This weekly roundup covers the FBI's attribution of the $6 billion Binance hack to North Korea, a spreading wave of refrigeration attacks that has now reached France's blood supply, rapid exploitation of a freshly patched WordPress flaw, a Europol takedown of a fake trading platform supplier, and unauthorized trades in Stockal customer accounts.  Two threads run through this week's stories. First, attackers are increasingly coming in through someone else's door: a third-party refrigeration supplier, a scam platform provider, or data leaked by another company. Second, speed decides the outcome. Attackers moved on WordPress within two days of a patch, while fast alarms saved France's blood stocks from the fate of supermarket food. 

The Cyber Express Weekly Roundup 

FBI Blames North Korea for $6B Binance Hack 

The FBI has attributed the theft of more than $6 billion from Binance, which took place around October 29, to North Korean hackers it tracks as "TraderTraitor." The stolen funds are being converted mainly into Ethereum, and the agency has urged crypto firms to block transactions linked to the attackers. Read more… 

Hackers Heat Supermarket Freezers Across Europe 

Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia threw out spoiled food after hackers took control of refrigeration systems, in some cases setting them to 50°C. The attacks follow a similar campaign against around 400 stores in France last month that exploited outdated, internet-connected cooling equipment. Who is responsible remains unknown. Read more… 

Hackers Target WordPress Flaw Days After Patch 

Attackers began exploiting a critical WordPress flaw within 48 hours of its October 28 fix in version 7.1.4, with Wordfence blocking nearly 63,000 attempts in a single day. The bug affects versions 4.7 through 7.1.3 and can let hackers run code on a site during a core update. With no workaround available, site owners are urged to update immediately. Read more… 

Europol Busts Supplier of Fake Trading Platforms 

Authorities in seven countries seized more than 100 servers and arrested seven suspects on November 3 in an operation against a company accused of supplying fake trading platforms to scam call centres. Victims were lured with promises of quick profits, shown fake gains to draw in more money, and then blocked from withdrawing. Losses are estimated at over €4 million, with potential victims in more than 50 countries. Read more… 

Freezer Hackers Hit France's Blood Supply 

France's national blood service, EFS, said hackers raised temperatures in cold storage rooms at three sites by going through a third-party refrigeration supplier. Alarms caught the changes quickly, and no blood products were lost. It is the first healthcare organisation hit in a wave of refrigeration attacks now reported in at least 11 countries. No one has claimed responsibility. Read more… 

Stockal Confirms Unauthorized Trades in 13 Accounts 

Borderless, which runs US equities platform Stockal, said attackers logged into 26 customer accounts using valid credentials and, in 13 of them, sold large-cap stocks to buy obscure microcap shares. No funds were withdrawn. The company says its systems were not breached and suspects social engineering using data leaked in another firm's breach. Read more… 

Weekly Cybersecurity Takeaway

Several of this week's incidents show that an organization's security is only as strong as the partners and data around it. Supermarkets and France's blood service were reached through refrigeration suppliers; Stockal customers were likely targeted with data stolen elsewhere, and the Europol case exposed a business that built scam platforms for others to run.  Speed is the other lesson. Attackers turned the WordPress fix into a roadmap within 48 hours, while the EFS avoided losses because its monitoring flagged the problem right away.  Organizations should review the remote access their suppliers have to critical systems, retire or isolate unsupported internet-connected devices, and make sure alarms on physical equipment reach someone around the clock. They should also patch critical flaws without delay, strengthen account authentication, and, for crypto firms, block addresses linked to the Binance attackers. 

A severe DreamHost security breach exposed customer FTP credentials and webmail accounts, prompting urgent password rotations and website file audits.

Related Posts:

• DigiCert Data Exposure Reveals Customer Contact Records and Identity Documents
• NVIDIA Brev Security Incident Prompts SSH Key Rotation
• Amadeus Airline Data Breach Hits Major Global Carriers

The post DreamHost Security Breach Exposes FTP and Webmail Data appeared first on Daily CyberSecurity.

Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That's your problem, not theirs. Meanwhile, a company that promised to rescue ransomware victims without paying the criminals stands accused of... paying the criminals. ProPublica's Renee Dudley was on the case years before the indictment. Plus, Dropzone AI's Edward Wu asks what happens when AI models break out of their test environment and go hacking, and whether AI agents can help overstretched security teams keep up. All this and more in episode 491 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Renee Dudley.

DigiCert confirmed unauthorized access to an internal business system containing archived customer information due to a security misconfiguration that exposed the application to the internet. This incident affected business contact details and, in some cases, identity documents. However, DigiCert said its certificate authority services, including CertCentral, DigiCert ONE, customer login credentials, and issued certificates, were […]

The post DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

An Amadeus airline data breach compromised passenger travel records across Malaysia Airlines, JAL, ANA, and Cathay Pacific via compromised credentials.

Related Posts:

• Gitee Exposed Credentials Found Across Millions of Repositories
• OffiDocs Chrome Extensions With 2.3 Million Installs Caught Harvesting Browsing URLs
• Keystone Wallet Data Breach Exposes Customer Orders

The post Amadeus Airline Data Breach Hits Major Global Carriers appeared first on Daily CyberSecurity.

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog

Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539

Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

$6.3 Billion Stolen from Binance in Attack Attributed to North Korea

How to prioritize remediation after a pentest: a practitioner workflow

Hacker leaks data on more than 40,000 Homeland Security employees

Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion

US Probes Suspected Hack Behind Military Base Freezer Failures

484,142 Exposed Cloud Buckets Contain 18 Billion Files

U.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalog

Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Election Website Security: 42% of US County Sites Still Lack .gov Domains

ENGIE Data Breach Exposes Customer Details and Energy Contracts

Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail

Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users

CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers

U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog

Three Japan-Focused Cyberattacks Show How Hackers Use AI

Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters

Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP

Cohere Finds Qwen AI Model Contacting a Server in China

Magento Campaign Infects 953 Online Stores Across Five Domains

AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Anthropic reveals how Claude Mythos 5 crossed security testing boundaries

OpenAI Paused Frontier AI Training After a Security Incident

International Press – Newsletter

Cybercrime

Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets  

Police arrest two suspects in AI-powered bank fraud that cost victims €380,000   

M365 Token Spray and Replay Campaign Compromises Business Email Accounts 

Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens  

Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies  

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents 

deepveindrilling.com: Magento CMS block loader hits 953 stores

“Bulletproof” website domain seized in international law enforcement operation  

Trezor warns of suspected crypto-theft implant in hardware wallet

Polymarket halts trading after crypto-draining script breach, $2.5M traced

Malware

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps  

CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC

Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace  

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Hacking

PHP2Shell exploitation observed: packet-to-process RCE evidence  

CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure  

Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access  

Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan  

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability  

Discovering and exploiting vulnerabilities in critical, real-world software with Claude

Putting Claude Code in a box: a sandboxed dev container for Zed

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!  

Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say  

GitLab security incident: attempted exploitation of CVE-2026-97229  

Intelligence and Information Warfare  

Alibaba’s Qwen AI caught trying to contact server in China

Hackers can gain control of cameras and DVRs through cloud access      

Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says

Operation FlashHole: Lazarus breaks security, defies control 

Hackers Sympathetic to Russia Are Hitting Utilities and Factories  

Alleged Israeli spy company heavily targeted Starlink users, sources say

Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access  

North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History  

Mapping the Political Influencer Industry and the Problems it Causes for Democracy  

Cybersecurity

NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies  

The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare

Code-execution flaw in UEFI firmware affects most servers on planet Earth     

2026 County Election Website Security Census: Key Findings  

Cloud Exposure Index 2026: 484,142 open buckets mapped  

ENGIE: Data leak via a tool belonging to its business partners 

Beyond Framework Signatures: Understanding AI-Driven Intrusions 

I Think The Military Commissary’s Freezers Were Hacked  

Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning 

Passkeys Are Better Than Passwords. But They Are Not Enough

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Northflank urged customers to rotate all platform secrets after reports of unauthorized AI API key use, warning that environment variables across workloads, secret groups, and global settings may have been exposed.

Northflank is investigating a security incident involving reported misuse of AI keys but has not confirmed the entry point, identified an attacker, or disclosed affected customers. Its credential rotation warning remains precautionary, not confirmation of widespread theft.

Northflank’s published timeline begins with a Wiz threat alert at 11:43 UTC on October 30, 2026. Engineers reviewed the alert one minute later and deployed an initial network policy patch at 12:02 UTC.

Further patches followed at 12:50 and 13:05 UTC, and the team requested support from the Wiz incident response team at 13:00 UTC.

The timeline does not explain what those patches fixed. A network policy change alone does not establish how attackers entered the platform or reached customer secrets.

Northflank Security Breach

Northflank subsequently instructed users to treat environment variables as compromised and restrict public access to add-ons where enabled. Environment variables can hold API keys, database passwords, and other application credentials.

Similar exposure concerns surfaced in the recent Railway security incident, where customers were also advised to replace stored secrets after possible unauthorized access.

Northflank said the reported activity may fit a wider pattern of attacks targeting AI credentials. It pointed to similar IP addresses in Wiz’s “Black October” report, which described incidents across nine AI developer platforms during October.

Wiz found a shared focus on stored environment variables but identified no single vulnerability connecting the attacks. The financial risk comes from LLMjacking, where attackers use stolen credentials to consume paid AI services at the victim’s expense.

Previous reporting on LLMjacking attacks shows how compromised cloud keys can support unauthorized model access and resale. However, Northflank has not published a confirmed loss total or linked its incident to a named resale operation.

Customers should revoke existing credentials through the issuing providers, generate replacements, and update affected Northflank secrets and workloads.

Northflank also asked users to review AI provider usage and billing records for unexpected activity, then report suspicious usage to its support team and the relevant provider.

Secret rotation is now available for PostgreSQL, MongoDB, MySQL, Redis, MinIO, and RabbitMQ add-ons. Northflank also enabled audit logs for all customers, including free users, giving more teams access to records that may help their investigation.

The immediate priority is replacing all potentially exposed credentials, not only AI keys already showing abuse. Northflank’s latest guidance still covers secrets across workloads, shared secret groups, and global settings while its investigation remains open.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Northflank Security Breach Leads to Unauthorized AI API Key Usage, Customers Urged to Rotate Secrets appeared first on Cyber Security News.

This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision to let search engines index messages from its public servers.  Two threads run through this week’s stories. First, attackers are getting more out of less: one compromised laptop put billions of dollars in crypto at risk, and AI tools let a small, self-taught crew scale its attacks to dozens of victims. Second, the fallout from a breach lasts far longer than the breach itself, as lawsuits, prison sentences, and bounties land years after the original attacks, while a simple default setting can create new exposure. 

The Cyber Express Weekly Roundup 

Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen 

Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more... 

South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies 

Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more... 

Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach 

Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more... 

Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses 

Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more... 

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns 

Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more... 

Weekly Cybersecurity Takeaway 

Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team.  The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward.  Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use. 

Binance, the world's largest cryptocurrency exchange, said on Thursday that a "security incident" on its platform affected roughly $6.3 billion worth of assets. It is one of the largest security events in the crypto industry so far, though the exchange said close to $3 billion of the affected funds had already been frozen on-chain.  Stablecoin issuers moved quickly after the data breach at Binance. Tether said it had frozen more than 1.567 billion USDT linked to the incident, and Circle froze 800 million USDC. The Arbitrum Security Council also reportedly executed a transaction to freeze about $30.5 million connected to the Binance exploit. 

How the Binance Data Breach Happened 

According to the exchange, early findings point to a compromised employee device. Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update.  The statement, titled "Security Incident Update," was published on October 30, 2026, at 07:53. It said the company had found no evidence that any wallet private key was leaked. Binance added that it would release a detailed technical post-mortem once the investigation is complete and the facts are fully verified. 

Who Will Cover the Losses 

Binance said it will cover all losses from the cyberattack on Binance using its Secure Asset Fund for Users (SAFU) and the company's own funds. "User funds are safe," the exchange stated. It also said it had worked with blockchain partners to freeze the affected assets. Once remediation is complete, it plans to publish an updated Proof of Reserves. 

Immediate Steps Following the Binance Data Breach 

As an immediate precaution, the exchange said it has: 

• Temporarily suspended deposits and withdrawals while security checks are completed; 
• Revoked the affected address authorization; 
• Engaged law enforcement and blockchain intelligence partners to trace and recover the funds. 

The company said its teams are working around the clock to resolve the issue. "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said.  The exchange asked users to rely only on official Binance channels for updates and to contact Binance Customer Support with any further questions. 

Withdrawals Expected to Resume Within 48 Hours 

In a later update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses."  Until then, users cannot move funds on or off the platform. Binance has not yet said how the attacker gained access to the engineer's laptop. The company has said those technical details will be in its upcoming post-mortem on the Binance data breach.

A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.

Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had disclosed.

“The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.” TechCrunch reports.

The incident impacted border and immigration agents, cybersecurity staff and senior department officials. DHS confirmed it is aware of a potential breach and is investigating, saying it takes threats to employees seriously and will provide updates when more information is available.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available,” a DHS spokesperson told SecurityWeek.

The hacker, who uses the name Department of Peace, claims to have stolen the data from an Okta single sign-on system. DHS uses this service to give employees and contractors across its agencies access to the department’s central network. The system also stores IT and login records for each account, showing which systems and internal apps each person can access. The hacker left a note with the leaked data, seen by TechCrunch, saying that if others have their information, it is only fair to share theirs. The malicious actor did not reveal how the U.S. agency was breached.

More than half of the records, around 21,000, belong to U.S. Customs and Border Protection (CBP) employees working at airports and other ports of entry. Another 10,000 belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the cybersecurity agency CISA. Thousands of other records belong to DHS headquarters and agencies such as U.S. Citizenship and Immigration Services and the Federal Protective Service.

DDoSecrets says the leaked database identifies officials involved in undercover operations and key DHS personnel overseeing renditions and deportations. Department of Peace said the leak was a response to the government’s actions against ICE. Crimew described the database as an unprecedented view of DHS’s organizational structure, helping researchers identify employees, their roles and reporting lines. They said it could also support investigations and future Freedom of Information Act (FOIA) requests.

DDoSecrets co-founder Emma Best said the database, called Icepick, identifies officials involved in covert operations, internal investigations and deportation programs. Ryan Shapiro of Property of the People added that employee contact details could help researchers submit more targeted FOIA requests. Best said the data could also support journalism, congressional inquiries, legal challenges and community investigations.

“Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations,” said journalist and DDoSecrets cofounder Emma Best. “The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs.”

“By replacing the regime’s anonymity with accountability, Icepick and the tool developed by maia are catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests,” added Best.

DHS is investigating a potential breach. Okta says it has no evidence its systems or data were compromised.

The breach follows other attacks on U.S. government agencies that exposed FBI records and military personnel data. It is also the second DHS breach this year, after the same hacker claimed to have stolen thousands of government contracts.

Journalist maia arson crimew shared the data with DDoSecrets. TechCrunch verified some records, which suggest the database was copied around mid-August. The leak covers about one-fifth of DHS’s 220,000 employees.

The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE. Around 4,500 accounts belong to a Headspace user group, while more than 2,000 Homeland Security Investigations employees appear in Penlink-related groups.

Researchers say the contact details could help journalists file targeted Freedom of Information Act requests. However, exposing employees’ phone numbers and office locations also creates security and privacy risks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DHS)

The US Department of Homeland Security has had the details of more than 41,000 staff, including ICE and CBP agents, published online. Not ideal for an organisation with "Security" in its name. Read more in my article on the Hot for Security blog.

Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico's Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.

Hackers reduced the GMO Internet ransom demand from $50M to $1M and leaked victim files after the Japanese conglomerate ignored multiple bug warnings.

Related Posts:

• UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
• Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post GMO Internet Ransom Demand Slashed After Cloud Breach appeared first on Daily CyberSecurity.

ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected.

French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business partners. The exposed data includes contact details and energy contract information that could help fraudsters impersonate the supplier.

The company says its internal IT systems weren’t compromised and banking information wasn’t affected. It has blocked the attackers’ access, notified the relevant authorities and contacted affected customers, according to a spokesperson who spoke to BleepingComputer.

According to notification emails sent to affected customers, the incident involved a tool used by partners to sell the company’s electricity and natural gas offers.

The notification confirms that attackers gained unauthorized access to personal information stored in the sales tool.

“We are informing you that an act of cyber-malice recently affected a tool used by some of our partners to market energy offers. As part of this incident, unauthorized access to your personal data was identified.” reads the notification.

The compromised information includes customers’ names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers.

The company hasn’t disclosed the partner or platform involved. It also hasn’t revealed how many customers were affected, when the intrusion began, or when it was discovered.

For electricity customers, these include the delivery point identifier (PDL). For gas customers, they include the metering and estimation point (PCE).

ENGIE says financial information wasn’t affected and that its investigation indicates the exposure was limited to contact details and certain contract information.

That reduces one category of risk but doesn’t eliminate financial fraud. Attackers can use accurate customer information to persuade victims to disclose additional data or make payments.

Anyway, the exposed data could support impersonation scams. The company warned customers to watch for attempts to obtain further information or induce payments. A contract number, however, doesn’t prove that a caller is legitimate. It may simply show that the person has access to an exposed record.

Customers should verify unexpected requests through trusted channels, even when the sender knows their personal details.

ENGIE hasn’t attributed the attack to a specific group, and at this time no ransomware group has claimed responsibility for the attack.

Experts recommend visiting ENGIE’s official website or app directly instead of signing in through links received by email.

Customers should also be cautious with unexpected calls and messages. If someone requests a payment, password or additional personal information, they should end the exchange and verify the request using independently obtained official contact details.

Customers should never share SMS verification codes, passwords or banking details with someone who contacts them unexpectedly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)

A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read more in my article on the Hot for Security blog.

A hacker has leaked 115 GB of Summit Public Schools data containing billions of lines, student and staff…

Coinbase has disclosed that a security incident at analytics provider Amplitude exposed contact information belonging to a small subset of its customers. The cryptocurrency exchange said it found no evidence of unauthorized access to Coinbase systems and confirmed that customer funds were not impacted.

In its official statement, Coinbase Support said the incident also affected other Amplitude customers. The company is notifying impacted users and regulatory agencies under its legal obligations. However, its public update did not identify the other businesses involved or explain how the exposure happened.

“Coinbase has not had a data breach,” the company said, drawing a distinction between its own systems and information held by an outside provider. That distinction matters because customer data can be exposed through a vendor without attackers gaining access to the exchange itself.

Coinbase Customer Data Exposed

Coinbase has not confirmed the number of affected customers or provided a complete list of exposed data fields. Reports have mentioned email addresses and phone numbers, but the official statement refers only to customer contact data. Readers should not treat those reported fields as a confirmed inventory.

Coinbase has not had a data breach.

Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.

We’ve found no evidence of unauthorized access to Coinbase systems, and…

— Coinbase Support (@CoinbaseSupport) October 28, 2026

Reporting by Cryptopolitan cited a claim from SlowMist security researcher 23pds that more than 70,000 users were affected. Coinbase has not verified that figure. Its statement also did not name an attacker, disclose an entry method, or establish when the Amplitude incident began.

Coinbase’s statement does not say that passwords, private keys, or transaction records were exposed. It also does not provide a detailed technical account of the incident. Those gaps make it important to separate confirmed company statements from broader claims circulating online about the event.

The Coinbase Amplitude security incident highlights third-party risk. Analytics services help businesses understand how people use their products. When customer information reaches an outside provider, the security of that provider becomes part of the wider data protection picture, even when the main platform remains secure.

This event should not be confused with the separate Coinbase data theft disclosed in May 2025. Cyber Security News reported that attackers paid overseas support personnel to obtain customer information in that earlier case. There is no established connection between that incident and the current Amplitude exposure.

Contact data alone does not provide direct access to cryptocurrency wallets. However, it can help scammers reach customers with convincing messages about account restrictions, suspicious transactions, or urgent security checks. Knowing that someone uses Coinbase can make a fake support message seem more believable and harder to dismiss.

Cyber Security News previously covered another Coinbase cyberattack involving employees targeted with fake messages. That earlier case provides context for the risks of impersonation, but it does not establish how the Amplitude incident occurred. No public evidence reviewed for this report confirms phishing caused this vendor incident.

Customers should check security notices through the Coinbase app or by visiting its website directly rather than following unexpected links. Coinbase’s support scam guidance says staff will never ask for passwords or verification codes, request remote access, or tell customers to send cryptocurrency to an external address.

The immediate concern is therefore possible follow-up fraud, not a confirmed compromise of Coinbase wallets. Affected users should review their notification for specific details and remain cautious about unsolicited contact. Further disclosures are needed to establish the full scope of the exposure, the information involved, and the cause of the incident.

The post Coinbase Customer Data Exposed Via Analytics Vendor Amplitude Security Incident appeared first on Cyber Security News.

Sony Network Communications disclosed a data breach that exposed 2,585,481 customer records linked to its So-net and Plala (S Course) internet services. The breach, announced on October 27, 2026, compromised passwords for 54,401 email addresses. However, it did not affect primary membership passwords or credit card information. The compromised database contained 2,141,986 records from So-net […]

The post Sony Data Breach Exposes 2.58 Million Customer Records and 54,401 Email Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files from about 90 organizations, totaling 8.2 million records.

Targets included hospitals, private academies, golf courses, universities, and large companies’ affiliates. Investigators said the group used stolen data to pressure victims into paying money.

The Seoul Metropolitan Police Agency announced the case on October 26. The alleged ringleader, identified as “A,” was arrested on October 15 and referred to prosecutors on October 23 while in custody.

Six other suspects remain under investigation and are not in custody, according to reporting on the police findings. Police said the attacks began in September 2025 and continued into October 2026. Although the suspect did not study information technology, he taught himself hacking through online material.

He worked in penetration testing at a security company between 2019 and 2022. That background gave him practical experience before the alleged criminal campaign.

The suspect initially used conventional hacking tools to identify website weaknesses. Investigators said he began using generative AI more widely in late August 2026, expanding the operation.

Around 60 of the targeted organizations were reportedly breached with help from AI tools, rather than every intrusion involving AI from the outset.

AI Hacker Breaches South Korean Organizations

Reporting identified the software as ARTEX, an AI penetration testing framework also linked to separate attacks against South Korean financial institutions.

Cybersecurity News previously covered how hackers targeting South Korean banks exposed their attack tools, providing context about the framework and its use.

However, the shared tool does not establish that the same people carried out both campaigns. Public reporting also does not provide a complete attack chain for these 90 breaches.

The reports reviewed disclose no confirmed vulnerability list, malware details, or evidence that AI independently completed every intrusion.

After stealing information, the group allegedly sent threatening messages to affected organizations. The suspects warned that public disclosure could damage company reputations and lead to government fines.

Police identified 38 organizations connected to the extortion attempts, with combined demands reaching 360 million won, according to Yonhap News Agency.

That figure represents money demanded, not a confirmed total paid. The reported scheme focused on threatening to release stolen information. Available accounts do not describe a ransomware deployment or establish that the attackers encrypted victims’ systems.

The investigation followed a victim complaint in June. Police traced activity through affected organizations’ server logs and used an internal AI analysis system to examine evidence. Investigators recovered stolen information and continued checking whether copies had reached the dark web or supported further crimes.

Authorities described the arrests as South Korea’s first large-scale generative AI hacking case of this kind. The suspect’s prior testing experience remains important when assessing that claim. The case shows an experienced operator adopting AI, not proof that an untrained user could reproduce the same results.

The arrests follow wider concern about breaches in South Korea’s financial sector and security checks. Across both stories, investigators are examining AI’s role while key technical details remain undisclosed. For readers, separating confirmed breaches from claims of fully autonomous hacking remains essential to understanding the threat accurately.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records appeared first on Cyber Security News.

The University of Copenhagen has confirmed a data breach that exposed personal information belonging to about 525,000 people after hackers accessed a university test environment.

The affected database contained full names, Danish national identity numbers, work and private telephone numbers, and personal email addresses. The university is still examining the full extent of the exposure.

The attack was detected on October 20, 2026, and publicly disclosed on October 23. According to the university’s official security notice, the university has brought the incident under control and blocked the attackers’ access.

According to reports, the October 25 update confirmed the exposure of ID card PINs belonging to around 20,000 staff and students, with no evidence of disrupted university operations.

The university issued replacement codes and confirmed that this finding was part of the original incident, not a separate attack. It delayed announcing the compromised codes until it changed them.

University of Copenhagen Data Breach Exposes

The university restricted access to selected critical campus locations on October 23, reopening them after replacing affected PIN codes, as the investigation expanded to physical access control data.

The university should not add the 20,000 affected cardholders to the reported 525,000 people as a separate group. The university described them as affected staff and students within the same incident, rather than announcing a new total.

The confirmed entry point was a test environment. However, the university has not disclosed how the hackers gained access, which software was involved, or whether stolen login details or a software flaw enabled the intrusion. Its statement also does not establish that the hackers downloaded or published every exposed record.

The incident highlights the risks of keeping real personal information in testing systems. A related University of Sydney data breach involved historical personal records stored in an online code library intended for software development. That case similarly placed sensitive information inside a development resource.

A separate Dell test platform breach offers a useful contrast. Dell said its affected demonstration environment mainly contained synthetic data and was separated from customer systems. These cases illustrate why the contents and boundaries of test systems matter when assessing a breach’s impact.

The exposed identity and contact details could support targeted phishing and social engineering. Messages that include a person’s real name or other private details may appear credible, so affected people should independently verify unexpected requests rather than trust the information included in them.

The university has reported the incident to the Danish Data Protection Agency and is keeping other relevant authorities informed. It says the breach falls within the scope of GDPR and continues to investigate its extent. Further updates are expected once investigators establish a clearer picture of what happened and which information was affected.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post University of Copenhagen Data Breach Exposes 525,000 People’s Personal Data, Including Phone Numbers appeared first on Cyber Security News.