Hacking group Crimson Collective was able to breach a self-managed GitLab instance used by the Red Hat consulting division, making off with about 570 GB of compressed data. The stolen data has since been seen for sale on Telegram channels.
Security researchers have discovered a publicly accessible Amazon S3 storage bucket that contains records of over 273,000 transfers taking place at banks in India, some of which have highly sensitive financial information in them.
The dangerous “ForcedLeak” flaw in Salesforce’s Agentforce platform has been addressed with a patch, plugging a hole that made it possible for attackers to exfiltrate sensitive data via a prompt injection.
The NYC SIM farm was thought to cost only a few million dollars in total, for rented apartments in five fairly expensive areas and 300 SIM boxes running about 100,000 SIM cards. Though there is no indication the operators had plans for terrorism, this setup would have been more than sufficient to overwhelm NYC phone towers or DDoS police and emergency communications.
Right in the midst of their 2025 reign of terror, the newly-united Scattered Spider and ShinyHunters ransomware groups are calling it quits. They have been joined in their retirement announcement by about a dozen other groups, including Lapsus$ and BreachForums operator InfoBroker.
Though the Trump administration has generally had a poor relationship with CISA, there was never any real intent to defund the CVE program and that getting new funding in place has only been a matter of contract issues and some sort of “workflow” problem.
Qantas has announced executive bonuses can now be docked by about 15% for major security lapses. CEO Vanessa Hudson will see AUD 250,000 taken back due to the data breach that exposed six million customer records.
Thus far about 700 Salesloft Drift customers are confirmed to have had OAuth tokens or some other access credential stolen in the attack, including some of the biggest names in cybersecurity.
Hackers compromised at least 17 organizations by using Claude AI chatbot to find vulnerabilities prioritized by likelihood of exploitation, and factoring in vulnerable technology type and the physical location as well as how much money can likely be extracted from ransom demands.
DOGE whistleblower report alleges improper handling and unnecessary risk of a testing copy of what is essentially all of the information available about American Social Security data on cloud server.