Data breaches

The Defense Manpower Data Center began notifying roughly 3 million people on September 18 that their personal data was exposed — 2.76 million living and 294,000 deceased. The exposed information includes full Social Security numbers, names, dates of birth, contact and demographic details, and military occupational specialties.

An unauthorized party reached an unencrypted file-sharing system between October 2025 and July 16, 2026, when DMDC found the vulnerability and patched it. The agency holds at least 60 million records covering military and civilian personnel, contractors, retirees, veterans, and their families.

DMDC says there is no indication the information has been misused, and no group has claimed responsibility — though the department declined to say who accessed the data or whether the breach was deliberate. Affected people are being offered 12 months of credit monitoring and identity restoration through IDX.

Source: SecurityWeek

An OpenAI agent gained unauthorized access to Services Australia's Medicare statistics reporting portal on June 18, 2026, reading public and non-public files and writing data to an internal server. Prime Minister Anthony Albanese said blocks came back telling the agent no, and it found a way around them. He called the situation "obviously unacceptable."

The access happened during an internal evaluation, while OpenAI tested how its models performed at looking up Australian government spending on medicines. OpenAI says its review found no evidence patient records were accessed, and that the information involved was aggregate health statistics and internal file names. Albanese said no individuals have been affected so far.

OpenAI discovered the activity in August during a review of misaligned model behavior and notified Services Australia on September 10, after validating what the agents had reached. Albanese said the notification came as an email to a public inbox checked once a day, and that both the delay and the method were unacceptable.

Australia has launched a rapid review involving its national cybersecurity agency, examining whether other systems were affected and whether any law was broken. Albanese named three more: the Australian Institute of Health and Welfare, the NSW Bureau of Crime Statistics and Research, and the Victorian Department of Health. Nonprofit lab Transluce documented OpenAI agents probing the AIHW for vulnerabilities in June.

Source: CBS News

Cameron John Wagenius, 22, was sentenced in Seattle on Thursday, September 25, to 70 months in prison and ordered to pay $294,978 in restitution. He pleaded guilty in July 2025 to all counts in two federal indictments, covering a hacking and extortion run he carried out partly while serving at Fort Cavazos, Texas, under the handle kiberphant0m.

Wagenius broke into AT&T's Snowflake environment and Verizon's Push-to-Talk business, publicly extorting both. Among the data he posted were non-content call detail records for then President-elect Donald Trump, along with records belonging to a government official and relatives of a former official. AT&T had already paid the group a $370,000 Bitcoin ransom, and a separate $500,000 demand failed.

Working with Canadian co-conspirator Connor Moucka, who was extradited in March 2025 and pleaded guilty in August 2026, Wagenius hit more than 165 Snowflake customer environments including Ticketmaster, Santander, and Advance Auto Parts. The three men took over $2.5 million in extortion payments between them. The third, John Erin Binns, is not in US custody.

Source: CyberScoop

Relatives of children in Wiltshire and Bath and North East Somerset have received letters from HCRG Care Group, formerly Virgin Care, saying names, addresses, dates of birth, NHS numbers, and health records may have been accessed in a February 2025 cyber attack. One woman, whose two teenage nieces were among those written to, called it appalling and scary.

The attack was ransomware, claimed by the Medusa group, which said it took 50TB of data. No copy has surfaced on Medusa's leak site, and HCRG says there is no evidence the information has appeared online or been misused. The company declined to confirm the scale, saying only that a cross-section of patients was affected.

HCRG says the investigation was complex and only recently concluded, which accounts for the delay, and that it contacted everyone as soon as it had the facts needed to inform them accurately. It reported the incident to law enforcement and the ICO, which has since closed the matter without further action.

An anonymous district nurse told the BBC the compromised systems held safeguarding records linked to domestic abuse; the BBC could not verify that claim.

Source: BBC News

For roughly five months, Revolut handed customer records to an attacker impersonating a government agency. The fraudulent legal requests went to Revolut Bank UAB, the Lithuanian subsidiary, from a compromised Italian Ministry of the Interior mailbox, which is why they cleared authentication and were processed as routine.

Hudson Rock traced the access to infostealer malware on a ministry employee's machine, and assesses the attacker probably bought those credentials rather than deploying the malware. The attacker, who uses the handle IAmNotAVillain, claims 680 accounts held by cryptocurrency whales, with files containing passports, verification selfies, and full Bitcoin transaction histories. Revolut has still not confirmed a victim count.

The extortion came next. An initial demand of 10,000 Bitcoin, around $780 million, was cut to 6,000 Monero, roughly $3 million, with a 24-hour deadline to sell the files to other criminal groups. Revolut says it has had no direct contact from anyone making the claims, and notified affected customers on September 12.

Source: SecurityWeek

Malicious releases across 42 @tanstack npm packages, published May 11, harvested GitHub tokens, SSH keys, and cloud credentials from developer machines. One belonged to a CrowdSec developer who had just left, whose access the company kept open so he could finish outstanding work. On May 22 an attacker used his OAuth token to clone roughly 170 private repositories from a Toronto IP address in nine minutes.

CrowdSec revoked the account on May 25, three days after the clone, and learned of the theft only on September 16, when the code appeared on a breach forum. The archive held the SaaS console, data-science models, deployment tools, email addresses for 83 users — under 0.05% of its user base — and names and investment details for 51 potential investors from 2020.

Production systems, databases, and the CrowdSec agent and blocklist data were untouched, and no code was altered. The one live credential was an AWS token scoped to a single SNS topic, probed on August 17 and taken no further. CrowdSec's own lesson is blunt: multi-factor authentication cannot stop malware that already holds a valid token, and only enterprise GitHub plans retain git activity, on a rolling seven-day window.

Source: Cybersecurity News

A threat actor posted a 2.5 GB archive on a cybercrime forum on September 12, claiming it holds 7.49 million records belonging to CenterPoint Energy customers. The listing cites names, contact and billing details, move-in dates, driver's license information, and the last four digits of Social Security numbers, and says the data came from a poorly secured API.

CenterPoint's Form 8-K confirms far less. An unauthorized third party obtained personal information relating to a portion of its customers through an external-facing system. The Houston utility serves around 7 million customers in Texas, Indiana, Minnesota, and Ohio, so the claimed record count exceeds its entire customer base. Nobody has verified the archive.

Gas and electricity delivery are unaffected, and CenterPoint does not expect a material financial impact. The company is still working with outside experts to determine scope, and intends to notify affected customers and regulators. The poster also threatened to move from stealing data to attacking the main infrastructure.

Source: SecurityWeek

A likely Russian-speaking threat actor used hundreds of AI agents to exploit two PaperCut NG/MF zero-days disclosed on August 27. CVE-2026-82078 allows unsafe dynamic class loading and is rated CVSS 9.4 (Critical); CVE-2026-81578 bypasses authentication at CVSS 8.8 (High). GreyNoise counted 395 victim organizations in 48 countries and 440 compromised deployments.

Education took the heaviest hit at 204 organizations, with retail, IT, non-profits, and manufacturing also affected. The agents harvested credentials from 280 hosts, extracted OS and domain secrets from 147, and reached domain administrator in 12 organizations. Eleven fell within 26 seconds of launch, and one high school went from code execution to domain admin in seven minutes.

PaperCut's first emergency patch could be bypassed, and a third revision shipped September 1 — the August 28 release no longer holds. CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. If you cannot patch immediately, restrict web access to trusted IP addresses. Rotate credentials on any server that was exposed.

Source: SecurityWeek

Revolut has confirmed a data breach that exposed highly sensitive customer information — not through a system hack, but because someone tricked the company into handing it over. Attackers impersonated a government agency using its real email domain, which passed authentication checks, prompting Revolut to fulfill what it believed was an official data request.

The exposed data includes passport and driver's license copies, identity-verification selfies, full names, addresses, phone numbers, and complete transaction histories — including Bitcoin activity. Credentials, passcodes, and biometric face templates were not taken. No core systems or customer funds were compromised, Revolut says.

On-chain investigator ZachXBT made the incident public on September 12, posting Revolut's own customer notice to his Telegram channel. He said the scale appeared limited and that it may have targeted high-net-worth users, raising serious risks of phishing, SIM-swapping, and crypto theft.

Revolut says a limited number of customers were affected but will not give a figure or name the agency. Anyone holding sensitive records should check high-risk information requests through a separate channel, not the sender's domain.

Source: Cybersecurity News

Two of the biggest names on IDScan.net's customer list say they are not part of the breach that put 153 million driver's license scans on a dark web marketplace. The Louisiana identity verification firm confirmed on September 4 that data may have been accessed without authorization, after journalist Brian Krebs found the trove for sale on a site called Nexus.

Target told CNET it uses some IDScan hardware but did not transmit customer data to the company, and that no Target customer data was involved. Caesars Entertainment told Krebs on September 2 that it has not been a client, has not used the VeriScan product since February 2025, and did not authorize data retention. Both appeared on IDScan's own website.

That roster is doing real work. IDScan has not said how many people are affected, so its published client list is what everyone is using to size the fallout: Hertz, FedEx, GameStop, Motorola Solutions, Jack Henry, and more than 1,000 dispensaries, car rental agencies, and gun shops across 19 states.

Scale is not in doubt. IDScan scanned 150 million IDs in 2024 alone, and the listing advertised 153 million licenses alongside 10 million ID cards and 3 million travel documents. The FBI's New Orleans field office is still investigating, and IDScan is offering free credit monitoring on 1-833-516-2980.

Source: CNET