Berlin refused a 30 Bitcoin ransom, leading hackers to leak 6TB of sensitive state administration and national defense data on the dark web.

When a ransomware gang dumps nearly six terabytes of state administration files onto the dark web, ignoring them does not make the problem go away. The Rhysida ransomware group recently carried out this exact threat against Berlin after local authorities refused to pay a thirty Bitcoin ransom.

At the end of August, Berlin’s state government confirmed it was dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included.

Rhysida claimed it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes:

• Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.
• Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information.
• Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts.
• Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.
• Classified information: data related to classified-material handling and documents allegedly containing state secrets.
• Critical infrastructure: vulnerability analyses concerning Berlin’s water supply.
• Identity documents: passports and ID cards from personnel records.
• Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives.

The group also claimed that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified.

The scale of the breach is staggering. Investigators are now looking at roughly 1.4 million files containing personal details of civil servants, internal infrastructure records, and critical government data.

The fallout goes far beyond routine data theft. Investigative journalist Lars Winkelsdorf pointed out the gravity of the situation on social media.

Die absolute Vollkatastrophe ist eingetreten

Dieses Datenleck ist schlimmer als alle bisherigen Terroranschläge zusammen 1/xhttps://t.co/epU4mCYgew

— Lars Winkelsdorf (@winkelsdorf) September 4, 2026

“In addition to LKA documents related to investigations, the files also include plans concerning national defense—ranging from the federal government’s secret communication channels in the event of an apocalypse to defense-related companies and emergency plans developed by government agencies,” Winkelsdorf wrote.

Exposing crisis response plans and secret communication channels turns a financial shakedown into a national security headache.

Worse still, the leaked material includes files concerning chemical, biological, radiological, and nuclear threats.

“Among the published files is a folder titled “AG CBRN-Rahmenplanung.” CBRN stands for chemical, biological, radiological and nuclear threats,” notes the Euronews report

Having that kind of operational data floating around public forums gives hostile actors a blueprint for disaster.

Refusing to pay ransoms is the right policy, but it rarely stops the bleeding once the network is compromised. Governments keep treating cybersecurity like an IT expense rather than an existential line of defense.

Until boards start treating network segmentation with the same seriousness as physical security, we will keep watching expensive countdown timers tick down to zero.

Berlin’s state government announced the launch of a crisis response after the threat actors published the stolen data.

“A ‌central ⁠crisis unit will oversee the review, verification and assessment of the leaked data and support efforts to inform affected citizens and ​businesses, said the ​city.” Reuters reports.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Berlin)

MikroTik RouterOS SSH zero-day (MikroTrick chain) under active exploitation since Sept 2. Patch to 7.24.2, 7.23.5, or 6.49.21 immediately and check logs.

Anyone running a MikroTik router with SSH exposed to the internet should treat it as compromised until proven otherwise. The popular cybersecurity expert Costin Raiu published a detailed technical breakdown of the active exploitation on September 5, 2026, the same day CERT Polska issued its advisory titled “Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended.”

“If you have a MikroTik router on the internet with SSH open, it may already be compromised” Raiu wrote on Medium.

The attack chain being exploited is called MikroTrick and combines two of six vulnerabilities CERT Polska discovered and disclosed: CVE-2026-67276 (CVSS score of 9.2), an SSH authentication bypass, and CVE-2026-86060, an SSH session privilege escalation.

“The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Combining two of them allows an attacker to take full control of the device without authentication if the device supports remote access using the SSH protocol. To make this chain easier to identify, we have given it a common name, MikroTrick.” states CERT Polska. “In recent days we have been observing attacks against RouterOS devices accessible from the internet. “

CVE-2026-67276 flaw stems from how RouterOS verifies RSA public keys. If an attacker knows a valid username and the public part of the user’s RSA key, they can create a fake key and log in without the private key.

When combined with the privilege-escalation flaw, the attack can give an attacker full administrator access to any internet-exposed RouterOS device with SSH enabled.

“MikroTik has released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 on September 3, however, it would appear that exploitation began as early as September 2, making it a 0day.” Raiu added. “This seems to suggest someone got hold of the news the patches were dropping and began exploiting it at scale.”

A Polish security forum contained logs showing September 2 exploitation attempts, and CERT Polska confirmed successful attacks including the creation of an “ops” account dating to at least September 2.

Most of the attacks observed so far originated from 82.192.72[.]4, a Leaseweb IP that was hosting a busybox binary (a MIPS build from 2010, identical to the official BusyBox 1.16.1 precompiled binary), alongside three other files: ftpsrv.py, launch.sh, and serve.py. A second IP, 103.102.31[.]18, has also been associated with the campaign. Three of the four hosted files have no VirusTotal detections as of writing.

MikroTik routers are popular because they can run for years with little attention. But that also makes SSH vulnerabilities more dangerous. Devices that haven’t received updates in years may not get patched before attackers start exploiting a new flaw.

Defenders can detect attacks by looking for specific log entries. Failed login attempts show the username -2, which isn’t a valid account and shouldn’t appear in normal logs. A successful attack appears in /system history as ssh:-2@<IP>, followed by an action such as creating a user, adding an SSH key, changing firewall rules, or enabling a proxy or tunnel.

“When one is attached to a configuration action—especially the creation or modification of users, SSH keys, scripts, schedulers, services, firewall rules, proxies, tunnels, or packet-sniffing settings—treat it as confirmed compromise unless it came from an authorized security test.” concluded Raiu. “Do not assume the device is safe merely because no -2 login failure appears: logs may have rolled over or cleaned.”

The creation of an account named “ops” is an additional confirmed indicator of compromise in the observed attacks.

Raiu tested the reproducibility of the exploit using four different AI tools. Astra refused on safety grounds and suggested he apply for cyber verification. The other three (Sol, Daybreak Blue, and GLM-5.3) were willing to help but none could complete a working implementation. That gap gives defenders an estimated one to two days before a working proof of concept appears publicly on GitHub, which is better than nothing but not by much given that exploitation is already happening at scale from a single IP.

CERT Polska noted something unusual: MikroTik sent push notifications through its official mobile app to alert users about the vulnerabilities, a first for the company. Patched versions are 7.25beta3, 7.24.2, 7.23.4, 7.23.5 (released September 4), and 6.49.21. Devices using MikroTik’s default firewall configuration and not directly exposing SSH to the public internet are likely protected, but any device with SSH reachable from untrusted networks should be patched immediately and inspected for the indicators above.

The full list of IOCs from Raiu’s analysis: IPs 82.192.72[.]4 and 103.102.31[.]18; file hashes 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e (serve.py).

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MikroTik)

Another trove of data from Berlin's government has appeared online, authorities said. Germany's information security agency separately warned about the Rhysida cybercrime group.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure      

Gryxa: The AI-Built Toolkit That Watches How You Remove It

ValleyRAT masquerading as adware  

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds  

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Uncovering StreamRat: From Meta Ads to Full Device Takeover  

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon September 2, 2026

Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets  

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist 

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Peer Pressure: Inside the Sality Botnet Disruption Operation

Graph-Based Learning for Android Authorship Attribution: A Comparative Analysis of GNN Models

Stability and Hopf Criteria in a Malware Dissemination Model for Wireless Sensor Networks with Distributed Recovery Delays

PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

PaperCut Flaws Exploited in Attacks on U.S. and European Schools

Broadcom Patches Critical VMware Workstation and Fusion VM-Escape Vulnerabilities

U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

Crooks Behind Manchester Airports Group Hack Leaked Data of 8.8 Million People

PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign

Google fixes the sixth actively exploited Chrome zero-day of 2026

Dark Web Service Nexus Sells 153M+ Driver’s Licenses

2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators

OpenAI Astra Brings Autonomous Zero-Day Exploitation to AI

SonicWall Patches Two New Actively Exploited Zero-Days in SMA 1000 VPNs

$536 and 8 Hours: AI Learns to Attack a Different PLC

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Hackers Target Langflow in CVE-2026-0768 Attacks

Attackers Access Aesto Health AWS Infrastructure, Exposing 9.5 Million Records

Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague

Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Chaotic Eclipse Releases Kaspersky Zero-Day HardBreacher

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool

China-linked Fire Ant Hides Inside Trusted Infrastructure

Infostealers Are Hijacking Claude Sessions and Draining Subscriptions

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Extortion Group FulcrumSec Claims 86GB Manchester Airports Group Data Theft

Hackers Are Probing PaperCut Servers, and 47% Still Have No Patch

International Press – Newsletter

Cybercrime

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation  

FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs  

FBI Probes Service Selling 153M+ Drivers Licenses

Two Nigerian Nationals Extradited from Nigeria to the United States to Face Sextortion Charges in North Carolina and Mississippi  

The Town 2025 ticketing data sold as a Ticketmaster breach 

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon September 2, 2026  

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal   

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Malware

Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts

Gryxa: The AI-Built Toolkit That Watches How You Remove It

ValleyRAT masquerading as adware  

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds  

Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets  

Hacking

Eclypsium flags 1,051 CVEs in infrastructure advisories 

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP  

Kaspersky zero-day exploit HardBreacher 

PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability  

Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack 

Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet  

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon 

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking  

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

When Sorting Leads To Confusion  

Intelligence and Information Warfare  

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure

Insights into Suspected DPRK Workers: Red Flags to Look Out For   

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set  

Leaked Russian Cyber-Operations Training Materials  

Threat Intelligence Report: University Leak Exposes Russia’s Military Cyber Training Pipeline  

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

How the Russians Got Inside My Phone

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors    

Cybersecurity

Judge says Pentagon’s measures against Anthropic were ‘illegal and baseless’  

How AI could make it harder for governments to use hacking tools  

Own a gun? Go to church? Do yoga? AI can find out in seconds        

Path to Astra: critical capabilities and frontier safeguards  

PostGREShell: The database powering much of the internet had an open door for 12 years 

Fighting AI with AI: The US’s New Cyber Rules of Engagement 

ATM Flaws Reveal Key Weaknesses in the Software Supply Chain 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe.

Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education organizations in the U.S. and Europe, as reported by TheHackerNews.

Arctic Wolf researchers observed threat actors chaining an authentication bypass with remote code execution to run commands, perform reconnaissance and create privileged accounts. The activity shows how quickly attackers can turn newly disclosed vulnerabilities into real-world attacks, putting sensitive credentials and systems at risk.

“Arctic Wolf observed exploitation of PaperCut servers affected by CVE-2026-81578 and CVE-2026-82078 leading to command execution, reconnaissance, and attempts to create privileged accounts.” reads the advisory. “Observed post-exploitation activity included delivery of Windows registry hive collection tools, Metasploit/Meterpreter-related Java payloads, and commands used to identify hosts, users, processes, and sensitive configuration data.”

PaperCut, an enterprise print-management platform, has a history of exploitation, including attacks that delivered LockBit ransomware. PaperCut disclosed active exploitation of the latest flaws on August 27, 2026. CISA added both to its Known Exploited Vulnerabilities catalog on August 31.

Attackers used PaperCut flaws to run basic system checks, create a privileged account named Administrator17, and collect system and user data.

They downloaded credential-harvesting tools with certutil and used Meterpreter Java payloads to establish remote sessions. The attackers also searched PaperCut configuration files for passwords, secrets, LDAP settings and tokens.

Researchers observed lsa_collect.exe extracting registry keys to recover the Windows BootKey, which could give attackers access to the SAM database and stored credentials.

Defenders should review PaperCut server.log files for known exploitation indicators and look for unusual five-character .class, .cmd, or .out files. Monitor pc-app.exe for command shells such as cmd.exe and powershell.exe, and investigate commands like whoami, tasklist, ver, and uname.

Also check for credential-harvesting tools, unexpected privileged accounts such as Administrator17, suspicious requests to /custom/pcp_*.txt, and large downloads using python-requests.

Finally, keep PaperCut management interfaces off the public internet and install the vendor’s security fixes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PaperCut)

Manchester Airports Group (MAG) data allegedly leaked by FulcrumSec exposes emails and phone numbers of 8.8 million people.

Manchester Airports Group, which operates Manchester, London Stansted and East Midlands airports, has confirmed a data breach involving customer information held in a third-party database. The company says airport operations, passenger safety and aviation security were not affected, but the incident has exposed data that can make fraud far more convincing.

The data related to parking, lounge and Fast Track bookings, as well as airport Wi-Fi sign-ups. MAG said attackers took email addresses, phone numbers, vehicle registration details and postcodes, while payment-card data was not accessed.

The group disclosed the incident on 27 August and said it had contained the risk, engaged specialist advisers and notified relevant authorities.

The extortion group FulcrumSec claimed responsibility for the intrusion and leaked the data after MAG had refused its ransom demand.

“Today we are releasing the Manchester Airports Group dataset: every customer, event, configuration that serves Manchester Airport, London Stansted and East Midlands Airport. Half a terabyte, and every byte of it is pure PII. However, we have decided to withhold the most dangerous part of the breach : the nearly 200,000 passengers whose entire upcoming travel schedules were exposed by MAG’s negligence, which, when linked with their full PII and vehicle information, creates an ideal opportunity for burglars, stalkers, and worse.” FulcrumSec wrote on its data leak site. “Unfortunately for them, MAG made zero effort to protect all their data they’d been collecting. The way we gained access was so simple it is tragi-comical: Iterable admin keys in the frontend JavaScript of each of its three airports’ websites: manchesterairport.co.uk, stanstedairport.com, and eastmidlandsairport.com. Each site had its own key hardcoded into it that provided access to millions of passengers who had passed through that airport. That means for this breach to have occurred at the scale it did, MAG had to make a catastrophic security mistake not once, not twice, but THREE times.”

FulcrumSec claims it accessed MAG’s systems using administrator keys exposed in the JavaScript of its three airport websites. MAG hasn’t confirmed this, and SecurityWeek hasn’t independently verified it, so the claim remains unproven. Still, the case highlights a basic security rule: keep secrets off client-side code, rotate them regularly, limit access and scan code, repositories, logs and configurations for accidental exposure.

The group then published roughly 550 GB of uncompressed data it says came from the airport operator’s systems.

“These exposed keys gave us access to the following:

• 8,672,291 customer profiles with email, name, mobile, home town, postal region, and the residential IP address the account last connected from
• 1,169,302,811 events, of which 1,160,120,195 are email-channel events: 611,629,550 sends, 463,286,223 opens, 36,878,965 clicks, plus every subscribe, unsubscribe, bounce and complaint
• 2,482,763 purchases — every booking every customer of its parking, lounge, and fast-track products has ever made. An analysed subset of 1,154,675 transactions, from 877,754 identified purchasers, totals £83,413,317.89
• 461,433 SMS messages rendered with a passenger’s booking date, car park and vehicle registration spelled out in plain text
• 108,077 unique UK vehicle registration plates tied to the owner’s email, mobile, airport, car park and dated booking
• The complete platform configuration: every campaign, every journey, every list, every segment and every template, all as live JSON” FulcrumSec added.

The announcement claims that a leaked MAG database exposes 190,849 future bookings, including 142,755 linked to vehicle registrations, potentially revealing when homes will be empty.

It also claims the data includes thousands of government, judicial, military, police, NHS and defence-industry employees, creating significant security risks. The attackers say they removed the most sensitive travel details before publishing, while accusing MAG of downplaying the breach.

Databreach notification service Have I Been Pwned processed the available dataset and added the incident to its breach database. The service reports that approximately 8.8 million email addresses and phone numbers were compromised, alongside names, IP addresses, browser user-agent details, geographic information, purchases and vehicle registration plates.

That is not just a list of email addresses. It is a working fraud kit: a criminal can link a person to an airport, a booking type, a car, a location and a contact number. They don’t need to guess much after that.

What affected people should do

Anyone who has used MAG’s parking, lounge, Fast Track or airport Wi-Fi services should assume that phishing attempts may become more tailored. They should be cautious with messages claiming to concern a booking, refund, parking penalty, account problem or payment request.

Users should change passwords if they reused one associated with these services elsewhere, especially on email accounts. They should also enable multi-factor authentication, review account-recovery methods and avoid clicking links in unexpected messages.

A legitimate organisation will not ask for a password, a banking PIN or a one-time authentication code by email, SMS or phone. If a message refers to a booking, open the relevant airport or provider site manually rather than following the link it contains.

The Have I Been Pwned breach entry allows users to check whether their email address appears in the published dataset.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Manchester Airports Group)

The U.S. Department of Justice and the U.K.'s National Crime Agency and Crown Prosecutor signed a memorandum to cooperate on cases involving Southeast Asian scam operations.

In its first annual assessment, published Friday, the City of London Police said victims reported losing £6.3 million ($8.5 million) to account hacks in the year ending March 31, up from £1.2 million ($1.6 million) a year earlier.

Amir Yaryab is the leader of the IRGC's cyber unit and oversees hacker groups such as the CyberAv3ngers, the State Department said in posting a reward for information about him.

FBI probes suspected breach at IDScan.net after dark web service Nexus offered 153M+ US and Canadian driver’s license scans.

A dark web identity theft service called Nexus appeared on September 1, 2026, offering searchable access to more than 153 million scanned driver’s licenses belonging to people in the United States and Canada.

The FBI’s New Orleans field office opened a formal investigation the same day. Brian Krebs at KrebsOnSecurity, who broke the story, traced the source to idscan.net, a New Orleans-based identity verification company whose clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, and the financial services firm Jack Henry.

“On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.” wrote Krebs. “The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards.”

The record total was also increasing by roughly 400,000 per day at the time of publication, which the operators attributed to ongoing active exfiltration from a live breach they claim has been running for over a year.

Krebs found his own driver’s license in the database after a source alerted him to the service. The operators had posted his Virginia license as a free sample on the Russian cybercrime forum Exploit. Each record contains six images of the license, showing the front and back in visible, infrared, and ultraviolet light, with a timestamp. Krebs’ timestamp matched a June 2025 flight and car rental.

He then checked nine friends and relatives, and everyone who found their license confirmed traveling or renting a car around the same date. His license and his mother’s, who rented a Hertz car with him that day, had timestamps just seconds apart.

Security researcher Zach Edwards, whose license also appeared in Nexus, narrowed the source further. His timestamp matched a trip to Las Vegas for DEF CON in August. He hadn’t rented a car, but he had shown his license at a marijuana dispensary: Planet13, a multi-state chain. In 2022, idscan.net published a press release announcing an exclusive identity verification partnership with Planet13’s dispensaries nationally. The company now serves more than 1,000 marijuana dispensaries in 19 states, and its own documentation confirms that its technology scans IDs with both infrared and ultraviolet light, precisely the format of the images appearing in Nexus.

Idscan.net performs more than 21 million verifications per month at more than 20,000 locations globally. Its client list spans car rentals, retailers, hotels, financial services, and dispensaries, which explains both the volume and the geographic spread of the records. The dataset also includes marijuana dispensary cards and records marked with the notation “CAC,” which may refer to Common Access Cards, the government-issued credentials used to enter federal buildings and secure facilities. If confirmed, that would significantly expand the security implications beyond consumer identity theft.

The database reportedly contained the driver’s licenses of U.S. Defense Secretary Pete Hegseth and the FBI’s assistant director, but not FBI Director Kash Patel’s.

Idscan.net said Krebs’ findings would help its internal investigation but gave no further details. The company later said it was working with law enforcement and forensic experts. Soon after the story became public, the Nexus service went offline.

Identity verification systems that require driver’s licenses are spreading sensitive data across an expanding network of third-party vendors, and oversight mechanisms haven’t kept pace. Every bar, hotel, car rental counter, dispensary, and age-verification system that scans an ID is creating a copy of that image in a system whose security posture the cardholder has no way to assess.

The idscan.net incident, if confirmed at the reported scale, would be among the largest exposures of government-issued identity document images ever recorded.

Krebs reports that Nexus shut down after his article, while the FBI opened an investigation after learning that stolen IDs may include licenses belonging to FBI agents.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Nexus)

412,000 The Town 2025 festival buyer records are being sold for $10,000, with Brazil’s data openly marketed for bank fraud, loans and SIM registration.

A seller on a Russian-language data-trading forum listed what they’re calling a Ticketmaster database on September 2, claiming over 412,000 Latin American purchase records with a heavy concentration of Brazilian data. Ransomnews’s analysis confirms the sample is genuine ticket-buyer data from The Town 2025, the São Paulo music festival, though who actually lost the data and how remains unconfirmed.

“The listing is headed “SELLING NEW TICKETMASTER DATABASE” and describes a global ticketing platform, Latin America region, with an internal ticketing database as the source and a breach date of 28 August 2026. It advertises 412,192 rows across 34 columns.” reported Ransomnews. “The country breakdown is dominated by Brazil at 251,557 records, or 61%, with Argentina at 219, Chile 155, Colombia 144, Peru 123 and Paraguay 72, plus nine more countries not itemised.”

The seller is asking $10,000 for the full database, or $80 for every 1,000 records, with escrow available. The 251,557 Brazilian records make up about 61% of the database, meaning the seller is effectively asking around four cents per person.

The data includes names, email addresses, CPF numbers, phone numbers, neighborhoods, ticket types, and payment details. Together, these details provide a detailed profile that could be used for identity theft and fraud.

“The seller’s own notes are the part that should concern Brazilian readers most. Alongside the sales copy, the listing states that the CPF numbers work “for Brazilian bank fraud, loan apps and SIM registration”.” continues the report.”That is not our characterisation of the risk. It is the seller describing the intended use of the file.”

Ransomnews ran the kind of checks that usually expose fake listings within minutes, and this one kept passing. Purchase IDs across the sample rise in strict chronological order, exactly what an auto-incrementing database key produces and something close to statistically impossible to fake by chance. Every CPF number in the sample passes Brazil’s official check-digit validation, phone area codes correctly match the state listed on each row rather than defaulting to a single city, and neighborhood names map precisely onto their stated cities, the kind of granular accuracy a random data generator simply doesn’t produce.

The ticket prices provide another strong sign that the database is genuine. Full-price tickets cost exactly 975 reais, while discounted tickets cost 487.50 reais, matching Brazil’s legal student discount. The database also lists Pix and Elo as payment methods, both widely used in Brazil.

Even the incomplete records look realistic. Complimentary tickets issued by the festival’s back office contain no name or CPF, only the ticket type and date. These kinds of inconsistencies are common in real databases but would be unusual in fabricated data.

However, there is an important detail that challenges the claim of a direct Ticketmaster breach. Every record in the sample has exactly the same processing timestamp: October 1, 2025 at 23:05:41, about two weeks after the festival ended.

A live database dump would normally contain different timestamps. The identical timestamp instead suggests that the data may have been exported in a single batch after the event and then shared with a promoter, sponsor, payment provider, or another partner. Ransomnews therefore warns that blaming Ticketmaster directly would go beyond what the available evidence currently shows.

That distinction matters more than it might seem, because it points at an industry-wide blind spot rather than one company’s failure. Brazilian ticketing requires CPF collection to enforce discount eligibility rules, which means live-events companies routinely end up holding a national identity number, a verified phone, and a home neighborhood for hundreds of thousands of people, data with the sensitivity of a bank record sitting inside an industry with nothing like a bank’s security requirements. The moment that data gets exported into a spreadsheet to reconcile ticket sales with a partner, which happens constantly and rarely makes headlines, it becomes dramatically easier to lose.

“If you bought tickets to The Town 2025, treat your CPF as exposed.” concludes the report. “A CPF cannot be reissued the way a password can, and the seller is explicitly marketing these numbers for credit and telecoms fraud.”

If you bought tickets to The Town 2025, the practical response here isn’t panic, it’s specific vigilance. A CPF can’t be reissued the way a password gets reset, so treat it as permanently exposed and check your credit record through Brazil’s Central Bank registry or services like Serasa for accounts you didn’t open. Watch closely for SIM swap attempts given the seller’s explicit mention of telecom fraud, and be skeptical of any inbound call or message referencing your actual festival purchase, since whoever holds this file knows exactly which days you attended and how you paid, more than enough detail to make a scam call sound completely legitimate.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, The Town 2025)

In a joint advisory released Thursday, the G7 Cyber Security Working Group and the U.S. Cybersecurity and Infrastructure Security Agency, CISA, said organizations should begin moving to post-quantum cryptography now.

Cybersecurity expert Ken Underhill reports from CrowdStrike on the disruption of the 20-year-old Sality botnet and what security teams need to know.

The post CrowdStrike Disrupts Sality Botnet After More Than 20 Years appeared first on TechRepublic.

Sealed court information and sensitive personal data were exposed in a breach of a Thomson Reuters records platform affecting courts in at least 12 U.S. states, the U.S. Virgin Islands and Canada.

Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court on Monday after being arrested in Cyprus in May 2025 and extradited to the U.S. last week.

The healthcare data company Aesto informed federal regulators this week that more than 9.5 million people had sensitive information leaked during a cyberattack last December.

The group, which calls itself VantaCore, has targeted at least seven known victims, Russian cybersecurity firm F6 said in a report published this week.

This week, hosts of N2K CyberWire ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ and⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ alongside ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up from Anne, who writes in to share how much she enjoys the show, how she used the “Shields Up” message with her coworkers, and—most importantly another chicken update! Maria covers a pair of MyChart scams that use fake medical results and bogus Medicare giveaways to steal credentials, personal information, and payment details. Joe looks at two scams—one targeting a business through a massive Amazon fraud scheme and another warning residents about fake invoices designed to steal their money. Dave explores the surprising value of simply replying to a wrong-number text, as scammers use responses to identify active phone numbers and find potential targets for increasingly sophisticated fraud campaigns. Our Catch of the Day promises a piece of a mysterious $25 million overpayment. All you have to do is reply with your phone number and your desired cut—what could possibly go wrong?

Aesto Health suffered a breach exposing personal and health data of more than 9.5 million people after attackers accessed its AWS infrastructure.

Aesto Health, a U.S. healthcare technology company, disclosed a data breach that exposed personal and health information belonging to more than 9.5 million people. The company discovered the incident on December 18, 2025, after attackers gained access to part of its Amazon Web Services infrastructure.

Aesto Health is a U.S. healthcare technology company based in Birmingham, Alabama. It helps healthcare providers manage and protect electronic health records and other legacy medical data. Its services include secure data migration, electronic health record (EHR) exchanges and long-term data archiving. Aesto works with medical practices and healthcare organizations that need to move, store or access patient information securely.

“On or about December 18, 2025, Aesto experienced a network security incident that impacted a limited portion of our Amazon Web Services infrastructure.” reads the Notice of Data Security Incident. “After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor.”

The company launched an investigation into the incident with external leading cybersecurity experts.

The network security incident affected part of its Amazon Web Services infrastructure between December 2 and 18, 2025. On May 26, 2026, Aesto confirmed that an unauthorized actor may have accessed or acquired protected health information stored in its network. Exposed data may include names, birth dates, medical and insurance information, driver’s license and government ID numbers, financial account details, taxpayer IDs and, for a limited number of people, Social Security numbers.

Aesto says it found no evidence of identity theft or financial fraud linked to the breach. Starting June 26, 2026, it notified affected healthcare clients whose patients’ data may have been accessed.

The company announced it has already implemented measures to strengthen security and set up a dedicated helpline for questions.

The healthcare firm also notified the US Department of Health and Human Services (HHS), reporting that the incident impacted 9540683 individuals.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Aesto Health)