Northflank urged customers to rotate all platform secrets after reports of unauthorized AI API key use, warning that environment variables across workloads, secret groups, and global settings may have been exposed.

Northflank is investigating a security incident involving reported misuse of AI keys but has not confirmed the entry point, identified an attacker, or disclosed affected customers. Its credential rotation warning remains precautionary, not confirmation of widespread theft.

Northflank’s published timeline begins with a Wiz threat alert at 11:43 UTC on October 30, 2026. Engineers reviewed the alert one minute later and deployed an initial network policy patch at 12:02 UTC.

Further patches followed at 12:50 and 13:05 UTC, and the team requested support from the Wiz incident response team at 13:00 UTC.

The timeline does not explain what those patches fixed. A network policy change alone does not establish how attackers entered the platform or reached customer secrets.

Northflank Security Breach

Northflank subsequently instructed users to treat environment variables as compromised and restrict public access to add-ons where enabled. Environment variables can hold API keys, database passwords, and other application credentials.

Similar exposure concerns surfaced in the recent Railway security incident, where customers were also advised to replace stored secrets after possible unauthorized access.

Northflank said the reported activity may fit a wider pattern of attacks targeting AI credentials. It pointed to similar IP addresses in Wiz’s “Black October” report, which described incidents across nine AI developer platforms during October.

Wiz found a shared focus on stored environment variables but identified no single vulnerability connecting the attacks. The financial risk comes from LLMjacking, where attackers use stolen credentials to consume paid AI services at the victim’s expense.

Previous reporting on LLMjacking attacks shows how compromised cloud keys can support unauthorized model access and resale. However, Northflank has not published a confirmed loss total or linked its incident to a named resale operation.

Customers should revoke existing credentials through the issuing providers, generate replacements, and update affected Northflank secrets and workloads.

Northflank also asked users to review AI provider usage and billing records for unexpected activity, then report suspicious usage to its support team and the relevant provider.

Secret rotation is now available for PostgreSQL, MongoDB, MySQL, Redis, MinIO, and RabbitMQ add-ons. Northflank also enabled audit logs for all customers, including free users, giving more teams access to records that may help their investigation.

The immediate priority is replacing all potentially exposed credentials, not only AI keys already showing abuse. Northflank’s latest guidance still covers secrets across workloads, shared secret groups, and global settings while its investigation remains open.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Northflank Security Breach Leads to Unauthorized AI API Key Usage, Customers Urged to Rotate Secrets appeared first on Cyber Security News.

Coinbase has disclosed that a security incident at analytics provider Amplitude exposed contact information belonging to a small subset of its customers. The cryptocurrency exchange said it found no evidence of unauthorized access to Coinbase systems and confirmed that customer funds were not impacted.

In its official statement, Coinbase Support said the incident also affected other Amplitude customers. The company is notifying impacted users and regulatory agencies under its legal obligations. However, its public update did not identify the other businesses involved or explain how the exposure happened.

“Coinbase has not had a data breach,” the company said, drawing a distinction between its own systems and information held by an outside provider. That distinction matters because customer data can be exposed through a vendor without attackers gaining access to the exchange itself.

Coinbase Customer Data Exposed

Coinbase has not confirmed the number of affected customers or provided a complete list of exposed data fields. Reports have mentioned email addresses and phone numbers, but the official statement refers only to customer contact data. Readers should not treat those reported fields as a confirmed inventory.

Reporting by Cryptopolitan cited a claim from SlowMist security researcher 23pds that more than 70,000 users were affected. Coinbase has not verified that figure. Its statement also did not name an attacker, disclose an entry method, or establish when the Amplitude incident began.

Coinbase’s statement does not say that passwords, private keys, or transaction records were exposed. It also does not provide a detailed technical account of the incident. Those gaps make it important to separate confirmed company statements from broader claims circulating online about the event.

The Coinbase Amplitude security incident highlights third-party risk. Analytics services help businesses understand how people use their products. When customer information reaches an outside provider, the security of that provider becomes part of the wider data protection picture, even when the main platform remains secure.

This event should not be confused with the separate Coinbase data theft disclosed in May 2025. Cyber Security News reported that attackers paid overseas support personnel to obtain customer information in that earlier case. There is no established connection between that incident and the current Amplitude exposure.

Contact data alone does not provide direct access to cryptocurrency wallets. However, it can help scammers reach customers with convincing messages about account restrictions, suspicious transactions, or urgent security checks. Knowing that someone uses Coinbase can make a fake support message seem more believable and harder to dismiss.

Cyber Security News previously covered another Coinbase cyberattack involving employees targeted with fake messages. That earlier case provides context for the risks of impersonation, but it does not establish how the Amplitude incident occurred. No public evidence reviewed for this report confirms phishing caused this vendor incident.

Customers should check security notices through the Coinbase app or by visiting its website directly rather than following unexpected links. Coinbase’s support scam guidance says staff will never ask for passwords or verification codes, request remote access, or tell customers to send cryptocurrency to an external address.

The immediate concern is therefore possible follow-up fraud, not a confirmed compromise of Coinbase wallets. Affected users should review their notification for specific details and remain cautious about unsolicited contact. Further disclosures are needed to establish the full scope of the exposure, the information involved, and the cause of the incident.

The post Coinbase Customer Data Exposed Via Analytics Vendor Amplitude Security Incident appeared first on Cyber Security News.

South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files from about 90 organizations, totaling 8.2 million records.

Targets included hospitals, private academies, golf courses, universities, and large companies’ affiliates. Investigators said the group used stolen data to pressure victims into paying money.

The Seoul Metropolitan Police Agency announced the case on October 26. The alleged ringleader, identified as “A,” was arrested on October 15 and referred to prosecutors on October 23 while in custody.

Six other suspects remain under investigation and are not in custody, according to reporting on the police findings. Police said the attacks began in September 2025 and continued into October 2026. Although the suspect did not study information technology, he taught himself hacking through online material.

He worked in penetration testing at a security company between 2019 and 2022. That background gave him practical experience before the alleged criminal campaign.

The suspect initially used conventional hacking tools to identify website weaknesses. Investigators said he began using generative AI more widely in late August 2026, expanding the operation.

Around 60 of the targeted organizations were reportedly breached with help from AI tools, rather than every intrusion involving AI from the outset.

AI Hacker Breaches South Korean Organizations

Reporting identified the software as ARTEX, an AI penetration testing framework also linked to separate attacks against South Korean financial institutions.

Cybersecurity News previously covered how hackers targeting South Korean banks exposed their attack tools, providing context about the framework and its use.

However, the shared tool does not establish that the same people carried out both campaigns. Public reporting also does not provide a complete attack chain for these 90 breaches.

The reports reviewed disclose no confirmed vulnerability list, malware details, or evidence that AI independently completed every intrusion.

After stealing information, the group allegedly sent threatening messages to affected organizations. The suspects warned that public disclosure could damage company reputations and lead to government fines.

Police identified 38 organizations connected to the extortion attempts, with combined demands reaching 360 million won, according to Yonhap News Agency.

That figure represents money demanded, not a confirmed total paid. The reported scheme focused on threatening to release stolen information. Available accounts do not describe a ransomware deployment or establish that the attackers encrypted victims’ systems.

The investigation followed a victim complaint in June. Police traced activity through affected organizations’ server logs and used an internal AI analysis system to examine evidence. Investigators recovered stolen information and continued checking whether copies had reached the dark web or supported further crimes.

Authorities described the arrests as South Korea’s first large-scale generative AI hacking case of this kind. The suspect’s prior testing experience remains important when assessing that claim. The case shows an experienced operator adopting AI, not proof that an untrained user could reproduce the same results.

The arrests follow wider concern about breaches in South Korea’s financial sector and security checks. Across both stories, investigators are examining AI’s role while key technical details remain undisclosed. For readers, separating confirmed breaches from claims of fully autonomous hacking remains essential to understanding the threat accurately.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records appeared first on Cyber Security News.

The University of Copenhagen has confirmed a data breach that exposed personal information belonging to about 525,000 people after hackers accessed a university test environment.

The affected database contained full names, Danish national identity numbers, work and private telephone numbers, and personal email addresses. The university is still examining the full extent of the exposure.

The attack was detected on October 20, 2026, and publicly disclosed on October 23. According to the university’s official security notice, the university has brought the incident under control and blocked the attackers’ access.

According to reports, the October 25 update confirmed the exposure of ID card PINs belonging to around 20,000 staff and students, with no evidence of disrupted university operations.

The university issued replacement codes and confirmed that this finding was part of the original incident, not a separate attack. It delayed announcing the compromised codes until it changed them.

University of Copenhagen Data Breach Exposes

The university restricted access to selected critical campus locations on October 23, reopening them after replacing affected PIN codes, as the investigation expanded to physical access control data.

The university should not add the 20,000 affected cardholders to the reported 525,000 people as a separate group. The university described them as affected staff and students within the same incident, rather than announcing a new total.

The confirmed entry point was a test environment. However, the university has not disclosed how the hackers gained access, which software was involved, or whether stolen login details or a software flaw enabled the intrusion. Its statement also does not establish that the hackers downloaded or published every exposed record.

The incident highlights the risks of keeping real personal information in testing systems. A related University of Sydney data breach involved historical personal records stored in an online code library intended for software development. That case similarly placed sensitive information inside a development resource.

A separate Dell test platform breach offers a useful contrast. Dell said its affected demonstration environment mainly contained synthetic data and was separated from customer systems. These cases illustrate why the contents and boundaries of test systems matter when assessing a breach’s impact.

The exposed identity and contact details could support targeted phishing and social engineering. Messages that include a person’s real name or other private details may appear credible, so affected people should independently verify unexpected requests rather than trust the information included in them.

The university has reported the incident to the Danish Data Protection Agency and is keeping other relevant authorities informed. It says the breach falls within the scope of GDPR and continues to investigate its extent. Further updates are expected once investigators establish a clearer picture of what happened and which information was affected.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post University of Copenhagen Data Breach Exposes 525,000 People’s Personal Data, Including Phone Numbers appeared first on Cyber Security News.

India’s Central Board of Film Certification (CBFC) is investigating a reported data breach involving confidential documents linked to more than 500 film titles. The exposed records reportedly include shooting scripts, censor cut orders, certification files and private distribution agreements submitted through its e-Cinepramaan portal.

The Hindu first reported the exposure, which involved film certification applications rather than leaked movie files. Its reporting describes more than 500 affected titles, including dozens of feature films. That distinction matters because the incident does not mean 500 complete films or 500 separate scripts were stolen.

Film Scripts and Business Records Exposed

Filmmakers use e-Cinepramaan to submit documents needed for certification before theatrical release. According to reports, the files were allegedly accessed through this portal and remained available online for several days before removal.

The material reportedly appeared on the Internet Archive, where it could be downloaded. Documents dated from December 2025 to August 2026 were among the exposed records, according to Digit’s coverage of the findings.

The commercial impact could extend beyond spoilers. Local distribution agreements for The Secret Agent and Good Luck, Have Fun, Don’t Die were reportedly included. At least three agreements disclosed licensing fees, potentially revealing private deal terms to competitors or future negotiating partners.

For unreleased productions, exposed scripts could reveal storylines before marketing campaigns begin. Cut orders could also disclose scenes removed during certification. These are potential consequences of the reported exposure, not confirmed cases of financial loss or misuse.

The CBFC has reportedly started an investigation and a security audit. The board said its initial checks had not found evidence of further access to the documents identified in the report. It also said there was no indication that individual filmmakers’ accounts had been compromised.

According to India Today’s coverage, uploads stopped after the portal became unavailable for several hours on October 4. That timing alone does not establish how access occurred or whether the outage stopped it.

The Internet Archive reportedly removed the account involved. Cybercrime authorities received a complaint, and the Indian Computer Emergency Response Team, CERT-In, was notified. The investigation has not yet established the full exposure.

The available reporting does not identify a confirmed software flaw or access method. Cyber Security News previously covered an Indian Post Office portal document exposure involving broken access controls, but there is no evidence linking that weakness to CBFC.

Similarly, its SBI data breach coverage separated exposed records from an unconfirmed entry point. For CBFC, the key unanswered questions remain how documents became accessible, which submissions were affected, and whether copies remain elsewhere. Until investigators publish findings, claims of stolen passwords, ransomware or a specific vulnerability remain unsupported by the available public reporting.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post India’s Film Sensor Board Data Breach – Unreleased Scripts, 500+ Film Titles Exposed appeared first on Cyber Security News.

Capcom has announced plans to notify customers after unauthorized access to its CAPCOM ID service affected 11,774,247 records worldwide.

The Japanese game publisher disclosed the incident on October 22, 2026, saying the exposed information included email addresses and details of account activity.

Attackers also changed passwords on 196 accounts without permission. Capcom has reset those passwords, while its games and online services remain available.

Capcom Confirms Records Exposed

According to the company’s official security notice, CAPCOM ID is a shared account service used across its websites and required for online access to certain games.

The company apologized to customers and said it had completed emergency response measures. Its investigation into the full impact remains ongoing.

The affected records contained registered email addresses, account creation dates and times, last login dates and times, login counts, and the IP address used during the most recent login. These details reveal account activity, although the notice does not establish that every exposed record represents a separate person.

A smaller group of 43 records also included dates of birth, gender, country or region, and nicknames. These records are part of the overall total, not a separate set of affected accounts. The affected data did not include credit card information.

Capcom has not confirmed any compromise of customers’ originally chosen passwords. However, unauthorized password changes affecting 196 accounts show the incident involved changes to some accounts, not just access to stored information. The company has not publicly explained how it made those changes.

Capcom detected suspicious activity on October 19 and immediately began blocking access while investigating. It confirmed unauthorized access that day and introduced emergency measures.

On October 20, the company established an internal incident response headquarters and confirmed that customer information had been affected.

Capcom reported the incident to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on October 21. It says investigators identified and addressed the attack method, but the public notice does not name a vulnerability, describe the entry point, or identify an attacker.

That leaves important technical questions unanswered. The disclosure doesn’t say whether attackers used stolen credentials, exploited a software flaw, or reached the service another way.

Capcom warned that affected information could support fraudulent emails or messages pretending to come from the company or related parties. Customers should avoid links and attachments in suspicious messages.

The warning describes a possible follow-up threat, not a confirmed phishing campaign linked to this breach. Related reporting on malware affecting Japanese cloud servers highlights similar warnings about fake support messages.

Coverage of QR-code phishing emails also shows how criminals use deceptive messages to steal login details. Neither report links to Capcom.

Capcom says registered email addresses can still be used. Affected customers will receive notifications, and dedicated regional support channels are available. The company plans further security improvements based on its findings and will publish additional information through official channels as required.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer Records Exposed appeared first on Cyber Security News.

The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, the global professional services firm. This alleged data theft includes human resources records, training materials, and internal documents. However, the claims are unverified, and PwC has not yet responded.

The group’s listing was reported on October 22, 2026. Hackmanac’s public alert described 108,426 files allegedly taken from internal HR and learning systems. Separately, CTIWatch’s victim tracker recorded PwC appearing on Everest’s leak site that day. These reports document the claim, not independent proof of a breach.

Alleged PwC Data Breach

The supplied leak-site screenshot names a directory, pwc-stg.csod.com, and describes Cornerstone OnDemand platform materials, regional HR exports, e-learning courses, and integration testing documents. It lists 494 directories, alongside 1,333 original archive containers and 53 nested containers. The screenshot alone does not establish how these materials were obtained.

Hackmanac reported that the alleged data spans PwC operations in Australia, China, Canada, and the UK. One HR dataset reportedly contains 213,084 records. That figure should not be read as a confirmed count of affected employees because the number of unique people remains unknown.

The alert also mentions employee information, employment and training records, internal audit methods, confidential documents, and single sign-on source code and configuration files. It does not establish whether working passwords, tokens, or other usable secrets are present.

The screenshot threatens publication after a countdown and urges the company to make contact. A reported October 28 release deadline has not been independently confirmed. No ransom amount, initial access method, or evidence of encrypted PwC systems has been established in the reviewed material.

Everest has previously used data theft claims to pressure named organizations, including its alleged McDonald’s India breach. However, its history includes both data extortion and file encryption, so this listing should not automatically be treated as proof of ransomware deployment.

A separate technical analysis of Everest ransomware found no data theft function inside one examined encryptor. Researchers noted that any theft could instead occur earlier through separate tools. That finding does not explain this alleged incident.

If authentic, detailed employee records could help criminals craft convincing phishing messages or impersonate staff. For now, the central questions remain data authenticity, ownership, access scope, and whether any records are current.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data appeared first on Cyber Security News.

A reported Cartoon Network gigaleak has exposed more than 200GB of internal animation material, offering a rare look at how popular cartoons were made.

The collection reportedly includes editable animation projects, character designs, storyboards, and production guides from The Amazing World of Gumball, Adventure Time, and Regular Show. However, the archive’s full size, source, and authenticity remain unconfirmed.

Reports began spreading across online communities around October 9 and 10. Fans named the collection the “Classic CN Gigaleak,” with some posts claiming a wider archive approaching 1TB.

IndiaTimes reports the Cartoon Network material at over 200GB, noting that neither the full volume nor its origin has been independently verified. These figures should therefore be treated as reported estimates, not verified measurements.

Unlike finished episodes, these files reportedly contain production assets. The collection includes Flash projects, editable character rigs, layered Photoshop documents, model sheets, storyboards and animatics.

Character rigs let artists move separate parts of a digital character, while model sheets help teams keep designs consistent. Animatics show how planned scenes flow before final animation is completed.

Cartoon Network Gigaleak Exposes

Early Gumball material has drawn particular attention. According to the IndiaTimes report, files from Seasons 1 and 2 allegedly include episode source projects and puppet rigs.

Regular Show folders reportedly contain character portraits, size charts, backgrounds and style guides. Adventure Time material is said to total around 90GB, although its exact contents and completeness remain unclear.

Other reported titles include The Powerpuff Girls, Dexter’s Laboratory, Johnny Bravo, Foster’s Home for Imaginary Friends and Ed, Edd n Eddy.

A Google Drive collection and points to an anonymous X account called “totallynotaburner.” That identifies an apparent sharing point, not a confirmed attacker or the source of the files.

Available reporting does not establish whether the files came from a compromised company system, an exposed archive, a former worker, or another source. No verified attack method, stolen account, or software flaw has been identified. Calling this a confirmed network intrusion would go beyond the evidence currently available.

The difference matters when comparing entertainment industry incidents. Cybersecurity News previously covered a Disney hacker who stole 1.1TB of internal data, where malware and stolen employee credentials provided a documented access path.

That case offers useful context, but it does not explain how the Cartoon Network material surfaced. No shared attacker or technical connection has been established.

For aspiring animators, the reported archive could reveal how professional teams planned scenes and organized projects. However, public availability does not make copyrighted production files open-source.

Yahoo’s coverage reports that links were removed following copyright complaints, showing that preservation interest and permission to distribute are separate issues.

Readers should also avoid treating download links as trustworthy. Cybersecurity News has documented fake download sites spreading malware.

This does not establish that Cartoon Network downloads contain malware, but it supports caution around unfamiliar files and lookalike websites. Until stronger evidence emerges, the reported exposure remains significant, while its cause and complete scope remain unresolved.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Cartoon Network Gigaleak Exposes 200GB of Internal Animation Files and Production Secrets appeared first on Cyber Security News.

Nippon Columbia Group disclosed a malware infection on October 8, 2026, that may have exposed millions of Daiichi Kosho customer and employee records after a contractor’s employee computer was infected.

Daiichi Kosho says data theft and misuse remain unconfirmed, and it has found no impact on its own systems. The estimated total is 8.724 million records, comprising approximately 8.631 million customer records and 93,000 employee records.

Although the headline rounds the figure to 8.7 million customer records, the full count includes both groups. These figures describe records potentially at risk, not a confirmed number of people whose information was stolen.

Nippon Columbia Group handles personal information on behalf of Daiichi Kosho. According to the company’s initial incident notice, the infected computer temporarily stored personal data linked to this work was temporarily stored on the infected computer. Investigators could not rule out the possibility that information had leaked outside the organization.

BleepingComputer reported that Nippon Columbia notified Daiichi Kosho on October 5 and isolated the affected computer the following day. The contractor also reset passwords and other login credentials while investigating the cause, scope, and possible online release of data.

Nippon Columbia Malware Infection Exposed

The available reporting does not identify a malware family, name an attacker, or explain how the computer became infected. It also provides no technical evidence showing that files were copied outside the network. Those gaps mean the incident should not be described as confirmed ransomware activity or a proven data theft operation.

The affected information may include registered names, gender, dates of birth, email addresses, and telephone numbers. Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining may be affected. The records relate to people who registered as members or made reservations through the company’s services.

Daiichi Kosho says passwords are not included in the potentially exposed information. It has also reported no evidence of unauthorized use of loyalty points.

Customers should nevertheless remain cautious about unexpected emails, text messages, or calls asking for payment or personal and financial details.

The case highlights a risk linked to outsourced data handling. Daiichi Kosho’s own systems need not be compromised for a contractor’s information to be exposed.

Related CybersecurityNews coverage of the Veradigm third-party data breach and Fidelity Investments vendor incident offers further context on how incidents at service providers can affect their clients. These are separate cases, not evidence of a shared attacker.

In its October 9 update, Daiichi Kosho announced a dedicated toll-free inquiry hotline at 0120-732-079. The service operates from 10:00 a.m. to 5:00 p.m., excluding Saturdays, Sundays, and public holidays. Customers unable to reach the company by phone can email incident-desk@dkkaraoke.co.jp.

The company apologized again for the concern and inconvenience caused. It said it had not confirmed any unauthorized use of personal information arising from the incident, but the investigation remained ongoing. Daiichi Kosho will continue working with relevant authorities to establish the cause and prevent a recurrence.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Nippon Columbia Malware Infection May Have Exposed 8.7 Million Customer Records appeared first on Cyber Security News.

The FBI has arrested another suspected ShinyHunters co-conspirator as investigators pursue the group believed to be behind the FBIJobs.gov breach.

Director Kash Patel announced the arrest on October 9, saying the incident affected a third-party-managed platform. The announcement follows several recent actions against suspected members of the hacking network.

“Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group,” Patel said. He added that investigators were pursuing new leads and evidence while working with partners to disrupt the group and its associates. His statement did not name the suspect, disclose charges, or explain the person’s alleged role.

The New York Times identified the suspect as a Canadian citizen arrested in Pennsylvania. Patel’s announcement did not include that detail. The arrest remains part of an active investigation, and the allegations do not establish the suspect’s guilt.

The FBIJobs.gov incident was discovered in late September and exposed employee information held in an unclassified system. Although the website supports recruitment, reports indicate the stolen records extended beyond job applicants to bureau personnel.

FBI Cyber Assistant Director Brett Leatherman said the breach resulted from a security failure on a third-party platform after a contractor failed to install a security patch issued to protect it.

FBI Arrests Hacker Linked to ShinyHunters Breach

The bureau subsequently removed the contractor and said it had taken steps to reduce further risk and protect employees, according to ABC News.

ShinyHunters previously told BleepingComputer that it exploited an alleged Oracle PeopleSoft zero-day flaw and then moved into FBI-managed AWS GovCloud infrastructure. These claims describe the attackers’ account, not a fully confirmed attack chain.

The FBI’s explanation instead points to an available security update that was not installed. Public reporting has not resolved that difference.

The group also claimed it stole between two and three terabytes of data. Samples BleepingComputer reviewed contained home addresses, Social Security numbers, sensitive job assignments, and family information. The claimed total should not be treated as an independently verified measure of the breach.

The latest arrest follows the arrest of an alleged ShinyHunters leader in the Netherlands. Dutch police detained a 24-year-old Amsterdam suspect on September 15, with support from FBI investigators. Authorities described him as an alleged leader, while ShinyHunters denied that he belonged to the group.

Separately, a suspected ShinyHunters member detained in Jordan reportedly began helping investigators. Reuters identified him as Saif al-Din Khader, allegedly known online as “Rey.” Sources said he was helping identify other members, although the FBI did not confirm that specific detention.

ABC News reported that an internal notice listed exposed names, addresses, contact details, Social Security numbers, birth dates, and emergency contacts.

Sources said the bureau was treating every employee’s personal information as potentially compromised. The FBI urged affected staff to remain alert and avoid suspicious calls.

The arrests have increased pressure on ShinyHunters, but they do not prove the operation has ended. BleepingComputer reported that a new leak site appeared after an earlier site went offline, suggesting some members remained active. Patel said international cooperation would continue wherever the group’s remaining members operate.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post FBI Arrests Another Suspected ShinyHunters Hacker Linked to FBIJobs.gov Breach appeared first on Cyber Security News.

AT&T will pay $177 million to settle lawsuits over two major customer data breaches disclosed in 2024, after a federal judge granted final approval on October 2, 2026. The agreement covers separate incidents that exposed personal details and call records, creating lasting privacy risks for millions of current and former customers.

Judge Sidney A. Fitzwater of the U.S. District Court for the Northern District of Texas approved the settlement, according to Bloomberg Law. AT&T settled without admitting liability or wrongdoing. The deal creates a $149 million fund for the first incident and a $28 million fund for the second, with legal fees and administrative costs also paid from those funds.

Two Breaches Exposed Different Customer Data

The first incident was announced on March 30, 2024, after customer information appeared on the dark web. AT&T’s initial assessment identified approximately 7.6 million current account holders and 65.4 million former account holders, totaling 73 million. The company said the records appeared to date from 2019 or earlier.

The exposed information varied by person and could include names, addresses, email addresses, phone numbers, birth dates, account passcodes, billing account numbers, and Social Security numbers. AT&T initially said it had no evidence that the dataset resulted from unauthorized access to its systems and was still investigating whether the information came from the company or a vendor.

The second breach, announced on July 12, 2024, involved records stolen from an AT&T workspace on Snowflake’s cloud platform. As previously covered in Cyber Security News’ report on the AT&T call-record breach, attackers accessed the workspace between April 14 and April 25, 2024. The incident affected nearly all AT&T cellular customers.

Those records covered calls and texts from May through October 2022, plus some records from January 2, 2023. They included phone numbers, interaction counts, total call durations, and some cell tower identifiers. Unlike the first incident, this breach did not expose Social Security numbers or the actual content of calls and messages.

The distinction is important because communication records can reveal relationships even without message content. AT&T acknowledged that public online tools could connect phone numbers to names. Cyber Security News also previously reported that AT&T paid approximately $370,000 to have stolen records deleted, although fragments could still remain elsewhere.

Under the official settlement terms, eligible claimants from the first incident can receive up to $5,000 for documented losses linked to that breach. Those affected by the second can receive up to $2,500. Customers affected by both may qualify for both payments, but must provide separate evidence and cannot claim the same loss twice.

These maximum amounts are not automatic payouts. Standard cash payments are expected to be much smaller, with reported estimates ranging from $6.50 to $40 depending on the payment tier. Claimants whose Social Security numbers were exposed qualify for a higher tier than those whose other details were leaked.

The claim deadline passed on December 18, 2025, so customers cannot submit new claims through the closed process. Payments depend on claim review and the appeals process, with no confirmed distribution date reported. Customers should follow official updates, monitor their accounts, and remain alert to phishing messages that exploit the leaked information.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post AT&T to Pay $177 Million After Two Massive Customer Data Breaches appeared first on Cyber Security News.

Trump Mobile customers’ personal data has appeared on a dark web leak site after a ransomware group called BYOD claimed it breached the company. The published file reportedly contains 3,615 records, including names, email addresses, phone numbers, home addresses, and order details.

Straight Arrow News reported the incident on October 5, 2026, after reviewing the leaked data and contacting people listed in it. Several individuals confirmed their details were accurate, although some denied being customers. This supports the authenticity of some records, but does not confirm every entry.

The exposed information includes Eric Brunnett, vice president and chief information officer at the Trump Organization. His role covers the organization’s technology and information security. Straight Arrow found no Trump family members in the dataset.

Claimed Access Through Malware

A BYOD representative told Straight Arrow that the group gained access after infecting an employee at Florida-based Liberty Mobile with malware. Trump Mobile is owned by T1 Mobile and uses branding licensed from the Trump Organization.

BYOD also claimed it still had access to Trump Mobile’s backend dashboard and supplied a screenshot showing customer information. The malware family, infection method, and access path have not been publicly established. The report also provides no confirmed evidence that ransomware encrypted company systems.

The group alleged Trump Mobile responded to its breach warning with, “We have no team to handle this.” That account remains the attackers’ claim. Trump Mobile had not responded to Straight Arrow’s request for comment when it published its report.

Exposed contact and order details could help criminals craft convincing phishing messages, fake payment requests or calls posing as customer support. Cybersecurity News previously covered similar risks following the Odido telecom data breach.

Customers should verify unexpected messages through official channels and avoid sharing passwords or account codes with callers. The report does not establish that passwords or payment card numbers were exposed.

The key unanswered question is whether the claimed backend access remains active. Until that is verified, the full scope of the alleged Trump Mobile data breach remains uncertain, including any further exposure.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post Hacker Group Claims to Have Stolen Trump Mobile Customers’ Personal Data appeared first on Cyber Security News.

Denmark has confirmed a major data breach involving its Central Population Register, known as CPR, after unauthorized parties accessed personal records belonging to about 8.8 million people. The exposed information includes names, addresses, and CPR numbers, according to an official statement published on October 5, 2026.

The figure exceeds Denmark’s population of roughly six million because the register also holds records of people who have moved abroad and those who have died. Officials said the CPR system currently contains approximately 11 million registered people, meaning the incident affected a large share of its records.

How Attackers Accessed CPR Records

The attackers misused a private Danish company’s lawful access to search the CPR system during September. Authorities have not described how the unauthorized parties obtained or used that access, leaving the initial entry method unknown.

The confirmed route is important: this was misuse of an approved company connection, not a publicly confirmed software flaw in the register. The ministry has not disclosed the company’s name, linked the incident to a known threat group, or identified a specific vulnerability.

Under Section 38 of Denmark’s Civil Registration Act, private companies with a legitimate interest can receive certain CPR information about a defined group of people identified beforehand. They must also meet requirements under the General Data Protection Regulation and Denmark’s Data Protection Act.

Those rules do not provide unrestricted access to everyone’s records. Investigators are still examining how the company’s permitted access was misused on this scale and whether further findings will change the reported details.

The CPR administration became aware of unusual system behavior on Friday evening, October 2. Over the following weekend, officials established that unauthorized parties had accessed information covering approximately 8.8 million registered people.

Authorities blocked the company’s access and brought in specialists to map the incident. The administration also reported the breach to Denmark’s Data Protection Authority. Police are investigating alongside other relevant authorities, but the inquiry remains at an early stage.

Research, Education and Digitalization Minister Christina Egelund described the incident as deeply serious. She informed Parliament’s Business and Digitalization Committee and requested a thorough security review of CPR. Officials said preventive measures had already started, without detailing their technical scope.

The review found that names and addresses belonging to people registered with name and address protection were not included in the unauthorized access. This finding should not be read as confirmation that every data field for those people remained unaffected.[ufm]

Phishing Attack Risks

Names, addresses, and national identification numbers can make fraudulent messages and calls appear convincing. Cybersecurity News’ coverage of the Pentagon data breach similarly highlights the risks when personal records include identity numbers, while its phishing prevention guidance explains common warning signs.

Danish authorities warn residents not to share passwords or other confidential information through unexpected calls or emails, even when the sender already knows their name, address, and CPR number. Knowing those details does not prove that a caller represents a trusted organization.

Citizens can seek official guidance through Sikkerdigital or call the Cyberhotline for digital security at +45 33 37 00 37. The hotline has extended its opening hours to 8 a.m. through midnight in the coming days. Authorities have not yet publicly identified who carried out the breach, and the full circumstances remain under investigation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post Denmark Data Breach Exposes Personal Records of 8.8 Million People appeared first on Cyber Security News.