Saint Paulus Lutheran Church
May 6, 2020
•[ hack, misconfiguration, education ]
Saint Paulus Lutheran Church sues video chat company Zoom after a hacker allegedly hijacked a virtual Bible study class to post graphic images of child abuse.
Xen Orchestra
May 3, 2020
•[ hack, misconfiguration, technology ]
Xen Orchestra, a platform that provides tools to administrate Citrix Hypervisor is also compromised via the Salt vulnerability.
Fitness class
May 5, 2020
•[ hack, misconfiguration, education ]
A Zoom hacker scares a group of about 60 children taking part in a fitness class, streaming child sex abuse footage.
Algolia
May 3, 2020
•[ hack, misconfiguration, technology ]
Search service Algolia says it suffered a security breach over the weekend after hackers exploited a well-known vulnerability in the Salt server configuration software to gain access to its infrastructure.
Believr
April 20, 2020
•[ hack, misconfiguration, technology ]
Hackers infiltrate a Zoom meeting of a virtual church service hosted by Adam Evers, the founder of the Christian LGBTQ+ dating app Believr.
Clayton County school
April 17, 2020
•[ hack, misconfiguration, education ]
A Clayton County school's Zoom call was interrupted with pornographic images.
Lumberton Township Public Schools in Burlington County
April 27, 2020
•[ hack, misconfiguration, education ]
Lumberton Township Public Schools in Burlington County announces it will temporarily stop using Zoom after a hacker reportedly streamed pornography and used racist language during a lesson for middle school students.
Benefit Recovery Specialists, Inc.
April 20, 2020
•[ leak, misconfiguration, finance ]
The personal data of 274,837 has been exposed after a data breach at Benefit Recovery Specialists, Inc., a Texas-based billing and collection company.
US government
April 3, 2020
•[ hack, misconfiguration, government ]
Criminals disrupt a Zoom meeting held at the highest levels of the US government, despite warnings against using the software.
South African Department for Women, Youth, and Persons with Disabilities
April 15, 2020
•[ hack, misconfiguration, government ]
The South African Department for Women, Youth, and Persons with Disabilities is the latest victim of a Zoom bombing attack.
Puget Sound Educational Service District
April 5, 2020
•[ leak, misconfiguration, education ]
The Puget Sound Educational Service District (PSESD) sends out a notice to current and former students, and employees of King and Pierce County Schools, after learning of a data breach within their computer network.
Wolfe & Associates
April 3, 2020
•[ hack, financial, misconfiguration ]
Wolfe & Associates, Property Services discloses that an online database was compromised by cyber-criminals in a data breach that may have occurred as many as six months ago. In January 2021, San Diego residents Gordon Welterlen and Nicole Milan admitted to hacking Wolfe & Associates and stealing the identities of more than 9,000 clients. They used that information for fraudulent purposes.
Niazpardaz[.]ir
April 9, 2020
•[ leak, misconfiguration, technology ]
Someone is selling the personal details of 45,000 Iranians on the dark web. The data appears to have been taken from several sites including Niazpardaz[.]ir and Arzi24[.]com.
Open Exchange Rates
March 12, 2020
•[ leak, misconfiguration, finance ]
Open Exchange Rates announces a data breach that exposed the personal information and salted and hashed passwords for customers of its API service. The breach occurred between February 9th, 2020, and March 2nd, 2020.
Entercom
March 6, 2020
•[ leak, misconfiguration, technology ]
US radio giant Entercom reports a data breach that took place in August 2019 after an unauthorized party was able to access database backup files stored in a third-party cloud hosting service and containing Radio.com user credentials.
Aerial Direct
March 13, 2020
•[ leak, misconfiguration, technology ]
Aerial Direct reveals that an unauthorized third party had been able to access customer data on 26 February through an external backup database, which included personal information on both current and expired subscribers from the last six years.
GeoCloud
March 2, 2020
•[ leak, misconfiguration, technology ]
A threat actor posts another database, this time from technology company GeoCloud, leaked through a public Amazon server. The data contains users' names, email addresses, and passwords as well as the company's social media keys and company information.
Vijay Sales
March 2, 2020
•[ leak, misconfiguration, retail ]
A threat actor posts a leaked Vijay Sales, a large electronics retail store chain in India, database on a popular dark web hacker forum. The threat actor claims the source was from an "exposed backup server" breached in February 2020.
Rady's Children's Hospital
February 26, 2020
•[ leak, misconfiguration, healthcare ]
Rady's Children's Hospital notifies patients whose data were accessed via an "open port" on June 2019, and January 2020.
US municipal government
January 8, 2020
•[ hack, misconfiguration, government ]
The FBI says that also a US municipal government was breached via the CVE-2019-11510 Pulse Secure VPN flaw.
