The “RockYou” files collect and organize existing password leaks. The new 1.5 billion entries, at least what amount of that is made up of valid data, appear to come from breaches that were dumped to the dark web between 2021 and this year.
The current data breach exposed the customer records for domestic calls and messages of about 110 million AT&T customers, or about the number of subscribers the company has in the United States.
The Justice Department says that it has taken down a bot farm run by RT for disinformation campaigns, seizing two domain names and 968 X accounts used to spread these posts.
A backup carrier for cloud-based communications platform Twilio was found to have an AWS S3 bucket open to the internet for several days, exposing “SMS-related” data including millions of one-time client passwords.
Hackers responsible for the Ticketmaster hack has released 39,000 more print-at-home concert tickets, and has promised to release millions more if not paid a ransom. Some 166,000 concert tickets for the extremely popular Taylor Swift tour has already been leaked last month.
Following a refusal by the Indonesian government to pay an $8 million ransom demand, Brain Cipher has provided the ransomware decryptor along with a request for donations.
Shinyhunters has offered 33 million stolen phone numbers for sale. Twilio has since confirmed the Authy data breach and that the leak occurred due to an improperly secured API endpoint.
If ACMA had its way, penalties could go as high as $900 million for the Optus data breach. All of that will hinge on a court’s decision on the company’s handling of a coding error in the access control of an API that lingered for years before being exploited.
The skeleton key approach gets its moniker from its ability to work across multiple LLMs, with the same jailbreak statement or one that is only slightly modified. The ball is now in the courts of the developers of AI models to stop it.
The current OpenSSH vulnerability is the discovery of security researchers and not yet in the wild, but it is expected that threat actors will figure it out before long. The issue would provide an attacker with RCE ability and should be addressed immediately.