Ticker feed: Data breaches
For roughly five months, Revolut handed customer records to an attacker impersonating a government agency. The fraudulent legal requests went to Revolut Bank UAB, the Lithuanian subsidiary, from a compromised Italian Ministry of the Interior mailbox, which is why they cleared authentication and were processed as routine.
Hudson Rock traced the access to infostealer malware on a ministry employee's machine, and assesses the attacker probably bought those credentials rather than deploying the malware. The attacker, who uses the handle IAmNotAVillain, claims 680 accounts held by cryptocurrency whales, with files containing passports, verification selfies, and full Bitcoin transaction histories. Revolut has still not confirmed a victim count.
The extortion came next. An initial demand of 10,000 Bitcoin, around $780 million, was cut to 6,000 Monero, roughly $3 million, with a 24-hour deadline to sell the files to other criminal groups. Revolut says it has had no direct contact from anyone making the claims, and notified affected customers on September 12.
Source: SecurityWeek
For roughly five months, Revolut handed customer records to an attacker impersonating a government agency. The fraudulent legal requests went to Revolut Bank UAB, the Lithuanian subsidiary, from a compromised Italian Ministry of the Interior mailbox, which is why they cleared authentication and were processed as routine.
Hudson Rock traced the access to infostealer malware on a ministry employee's machine, and assesses the attacker probably bought those credentials rather than deploying the malware. The attacker, who uses the handle IAmNotAVillain, claims 680 accounts held by cryptocurrency whales, with files containing passports, verification selfies, and full Bitcoin transaction histories. Revolut has still not confirmed a victim count.
The extortion came next. An initial demand of 10,000 Bitcoin, around $780 million, was cut to 6,000 Monero, roughly $3 million, with a 24-hour deadline to sell the files to other criminal groups. Revolut says it has had no direct contact from anyone making the claims, and notified affected customers on September 12.
Source: SecurityWeek
Malicious releases across 42 @tanstack npm packages, published May 11, harvested GitHub tokens, SSH keys, and cloud credentials from developer machines. One belonged to a CrowdSec developer who had just left, whose access the company kept open so he could finish outstanding work. On May 22 an attacker used his OAuth token to clone roughly 170 private repositories from a Toronto IP address in nine minutes.
CrowdSec revoked the account on May 25, three days after the clone, and learned of the theft only on September 16, when the code appeared on a breach forum. The archive held the SaaS console, data-science models, deployment tools, email addresses for 83 users — under 0.05% of its user base — and names and investment details for 51 potential investors from 2020.
Production systems, databases, and the CrowdSec agent and blocklist data were untouched, and no code was altered. The one live credential was an AWS token scoped to a single SNS topic, probed on August 17 and taken no further. CrowdSec's own lesson is blunt: multi-factor authentication cannot stop malware that already holds a valid token, and only enterprise GitHub plans retain git activity, on a rolling seven-day window.
Source: Cybersecurity News
Malicious releases across 42 @tanstack npm packages, published May 11, harvested GitHub tokens, SSH keys, and cloud credentials from developer machines. One belonged to a CrowdSec developer who had just left, whose access the company kept open so he could finish outstanding work. On May 22 an attacker used his OAuth token to clone roughly 170 private repositories from a Toronto IP address in nine minutes.
CrowdSec revoked the account on May 25, three days after the clone, and learned of the theft only on September 16, when the code appeared on a breach forum. The archive held the SaaS console, data-science models, deployment tools, email addresses for 83 users — under 0.05% of its user base — and names and investment details for 51 potential investors from 2020.
Production systems, databases, and the CrowdSec agent and blocklist data were untouched, and no code was altered. The one live credential was an AWS token scoped to a single SNS topic, probed on August 17 and taken no further. CrowdSec's own lesson is blunt: multi-factor authentication cannot stop malware that already holds a valid token, and only enterprise GitHub plans retain git activity, on a rolling seven-day window.
Source: Cybersecurity News
A threat actor posted a 2.5 GB archive on a cybercrime forum on September 12, claiming it holds 7.49 million records belonging to CenterPoint Energy customers. The listing cites names, contact and billing details, move-in dates, driver's license information, and the last four digits of Social Security numbers, and says the data came from a poorly secured API.
CenterPoint's Form 8-K confirms far less. An unauthorized third party obtained personal information relating to a portion of its customers through an external-facing system. The Houston utility serves around 7 million customers in Texas, Indiana, Minnesota, and Ohio, so the claimed record count exceeds its entire customer base. Nobody has verified the archive.
Gas and electricity delivery are unaffected, and CenterPoint does not expect a material financial impact. The company is still working with outside experts to determine scope, and intends to notify affected customers and regulators. The poster also threatened to move from stealing data to attacking the main infrastructure.
Source: SecurityWeek
A threat actor posted a 2.5 GB archive on a cybercrime forum on September 12, claiming it holds 7.49 million records belonging to CenterPoint Energy customers. The listing cites names, contact and billing details, move-in dates, driver's license information, and the last four digits of Social Security numbers, and says the data came from a poorly secured API.
CenterPoint's Form 8-K confirms far less. An unauthorized third party obtained personal information relating to a portion of its customers through an external-facing system. The Houston utility serves around 7 million customers in Texas, Indiana, Minnesota, and Ohio, so the claimed record count exceeds its entire customer base. Nobody has verified the archive.
Gas and electricity delivery are unaffected, and CenterPoint does not expect a material financial impact. The company is still working with outside experts to determine scope, and intends to notify affected customers and regulators. The poster also threatened to move from stealing data to attacking the main infrastructure.
Source: SecurityWeek
A likely Russian-speaking threat actor used hundreds of AI agents to exploit two PaperCut NG/MF zero-days disclosed on August 27. CVE-2026-82078 allows unsafe dynamic class loading and is rated CVSS 9.4 (Critical); CVE-2026-81578 bypasses authentication at CVSS 8.8 (High). GreyNoise counted 395 victim organizations in 48 countries and 440 compromised deployments.
Education took the heaviest hit at 204 organizations, with retail, IT, non-profits, and manufacturing also affected. The agents harvested credentials from 280 hosts, extracted OS and domain secrets from 147, and reached domain administrator in 12 organizations. Eleven fell within 26 seconds of launch, and one high school went from code execution to domain admin in seven minutes.
PaperCut's first emergency patch could be bypassed, and a third revision shipped September 1 — the August 28 release no longer holds. CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. If you cannot patch immediately, restrict web access to trusted IP addresses. Rotate credentials on any server that was exposed.
Source: SecurityWeek
A likely Russian-speaking threat actor used hundreds of AI agents to exploit two PaperCut NG/MF zero-days disclosed on August 27. CVE-2026-82078 allows unsafe dynamic class loading and is rated CVSS 9.4 (Critical); CVE-2026-81578 bypasses authentication at CVSS 8.8 (High). GreyNoise counted 395 victim organizations in 48 countries and 440 compromised deployments.
Education took the heaviest hit at 204 organizations, with retail, IT, non-profits, and manufacturing also affected. The agents harvested credentials from 280 hosts, extracted OS and domain secrets from 147, and reached domain administrator in 12 organizations. Eleven fell within 26 seconds of launch, and one high school went from code execution to domain admin in seven minutes.
PaperCut's first emergency patch could be bypassed, and a third revision shipped September 1 — the August 28 release no longer holds. CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. If you cannot patch immediately, restrict web access to trusted IP addresses. Rotate credentials on any server that was exposed.
Source: SecurityWeek
Revolut has confirmed a data breach that exposed highly sensitive customer information — not through a system hack, but because someone tricked the company into handing it over. Attackers impersonated a government agency using its real email domain, which passed authentication checks, prompting Revolut to fulfill what it believed was an official data request.
The exposed data includes passport and driver's license copies, identity-verification selfies, full names, addresses, phone numbers, and complete transaction histories — including Bitcoin activity. Credentials, passcodes, and biometric face templates were not taken. No core systems or customer funds were compromised, Revolut says.
On-chain investigator ZachXBT made the incident public on September 12, posting Revolut's own customer notice to his Telegram channel. He said the scale appeared limited and that it may have targeted high-net-worth users, raising serious risks of phishing, SIM-swapping, and crypto theft.
Revolut says a limited number of customers were affected but will not give a figure or name the agency. Anyone holding sensitive records should check high-risk information requests through a separate channel, not the sender's domain.
Source: Cybersecurity News
Revolut has confirmed a data breach that exposed highly sensitive customer information — not through a system hack, but because someone tricked the company into handing it over. Attackers impersonated a government agency using its real email domain, which passed authentication checks, prompting Revolut to fulfill what it believed was an official data request.
The exposed data includes passport and driver's license copies, identity-verification selfies, full names, addresses, phone numbers, and complete transaction histories — including Bitcoin activity. Credentials, passcodes, and biometric face templates were not taken. No core systems or customer funds were compromised, Revolut says.
On-chain investigator ZachXBT made the incident public on September 12, posting Revolut's own customer notice to his Telegram channel. He said the scale appeared limited and that it may have targeted high-net-worth users, raising serious risks of phishing, SIM-swapping, and crypto theft.
Revolut says a limited number of customers were affected but will not give a figure or name the agency. Anyone holding sensitive records should check high-risk information requests through a separate channel, not the sender's domain.
Source: Cybersecurity News
Two of the biggest names on IDScan.net's customer list say they are not part of the breach that put 153 million driver's license scans on a dark web marketplace. The Louisiana identity verification firm confirmed on September 4 that data may have been accessed without authorization, after journalist Brian Krebs found the trove for sale on a site called Nexus.
Target told CNET it uses some IDScan hardware but did not transmit customer data to the company, and that no Target customer data was involved. Caesars Entertainment told Krebs on September 2 that it has not been a client, has not used the VeriScan product since February 2025, and did not authorize data retention. Both appeared on IDScan's own website.
That roster is doing real work. IDScan has not said how many people are affected, so its published client list is what everyone is using to size the fallout: Hertz, FedEx, GameStop, Motorola Solutions, Jack Henry, and more than 1,000 dispensaries, car rental agencies, and gun shops across 19 states.
Scale is not in doubt. IDScan scanned 150 million IDs in 2024 alone, and the listing advertised 153 million licenses alongside 10 million ID cards and 3 million travel documents. The FBI's New Orleans field office is still investigating, and IDScan is offering free credit monitoring on 1-833-516-2980.
Source: CNET
Two of the biggest names on IDScan.net's customer list say they are not part of the breach that put 153 million driver's license scans on a dark web marketplace. The Louisiana identity verification firm confirmed on September 4 that data may have been accessed without authorization, after journalist Brian Krebs found the trove for sale on a site called Nexus.
Target told CNET it uses some IDScan hardware but did not transmit customer data to the company, and that no Target customer data was involved. Caesars Entertainment told Krebs on September 2 that it has not been a client, has not used the VeriScan product since February 2025, and did not authorize data retention. Both appeared on IDScan's own website.
That roster is doing real work. IDScan has not said how many people are affected, so its published client list is what everyone is using to size the fallout: Hertz, FedEx, GameStop, Motorola Solutions, Jack Henry, and more than 1,000 dispensaries, car rental agencies, and gun shops across 19 states.
Scale is not in doubt. IDScan scanned 150 million IDs in 2024 alone, and the listing advertised 153 million licenses alongside 10 million ID cards and 3 million travel documents. The FBI's New Orleans field office is still investigating, and IDScan is offering free credit monitoring on 1-833-516-2980.
Source: CNET
A dark web identity theft service called Nexus began selling digital scans of more than 153 million US and Canadian driver's licenses in the week of August 31, 2026, most of them American. The FBI's New Orleans field office opened an investigation on September 1, and the site went dark hours later.
Investigative journalist Brian Krebs found his own license listed, then asked more than a dozen friends and family for permission to search. All nine he found confirmed traveling on or near the timestamps attached to their images. The common thread was Hertz car rentals, plus a Las Vegas dispensary in one case.
Both point to IDScan.net, a Louisiana identity verification firm that lists Hertz as a client and holds an exclusive agreement with that dispensary chain. IDScan scans IDs with infrared and ultraviolet light, and the Nexus records include infrared and ultraviolet versions of each license.
IDScan.net says it is investigating and has issued no statement. Nexus operators claim a year of continuous exfiltration, and the license count grew by nearly 400,000 in a single day. Licenses for Defense Secretary Pete Hegseth and the FBI's assistant director were among those listed.
NCC Group's Tim Rawlins says organizations should design identity systems assuming that identity evidence will eventually be compromised, and should hold identity vendors to contract terms covering retention, incident notification, and independent assurance.
Source: SecurityWeek
A dark web identity theft service called Nexus began selling digital scans of more than 153 million US and Canadian driver's licenses in the week of August 31, 2026, most of them American. The FBI's New Orleans field office opened an investigation on September 1, and the site went dark hours later.
Investigative journalist Brian Krebs found his own license listed, then asked more than a dozen friends and family for permission to search. All nine he found confirmed traveling on or near the timestamps attached to their images. The common thread was Hertz car rentals, plus a Las Vegas dispensary in one case.
Both point to IDScan.net, a Louisiana identity verification firm that lists Hertz as a client and holds an exclusive agreement with that dispensary chain. IDScan scans IDs with infrared and ultraviolet light, and the Nexus records include infrared and ultraviolet versions of each license.
IDScan.net says it is investigating and has issued no statement. Nexus operators claim a year of continuous exfiltration, and the license count grew by nearly 400,000 in a single day. Licenses for Defense Secretary Pete Hegseth and the FBI's assistant director were among those listed.
NCC Group's Tim Rawlins says organizations should design identity systems assuming that identity evidence will eventually be compromised, and should hold identity vendors to contract terms covering retention, incident notification, and independent assurance.
Source: SecurityWeek
The Minnesota Supreme Court, Court of Appeals, Tax Court, and Court of Administrative Hearings all had user data compromised in a breach at their vendor, Thomson Reuters Court Management Solutions. Attackers were inside the C-Track case management platform from March 1 until June 29, and Thomson Reuters only discovered the intrusion on June 30.
The exposed backup data may include names alongside Social Security numbers, driver's license numbers, dates of birth, medical information and health insurance details. Case documents such as orders and briefs were not affected, and Minnesota courts are operating normally. Chief Justice Natalie Hudson called the compromise deeply troubling.
Minnesota's judicial branch has cut Thomson Reuters' access to court information. Every Minnesota C-Track user has to reset their password — old credentials will lock the account — and affected individuals are being offered 12 months of credit monitoring.
This reaches well past Minnesota. Courts in at least eleven other states, the U.S. Virgin Islands and Ontario, Canada were caught in the same intrusion, which Thomson Reuters says happened inside its own environment rather than the courts' systems. Investigators are still working out what was taken.
Source: CBS News Minnesota
The Minnesota Supreme Court, Court of Appeals, Tax Court, and Court of Administrative Hearings all had user data compromised in a breach at their vendor, Thomson Reuters Court Management Solutions. Attackers were inside the C-Track case management platform from March 1 until June 29, and Thomson Reuters only discovered the intrusion on June 30.
The exposed backup data may include names alongside Social Security numbers, driver's license numbers, dates of birth, medical information and health insurance details. Case documents such as orders and briefs were not affected, and Minnesota courts are operating normally. Chief Justice Natalie Hudson called the compromise deeply troubling.
Minnesota's judicial branch has cut Thomson Reuters' access to court information. Every Minnesota C-Track user has to reset their password — old credentials will lock the account — and affected individuals are being offered 12 months of credit monitoring.
This reaches well past Minnesota. Courts in at least eleven other states, the U.S. Virgin Islands and Ontario, Canada were caught in the same intrusion, which Thomson Reuters says happened inside its own environment rather than the courts' systems. Investigators are still working out what was taken.
Source: CBS News Minnesota
8.7 million people are at risk after hackers breached Manchester Airports Group (MAG) — operator of Manchester, Stansted, and East Midlands airports — and published the stolen data for free. FulcrumSec extorted MAG for an undisclosed sum, failed to get paid, and dumped half a terabyte in response: "every byte of it is pure PII," the gang wrote.
HaveIBeenPwned indexed the dump within a day — names, emails, phone numbers, IP addresses, and 108,000 vehicle plates among them. Unlike most leak sites, this one sits on the open internet rather than the dark web, so anyone can reach it.
Security researcher Kevin Beaumont warned that wealthy or high-profile people face particular risk: the files map where customers have been and where they're going next, including some 190,000 upcoming bookings. MAG says it contacted those travelers separately. Everyone else should expect scammers who know their phone number and car registration.
FulcrumSec says it got in the same way it hit Arup and Novo Nordisk: admin keys to Iterable, MAG's marketing platform, left in the airport websites' JavaScript. "Any of the millions of visitors to the site could have right-clicked 'inspect' and seen the keys," the gang wrote. MAG hasn't confirmed it.
Source: BBC News
8.7 million people are at risk after hackers breached Manchester Airports Group (MAG) — operator of Manchester, Stansted, and East Midlands airports — and published the stolen data for free. FulcrumSec extorted MAG for an undisclosed sum, failed to get paid, and dumped half a terabyte in response: "every byte of it is pure PII," the gang wrote.
HaveIBeenPwned indexed the dump within a day — names, emails, phone numbers, IP addresses, and 108,000 vehicle plates among them. Unlike most leak sites, this one sits on the open internet rather than the dark web, so anyone can reach it.
Security researcher Kevin Beaumont warned that wealthy or high-profile people face particular risk: the files map where customers have been and where they're going next, including some 190,000 upcoming bookings. MAG says it contacted those travelers separately. Everyone else should expect scammers who know their phone number and car registration.
FulcrumSec says it got in the same way it hit Arup and Novo Nordisk: admin keys to Iterable, MAG's marketing platform, left in the airport websites' JavaScript. "Any of the millions of visitors to the site could have right-clicked 'inspect' and seen the keys," the gang wrote. MAG hasn't confirmed it.
Source: BBC News
Chick-fil-A began notifying customers across 11 jurisdictions in late July after a credential-stuffing attack on its loyalty program between June 17 and 19. Thieves used usernames and passwords stolen from a third-party source to break into Chick-fil-A One accounts through the website and app. The company had concluded on July 13 that data may have been accessed.
Data that may have been accessed includes names, email addresses, membership numbers, Mobile Pay numbers, partial payment card digits, gift card balances, and QR codes. Customers who had saved more to their accounts may also have had their birth month and day, phone number, and address accessed.
Chick-fil-A calls it a limited number of accounts and hasn't given a total; filings show 2,182 in Texas and 39 in Massachusetts. It's the second credential-stuffing hit on Chick-fil-A One — an earlier one in 2023 reached more than 71,000 customers.
The company logged out affected users, removed stored payment methods, restored balances, and added rewards as compensation. Customers should reset their passwords and make them unique — reuse is what credential stuffing runs on — then check account activity. A law firm has been investigating a possible class action since early August.
Source: CBS News
Chick-fil-A began notifying customers across 11 jurisdictions in late July after a credential-stuffing attack on its loyalty program between June 17 and 19. Thieves used usernames and passwords stolen from a third-party source to break into Chick-fil-A One accounts through the website and app. The company had concluded on July 13 that data may have been accessed.
Data that may have been accessed includes names, email addresses, membership numbers, Mobile Pay numbers, partial payment card digits, gift card balances, and QR codes. Customers who had saved more to their accounts may also have had their birth month and day, phone number, and address accessed.
Chick-fil-A calls it a limited number of accounts and hasn't given a total; filings show 2,182 in Texas and 39 in Massachusetts. It's the second credential-stuffing hit on Chick-fil-A One — an earlier one in 2023 reached more than 71,000 customers.
The company logged out affected users, removed stored payment methods, restored balances, and added rewards as compensation. Customers should reset their passwords and make them unique — reuse is what credential stuffing runs on — then check account activity. A law firm has been investigating a possible class action since early August.
Source: CBS News
