Breaches
Rank Math PRO Updates Were Poisoned for 11 Hours. Any Site That Pulled One Is Owned.
A paid WordPress SEO plugin trusted on millions of sites shipped malicious updates for part of October 15 and 16. The backdoor rebuilds itself if you delete it.
UK Legal Aid Agency breach reaches back to 1978, far further than first thought
Follow-up analysis of the April hack puts around 250,000 records before 2007, with the oldest from 1978. The Ministry of Justice says nothing has turned up online yet.
Pentagon tells 3 million military personnel their records were stolen in nine-month breach
The Defense Manpower Data Center says attackers sat in its file-sharing systems from October 2025 to July 2026 before anyone noticed.
Army Soldier Gets 70 Months for AT&T Hack, Then Tried to Hack the Prison
Cameron Wagenius pleaded guilty to stealing call records for more than 100 million AT&T customers. Behind bars, he used other inmates' email accounts to prompt AI tools for exploit code.
How a poisoned coding library led to 170 private repos being copied at CrowdSec
A French security firm says a departing employee's laptop was infected through the TanStack npm supply-chain attack in May. The fallout reached its GitHub.
ShinyHunters Claims Theft of 200,000+ Florida Driver Records From State DMV System
The extortion crew says it abused a password-reset flaw in Florida's law-enforcement lookup tool, DAVID, and posted Jeffrey Epstein's record as proof.
Veradigm Confirms Patient Data Theft After Vendor Credentials Stolen; Ransomware Crew Claims 3.5 Million Records
The Chicago health-tech firm told the SEC that attackers used a vendor's login to a customer-service API. The Gentlemen ransomware group says it grabbed millions of patient records.
AdaptHealth Confirms 4.1 Million Patients Hit in Breach Tied to ShinyHunters
The home medical supplier says a contractor's account was tricked open in June, giving intruders a path into patient records across all 50 states.
Trezor's email system hijacked to send fake 'security alert' phishing to customers
Criminals used a breached third-party email provider to send phishing from a real Trezor address, weeks after a separate shipping-partner breach ballooned to 81,000 customers.
IDScan admits break-in after 153 million driver's license scans surface on dark web
The identity verification firm says an unauthorised party may have copied customer records from its cloud, days after a criminal marketplace advertised access to a huge trove of scanned IDs traced back to the company.
Surfshark Admits Hackers Reached Internal Test Server After Config Slip
The VPN provider says customer traffic and identities were untouched, but engineering credentials and build files sat exposed on the open internet for days.
Clinical trial files feared stolen in New Zealand health data breach
A cyber incident at Zenith Technology, a private company that runs clinical trials, has prompted a police investigation and a briefing to New Zealand's Health Minister.
Revolut handed customer passports and selfies to a scammer with a real-looking government email
The fintech says it fulfilled an information request that arrived from a genuine-looking government domain, exposing IDs, selfies and full transaction histories of what it calls a very limited number of customers.
Telus Customers Hit by Account Breach Spanning More Than a Year
Canada's second-largest phone company says criminals used stolen login details to break into customer accounts, access personal data, and in some cases quietly change people's phone plans.
Japan's Digital Agency says a VPN flaw leaked 246,000 staff records
A patchable bug in a remote-access box gave an attacker the keys to a government support system for weeks before anyone noticed.