88 ID-verification breaches exposed billions of records, highlighting the growing risks of collecting sensitive identity and biometric data.

A new report from Mysterium VPN compiles 88 documented incidents since 2011 where data collected specifically to verify someone’s identity or age got breached, exposed, or sold. The confirmed and researcher-verified total sits at 2.15 billion records, with attacker and seller claims piling another 4.54 billion on top of that.

The most uncomfortable number in the whole dataset isn’t the total record count, it’s how much of it can’t be fixed after the fact. In 41 of the 88 incidents, what actually leaked included the source documents themselves: ID scans, verification selfies, fingerprints, full biometric templates. A password gets reset in thirty seconds. A face doesn’t.

The timing makes the report especially concerning. Of the 88 incidents, 37, or 42%, happened between January 2024 and August 2026, when mandatory identity and age checks were spreading quickly around the world. The message is simple: the systems that collect your ID can be breached just like any other online service.

“The pattern of this era is specific: the wall you are forced to hand your ID to is exactly as breachable as everything else on the internet.” reads the report.

Some recent cases are particularly worrying. The Tea app, created as a women-only safety platform, exposed verification selfies through an open storage bucket, and the images later appeared on 4chan. Discord users who challenged age-verification decisions also had around 70,000 government IDs exposed through a third-party support provider, even as Discord continued expanding age checks.

What makes this particularly damning is who’s actually running the verification layer for the internet’s biggest platforms. AU10TIX, which verifies identity for TikTok, Uber, and X, left admin credentials exposed for over a year. Sumsub disclosed a support-system intrusion that went undetected for 18 months. Persona, which handles age verification for Discord and Roblox, exposed its own frontend configuration.

“In 41 of the 88 incidents, what leaked included the actual documents: ID scans, verification selfies, fingerprints, biometric templates. Unlike a password, none of that can be changed.” states the report. “Every major identity-verification vendor from the current era — AU10TIX, IDMerit, Sumsub, Persona, inVOID — has appeared in this timeline. The companies the internet now relies on to hold everyone’s identity documents safely haven’t demonstrated they can do it.”

Governments haven’t fared any better with their own centralized registries. Argentina’s national identity system leaked 45 million records including ID scans and selfies. France’s ANTS, the agency that literally issues French identity documents, confirmed 11.7 million people affected in a 2026 breach. India’s Aadhaar system, Thailand’s visitor database, the Philippines’ voter rolls, Brazil’s tax registry, the pattern repeats at country scale roughly as often as it does at startup scale.

The report isn’t blaming one company or one mistake. Its main point is that the growing use of ID and age checks is creating more opportunities for sensitive data to be exposed.

Every new law that requires ID checks, every platform that adds age verification, and every company that stores identity data creates another valuable target. Putting permanent and highly sensitive information into systems with different levels of security creates a risk that’s hard to ignore.

This doesn’t mean ID and age verification have no value. They can serve legitimate purposes. But companies deciding whether to build or outsource these systems should study this history carefully. Relying on a “reputable” third-party provider clearly isn’t enough.

“The timeline makes something visible that individual breach reports obscure: this isn’t a series of unrelated failures. It’s one failure mode, repeated across 88 incidents, fifteen years, and every type of organization that has ever decided to collect this category of data.” concludes the report. “What varies is the victim. Sometimes, it’s a startup with inadequate security. Sometimes, it’s a national government that built a country-scale identity registry and watched it walk out the door. Sometimes, it’s a verification vendor that became the single point of failure for a dozen companies that outsourced their compliance obligations to them. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ID Verification Breaches)

An AI-assisted audit found 29 flaws in GlobaLeaks, showing LLMs make large-scale code reviews faster, cheaper, and accessible.

GlobaLeaks, a mature whistleblowing platform that had already undergone six independent professional audits over the past thirteen years, was subjected to an LLM-assisted security review that cost roughly USD 3,140 in API calls. The review identified 29 confirmed vulnerabilities, 12 denial-of-service issues, and 42 hardening recommendations, with an average cost of about USD 77 per confirmed finding before human validation.

The most important point is probably the cost. Reading an entire codebase systematically, line by line and against major known weakness classes, traditionally required weeks of specialist work and a serious budget. That assumption no longer holds in the same way: the report argues that this kind of analysis is now far more accessible than it used to be.

“The distinction matters because it changes who a defender has to worry about. For most of the history of software, the close reading of a large codebase was a scarce and expensive skill; the set of people who could do it was small, and the effort priced casual adversaries out.” reads the report.

The review was not run against neglected software. According to the report, the maintainers had landed 183 commits in the month before the reviewed snapshot during an intensive hardening and release cycle that included token hashing, session-state resets, tighter authorization, and new audit logging. That matters because findings uncovered in a codebase at one of its better-defended moments carry more signal than issues found in stale or abandoned software.

The distribution of cost across models was also revealing. One high-reasoning model accounted for 61.9% of total spend while processing only about 90 million of the 1.24 billion tokens used in the campaign, while cheaper models handled most of the broad reading volume at much lower cost. In other words, deeper reasoning was more expensive, but the gap was no longer large enough to act as a serious barrier.

“The capability is real, and by the standards of any motivated adversary it is inexpensive.” states GlobaLeaks.

The review produced 110 triaged records in total: 29 confirmed vulnerabilities, 12 denial-of-service findings, 42 hardening recommendations, and 27 retained non-findings kept for transparency. That choice matters because it shows not only what was found, but also what was considered and later set aside, which is a healthier way to present LLM-assisted research than pretending every model output is meaningful.

Some of the most important findings were not exotic at all. The report describes issues involving session-to-account takeover paths, whistleblower anonymity risks, tenant-boundary weaknesses, missing audit trails for sensitive actions, and availability problems that a single unauthenticated user could trigger. That is precisely what makes the result uncomfortable: the value of the LLM-assisted approach is not that it discovers magic bugs, but that it makes broad, patient, systematic reading cheap enough to be repeated at scale.

“What is striking about these findings is how ordinary most of them are. They are not exotic cryptographic breaks or novel exploit primitives.” continues the report. “They are missing checks, mutable identifiers, unlogged actions – the small, individually forgivable mistakes that accumulate in every large codebase and that no amount of prior auditing fully removes.”

The report is also careful not to oversell the machine. Every candidate produced by the models was treated as a hypothesis until a human reviewer traced it through the code, reproduced it where needed, and assessed its practical impact. The machine reduced the cost of looking, but it did not replace expert judgment.

“None of this means the machine has replaced the expert. It has not: separating 29 real vulnerabilities from a much larger heap of plausible-looking noise took human judgment at every step.” reads the report. “What has changed is the price of looking.”

That is the real takeaway for teams building or defending critical software. A project that protects people at real risk can no longer assume that thorough code reading is too expensive for most adversaries, because commercial LLMs have changed that equation. The practical response is the one the report itself points to: continuous hardening, disciplined review, and the assumption that the next entity reading the code may be cheaper, faster, and more patient than the last.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, GlobaLeaks)

A new report links 148 ransomware attacks to Italian organizations in H1 2026, with manufacturing the most targeted sector.

Six months, 148 confirmed ransomware claims against Italian targets, and one sector taking the brunt of it. That’s the headline number from a new semi-annual tracker compiled by ransomNews under its RedACT project, which pulls together OSINT and SOCMINT sources to build a manual, deduplicated picture of who’s getting hit and by whom.

The pace works out to roughly 25 claims a month, just under six a week. Attackers claim to have exfiltrated over 13,400 GB of data across the period, though that figure only covers 64 of the 148 cases; where a volume is actually disclosed, it averages around 61 GB. Read that gap as a reminder that leak-site numbers are marketing copy from criminals, not audited disclosures.

“During the reporting period, 148 confirmed ransomware claims were recorded against Italian organizations, averaging 24.7 per month or 5.7 per week.” reads the report published by ransomNews. “The geographic distribution by NUTS macro-region shows Northwest Italy as the most affected area with 63 victims (42.6%), followed by the Northeast (36), Central Italy (30), Southern Italy (13), and the Islands (5). One claimed victim could not be geographically identified. Attackers claimed to have stolen a total of 13,405.22 GB (approximately 13.4 TB) of data, although data volume was disclosed in only 64 of the 148 cases (43.2%). Where reported, the average amount of exfiltrated data was 61.1 GB.”

Geography tells its own story here. The industrial north carries the weight: the northwest alone accounts for 63 victims, and combined with the northeast that’s two-thirds of every claim in the country. Lombardy alone racks up 45 victims, more than the center, south, and islands combined if you set Lazio aside, and Milan’s province leads every other with 22 claims on its own.

Manufacturing is the sector everyone should be watching, and not because it’s surprising. Factories carry proprietary designs, run operational technology that’s brutal to patch without stopping the line, and have close to zero tolerance for downtime, which makes paying up look cheap by comparison. That combination hands manufacturing 59 victims, nearly 40% of the whole dataset, well ahead of commerce and transport, which trail with 17 each.

Two groups dominate the leaderboard, tied at 21 claims apiece: LockBit5 and Qilin. They couldn’t look more different in how they operate.

“The most active ransomware groups were LockBit5 and Qilin, with 21 claimed victims each. The manufacturing sector was the hardest hit, accounting for 59 victims (39.9% of the total).” continues the report.

LockBit5, the rebrand that surfaced on the RAMP forum after law enforcement’s Operation Cronos took down its predecessor, dumped almost half its Italian activity into a single month, March, which lines up with a broader global surge researchers clocked around the same time. Qilin, by contrast, just kept showing up all six months, steady enough that Italy’s CSIRT put out a dedicated advisory calling out its systematic targeting of small and medium businesses.

June was the loudest month of the half, with 31 claims, a 72% jump from May’s quiet stretch of 18. Don’t read that as organic growth, though. A group called Deadlock dumped 12 Italian victims in a single day, and Safepay separately claimed three targets worth nearly 1,900 GB on its own. Strip those two bursts out and June looks a lot less dramatic, which is the sort of detail that matters if you’re briefing leadership on trend lines rather than headlines.

Data volume, interestingly, doesn’t track victim count at all. February produced the smallest number of claims for its size but the largest data haul of the half, over 4,700 GB, and that’s almost entirely down to two single claims of roughly 2,000 GB each, against Gruppo SEAC and Sofinter Group. Two big fish can outweigh a dozen small ones on paper.

The access methods behind all this aren’t exotic. Reused credentials pulled from old breaches and dark web dumps, unpatched public-facing systems, and RDP left exposed do most of the damage; there’s little sign of exotic tradecraft driving these numbers. CL0P’s four Italian claims in January and February trace directly back to its mass-exploitation campaign against Oracle E-Business Suite, a reminder that a single unpatched enterprise system can ripple into victim lists months later.

Thirty different groups claimed at least one Italian victim this half, but eleven of them show up exactly once, which is less a sign of a crowded market and more a sign of how disposable ransomware brands have become. Affiliates rebrand, spin up a new name, and vanish within weeks. Basing your threat model on which “brand” is currently trending is a bit like planning for weather using yesterday’s forecast.

The national picture from Italy’s cybersecurity agency ACN backs up what this dataset shows locally: cyber events climbed in June compared to May, with pressure concentrated on smaller, lower-resilience organizations, exactly the profile of most companies on this list. If you run a mid-sized manufacturer in Lombardy with RDP facing the internet, you’re not a hypothetical target. You’re the median one.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybercrime)

US agencies warn Russian group Laundry Bear is exploiting a patched Zimbra flaw to steal email accounts from organizations running unpatched servers.

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and other U.S. government and international partners published a joint advisory to warn that the Russia-linked APT group Laundry Bear (aka Void Blizzard) is targeting organizations using unpatched Zimbra Collaboration servers.

The attackers exploit CVE-2025-66376, an XSS flaw that allows malicious JavaScript embedded in HTML emails to run automatically when viewed, enabling account theft without user interaction. The vulnerability was exploited as a zero-day before being patched and remains under active exploitation against unpatched systems.

“Unlike traditional phishing that attempts to persuade a user to take an action, such as clicking a link or downloading a file, LAUNDRY BEAR’s current campaign uses a zero-click exploit that only requires a user to view a malicious email within a vulnerable version of the ZCS webmail service.” reads the advisory. “This campaign uses a custom-developed aggregation and data exfiltration capability called Ulej to exploit a common vulnerabilities and exposures (CVE) in ZCS, CVE-2025-66376, with the potential for adaption to exploit other vulnerabilities as well. This advisory provides several mitigations to protect against this activity and specific remediation actions for organizations that detect indicators of compromise in their environment. “

LAUNDRY BEAR conducted a sophisticated campaign targeting Zimbra Collaboration Suite (ZCS) users by exploiting CVE-2025-66376, a zero-day vulnerability that enabled JavaScript execution directly from malicious emails.

“To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566].” continues the advisory. “Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform.”

The group began exploiting the flaw before public disclosure and patch availability, demonstrating the ability of emerging threat actors to weaponize unknown vulnerabilities.

The attack starts with phishing emails sent from previously compromised accounts to evade detection and increase credibility. When victims open the message in Zimbra webmail, the embedded JavaScript executes through abused CSS @import directives.

“Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376.” continues the advisory. “This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013].”

The payload uses encryption and obfuscation techniques to bypass basic security controls and launches a multi-stage script designed for reconnaissance, credential theft, and data collection.

The malware attempts to maintain access by enabling IMAP, creating application passwords, harvesting two-factor authentication codes, and extracting saved browser password manager credentials. It collects mailbox information, user environment details, contacts, OAuth consumers, device status, and emails from the previous 90 days.

“LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent.” states the advisory. “This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.”

Collected data is exfiltrated through HTTPS and DNS channels to attacker-controlled infrastructure named Flowerbed, using a dedicated service called Catcher to receive and temporarily store stolen information. The campaign highlights the growing capability of smaller threat groups to exploit zero-days, bypass MFA protections, and compromise enterprise email environments for intelligence gathering and further attacks.

CISA released indicators of compromise (IOCs) linked to the LAUNDRY BEAR campaign, revealing that attackers used websites designed to impersonate legitimate Zimbra infrastructure. The threat actors registered deceptive domains, including mailnalysis.com, emailanalytics.com.ua, zimbrastat.com, zimbra-metadata.com, istc-cloud.com, and zmailanalytics.com, to support their operations and potentially collect stolen information.

To mitigate the risk, CISA recommends that organizations running Zimbra update their deployments to the latest available versions, review the published IOCs, and investigate possible connections to the identified domains and IP addresses. Organizations should also monitor authentication activity for anomalies, revoke unauthorized application passcodes, particularly those created with the “ZimbraWeb” identifier, and check user accounts for unauthorized mailbox access. In addition, CISA advises implementing phishing-resistant multi-factor authentication to reduce the risk of account compromise and limit the impact of similar campaigns.

In May, Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD) linked a previously undetected Russia-linked group, tracked Laundry Bear (aka Void Blizzard), to a 2024 police breach. In October 2024, the Dutch police blamed a state actor for the recent data breach that exposed officers’ contact details, the justice minister told lawmakers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zimbra)

US and allies warn of Russian APT groups targeting routers and network devices to compromise critical infrastructure worldwide.

The US and allied governments warn that Russian state-sponsored APT groups are scanning and exploiting poorly secured network devices, especially routers, to access critical infrastructure. Groups linked to FSB Center 16, including Berserk Bear, Energetic Bear, Ghost Blizzard, Crouching Yeti, Dragonfly, and Static Tundra, have targeted organizations in communications, defense, energy, finance, government, and healthcare sectors.

“Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks.” reads the joint advisory.”

Russian FSB Center 16 actors mainly target poorly configured network devices, especially routers, by scanning the internet for exposed SNMP services with weak or default credentials.

They use spoofed requests to steal device configurations and move them to attacker-controlled servers through TFTP or FTP. The group also exploits known Cisco vulnerabilities and management interfaces. These techniques are not unique to Russia and overlap with other nation-state actors, so the recommended protections help defend against multiple threats.

“The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication” continues the joint advisory.

“While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices.”

Russia-linked threat actors have also exploited known vulnerabilities, including CVE-2018-0171 and CVE-2008-4128, to compromise network devices. Their techniques overlap with other threat groups, such as Salt Typhoon.

Network defenders should strengthen router security by disabling Cisco Smart Install, replacing SNMPv1/v2 with SNMPv3 using strong encryption, and enforcing unique passwords with secure storage.

Organizations should monitor SNMP activity, restrict management access through ACLs, block unnecessary ports such as TFTP, SMI and SNMP from external networks, and detect suspicious configuration changes. They should also keep firmware updated, replace unsupported devices, and use attack surface management tools to identify exposed systems and weak configurations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Ransomware remains above 1,400 attacks yearly since 2023. Qilin leads in 2026, while the U.S. remains the main target.

Ransomnews has independently confirmed 9,291 ransomware attacks worldwide between January 2018 and July 2026, tracking incidents only when verified through victim disclosures, regulatory filings, official statements, or credible press reporting. Leak-site listings alone don’t qualify, operators inflate, duplicate, and occasionally fabricate claims. The result is a dataset that’s smaller than what most ransomware statistics cite, and more defensible.

“Confirmed ransomware attacks have run at roughly 1,400 to 1,550 per year since 2023, after a visible dip in 2022. The 2020 to 2021 surge, the 2022 trough (which coincided with the Conti shutdown and the Russia-Ukraine war reshuffling the ecosystem), and the post-2023 plateau are all visible in the yearly series. The current year always shows a partial count.” reads the Ransomnews ‘s report.

The 2022 drop to 960 confirmed attacks is the most significant single-year shift in the dataset: when Conti imploded and threat actors reorganized around the war in Ukraine, the volume genuinely fell. It came back. By 2023 it had exceeded the 2021 peak, and it’s stayed there.

“LockBit remains the all-time leader by confirmed victims, with more than 500 verified attacks attributed to the operation since 2019, ahead of Qilin, Akira and the now-defunct Conti.” states the report.

In 2026, however, Qilin leads with 53 confirmed victims, followed closely by a group called The Gentlemen with 51. LockBit sits at 26 confirmed victims this year, which tells you something about how law enforcement pressure has affected its operational tempo without shutting it down entirely.

“The United States accounts for roughly half of all confirmed ransomware attacks in the dataset, followed at a distance by France, Germany, Japan, Canada and the United Kingdom.” continues the report. “Part of that gap is real exposure and part is reporting bias: US breach-notification and SEC disclosure rules force more incidents onto the public record than most jurisdictions, which makes American attacks easier to confirm.”

In 2026, Japan sits in second place with 63 confirmed attacks, significantly more than Germany’s 41, which is a notable shift from the all-time rankings where France and Germany have historically held those positions. Whether that reflects increased targeting or improved Japanese disclosure practices is an open question.

The sector picture hasn’t changed.

“Business is the largest umbrella category at around three fifths of confirmed attacks, but the standout concentrations are in the public-facing sectors: government, healthcare and education together account for well over a third of all confirmed incidents.” concludes the report. “These are the sectors where operational disruption is most visible, which drives both the targeting and the confirmation rate.”

Healthcare alone has 1,297 confirmed attacks across the full dataset, and manufacturing — which sits outside the headline government-healthcare-education grouping — has more confirmed attacks than education at 1,037. The 2026 year-to-date total sits at 504 confirmed attacks as of July 8, with recent months provisional as confirmation lags the actual incidents by weeks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)