The company has disclosed exposure of customer files uploaded to the Okta support system. The security breach took place near the start of October and the window may have been open for most of the first half of the month.
Media conglomerate News Corp has reported that a security breach first discovered in early 2022 stretches back to February 2020 and impacted a broad array of the company’s subsidiaries. Attackers believed to be a state-backed Chinese cyber espionage team.
Security breach of Riot Games targeted source code for governing game cheats for League of Legends and Teamfight Tactics. Source code of League of Legends itself auctioned at starting price of $1 million.
A wide range of products across the GoTo ecosystem have been compromised, and customers have been left to wonder if their data has been exposed after encrypted backups were taken along with an encryption key that the company says provides access to “a portion” of the stolen data.
Another security breach has impacted over a hundred Mailchimp customers. Social engineering was used to gain access to the company’s customer support tools similar to prior attacks.
CircleCI customers have been advised to rotate secrets as a major security breach appears to have given attackers access to a broad variety of authentication credentials.
It is not clear exactly what sort of source code was taken from the GitHub repositories during the security breach, but Slack says that it was not part of the primary codebase.
Security breach was traced back to an employee that followed a phishing link to a bogus login page and entered their credentials on October 13. The attackers then took the credentials and used them to raid some 130 GitHub repositories belonging to Dropbox.
The immediate danger to LastPass users from this security breach is, fortunately, minimal. The password manager stores each user’s master password on their own local device, preventing a server compromise from exposing it.
Twitter says that the security breach occurred in December 2021, but was not public knowledge until July 21 of this year. An attacker using a zero-day was able to capture phone numbers and email addresses from anonymous accounts.