority issued its biggest fine ...

2026-10-17T22:37:25Z

The Norwegian data protection authority issued its biggest fine ever ($9,758,476.80 USD).

"– We issued such a high fine in this case because the breaches we identified were very serious. Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data, says Line Coll, Director General of the Norwegian Data Protection Authority.

Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies. Xandr defended itself by saying that they thought Grindr had collected users’ consent, but the Norwegian Data Protection Authority does not accept that actors can simply blame one another."

Read their full press release at https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/

#dataprotection #GRINDR #XANDR #datatilsynet #consent

First: I don't agree with some of what @npub1vc3…axsh ...

2026-09-28T20:42:06Z

In reply to nevent1q…ndtj
_________________________

First: I don't agree with some of what BrianKrebs (npub1vc3…axsh) wrote, but that's for another time. Second: With van der Stap, the hacking was never for a shopping spree. He seldom spent any money he made extorting. He'd occasionally spend some on servers. He was just obsessed with databases, especially private ones. And he still was after he got out of prison, based on chats I had with him.

I don't know if there's any evidence linking him to the Odido hack, but four people say that the audio clip the Dutch police released is not van der Stap's voice.

As to ShinyHunters' statement claiming he is not a member, well, criminals lie all the time, right? I do predict we'll hear about evidence linking them, if not as a "full member," then as someone associated with them.

Bottom line: I think he's in serious trouble because he violated probation and allegedly engaged in cybercrime again, but let's hear what they claim he actually did.

RE: https://cyberplace.social/@GossiTheDog/117313751385768529 I ...

2026-09-22T21:27:56Z

RE: https://cyberplace.social/@GossiTheDog/117313751385768529

I emailed Elsevier to ask whether there was any risk to any patient/healthcare data at all. They sent me a statement:

"On September 21, Elsevier identified that visitors to select platforms were being redirected to a third-party page. Our cybersecurity team responded immediately, resolving the issue and restoring normal service.

Our investigation indicates that this was a narrowly scoped, limited-duration event involving the temporary redirection of traffic for certain web properties. There is no indication that core platforms, customer data, research content, or operational systems were compromised."

quoting
note1d7e…sw54

Elsevier got hacked and their website replaced with a LAPSUS$ ransomware group portal.

NEW by me: The U.S. military leaked more than 93,000 tips via ...

2026-09-18T19:58:29Z

NEW by me:

The U.S. military leaked more than 93,000 tips via insecure P3 Global Intel. Has anyone been notified?

I had reported on the school-related tips in the Navigate360 breach, and then the Crime Stoppers tips. In this post, I looked at the tips to the U.S. military.

https://databreaches.net/2026/09/18/the-u-s-military-leaked-more-than-93000-tips-via-insecure-p3-global-intel-has-anyone-been-notified/

#Navigate360 #P3GlobalIntel #databreach #cybersecurity #incidentresponse

Doug Levin (npub12wk…z5fq)

SCOOP: Some Click2Mail customers will soon be receiving ...

2026-08-29T14:04:54Z

SCOOP: Some Click2Mail customers will soon be receiving notification of a data security incident

https://databreaches.net/2026/08/29/scoop-some-click2mail-customers-will-soon-be-receiving-notification-of-a-data-security-incident/

#databreach #cardskimmer #Click2Mail

RE: https://infosec.exchange/@chum1ng0/117164044590120518 I just ...

2026-08-27T00:53:05Z

RE: https://infosec.exchange/@chum1ng0/117164044590120518

I just read your full post, and those folks are so fortunate that you didn't give up and kept trying every possible connection to get so much personal and sensitive information locked down. Well done, Chu!
nostr:note1hx3faj55gfj987lsdg6mvdn6j9erxg0j662d6hhuf2qauuwm58vsrn8d0m

I have no history with this group (unless I knew them under ...

2026-08-26T13:33:32Z

In reply to nevent1q…elxg
_________________________

I have no history with this group (unless I knew them under another brand), so I can't be sure, but usually, when TAs tell me that they haven't disrupted, they haven't locked.

Bill (npub19qj…eda3)

I was able to contact DireWolf, and they tell me they have not ...

2026-08-26T13:30:15Z

In reply to nevent1q…9m4y
_________________________

I was able to contact DireWolf, and they tell me they have not interfered with the registry's operations.

So that's a bit of a relief.

Bill (npub19qj…eda3)

group encrypts, which could likely interfere with rapid matching ...

2026-08-25T22:53:33Z

In reply to nevent1q…y8w5
_________________________

group encrypts, which could likely interfere with rapid matching and cause delays in matching or arranging for transfers.

I'm trying to reach the TAs on qTox to ask whether they actually locked the registry. Their "about" page suggests that they might have. 😡 I also reached out to the registry but no reply at this time. I noticed that they were able to update their website with a news update yesterday.

Bill (npub19qj…eda3)

ShinyHunters added ReliaQuest to its DLS yesterday. ReliaQuest ...

2026-08-24T11:42:52Z

ShinyHunters added ReliaQuest to its DLS yesterday.

ReliaQuest responded with an entire blog post showing how ShinyHunters got nowhere.

"Our defense in depth starts from the assumption that a threat actor will eventually phish someone's account. Phishing works. Even well-trained people can be deceived by a convincing caller who knows a teammate's name. We don't treat a sign-in to our identity provider as permission to do anything at all. Our controls include device trust which prevent non-ReliaQuest devices from accessing any application or systems and containment actions terminated the attacker's sessions, expired the password, and reset every authentication factor."

Read their full blog post:

https://reliaquest.com/blog/threat-spotlight-social-engineering-attempt-against-reliaquest-what-we-found

#infosec #cybersecurity #reliaquest #shinyhunters

More than a dozen Republican attorneys general are calling on ...

2026-08-04T12:42:26Z

More than a dozen Republican attorneys general are calling on #OpenAI to preserve records on its models’ recent breach of #HuggingFace, suggesting the #AI firm may have violated state or federal laws in the incident.

Press release: https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-leads-coalition-demanding-transparency-from-openai-after-ai-breach-and

Direct link to full letter:
https://www.iowaattorneygeneral.gov/media/cms/08_5392C9E17791C.pdf

In January 2025, the WA attorney general sued T-Mobile over a ...

2026-07-24T13:19:02Z

In January 2025, the WA attorney general sued T-Mobile over a data breach that affected 2M residents (this was the 79M T-Mobile breach). One of the issues in the litigation was that T-Mobile didn't properly notify those affected of the breach -- it omitted telling them in SMS notifications that their SSN had been acquired.

For background, see https://www.atg.wa.gov/news/news-releases/ag-ferguson-files-lawsuit-against-t-mobile-massive-data-breach

Now a court has agreed with the state that the text message notifications did not comply with the state's breach notification law:

https://www.seattletimes.com/business/t-mobile-violated-wa-data-breach-notification-law-judge-rules/

T-Mobile says it will appeal.

#databreach #incidentresponse #notifications #TMobile

I don't see any logical connection between the two, either. ...

2026-07-09T02:29:34Z

In reply to nevent1q…pg0x
_________________________

I don't see any logical connection between the two, either. And now I'm wondering which law firm it was, and whether it was one of Silent Ransom Group's, in which case, the data may all be on a leak site.

"On June 8, 2026, the Company became aware of a cybersecurity ...

2026-07-09T02:21:56Z

In reply to nevent1q…6na3
_________________________

"On June 8, 2026, the Company became aware of a cybersecurity incident involving a third‑party law firm (the “Firm”) that provides services to the Company. The incident involved a ransomware attack affecting certain of the Firm’s information systems."

Third-party breach, not their system.

NEW, by me: Global Schools Holdings Cites Two Injunctions in a ...

2026-07-02T19:04:45Z

NEW, by me:

Global Schools Holdings Cites Two Injunctions in a Bid to Chill Our Reporting. It Won't Work.

https://databreaches.net/2026/07/02/global-schools-holdings-cites-two-injunctions-in-a-bid-to-chill-our-reporting-it-wont-work/

Another day, another #legalthreat.

If you're a solo blogger or small outlet, don't panic just because you receive an injunction. They may have no jurisdiction over you, no matter how intimidating they may sound.

#GlobalSchoolsGroup #GlobalSchoolsHoldings #databreach #injunctions #FulcrumSec #freepress #pressfreedom #jursidiction #chillingeffects

Zack Whittaker (npub1p5z…krfz) Catalin Cimpanu (npub1s69…rmen)

Am I missing something? Was there really a two-year gap between ...

2026-06-21T21:37:20Z

In reply to nevent1q…vvqw
_________________________

Am I missing something? Was there really a two-year gap between their requests?

RE: https://infosec.exchange/@PogoWasRight/116757057256928362 ...

2026-06-16T12:49:41Z

RE: https://infosec.exchange/@PogoWasRight/116757057256928362

DEVELOPING: This story just got wilder. I have been contacted by another gang that claims they also hit NovoNordisk at around the exact same time. They have also leaked data, but the data is different than what FulcrumSec is leaking. I will be posting a follow-up on this development when I get more info.

Catalin Cimpanu (npub1s69…rmen) Lawrence Abrams (npub1vwk…7k3l) Jon Greig (npub19q3…dgem) Dan Goodin (npub1z3l…qvzu) Zack Whittaker (npub1p5z…krfz) loren schmidt (npub1cl6…76ay) securityaffairs (npub1u96…psp5)

quoting
note13v7…redf

New by me:

Scoop: FulcrumSec Leaks Novo Nordisk Data After $25M Demand Goes Unpaid

https://databreaches.net/2026/06/15/scoop-fulcrumsec-leaks-novo-nordisk-data-after-25m-demand-goes-unpaid/

#novonordisk #FulcrumSec #hackandleak #infosec #cybersecurity #databreach #intellectualproperty

Catalin Cimpanu (npub1s69…rmen) Dan Goodin (npub1z3l…qvzu) Zack Whittaker (npub1p5z…krfz) Mathew J. Schwartz (npub1neu…ycl9) amvinfe (npub1a9c…gqxz) BrianKrebs (npub1vc3…axsh) Lawrence Abrams (npub1vwk…7k3l)

New by me: Scoop: FulcrumSec Leaks Novo Nordisk Data After $25M ...

2026-06-16T00:55:08Z

New by me:

Scoop: FulcrumSec Leaks Novo Nordisk Data After $25M Demand Goes Unpaid

https://databreaches.net/2026/06/15/scoop-fulcrumsec-leaks-novo-nordisk-data-after-25m-demand-goes-unpaid/

#novonordisk #FulcrumSec #hackandleak #infosec #cybersecurity #databreach #intellectualproperty

Catalin Cimpanu (npub1s69…rmen) Dan Goodin (npub1z3l…qvzu) Zack Whittaker (npub1p5z…krfz) Mathew J. Schwartz (npub1neu…ycl9) amvinfe (npub1a9c…gqxz) BrianKrebs (npub1vc3…axsh) Lawrence Abrams (npub1vwk…7k3l)

RE: https://infosec.exchange/@metacurity/116756453345404501 Does ...

2026-06-15T22:49:01Z

RE: https://infosec.exchange/@metacurity/116756453345404501

Does anyone know who the third-party is and who the TA is?

quoting
note1quq…mmcj

iRhythm reports cybersecurity breach with protected health data accessed

https://www.massdevice.com/irhythm-reports-cybersecurity-breach-health-data/

NEW by me: After a Massive Hack, Global Schools Group’s ...

2026-06-12T13:52:26Z

NEW by me:

After a Massive Hack, Global Schools Group’s Negotiator Acted “Bizarrely.” It Didn’t End Well for Them.

https://databreaches.net/2026/06/12/after-a-massive-hack-global-schools-groups-negotiator-acted-bizarrely-it-didnt-end-well-for-them/

#GSG #GlobalSchoolsGroup #databreach #hack #EduSec #IncidentResponse #GIIS

St. George Fire Protection District No. 2 in Louisiana has filed ...

2026-06-10T14:49:18Z

St. George Fire Protection District No. 2 in Louisiana has filed a lawsuit against its former IT security provider, General Informatics, LLC.

From reporting by #wafb:

"The lawsuit claims St. George discovered multiple security vulnerabilities after the breach, including unpatched servers, no network backups despite monthly payments for backup services, and administrative passwords stored in plain text.

General Informatics used the same username and password for its remote access tool across multiple clients, according to the petition. The lawsuit alleges the company continued using compromised credentials for other clients, including St. George, even after learning in November 2023 that the credentials had been breached."

Read more at WAFB: https://www.wafb.com/2026/06/09/st-george-fire-district-sues-it-company-over-cyberattack/

#databreach #vendor #infosec #cybersecurity #lawsuit

#Microsoft walks back its threat to pursue those who don't ...

2026-06-01T14:44:56Z

#Microsoft walks back its threat to pursue those who don't disclose responsibly as criminals. They don't apologize, but merely "clarify" their position in a post on X.com today. Since their statement doesn't seem to be on their blog, I am linking to x.com:

https://x.com/msftsecresponse/status/2061293718942908925

This is the type of threat to researchers that Zack Whittaker (npub1p5z…krfz) and I had been looking at in our survey on threats to journalists and researchers. It was impressive to see all of the experts like Kevin Beaumont (npub1lcc…lcye) speaking up to slam Microsoft for their blog post of May 27.

Confronted with overwhelming criticism by the security community, Microsoft stepped back.

#responsibledisclosure #Microsoft

One of the many things I love about this platform is that people ...

2026-05-14T19:36:27Z

One of the many things I love about this platform is that people can disagree civilly.

So to thank you all, I will share with you the handwritten Mother's Day card my pre-teen granddaughter wrote to me:

Roses are red.
Violets are blue.
Life would suck
Without someone like you.

(Yes, it caught me by a bit of surprise, too.) 😂

RE: https://infosec.exchange/@amvinfe/116567370386921171 I ...

2026-05-13T20:08:00Z

RE: https://infosec.exchange/@amvinfe/116567370386921171

I realize my view on whether it is ever okay to pay #ransom in a #hackandleak situation is contentious. Great thanks to amvinfe (npub1a9c…gqxz) for asking me to articulate my views. #incidentresponse #mitigation #responsibility #ethics

quoting
note1dwl…wqx7

𝐑𝐚𝐧𝐬𝐨𝐦𝐰𝐚𝐫𝐞, 𝐓𝐫𝐚𝐧𝐬𝐩𝐚𝐫𝐞𝐧𝐜𝐲, 𝐚𝐧𝐝 𝐈𝐧𝐯𝐢𝐬𝐢𝐛𝐥𝐞 𝐕𝐢𝐜𝐭𝐢𝐦𝐬: 𝐃𝐢𝐬𝐬𝐞𝐧𝐭 𝐑𝐞𝐬𝐩𝐨𝐧𝐝𝐬 𝐭𝐨 𝐭𝐡𝐞 𝐈𝐧𝐬𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 𝐂𝐚𝐬𝐞

A recent article published by DataBreaches.net by journalist Dissent addresses one of the most controversial issues in modern cybersecurity: the payment of ransoms following a cyberattack and the consequences such decisions can have not only on the companies involved, but also on the individuals whose data has been compromised.

https://www.suspectfile.com/ransomware-transparency-and-invisible-victims-dissent-responds-to-the-instructure-case/

#Canvas #Data_Breach #Instructure #Navigate360 #Ransom #Ransomware #ShinyHunters

RE: https://infosec.exchange/@adamshostack/116535298159373352 ...

2026-05-07T20:59:35Z

RE: https://infosec.exchange/@adamshostack/116535298159373352

Well, yes. They scheduled it as soon as they realized they'd been hacked again.

quoting
note14e2…r9r8

"scheduled"

OK, so it seems that #ShinyHunters breached #Instructure again ...

2026-05-07T20:55:30Z

OK, so it seems that #ShinyHunters breached #Instructure *again* and replaced login pages with their own message to schools about how to contact them directly.

The Canvas login page were replaced with the message in the screenshot below.

Canvas subsequently replaced the login with "under maintenance" pages.

#databreach #hackandleak #EduSec #cybersecurity

RE: https://freeradical.zone/@funnymonkey/116529490033852866 ...

2026-05-06T21:16:53Z

RE: https://freeradical.zone/@funnymonkey/116529490033852866

That's an incredibly well-written piece. Thanks for pointing to it.

quoting
note1qem…t8an

This is a rip of a post.

https://www.stvn.sh/writing/programming-still-sucks-fqffhyp

Today, two cybersecurity professionals who made a deal with ...

2026-04-30T23:16:51Z

Today, two cybersecurity professionals who made a deal with AlphV/BlackCat to use their #ransomware to attack multiple victims in the U.S. were sentenced to four years in prison. A third co-conspirator has yet to be sentenced.

Two of the three worked for DigitalMint; the third worked for Sygnia. Neither firm had any knowledge of its employees' illegal activities and cooperated fully with law enforcement.

One of the victims was a doctor's office that the defendants had encrypted. Then, when the doctor wouldn't pay, they leaked patient data and wouldn't provide a decryptor.

Both of the defendants sentenced today had pleaded guilty to one count of conspiracy to obstruct, delay, or affect commerce or the movement of any article or commodity in commerce by extortion in violation of 18 U.S.C. § 1951(a).

They faced maximum sentences of 20 years, but were sentenced to four years.

Goldilocks and the 3 Verdicts Poll:

Does their sentence seem

BREAKING NEWS (I've always wanted to say that...): The ...

2026-04-22T22:46:53Z

BREAKING NEWS (I've always wanted to say that...):

The hacktivist who acquired the 8.3 million tips with sensitive info has decided NOT to try to sell the data. Given the sensitivity of the tips in #BlueLeaks2, that is welcome news.

https://databreaches.net/2026/04/22/not-for-sale-blueleaks-2-0-hacktivist-decides-not-to-sell-dataset-with-sensitive-data/

#databreach #infosec #hacktivism #ethics #P3Tips

Zack Whittaker (npub1p5z…krfz) Catalin Cimpanu (npub1s69…rmen) Dan Goodin (npub1z3l…qvzu) Mathew J. Schwartz (npub1neu…ycl9) Mark Keierleber 🚴‍♂️🎸 (npub10m3…qz3k) Distributed Denial of Secrets (npub1dp6…xtp6)

I think that's supposed to be IntelBroker at the top -- ...

2026-04-10T22:58:14Z

In reply to nevent1q…zwal
_________________________

I think that's supposed to be IntelBroker at the top -- there's a pic of him wearing a hat like that circulated after he was arrested.

Not sure about lower left. It reminds me of Omnipotent, though.

Note to ALL: I am starting to use another hashtag called ...

2026-04-10T14:51:12Z

Note to ALL:

I am starting to use another hashtag called #HackAndLeak that I hope others will also use to describe incidents where there has been no indication that any #ransomware or #malware was deployed.

It's time we stopped calling most attacks "ransomware" when they are really hack and leak incidents.

If you agree, how about sharing/boosting this idea and hashtag shift?

If you don't agree, tell me why so I can argue with you. :))

Steve Gielda has updated his research findings on VPNs and who ...

2026-04-08T12:29:44Z

Steve Gielda has updated his research findings on VPNs and who really owns them, runs them, and where they really are.

So... who really runs your VPN? Read his update at https://codamail.com/articles/vpn_exposed.html

#privacy #VPN #analysis

NEW by me: Insightin Health discloses its second data security ...

2026-03-10T13:34:12Z

NEW by me:

Insightin Health discloses its second data security incident in two years:
https://databreaches.net/2026/03/10/insightin-health-discloses-its-second-data-security-incident-in-two-years/

#databreach #healthsec #thirdparty #dataleak #cybersecurity #HIPAA #SecurityRule

For researchers and those trying to disclose incidents ...

2026-02-01T14:21:35Z

For researchers and those trying to disclose incidents responsibly or get help:

There is an international organization called FIRST.

From the FIRST Teams website:

"This is a list of the contact information for incident response teams participating in FIRST, the Forum of Incident Response and Security Teams. The teams are responsible for providing FIRST with their latest contact information for this page. The list is alphabetized by team name. All telephone numbers are preceded with the appropriate country code."

There are 829 teams listed. Some are government CERT teams, some are corporate incident response teams.

You might want to bookmark the site to speed up your attempt to contact these teams:

https://www.first.org/members/teams/#

#responsibledisclosure #incidentresponse #CERT

On its Telegram channel, ShinyHunters claims to have compromised ...

2026-01-03T19:33:44Z

On its Telegram channel, ShinyHunters claims to have compromised @Resecurity, but it looks like they fell for a carefully crafted honeypot.

https://databreaches.net/2026/01/03/shinyhunters-claims-to-have-compromised-resecurity-but-it-looks-like-they-fell-for-a-honeypot/

#honeypot #ShinyHunters #Resecurity #infosecurity

Catalin Cimpanu (npub1s69…rmen) Kevin Beaumont (npub1lcc…lcye)

For those being notified or first learning about the #WIRED ...

2025-12-28T17:27:47Z

For those being notified or first learning about the #WIRED #databreach:

On December 25, I broke the story of how I had been contacted in November by "Lovely," who claimed to have discovered a vulnerability. They asked for help getting Condé Nast to respond to them. They claimed they were not seeking any bounty or payment and had only downloaded a few profiles as proof.

They showed me my own data.

Trying to help, I reached out to Condé Nast corporate as well as to a contact at #WIRED.

Condé Nast never responded to me -- or to "Lovely" who eventually showed their true colors as someone trying to extort Condé Nast.

Do they have more data? Yes, it appears they do.

Troy Hunt (npub12zf…9xlm) verified the data leak and #HIBP has been notifying its affected subscribers.

Read more details in my blog post at https://databreaches.net/2025/12/25/conde-nast-gets-hacked-and-databreaches-gets-played-christmas-lump-of-coal-edition/

Zack Whittaker (npub1p5z…krfz) Catalin Cimpanu (npub1s69…rmen) Graham Cluley (npub1kcf…r43y) Mathew J. Schwartz (npub1neu…ycl9) Valéry Rieß-Marchive :verified: (npub1u8y…uh6d)

#databreach #dataleak #infosec #cybersecurity #incidentresponse #CondeNast

OT: Falling down the stairs in my home resulted in a number of ...

2025-12-24T14:10:51Z

OT: Falling down the stairs in my home resulted in a number of fractured vertebrae. Not good, obviously, and I'm told it will take about 12 weeks to heal.

After talking with the spine doc, I asked my husband to go down to his woodworking shop and make me a standing desk.

Do you know what happens when you ask a retired architect to build a desk? You get schematics, and plans, and discussions of what kinds of wood.

I have no idea if this desk will be done within 12 weeks, but I am anticipating it will require more clamps. 🤣

Wishing all who celebrate a Merry Christmas or Happy Kwanzaa.

ANNOUNCE: Survey on threats experienced by journalists and ...

2025-12-20T15:01:51Z

ANNOUNCE: Survey on threats experienced by journalists and security researchers

Are you a security researcher or a journalist in the cybersecurity/cybercrime space?

DataBreaches.net and Zack Whittaker at this.weekinsecurity.com are conducting a survey on the types of threats researchers and journalists have faced, including legal threats or legal process and threats of violence from cybercriminals.

The survey is at https://forms.gle/P9jr6VxfD1LV6odg9

Please complete the survey and share the link on social media and with your colleagues and friends to help us understand how widespread some problems may be.

Reposts with more tags to other individuals would be appreciated.

#journalism #pressfreedom #cybersecurity #risk #threats

Catalin Cimpanu (npub1s69…rmen) Zack Whittaker (npub1p5z…krfz) Jon Greig (npub19q3…dgem) Lawrence Abrams (npub1vwk…7k3l) BrianKrebs (npub1vc3…axsh) amvinfe (npub1a9c…gqxz)

Alleged Scattered Spider members Thalha Jubair and Owen Flowers ...

2025-11-21T15:14:31Z

Alleged Scattered Spider members Thalha Jubair and Owen Flowers who are both charged with the TransportForLondon cyberattack, pleaded not guilty in Southwark Crown Court in London today. The judge has set a trial date of June 8, 2026 for them, and they continue to be detained on remand.

Flowers is also charged with conspiring to damage the network of SSM Health Care Corporation and attempting to do the same to Sutter Health, both U.S. healthcare entities. He pleaded not guilty to those charges, too.

Jubair also faces an additional charge of not providing his password to investigators when they seized his devices.

#ScatteredSpider #databreach #ransom #cybersecurity

Remember that frustrating situation where some of us couldn't ...

2025-10-31T14:27:36Z

Remember that frustrating situation where some of us couldn't get a vendor to respond to notifications that court-sealed records and sensitive files were exposed? One entity eventually reached the vendor by phone and was so angry at their response that they wound up canceling their account with them.

Yesterday, I finally reached the second court entity. They, too, wound up telling the vendor to take the share down.

How many other clients may still have exposed data because the vendor tells clients that everything's fine when it isn't? I don't know. If you know any entity using Software Unlimited Corp software (not Software Unlimited Inc, but Software Unlimited *CORP*), you may want to point them to my coverage:

Original Report:
https://databreaches.net/2025/10/13/months-after-being-notified-a-software-vendor-is-still-exposing-confidential-and-sealed-court-records/

Today's Update:
https://databreaches.net/2025/10/31/how-many-courts-have-had-sealed-and-sensitive-files-exposed-by-one-vendors-error/

#dataleak #vendor #incidentresponse #cybersecurity #SoftwareUnlimitedCorp #FTC #govsec

Zack Whittaker (npub1p5z…krfz) Mathew J. Schwartz (npub1neu…ycl9) Catalin Cimpanu (npub1s69…rmen) JayeLTee (npub16t3…dfw5)

As a loooong-time #F1 fan and a #databreach blogger, of course ...

2025-10-23T11:45:57Z

As a loooong-time #F1 fan and a #databreach blogger, of *course* I had to read this report on hacking F1. It's the first part of a 3-part series on vulnerabilities in #Formula1

Hacking Formula 1: Accessing Max Verstappen's passport and PII through FIA bugs:
https://ian.sh/fia

#FIA_vulnerabilities

NEW, by me, the one some of you have been asking about: Months ...

2025-10-13T19:56:09Z

NEW, by me, the one some of you have been asking about:

Months After Being Notified, a Software Vendor is Still Exposing Confidential and Sealed Court Records

https://databreaches.net/2025/10/13/months-after-being-notified-a-software-vendor-is-still-exposing-confidential-and-sealed-court-records/

I don't usually ask for boosts, but if you are in a position to help spread the word about this vendor and that its clients need to check their security, that would be great.

#dataleak, #incidentresponse, #infosecurity, #cybersecurity, #SoftwareUnlimitedCorp #FBI #CISA

Zack Whittaker (npub1p5z…krfz) Mathew J. Schwartz (npub1neu…ycl9) Catalin Cimpanu (npub1s69…rmen) [@therecord_media](https://mastodon.social/@therecord_media ) Kevin Beaumont (npub1lcc…lcye) BrianKrebs (npub1vc3…axsh)

According to a new state auditor's report, nearly a third of ...

2025-10-09T11:19:17Z

According to a new state auditor's report, nearly a third of Mississippi's state agencies fail cybersecurity requirements

Media coverage: https://vicksburgnews.com/shad-whites-office-finds-nearly-a-third-of-state-agencies-fail-cybersecurity-requirements/

Direct link to state report: https://www.osa.ms.gov/sites/default/files/osa/files/reports/252025%20Review%20of%20Mississippi%20Enterprise%20Security%20Program%20Compliance%20%28Cybersecurity%29.pdf

#Audit #cybersecurity #govsec #Mississippi #ComplianceTech

NEW: Just days before its data might be leaked, Qantas Airways ...

2025-10-04T20:08:41Z

NEW: Just days before its data might be leaked, Qantas Airways obtained a permanent injunction

https://databreaches.net/2025/10/04/just-days-before-its-data-might-be-leaked-qantas-airways-obtained-a-permanent-injunction/

#injunction #censorship #pressfreedom #Qantas #Salesforce #databreach

Two teens have been arrested by Dutch authorities on ...

2025-09-26T18:04:43Z

Two teens have been arrested by Dutch authorities on espionage-related charges. They were allegedly recruited --and paid -- by pro-Russian hackers on Telegram to carry a wi-fi sniffer near areas that included embassies near the Hague, Europol, and Eurojust.

As part of their coverage of the story, the NL Times reports:

The father (of one of the boys) said his son is a diligent student, plays hockey, and works part-time in a supermarket. “He doesn’t go out, and shows no inclination to explore the world. We raise our children to handle everyday risks, but nothing like this. Who could have anticipated it?”

#espionage #recruitment #Telegram

NEW: When “Goodbye” isn’t the end: Scattered LAPSUS$ ...

2025-09-21T19:37:51Z

NEW: When “Goodbye” isn’t the end: Scattered LAPSUS$ Hunters hack on

Others seem to have interpreted their "goodbye" message differently than I had. Were they lying or did people just not understand a significant statement in their message?

And while headlines focus on them hitting a bank, I think we need to take a closer look at their attacks on the aviation sector.

https://databreaches.net/2025/09/21/when-goodbye-isnt-the-end-scattered-lapsus-hunters-hack-on/

#databreach #ScatteredSpider #ShinyHunters #LAPSUS$ #CollinsAerospace #airlines #airports

Was he ever in a juvie facility or did they just send him home ...

2025-09-18T22:57:56Z

In reply to nevent1q…7mud
_________________________

Was he ever in a juvie facility or did they just send him home each time because he was a minor?

IntelBroker got into a diversion program at one point. It didn't stick, obviously, but do you know if either of these teens was ever in any kind of diversion program or getting any supervision?

"The ShinyHunters extortion group claims to have stolen over ...

2025-09-17T21:32:30Z

"The ShinyHunters extortion group claims to have stolen over 1.5 billion Salesforce records from 760 companies using compromised Salesloft Drift OAuth tokens.

[...]

In March, one of the threat actors breached Salesloft's GitHub repository, which contained the private source code for the company.

ShinyHunters told BleepingComputer that the threat actors used the TruffleHog security tool to scan the source code for secrets, which resulted in the finding of OAuth tokens for the Salesloft Drift and the Drift Email platforms."

Read more of Lawrence Abrams' great reporting on Bleeping Computer:
https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/

#Salesforce #Salesloft #Oauth #Drift #databreach #ransom #ShinyyHunters #ScatteredSpider #LAPSUS$ #UNC6040 #UNC6395

So many news reports have repeated the BBC's mistaken ...

2025-09-16T16:22:12Z

So many news reports have repeated the BBC's mistaken estimate about the number of customers affected by the Kering data breaches. So...

No, folks, it's not 7.4 million affected or fewer. It's a lot *more* because the BBC's estimate was based on just the second and smaller breach (Balenciaga, Brioni, and Alexander McQueen), and not the Gucci data which allegedly has more than 43 million records. Even assuming repeat customers are in there, there are likely a lot of unique customers in the Gucci data.

If we use the same percent based on 7.4 million out of almost 13 million recordsin the second data set, then that would yield 24-25 million unique email addresses for the Gucci data set, for an estimated total of more than 31 million customers all told.

I didn't estimate the number of unique customers in my reporting because it's too sloppy. But it's highly unlikely to be 7.4 million or fewer as BBC reported.

#Kering #Gucci #Balenciaga #Brioni #AlexanderMcQueen #databreach #Salesforce #ShinyHunters #UNC6040 #incidentresponse #transparency

My reports:
https://databreaches.net/2025/09/11/exclusive-high-end-fashion-retailers-gucci-balenciaga-brion-and-alexander-mcqueen-hit-by-salesforce-attacks/

https://databreaches.net/2025/09/15/update-kering-confirms-gucci-and-other-brands-hacked-claims-no-conversations-with-hackers/

Mathew J. Schwartz (npub1neu…ycl9) Zack Whittaker (npub1p5z…krfz)

Burger King hacked, systems described as 'solid as a paper ...

2025-09-07T11:50:02Z

Burger King hacked, systems described as 'solid as a paper Whopper wrapper in the rain’ – hackers 'impressed by the commitment to terrible security practices,' also exploited other RBI brands like Tim Hortons and Popeyes:

"Ethical hackers BobDaHacker and BobTheShoplifter have detailed their claim that they uncovered “catastrophic” vulnerabilities in multiple platforms hosted by Restaurant Brands International (RBI). While RBI may not be a very familiar name, this lax security means that systems powering mega brands like Burger King, Tim Hortons, and Popeyes, with over 30,000 locations worldwide, and all were almost trivially easy to hack. “Their security was about as solid as a paper Whopper wrapper in the rain,” snarks the BobDaHacker blog, sharing the full technical exposé (the blog has since been taken down, but it's archived here)."

https://www.tomshardware.com/tech-industry/cyber-security/burger-king-hacked-digital-platform-as-solid-as-a-paper-whopper-wrapper-in-the-rain-easy-security-bypass-exploited-catastrophic-vulnerabilities-also-worked-on-other-rbi-brands-like-tim-hortons-and-popeyes

#infosec #cybersecurity

Heads up, folks: Michael Kan reports that National Public Data is ...

2025-08-13T11:33:29Z

Heads up, folks:

Michael Kan reports that National Public Data is back under new owners: https://www.pcmag.com/news/site-behind-major-ssn-leak-returns-with-detailed-data-on-millions-how-to

Here is the direct link to their opt-out page instructions:
https://nationalpublicdata.com/optout.html

I had opted out previously after their humongous #databreach last year. When I checked my name now, it did not find my profile, so if you opted out before, you may still be opted out, but better safe than sorry: check and opt-out if needed.

#NPD #NationalPublicData #OptOut #DataBroker #Privacy

So yesterday, I emailed a state court system that appears to be ...

2025-08-12T23:13:57Z

So yesterday, I emailed a state court system that appears to be linked to the exposed data I mentioned recently and that the host notified on or about July 28.

No reply was received.

Today, I sent a contact form message to the lawyer for a juvenile whose records were sealed. Sealed, except 11 of them were exposed to anyone who can access the data. I told him what was going on and suggested he contact the court and tell them to get the data secured.

No reply was received.

Today, I sent an email to the judge who ordered the juvenile's records sealed and I cc:d the district attorney. I gave them the juvenile's name, case number and that I could see all the sealed records. I urged them to have their IT or vendor call me and I could give them the IP address over the phone, etc.

No reply was received.

Dear Russia, China, and North Korea:

You do not need to hack our courts. They are leaking like sieves and do not respond when we try to tell them they need to secure the data.

Yours in total frustration,

/Dissent

#infosec #cybersecurity #incident_response #dataleak #databreach #WAKETHEFUCKUP

NEW: Federal judiciary says it is boosting security after ...

2025-08-10T11:58:35Z

NEW: Federal judiciary says it is boosting security after cyberattack; researcher finds new leaks

More of those frustrating leaks where, despite our best efforts, we have been unable to get the network shares locked down so far, even with the host's assistance.

This one involves two courts: one state and one federal, and yes, we saw some files that were supposed to be sealed or confidential.

https://databreaches.net/2025/08/10/federal-judiciary-says-it-is-boosting-security-after-cyberattack-researcher-finds-new-leaks/

#dataleak #infosec #cybersecurity #databreach #govsec

"Breaking News:" The Scattered Spider kids seem to have ...

2025-08-08T22:59:26Z

"Breaking News:" The Scattered Spider kids seem to have opened their own channel on Telegram. Rude, crude, and leaking data already. Some of the redacted screenshots they have posted suggest that they may have had victims that we did not know about already.

#ScatteredSpider #ShinyHunters #SalesForce #AirFrance #Qantas #Gucci #databreach #extortion

NEW: RansomedVC is back — and is still attacking its ...

2025-07-17T17:15:44Z

NEW: RansomedVC is back — and is still attacking its competitors:

https://databreaches.net/2025/07/17/ransomedvc-is-back-and-is-still-attacking-its-competitors/

RansomedVC has a history of leaking its competitors' data. Heck, they even leaked their own to get attention. Now they're back, and one of their first targets was the Medusa ransomware gang.

#databreach #ransomware #SnapAv #SnapOne #Medusa #RansomedVC

amvinfe (npub1a9c…gqxz)

Nostr event nevent1qqsfw5jsku8mx4cqglpjvtrp6vslc63tc37kj9y2x9hy2fgfed42thgzyrm7sc47gurzet8yjf5z7z7l5lu8fssrfj79mejsq9frpy27r04l7a56quz

2025-07-02T13:26:19Z

#dogsofmastodon

So sorry to read this. Donation made. I am wishing your family ...

2025-06-27T00:59:58Z

In reply to nevent1q…k2nr
_________________________

So sorry to read this. Donation made. I am wishing your family all the best.

"IntelBroker's" real identity is Kai West, a British ...

2025-06-25T22:04:20Z

"IntelBroker's" real identity is Kai West, a British national, according to court filings now revealed by the U.S. Attorney's Office for the Southern District of New York today.

U.S. is seeking his extradition from France, where he was arrested on February 5 and detained.

USAO press release: https://www.justice.gov/usao-sdny/pr/serial-hacker-intelbroker-charged-causing-25-million-damages-victims

Kai West Four-Count Indictment: https://www.justice.gov/usao-sdny/media/1404621/dl?inline

Kai West Complaint: https://www.justice.gov/usao-sdny/media/1404616/dl?inline

#databreach #intelbroker #arrest #indictment

Here's a pic of him from his 2023 license (from court filing):

(continuing on ShinyHunters arrests) The Paris prosecutor has ...

2025-06-25T19:17:54Z

In reply to nevent1q…uq88
_________________________

(continuing on ShinyHunters arrests)

The Paris prosecutor has issued a press release about the arrests. It doesn't provide real names but does reveal that IntelBroker is a British national who was arrested in France in February 2025 and was detained in pre-trial detention.

The press releases in French and English can be found on my site:

Catalin Cimpanu (npub1s69…rmen)

As expected, more details are emerging in other news outlets ...

2025-06-25T12:02:48Z

As expected, more details are emerging in other news outlets about the arrest of #ShinyHunters.

One detail I noted is that ShinyHunters is suspected of being responsible for the attacks on #LVMH, which is the high-end brand associated with Tiffany and Dior, who both reported breaches this year. Although there had been some speculation that #ScatteredSpider might be responsible for those breaches, it appears that ShinyHunters was allegedly responsible.

There have been a number of hacks this year where it is not clear -- in the absence of law enforcement confirmation -- whether a #databreach has been by Scattered Spider or ShinyHunters, or whether they have collaborated with one doing the hacking and the other doing the extortion. I predict in weeks/months to come, we will be given a pretty big list of big hacks that ShinyHunters has been involved in this year.

As I reported in my coverage of the PowerSchool hack and prosecution of Matthew Lane, ShinyHunters' name has been linked to that one, too, but was not named as a co-conspirator.

This is where I should write "This is a developing story..." huh?

Catalin Cimpanu (npub1s69…rmen)

First you get your fingers burned. Now you get stung. Is the ...

2025-06-25T10:54:15Z

In reply to nevent1q…ffk2
_________________________

First you get your fingers burned. Now you get stung.

Is the universe suggesting you stop reporting on cyber and start reporting on first aid or safety? Or maybe good reasons to increase life insurance?

Stay safe, fella!

Aflac notifies SEC of breach suspected to be work of Scattered ...

2025-06-20T15:49:37Z

Aflac notifies SEC of breach suspected to be work of Scattered Spider:

https://databreaches.net/2025/06/20/aflac-notifies-sec-of-breach-suspected-to-be-work-of-scattered-spider/

They're the third U.S. insurer breach we know about this month.

#databreach #ScatteredSpider #cybersecurity #insurance

As much as I generally detest claims that something should be a ...

2025-06-20T13:33:46Z

As much as I generally detest claims that something should be a wake-up call, Lawrence Abrams (npub1vwk…7k3l) response to Cybernews (npub1yvu…8mny) "16 billion" story really should be a wake-up call for any news outlets who repeat any claims of discovered leaks or breaches by Cybernews.

See https://www.bleepingcomputer.com/news/security/no-the-16-billion-credentials-leak-is-not-a-new-data-breach/

DataBreaches.net will no longer link to Cybernews unless there is some reliable source that confirms that their claims are accurate and that they are not just reporting on leaks that they haven't even seriously tried to get locked down before they report on it.

Comments:
https://databreaches.net/2025/06/20/no-the-16-billion-credentials-leak-is-not-a-new-data-breach-a-wake-up-call-about-fake-news/

#journalism #databreach #dataleak #infostealers #passwords #hype #clickbait #ethics

Kevin Beaumont (npub1lcc…lcye) JayeLTee (npub16t3…dfw5) Dan Goodin (npub1z3l…qvzu) Graham Cluley (npub1kcf…r43y) Brian Honan (npub1vfn…4mmp)

OK, is this where you write a post with a headline that has ...

2025-06-03T17:00:54Z

In reply to nevent1q…4r3e
_________________________

OK, is this where you write a post with a headline that has "wake up call for..." in it?

J/K... wishing you a speedy and full recovery.

Nova Scotia Power has repeatedly said that data from the ...

2025-05-28T23:22:07Z

Nova Scotia Power has repeatedly said that data from the ransomware attack it suffered has been published on the dark web. Yet not one media outlet or anyone I know has reported finding any data from this anywhere, and no ransomware group that I track has claimed responsibility for this incident.

Does anyone know where these data have allegedly been published? If so, please contact me privately.

#ransomware #databreach

Clever teasing by #OperationEndgame A new vid about Qakbot, ...

2025-05-22T17:15:01Z

Clever teasing by #OperationEndgame

A new vid about Qakbot, "My Happy Lie by Cortes" and they reset the countdown timer to 16 hours while linking to a DOJ press release dated today that has not yet been released:

"Russian national and leader of Qakbot malware conspiracy indicted in long-running global ransomware scheme"

#qakbot #malware

Massachusetts hacker to plead guilty to PowerSchool data breach: ...

2025-05-20T21:31:31Z

Massachusetts hacker to plead guilty to PowerSchool data breach:

https://www.investing.com/news/stock-market-news/massachusetts-hacker-to-plead-guilty-to-powerschool-data-breach-4055643

Related:

DOJ Press release: https://www.justice.gov/usao-ma/pr/worcester-college-student-plead-guilty-cyber-extortions

USA v. Matthew D. Lane - Information: https://www.justice.gov/usao-ma/media/1400921/dl

USA v. Matthew D. Lane - Plea Agreement:
https://www.justice.gov/usao-ma/media/1400926/dl

#databreach #PowerSchool #EduSec #cybersecurity

Doug Levin (npub12wk…z5fq) funnymonkey (npub16nr…879s) Brett Callow (npub1f79…vxnn) Mark Keierleber 🚴‍♂️🎸 (npub10m3…qz3k)

Holy sh*t... FBI arrests judge in escalation of Trump immigration ...

2025-04-25T15:01:57Z

Holy sh*t...

FBI arrests judge in escalation of Trump immigration enforcement effort:
https://www.cnbc.com/2025/04/25/fbi-arrest-judge-hannah-dugan-milwaukee.html

#obstruction

Google Hit With Lawsuit Over Data Collection on School Kids ...

2025-04-12T14:46:27Z

Google Hit With Lawsuit Over Data Collection on School Kids

https://news.bloomberglaw.com/litigation/google-hit-with-privacy-suit-over-data-collection-on-school-kids

Nor for nothing, but this is the same issue some parents in Toronto and I tried to raise against Google years ago -- and Google told me that their relationship was with their clients -- the schools -- and the schools consented. It was up to the schools, they claimed, to seek parental consent.

Doug Levin (npub12wk…z5fq) funnymonkey (npub16nr…879s) Mark Keierleber 🚴‍♂️🎸 (npub10m3…qz3k)

#Google #WorkspaceForEducation #EdTech #consent #privacy #dataprotection #k12

And here's another reminder of the insider threat if you ...

2025-04-05T23:46:22Z

And here's another reminder of the insider threat if you don't investigate your employees' or consultants' backgrounds and claimed credentials carefully enough. BrianKrebs (npub1vc3…axsh) has the story and how a number of criminal cases may now be appealed or overturned:

Cyber Forensic Expert in 2,000+ Cases Faces FBI Probe:

https://krebsonsecurity.com/2025/04/cyber-forensic-expert-in-2000-cases-faces-fbi-probe/

#insiderthreat #fraud

A little ray of sunshine: The Journal Times, part of Lee ...

2025-03-30T11:21:35Z

A little ray of sunshine:

The Journal Times, part of Lee Enterprises, had been seriously impacted by the #ransomware attack by Qilin in February. Today, they announced that they are back to full strength: https://journaltimes.com/opinion/column/article_856d2fed-473b-4683-bbf4-61e8fd157830.html

Sincere congrats to them after what was almost two months of intensive and dedicated efforts to fully recover.

#journalism #freepress

Thanks to everyone in the fediverse who has favorited, boosted, ...

2025-03-06T21:19:06Z

Thanks to everyone in the fediverse who has favorited, boosted, and reached out to me supportively over the injunction and takedown order that I wouldn't comply with (overview: https://infosec.exchange/@PogoWasRight/114110520940142405)

Special thanks to Zack Whittaker (npub1p5z…krfz) for reporting about it all on #TechCrunch:

https://techcrunch.com/2025/03/06/hacked-health-firm-hcrg-demanded-journalist-take-down-data-breach-reporting-citing-uk-court-order/

#databreach #HCRG #ransomware #incident_response #injunction

Here's my post on the court injunction my site got hit with: ...

2025-03-05T15:26:08Z

Here's my post on the court injunction my site got hit with:

HCRG Care's lawyers claimed an injunction issued in a "private" hearing required us to remove two posts. We didn't comply.

HCRG Care was represented by the Pinsent Masons law firm in the UK in this matter. The injunction was issued by the High Court of Justice, King's Bench Division, Media and Communications List by the Honorable Mr. Justice Soole.

Pinsent Mason's attempt to get my web host to remove my posts also failed.

As always, I feel blessed to have the legal support of Covington and Burling's Kurt Wimmer Pro Media Freedom Initiative, which has represented my site pro bono for the last 16 years.

Read about the letter, the injunction, and why the High Court's over-reaching injunction endangers UK journalists and doesn't serve the public well.

https://databreaches.net/2025/03/05/hcrg-cares-lawyers-claimed-an-injunction-issued-in-a-private-hearing-required-us-to-remove-two-posts-we-didnt-comply/

Oh, and I'm not the only one ignoring the injunction. Medusa also got served with the injunction via tox chat, they tell me. And like other injunctions they have received, they are ignoring it. So what has HCRG really accomplished?

#databreach #ransomware #Medusa #transparency #censorship #pressfreedom #injunction #FirstAmendment

Zack Whittaker (npub1p5z…krfz) Catalin Cimpanu (npub1s69…rmen) Lawrence Abrams (npub1vwk…7k3l) iainthomson (npub1cdh…65e3)
amvinfe (npub1a9c…gqxz) @lawfare Freedom of the Press (npub1hxa…caxd)

Last Friday I received a letter from a U.K. law firm with an ...

2025-03-04T20:32:09Z

Last Friday I received a letter from a U.K. law firm with an attached injunction. The law firm claimed I must remove two posts about their client.

That is not going to happen. I am not under the jurisdiction of the U.K. or the High Court of Justice. My lawyer informed them of that yesterday.

But DataBreaches.net might disappear tomorrow because the U.K. law firm sent the injunction to my domain registrar who, innocently believing them, informed me they will suspend my site if I don't remove the posts within 24 hours. I have replied to them but have not heard back.

So...

If my site is gone tomorrow, I will let you know where you can read a lot more about the injunction and how the injunction poses a serious risk of censorship in the U.K.

If my site is still online tomorrow, I will still let you know here where you can read about the over-reaching injunction obtained in a private hearing where no one represented journalists whose reporting was being censored.

#censorship #injunction #pressfreedom
#AssociatedPress #RCFP #databreach #ransomware #journalism

Freedom of the Press (npub1hxa…caxd) Catalin Cimpanu (npub1s69…rmen) Zack Whittaker (npub1p5z…krfz) [@aj_vicens](https://infosec.exchange/@aj_vicens ) Carly Page (npub1m6u…rk8l) iainthomson (npub1cdh…65e3) amvinfe (npub1a9c…gqxz) Lawfare (npub16r8…wmwp)

I don't know if this is a first or not, but it sure struck me ...

2025-02-25T13:05:27Z

I don't know if this is a first or not, but it sure struck me as unusual:

RansomHub sends a letter to the editor. Really.

https://databreaches.net/2025/02/25/ransomhub-sends-a-letter-to-the-editor-really/

#ransomware #databreach

Lawrence Abrams (npub1vwk…7k3l) Catalin Cimpanu (npub1s69…rmen) Mathew J. Schwartz (npub1neu…ycl9)

The New York Blood Center was already having a blood shortage ...

2025-01-29T22:09:57Z

The New York Blood Center was already having a blood shortage emergency and then they got hit with a ransomware attack.

Whoever hit them: please, please, please: you are putting more lives at risk every day. Give them a decryptor.

#emergency #blood #ransomware

Being explicit that an attack is "ransomware" is only ...

2025-01-27T23:44:25Z

In reply to nevent1q…6zzn
_________________________

Being explicit that an attack is "ransomware" is only really helpful if we all only call an attack "ransomware" if ransomware is actually deployed and encrypts the victim's files. If there's no encryption of files, maybe we should call it a hack with an extortion attempt. Right now, too many folks use "ransomware" to describe incidents in which nothing's encrypted and I think that creates a wrong impression and may cause even more unease.

Two ransomware groups claimed they attacked Rutherford County ...

2025-01-07T14:22:48Z

Two ransomware groups claimed they attacked Rutherford County Schools. in Tennessee. One leaked sensitive records.

I skimmed the data tranche and found tens of thousands of files with sensitive student information and personnel files. Read more about it here:

https://databreaches.net/2025/01/07/two-ransomware-groups-claimed-they-attacked-rutherford-county-schools-one-leaked-sensitive-records/

#databreach #ransom #EduSec #cybersecurity

Doug Levin (npub12wk…z5fq) Brett Callow (npub1f79…vxnn) funnymonkey (npub16nr…879s)

OK, a huge thumbs up to Byte Federal for their breach ...

2024-12-17T21:52:36Z

OK, a huge thumbs up to Byte Federal for their breach notification letter. They frankly admit where they screwed up and what happened. I wish more notifications were as clear and straightforward as this one.

https://databreaches.net/2024/12/17/a-positive-example-of-forthright-breach-disclosure/

#databreach #transparency #disclosure #IncidentManagement #IncidentReporting #infosec

Unbelievable. Or maybe too believable... I previously posted ...

2024-12-16T18:23:58Z

Unbelievable. Or maybe too believable...

I previously posted about Bolton Walk-in Clinic in Ontario not locking down their patient data despite multiple responsible disclosure alerts (https://infosec.exchange/@PogoWasRight/113589181607493357). Then I reported that Canada's cybersecurity agency contacted me and offered to help (https://infosec.exchange/@PogoWasRight/113589757905504474).

Well, they tried... but got no results either. Bolton Walk-In Clinic is *still* exposing patient data and didn't even do anything when contacted by Canadian federal police.

If any Canadian news outlet would like to report on this, get in touch. JayeLTee (npub16t3…dfw5) and I will share the information with you (yes, I just volunteered him too). 😂

Or if anyone is in the vicinity of their clinic, maybe stand outside with a sign that says, "Bolton Walk-In Clinic is leaking patient data and ignoring alerts!" That might get some attention...

Bonus points if you get someone in a Santa outfit to stand outside their clinic with a sign that says "Bolton Walk-In Clinic is naughty -- they are leaking patient data."

#dataleak #negligence #healthsec #PHIPA #HIPA #cybersecurity #databreach #accountability

How is it that no one has set up the dark web equivalent of ...

2024-12-06T20:22:06Z

How is it that no one has set up the dark web equivalent of archive.org to archive onion sites?

(Translation: a link is dead and I really want to know what data it linked to) :blobnotlike:

Scattered Spider Hacking Gang Arrests Mount With Teen: Remington ...

2024-12-05T17:47:21Z

Scattered Spider Hacking Gang Arrests Mount With Teen:

Remington Ogletree (aka "Remi") arrested and charged with wire fraud and aggravated identity theft.

This teen had jaw-droppingly bad opsec, and to add to it, he used a crypto laundering service on TG that was actually an undercover FBI operation.

https://databreaches.net/2024/12/05/scattered-spider-hacking-gang-arrests-mount-with-teen/

#ScatteredSpider #FinSec #Telecoms #Hack #phishing #infosec #databreach

#dogsofmastodon #doghair ...

2024-12-05T00:16:03Z

#dogsofmastodon #doghair

Yeah... I kinda hate LinkedIn and am only on it minimally. I am ...

2024-11-20T18:40:29Z

In reply to nevent1q…aeqh
_________________________

Yeah... I kinda hate LinkedIn and am only on it minimally. I am more likely to read you here than there so count me as one of the "Do it!" replies.

Idaho man who hacked medical entities and made vile threats ...

2024-11-14T00:49:05Z

Idaho man who hacked medical entities and made vile threats sentenced to 10 years in prison:

https://databreaches.net/2024/11/13/idaho-man-who-hacked-medical-entities-and-made-vile-threats-sentenced-to-10-years-in-prison/

This is a case that started because the threat actor, "Lifelock," contacted DataBreaches to try to get DataBreaches.net to report on victims who hadn't paid his ransom demands.

Some of his court filings tried to blame me for the FBI raiding him and seizing his devices. The FBI did their own investigation but yes, it was my reporting that initially made the FBI aware of Robert Purbeck.

#databreach #healthsec #cybersecurity #infosec #extortion

Mathew J. Schwartz (npub1neu…ycl9) Catalin Cimpanu (npub1s69…rmen) Graham Cluley (npub1kcf…r43y) Zack Whittaker (npub1p5z…krfz)

I wasn't thinking about cheap or lazy or apathetic, and I ...

2024-10-31T10:54:46Z

In reply to nevent1q…78zs
_________________________

I wasn't thinking about cheap or lazy or apathetic, and I apologize if it came across that way. What I was asking about was entities with limited resources making tough decisions in their budgets. I can see why some may not invest more in security. In other cases, it may not be as obvious to the public why an entity didn't do more before a breach or why entities aren't flat-out required to do more.

Are you confident that it's an inability to secure themselves ...

2024-10-31T00:16:50Z

In reply to nevent1q…04px
_________________________

Are you confident that it's an inability to secure themselves in most cases and not just a lack of prioritizing security when they'd rather use the money for something else?

And if they're unable to secure themselves because they choose not to allocate a bigger percentage of their budget to security, what then? What's the fix?

Scary "Grampus" Jerry 👻 (npub1vtx…e7wk)

What do you think is more effective in getting entities to level ...

2024-10-30T23:25:53Z

What do you think is more effective in getting entities to level up their cybersecurity? What type of consequence will be more likely to get others to up their game?

In every generation, there have been people who stood up for ...

2024-10-30T19:17:16Z

In every generation, there have been people who stood up for inclusion while others spewed divisiveness.

Franklin debuted on Peanuts in a decade that saw civil rights protests, children hit with firehose for protesting, MLK assassinated, and so much more.... Remembering Charles Schulz:

Breaking News: The threat actor known as "USDoD" (aka ...

2024-10-16T19:44:37Z

Breaking News: The threat actor known as "USDoD" (aka "EquationCorp" and other monikers") has been arrested by Brazilian Federal Police. USDoD is probably best known for his attacks on #InfraGard, Airbus, and his role in the recent National Public Data breach.

Media coverage indicates he was arrested this morning: https://g1.globo.com/politica/noticia/2024/10/16/pf-prende-hacker-de-33-anos-suspeito-de-invadir-sistemas-e-vazar-dados-de-policiais.ghtml

#databreach #hacker #USDoD #EquationCorp

Brett Callow (npub1f79…vxnn) Catalin Cimpanu (npub1s69…rmen)

The #SEC doesn't take kindly to be lied to, it seems. Data ...

2024-10-16T18:30:57Z

The #SEC doesn't take kindly to be lied to, it seems.

Data Center Company CEO Indicted for Major Fraud and Making False Statements to the U.S. Securities and Exchange Commission:

https://www.justice.gov/opa/pr/data-center-company-ceo-indicted-major-fraud-and-making-false-statements-us-securities-and

They don't name the company but a little googling suggests that Deepak Jain's data center was AiNET in Beltsville, MD.

#fraud #datasecurity

British intelligence services to protect all UK schools from ...

2024-10-15T16:59:48Z

British intelligence services to protect all UK schools from ransomware attacks:

https://therecord.media/uk-pdns-schools-cyberdefense-intelligence-services

Direct link to #NCSC announcement: https://www.ncsc.gov.uk/blog-post/pdns-for-schools-provide-cyber-resilience-for-more-institutions

Doug Levin (npub12wk…z5fq) funnymonkey (npub16nr…879s) Mark Keierleber 🚴‍♂️🎸 (npub10m3…qz3k) Brett Callow (npub1f79…vxnn) Brian Honan (npub1vfn…4mmp)

#EduSec #cybersecurity #ransomware

Heads up! New developments -- and arrests -- in law enforcement ...

2024-09-30T11:21:07Z

Heads up! New developments -- and arrests -- in law enforcement pursuit of LockBit.

Law enforcement reactivated a previously seized LockBit URL to announce what will be revealed tomorrow. Announcements will include the arrest of what they describe as a major LockBit actor, other LockBit-linked UK arrests, and a member of EvilCorp identified as a LockBit affiliate.

Stay tuned, it seems.

#LockBit30 #NCA #disruption #EvilCorp #ransomware

Threat actors called VANIR Ransomware Group posted a few listings ...

2024-09-18T01:27:41Z

Threat actors called VANIR Ransomware Group posted a few listings in July. Tonight, their onion site has a seized message:

" THIS HIDDEN SITE HAS BEEN SEIZED
by the State Bureau of Investigation Baden-Württemberg as a part of a law enforcement action taken against Vanir Ransomware Group "

From the press release about the seizure, it sounds like there have been no arrests and the identity of the TAs is not yet known: https://www.presseportal.de/blaulicht/pm/110980/5866617

For more on what Vanir's leak site looked like previously, see Cyjax: https://www.cyjax.com/data-leak-site-emergence-continues-to-increase/

#ransomware #databreach

This seems to be a week for announcing big lawsuit settlements. ...

2024-09-14T11:22:07Z

This seems to be a week for announcing big lawsuit settlements. Here's another big one:

An Oracle lawsuit settlement for $115 million addresses claims that Oracle unlawfully tracked and collected vast amounts of personal information without obtaining proper consent from users and allegedly sold it to third parties for advertising purposes through Oracle’s various advertising products, including ID Graph and Data Marketplace.

Official settlement website: https://www.katzprivacysettlement.com/

If you think you might be an eligible class member, you only have until Oct. 17th to file a claim. See the settlement site for info on who's eligible, etc.

#privacy #consent #Oracle #lawsuit

Catalin Cimpanu (npub1s69…rmen)