Pellissippi State Community College
February 4, 2019
•[ leak, misconfiguration, education ]
More than 200 current and former students of Pellissippi State Community College could be in danger of identity theft because an unauthorized user had access to their personal information.
China Railway
January 2, 2019
•[ leak, misconfiguration ]
Data thieves steal the personal information of nearly 5 million people from an unconfirmed number of Chinese online ticket reservation platforms, according to Beijing police, who arrested a suspect in the case.
Hanover County
January 9, 2019
•[ financial, misconfiguration, government ]
Another victim of the Click2Gov breach. Officials disclose that an unauthorized party stole credit card information between Aug. 1, 2018 and Jan. 9, 2019.
The Wall Street Journal's website
December 17, 2018
•[ hack, misconfiguration, technology ]
The Wall Street Journal's website is defaced with a post containing a fake apology supporting YouTube megastar PewDiePie, previously accused of antisemitism by the same paper.
City of Topeka
December 7, 2018
•[ hack, misconfiguration, government ]
Another possible Click2Gov breach: Topeka's third-party payment vendor is breached possibly exposing the personal information of about 10,000 residents.
Middle East Airlines
November 14, 2018
•[ espionage, misconfiguration, government ]
An unknown actor with a connection to Iran hijacked DNS records to target the traffic of governments and telecommunications organizations around the world. One of the victims is Middle East Airlines, a Lebanese airline.
Organization for the Prohibition of Chemical Weapons
October 4, 2018
•[ espionage, misconfiguration, government ]
A threat actor, believed to be Russian military intelligence, targeted the office of the Organization for the Prohibition of Chemical Weapons in The Hague with a view of compromising its Wi-Fi network for espionage purposes.
Internet Solutions
October 23, 2018
•[ hack, misconfiguration, technology ]
Internet Solutions (IS) sends a notice to clients to warn them about a breach, and urges them to change their passwords and take additional steps to secure their servers. Later the company confirms that its internal monitoring systems have detected "irregular activity" on some of its virtual services.
SpankChain
October 6, 2018
•[ financial, misconfiguration, finance ]
SpankChain, an adult industry focused cryptocurrency, has $38,000 worth of Ethereum stolen due to a smart contract bug.
Rep. Pete King's campaign website
October 7, 2018
•[ hack, misconfiguration, government ]
Rep. Pete King's campaign website is defaced.
PIR Bank of Russia
July 20, 2018
•[ financial, misconfiguration, finance ]
Cybercriminals part of the notorious hacking group MoneyTaker attack the PIR Bank of Russia and steal $1M. The hacking is carried out after infiltrating the bank's systems by compromising an old, outdated router. The router was installed at one of the regional branches of the bank.
Family Orbit
August 30, 2018
•[ hack, leak, misconfiguration ]
An anonymous hacker is able to find the key to the cloud servers of Family Orbit and leaks 281 Gb of pictures and videos.
Air Canada
August 29, 2018
•[ hack, misconfiguration ]
Air Canada says the personal information for about 20,000 customers "may potentially have been improperly accessed" via a breach in its mobile app, so the company has locked down all 1.7 million accounts as a precaution until customers change their passwords.
Saverspy
September 17, 2018
•[ leak, misconfiguration, retail ]
Bob Diachenko, a security researcher, identifies an unsecured MongoDB server leaking the personal details of nearly 11 million users. The database seems to have been ransomed back in June.
Facebook
September 27, 2018
•[ hack, misconfiguration, technology ]
Facebook says a breach affected 50 million people on the social network. The vulnerability stemmed from the "view as" feature, which lets people see what their profiles look like to others. Attackers exploited code associated with the feature that allowed them to steal "access tokens" that could be used to take over people's accounts.
EscortReviews
September 1, 2018
•[ hack, misconfiguration, technology ]
An online community promoting female escorts and reviews of their services has suffered a data breach after a hacker downloaded the site's database. The site ran vBulletin 3.8.9, which has known vulnerabilities that could allow attackers to breach the site. It is unknown if the forum was hacked using one of these vulnerabilities or if the site left an unsecured backup of the database online.
T-Mobile
August 23, 2018
•[ hack, misconfiguration, technology ]
T-Mobile reveals that hackers stole some of the personal data of 2 million people in a new data breach. The intrusion took place on August 20 when hackers accessed company servers through an API that "didn't contain any financial data or other sensitive data."
Bossier City
August 18, 2018
•[ hack, misconfiguration, government ]
Some Bossier City water customers may have had their information compromised due to a possible breach of an online billing payment system.
Mention
August 3, 2018
•[ leak, misconfiguration, technology ]
Mention CEO Matthieu Vaxelaire informs users of the occurrence of a data security breach involving a third-party provider. The breach occurred in July and Mention promptly reported details to the French data protection authorities.
Altex Exchange
July 30, 2018
•[ financial, misconfiguration, finance ]
Altex Exchange acknowledges that a double-counting bug in Monero (XMR) cryptocurrency did result in a major undisclosed financial loss.
