Data breaches (3)

Chick-fil-A began notifying customers across 11 jurisdictions in late July after a credential-stuffing attack on its loyalty program between June 17 and 19. Thieves used usernames and passwords stolen from a third-party source to break into Chick-fil-A One accounts through the website and app. The company had concluded on July 13 that data may have been accessed.

Data that may have been accessed includes names, email addresses, membership numbers, Mobile Pay numbers, partial payment card digits, gift card balances, and QR codes. Customers who had saved more to their accounts may also have had their birth month and day, phone number, and address accessed.

Chick-fil-A calls it a limited number of accounts and hasn't given a total; filings show 2,182 in Texas and 39 in Massachusetts. It's the second credential-stuffing hit on Chick-fil-A One — an earlier one in 2023 reached more than 71,000 customers.

The company logged out affected users, removed stored payment methods, restored balances, and added rewards as compensation. Customers should reset their passwords and make them unique — reuse is what credential stuffing runs on — then check account activity. A law firm has been investigating a possible class action since early August.

Source: CBS News

Healthcare giant McKesson confirmed hackers stole customer data after discovering a breach on August 25. Attackers had been pulling data since the 21st. The company, which delivers roughly one-third of North American prescription medicines, said unauthorized access affected its Oncology & Multispecialty and Medical-Surgical business units — though it hasn't disclosed how many people were impacted.

The ShinyHunters extortion group is claiming responsibility, alleging they stole 284 million customer records including medical histories, prescriptions, billing data, and employee files. The group has since conceded that figure counts rows of raw data, not individual people, and that it hasn't finished going through what it took.

They're demanding around $55 million and threatening to publish everything unless McKesson opens payment negotiations by September 1 — that deadline expires today. McKesson hasn't engaged, says its services remain operational, and still hasn't determined how much data was taken. None of ShinyHunters' claims have been verified.

Source: SecurityWeek

Manchester Airports Group (MAG), which operates Manchester, East Midlands, and London Stansted, has confirmed a cyberattack that exposed the personal data of around 8.7 million customers. Hackers took contact details, vehicle registrations and postcodes over the weekend of August 22–23, then demanded a ransom for the data's return — which MAG refused to pay.

MAG only became aware on Tuesday, August 25, and says it cut off further access and notified affected customers. For the majority, the data was limited to the email address given when signing up to airport WiFi; the more detailed records came from car park, lounge, and fast-track bookings.

The hacked system didn't hold bank or payment card details, MAG says, and at no point was passenger safety or aviation security compromised. The group says it knows the hackers' identity and has informed the relevant authorities.

The Information Commissioner's Office has received MAG's breach report and says it is assessing the information provided. Affected customers should watch for suspicious emails, texts or calls, and avoid opening unknown attachments.

Source: BBC News

Australian authorities arrested two Western Australia men on Wednesday, August 26, over their alleged roles in TeamPCP, the cybercrime group that injected credential-stealing code into Aqua Security's Trivy scanner, Checkmarx KICS and LiteLLM in March. The AFP says that code potentially compromised more than 1,000 organizations worldwide.

Police didn't name the pair; Australian media identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23. Between them they face 14 charges, including four counts each of unauthorized modification of data with intent to commit a serious offence. Only Thomson faces a proceeds-of-crime count over $100,000 and a password-refusal charge.

The AFP estimates the code enabled theft of more than 500,000 credentials and at least 300GB of data, with global cleanup costs in the hundreds of millions. CERT-EU tied the European Commission's cloud breach to the poisoned Trivy release. Flare assesses with high confidence that Thomson led TeamPCP.

Both men appeared in Perth Magistrates Court on Thursday. Thomson withdrew a bail application after the magistrate signalled she would refuse it, and both remain in custody until September 18.

Source: CyberScoop

George House Trust, a Manchester-based HIV charity, has warned users that their sensitive health data may have been stolen by hackers. The breach, which occurred at the end of July, exposed personal details including addresses, phone numbers, and case notes about users' engagement with the charity.

The incident stems from a cyberattack on Beacon, a tech company whose database system is used by 1.5K+ UK charities. George House Trust was notified on 3 August but waited three weeks before alerting users. So far, no stolen data appears to have been misused. Investigations are ongoing.

Source: BBC News

A cyberattack hit Ceva Logistics on July 29, knocking out eight European warehouses and halting shipments. The French-headquartered logistics giant told corporate client Bol about the intrusion on August 1 — but the notices that reached consumers came from the retailers themselves, not from Ceva.

Several major organizations confirmed impact, including Dutch retailers Bol and De Bijenkorf, ING, Ace & Tate, Amsterdam's Ajax football club, and game company Valve. Exposed data includes names, addresses, phone numbers, emails and order details.

De Bijenkorf said no payment details, IBANs, card data, usernames or passwords were involved; Ceva never held Steam payment credentials either. Valve says Ceva keeps order records up to 90 days, and has warned customers to expect fake emails, texts, and calls about their hardware orders.

Who's behind the attack remains unknown. Ceva has not publicly disclosed the incident, responded to press enquiries, or said how the intruders got in or how many people are affected.

Source: SecurityWeek

Florida's Department of Health is reaching out to people affected by a June 26 cyberattack that exposed a wide range of sensitive personal data. We're talking names, Social Security numbers, banking details, medical history, medication and prescription information, military identification numbers, Nexus numbers, passwords, passport numbers — the works. The department has started mailing letters to those impacted with specifics on what was accessed.

To help, they've partnered with Kroll, an identity-monitoring firm, to provide free credit monitoring services. Law enforcement and cybersecurity experts are actively investigating. If you're a Florida Health Department client and haven't received a letter yet, it's worth keeping a close eye on your accounts.

Source: CBS News Miami

A Somerset NHS worker accessed up to 200 patient records without permission between August 2017 and October 2023, sharing screenshots of medical information with their partner. The breach at Musgrove Park Hospital included sensitive data — demographic details, A&E visits, and appointment records — and even led to a patient being contacted using a phone number taken from hospital files.

The worker resigned before facing disciplinary action and received only a police caution, with officers concluding the actions weren't malicious. Victims are furious. "She violated families, vulnerable people," one told the BBC. Privacy campaigners are now calling for automatic NHS App notifications whenever patient records are viewed.

Source: BBC News

The Cl0p ransomware gang has publicly named more than 40 organizations it claims to have breached through a vulnerability in PTC's Windchill and FlexPLM platforms. The flaw, CVE-2026-12569, allows unauthenticated remote code execution and was added to CISA's KEV catalog in June after active exploitation began.

High-profile alleged victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, and Apple lens supplier Largan Precision. GE was listed but has been removed from C10p's website— possibly signaling ransom negotiations. Stolen data ranges from 1 GB to several terabytes per organization, covering databases, engineering blueprints, and corporate documents. None of the named companies have confirmed a significant breach.

Source: SecurityWeek

A supply chain attack that exposed more than 2,000 organizations traces back to a compromised Trivy build — not LiteLLM, as initially reported. SOCRadar identified 2,188 organizations with attributable records and found 95% had their data collected before March 24, when the two poisoned LiteLLM releases appeared on PyPI for just 40 minutes.

The real damage started March 19, when TeamPCP force-pushed malicious commits to 76 of 77 trivy-action version tags, using access it had kept after an incomplete credential rotation — Aqua Security's own systems were never breached. Their Shai-Hulud worm harvested credentials, tokens, and API keys, then used stolen developer secrets to spread itself across accessible packages.

It all falls under CVE-2026-33634 — 8.8 high on CVSS v3.1, 9.4 critical on v4.0 — covering Trivy v0.69.4, trivy-action 0.0.1 through 0.34.2, setup-trivy 0.2.0 through 0.2.6, LiteLLM 1.82.7 to 1.82.8, and telnyx-python 4.87.1 to 4.87.2. CISA added it to KEV on March 26, with an April 9 deadline.

Six CI/CD platforms were hit — GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite — with Germany, Brazil, and France most affected. Stolen data is already up for sale on Telegram.

Source: SecurityWeek