Security Incidents & Threat Telemetry

Russian emergencies ministry's mobile app hit by cyberattack, TASS says Reuters

Federal authorities and international partners apprehended key operatives linked to the ShinyHunters cybercrime syndicate following an unauthorized breach of FBI applicant and personnel records originating from an unpatched contractor-managed portal.

CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.

AmplifAI (GoDaddy instance) was listed on the Whitearmor ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

BKV Vasúti Jármjavító Kft was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

CMD Naturkosmetik was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Danser was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

EVINOKS was listed on the Barracuda ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Forum was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Global Holding was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

hitech group was listed on the HYFLOCK ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Latvia reports brief airspace intrusion near Russia, Belarus borders Reuters

Meshbesher & Spence was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

My Cloud Grocer was listed on the Direwolf ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

qc-consult was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Select Community Management was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Shibata Co., Ltd. was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

synergy.co.id was listed on the Lockbit5 ransomware extortion leak portal. PT Synergy Risk Management Consultants (“SYNERGY”), an independent company, established in London,...

Tema Hwt was listed on the Shiba ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

State of California Department of Justice data breach disclosure notice filed by Discord.

Bi Link was listed on the Thegentlemen ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]

chicagolawyer.com was listed on the Incransom ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]

CommTank was listed on the Thegentlemen ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Digital Triumph was listed on the N0n ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

everon.com.ar was listed on the Safepay ransomware extortion leak portal. The company is headquartered in Resistencia, in Chaco Province, and specializes in providing fiber-optic internet connectivity to residential customers and …

**F*A *.A was listed on the Nightspire ransomware extortion leak portal. Data is not available now.

Gamdom V2 was listed on the Whitearmor ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

goldencrops.com.tw was listed on the Safepay ransomware extortion leak portal. The company specializes in grain-based foods, nutritional products, plant-based foods and customized food manufacturing services. It operates three factories in …

grifosespinoza.com was listed on the Safepay ransomware extortion leak portal. Headquartered in Lima, the company manages fuel stations that serve individual motorists, commercial customers and other transportation-related businesses. Its core …

Holcim was listed on the Emperador ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Ined was listed on the Thegentlemen ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Ivan Smith Furniture was listed on the Sarcoma ransomware extortion leak portal. Threat actor claims exfiltration of 500 GB of internal data files.

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

JHAMF Group was listed on the Vexy Ransomware ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

jumonji-u.ac.jp was listed on the Safepay ransomware extortion leak portal. The institution is operated by Jumonji Gakuen Educational Corporation and focuses on providing undergraduate and postgraduate education in humanities, education, …

Kraft Lernen was listed on the Payload ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

layam.com was listed on the Safepay ransomware extortion leak portal. Its product portfolio includes food and provisions, beverages, tobacco products, perfumes, cosmetics, electronics, confectionery, gifts and other duty-free merchandise. The …

mars-semi.com.tw was listed on the Safepay ransomware extortion leak portal. Established in 2001 and headquartered in Hsinchu Science Park, the company develops long-range, high-bandwidth wireless audio and video system-on-chip (SoC) …

NOVADATA was listed on the Thegentlemen ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Phoenix Charter Academy was listed on the Rhysida ransomware extortion leak portal. Threat actor claims exfiltration of 445.1 GB of internal data files.

Punta Shopping was listed on the Emperador ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

quevedo-ponce.com was listed on the Safepay ransomware extortion leak portal. Headquartered in Quito, the firm serves domestic and international clients, including businesses, investors, entrepreneurs and multinational companies operating in Ecuad...

Rood Trucking was listed on the Safepay ransomware extortion leak portal. Established in 1962 by George and Diane Rood Sr., the company developed from a single-truck operation into a regional carrier …

SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) was listed on the Payload ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

spencers.com was listed on the Scarlettgroup ransomware extortion leak portal. Spencer's is an American specialty retailer known for novelty gifts, pop culture merchandise, clothing, accessories, and adult-themed products.

Straze Garden Center was listed on the Payload ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

System Soft was listed on the Vexy Ransomware ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

uaa.mx was listed on the Safepay ransomware extortion leak portal. It provides undergraduate and postgraduate education across a broad range of academic disciplines, including engineering, natural sciences, health sciences, social …

Microsoft disclosed an intrusion by Russian foreign intelligence threat group Midnight Blizzard (APT29), accessing senior leadership corporate emails and source code.

Healthcare data breach disclosure submitted to federal regulators by CrowdStrike.

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which desc...

A... F... was listed on the SilentRansomGroup ransomware extortion leak portal. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Acclaim Companies / JCJ Investment was listed on the Genesis ransomware extortion leak portal. A privately-held, real estate development and property management company.

Aliqout Association was listed on the Genesis ransomware extortion leak portal. A multi-disciplinary civil engineering firm based in Walnut Creek, CA.

Anthropic's latest research adds to the growing safety concerns around AI from the ability for models to carry out cyberattacks to the technology going rogue.

ArentFox Schiff was listed on the SilentRansomGroup ransomware extortion leak portal. ArentFox Schiff LLP is a prominent national law firm and lobbying firm formed on March 1, 2022, throug…

Binance, the world's largest cryptocurrency exchange, confirmed Thursday that it had been hacked in a $6.3 billion cyber heist that blockchain investigators are blaming on North Korea.

Cathay Pacific says Amadeus breach affected 53,000 bookings Reuters

Cipsa Industrias Sa De Cv was listed on the Rhysida ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

CP Manufacturing, Inc. was listed on the Aurora ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. [...]

EAS Engineering was listed on the Genesis ransomware extortion leak portal. Specializes in navigating wetland regulations for landowners, developers, and their legal representatives at local, state, and federal levels.

Facts N Figures was listed on the Genesis ransomware extortion leak portal. A consumer insights research company.

Farmacia I was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Fred H Beck & Associates was listed on the Genesis ransomware extortion leak portal. A regional commercial real estate services firm based in Charlotte, North Carolina.

FrenchCreek Production was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 40GB of internal data files.

Gilliam & Associates, P.C was listed on the Genesis ransomware extortion leak portal. A full service CPA firm.

Grupo Ciosa, SAPI de CV was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Honghwa International was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Hudson & Hudson Sign Products was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 14GB of internal data files.

iFink was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Illinois Work Injury Resource Center (IWIRC) was listed on the Genesis ransomware extortion leak portal. A comprehensive occupational health and rehabilitation service provider located in Peoria, IL.

Innoe Asesores was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

INTI International University & Colleges was listed on the Rhysida ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

KTU Shipyard was listed on the Whitearmor ransomware extortion leak portal. Threat actor claims exfiltration of 3TB of internal data files.

Light Rail Manila was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Louisiana Crane & Construction was listed on the Genesis ransomware extortion leak portal. A construction management company.

lyserp.com was listed on the Dragonforce ransomware extortion leak portal. ERP systems and automation: Inventory management, finance and accounting, logistics, production management and supply chain.

M... H... was listed on the SilentRansomGroup ransomware extortion leak portal. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Minutes Quick Services was listed on the N0n ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Moritt Hock & Hamroff LLP was listed on the SilentRansomGroup ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Palletline was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attac...

Poryadok, which operates 48 stores across 32 Russian cities, first reported technical problems on Sunday, saying its website, mobile app and physical stores were temporarily unavailable.

Psychometrics Canada was listed on the Genesis ransomware extortion leak portal. A company that works in the science of objective assessments for over 35 years.

Rapid Manufacturing was listed on the Aurora ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Richland Resources Corporation was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Service One Transportation was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 5GB of internal data files.

Shield Wall Systems of Florida was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Sistemas Visuales 360 was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Societe Ivoirienne De Telediffusion was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Studio Stelitano e Associati was listed on the Emperador ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Suburban Orthopaedics was listed on the Wallstreet ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Susman Godfrey LLP was listed on the SilentRansomGroup ransomware extortion leak portal. Susman Godfrey L.L.P. is a premier litigation firm recognized for its exceptional courtroom talent and…

TRAUCO AG was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Verification was listed on the Whitearmor ransomware extortion leak portal. Verification for Gamblinglore.com

Washington State Attorney General formal data breach disclosure notice filed by DOYON, LIMITED affecting 1,929 residents.

Australian officials are urging TeamCity customers to patch an actively exploited critical flaw, which follows a similar warning from the US government

Disclosed a network intrusion

Antwerp House Dentistry was listed on the Shiba ransomware extortion leak portal. Local dentist clinic based in Cambridge, London

BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks. The post BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts appeared first on SecurityWeek .

Baker McKenzie was listed on the SilentRansomGroup ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

State of California Department of Justice data breach disclosure notice filed by Bangkok Bank PCL - New York Branch.

Officials confirm this week’s tax deadlines extended to November as a result

California School Boards Association was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 80 GB of internal data files.

Circleville Police Department was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 15 GB of internal data files.

ClaimTek Systems was listed on the Rhysida ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

corp-smart.com was listed on the Everstake ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

State of California Department of Justice data breach disclosure notice filed by Del Monte Foods II.

French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]

"No data was extracted,” a spokesperson for BAE Systems, a federal contractor, told Recorded Future News about its probe into a cyberattack against its systems for federal bankruptcy courts.

Eric Weiss reports: The Florida Department of Education says a breach of its student financial aid website may have exposed personal information, including Social Security numbers, belonging to approximately 4.9 million people. The department said...

Friendly Senior Living was listed on the Shiba ransomware extortion leak portal. Hospitals & Physicians Clinics

State of California Department of Justice data breach disclosure notice filed by Frontline Education.

INTAX, Inc. was listed on the Rhysida ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers. The post iRhythm Data Breach Impacts at Least 360,000 People appeared first on SecurityWeek .

IT Foods Industries was listed on the Shiba ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Hackers stole passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers.

LA PROFUMERIA SRL was listed on the Emperador ransomware extortion leak portal. Italian company working with perfumes and cosmetics. Archived personal and corporate data of employees and customers. [Sector: Manufacturing]

LifeFone was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 1 GB of internal data files.

MAA Group Consulting Engineers was listed on the Emperador ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Morgan White Group was listed on the Shiba ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

National Association of Credit Management was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 38 GB of internal data files.

Programs for Parents, Inc. was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 95 GB of internal data files.

Proterial was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

rolly.io was listed on the Whitearmor ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

South Weber City was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 295 GB of internal data files.

sunnybrook.ca was listed on the Scarlettgroup ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

susannecerda.com was listed on the Lockbit5 ransomware extortion leak portal. Die Unternehmensgruppe Susanne Cerdá bietet nicht nur Dienstleistungen im Bereich Unternehmensgründu...

TDS Telecommunications LLC. was listed on the Global Secret Group ransomware extortion leak portal. Threat actor claims exfiltration of 27.4 GB of internal data files.

Udima was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.