Kadokawa
June 28, 2024
•[ ransomware, leak, malware ]
Japanese media giant Kadokawa confirms that some of its data was leaked in a ransomware attack early June 2024. The BlackSuit ransomware gang claims responsibility for the attack.
Landmark Admin
June 27, 2024
•[ leak, finance ]
Life insurance company Landmark Admin sends notifications to an unknown number of individuals about a data breach impacting personal, medical, and insurance information.
SpyX
June 24, 2024
•[ leak, malware, technology ]
In June 2024, spyware maker SpyX suffered a data breach that exposed almost 2M unique email addresses. The breach also exposed IP addresses, countries of residence, device information and 6-digit PINs in the password field. Further, a collection of iCloud credentials likely used to monitor targets directly via the cloud were also in the breach and contained the target's email address and plain text Apple password.
Jollibee Group
June 23, 2024
•[ leak, retail ]
The Jollibee Group begins investigates a cybersecurity incident that may have compromised the records of millions of customers.
Zacks (2024)
June 22, 2024
•[ leak, finance ]
In June 2024, the investment research company Zacks was allegedly breached, and data was later published to a popular hacking forum. This comes after a separate Zacks data breach confirmed by the organisation in 2023 with the subsequent breach disclosing millions of additional records representing a superset of data from the first incident. The 2024 breach included 12M unique email addresses along with IP and physical addresses, names, usernames, phone numbers and unsalted SHA-256 password hashes. Zacks did not respond to multiple attempts to contact them about the incident.
Undisclosed third-party of Accenture
June 20, 2024
•[ leak, misconfiguration, technology ]
A threat actor named '888' claims to have extracted contact details of 33,000 current and former employees of Accenture in a breach that involves a third-party firm.
Z-lib
June 20, 2024
•[ leak, misconfiguration, technology ]
In June 2024, almost 10M user records from Z-lib were discovered exposed online. Now defunct, Z-lib was a malicious clone of Z-Library, a well-known shadow online platform for pirating books and academic papers. The exposed data included usernames, email addresses, countries of residence, Bitcoin and Monero cryptocurrency wallet addresses, purchases and bcrypt password hashes.
Maxicare
June 16, 2024
•[ leak, healthcare ]
The health maintenance organization (HMO) Maxicare reports a data breach affecting the personal information of some 13,000 members.
Keytronic
June 14, 2024
•[ ransomware, leak, malware ]
PCBA manufacturing giant Keytronic warns it suffered a data breach after the Black Basta ransomware gang leaked 530GB of the company's stolen data two weeks ago.
Gramercy Surgery Center
June 14, 2024
•[ leak, healthcare ]
The threat actor(s) known as Everest Team add Gramercy Surgery Center (Gramercy) to its leak site, and claims to have acquired more than 460 GB of files.
Truist Bank
June 13, 2024
•[ hack, leak, finance ]
Truist Bank, a leading U.S. commercial bank, confirms this week that its systems were breached in an October 2023 cyberattack after a threat actor posted some of the company's data for sale on a hacking forum.
mSpy (2024)
June 9, 2024
•[ hack, leak, technology ]
In June 2024, a huge trove of data from spyware maker mSpy was obtained by hacktivists and published online. Comprising of 142GB of user data and support tickets along with 176GB of more than half a million attachments, the data contained 2.4M unique email addresses, IP addresses names and photos. The data was predominantly support tickets seeking help to install the spyware on target devices, whilst the attachments contained various data including screen grans of financial transactions, photos of credit cards and nude selfies.
New York Times
June 8, 2024
•[ leak, misconfiguration, technology ]
The New York Times confirms that internal source code and data was leaked on the 4chan message board after being stolen from the company's GitHub repositories in January 2024.
CoinGecko
June 7, 2024
•[ leak, finance ]
CoinGecko, the worlds largest independent cryptocurrency data aggregator, experiences a data breach through its third-party email platform, GetResponse.
Los Angeles Unified School District
June 6, 2024
•[ leak, education ]
Los Angeles Unified School District (LAUSD) officials are investigating a threat actor's claims that they're selling stolen databases containing records belonging to millions of students and thousands of teachers. 24 million records are allegedly compromised.
Dubai Municipality
June 5, 2024
•[ leak, government ]
Daixin Team adds the Dubai Municipality to its dark web leak site.
Advance Auto Parts
June 5, 2024
•[ leak, misconfiguration, automotive ]
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum. Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees. In total, 79M unique email addresses were included in the breach, alongside names, phone numbers, addresses and further data attributes related to company employees.
Ticketek
May 31, 2024
•[ leak, misconfiguration, retail ]
In May 2024, the Australian event ticketing company Ticketek reported a data breach linked to a third party cloud-based platform. The following month, the data appeared for sale on a popular hacking forum and was later linked to a series of breaches of the Snowflake cloud storage service. The data contained almost 30M rows with 17.6M unique email addresses alongside names, genders, dates of birth and hashed passwords.
Michigan Medicine
May 23, 2024
•[ leak, healthcare ]
Michigan Medicine, the academic medical center of the University of Michigan, notifies roughly 57,000 individuals that their personal and health information might have been compromised in a data breach.
BBC
May 21, 2024
•[ leak, misconfiguration, technology ]
The BBC discloses a data security incident that occurred on May 21, involving unauthorized access to files hosted on a cloud-based service, compromising the personal information of BBC Pension Scheme members.
