RailYatri
August 12, 2020
•[ leak, misconfiguration, technology ]
One of India's most popular travel booking hubs has suffered a significant data breach that led to the loss of over 43GB of data as a result of a Meow bot attack. Preceding the attack, the affected Elastic search server was left publicly exposed for several days.
Ashley County Medical Center
August 10, 2020
•[ insider, misconfiguration, healthcare ]
Ashley County Medical Center is investigating a former employee who they claim inappropriately accessed medical records. It appears that the information was viewed out of curiosity and has not been shared with a third-party.
Adit
August 11, 2020
•[ hack, misconfiguration, healthcare ]
An unsecured database with 3.1 million patients' details is exposed by a medical software company and subsequently destroyed by a "meow" attack.
Defcon
August 9, 2020
•[ hack, misconfiguration, technology ]
The defcon.org forum is attacked with CVE-2019-16759 (targeting vBulletin), three hours after it is disclosed.
Camino Real Middle School
July 29, 2020
•[ hack, misconfiguration, education ]
Camino Real Middle School suffers a Zoom bombing attack.
Flood
July 26, 2020
•[ hack, misconfiguration, technology ]
Software testing service Flood.io suffers a breach blamed on OAuth tokens stolen by the attackers from Waydev.
Sylva, NC
July 23, 2020
•[ social, misconfiguration, government ]
A town board meeting in Sylva, NC was Zoom-bombed with unknown participants shouting racist remarks.
New York state's Metropolitan Transport Authority
July 28, 2020
•[ leak, misconfiguration, government ]
The New York Metropolitan Authority blames Google algorithm for adding porn titles to train station search results.
Century Specialty Script, LLC
July 28, 2020
•[ hack, misconfiguration, retail ]
Century Specialty Script, LLC disclosed a data breach from July where one employee's Microsoft Office365 account was compromised.
Dave
July 26, 2020
•[ leak, misconfiguration, finance ]
Loan app Dave.com has 7.5 million records leaked, blaming the breach to the OAuth tokens stolen by the attackers from Waydev.
Citrix third-party
July 15, 2020
•[ leak, misconfiguration, technology ]
An actor sells what they claim to be a database with information on 2,000,000 Citrix customers on the dark web. An official statement by the company reveals that the database has been obtained from a third-party.
Sheffield Hallam University
July 16, 2020
•[ leak, misconfiguration, education ]
The Sheffield Hallam University confirms that it is dealing with a data breach linked to the software provider Blackbaud.
Center for Alternative Sentencing and Employment Services
July 6, 2020
•[ hack, misconfiguration, government ]
The Center for Alternative Sentencing and Employment Services has put out a notification stating that a number of employee email accounts were compromised in 2020.
Ledger
June 25, 2020
•[ leak, misconfiguration, finance ]
Crypto-wallet firm Ledger reveals a major security breach of its e-commerce and marketing database, resulting in the compromise of one million customer email addresses and the personal details of thousands after the vulnerability was exploited on June 25, 2020.
Stradis Healthcare
July 1, 2020
•[ insider, misconfiguration, healthcare ]
A former vice president of a company in Georgia has been sent behind bars for sabotaging systems and causing delays in the shipment of Personal Protective Equipment (PPE).
Frost & Sullivan
June 24, 2020
•[ leak, misconfiguration, technology ]
U.S. business consulting firm Frost & Sullivan is breached after data from an unsecured backup folder exposed on the Internet is sold on a hacker forum.
City of Lexington
June 17, 2020
•[ hack, misconfiguration, government ]
A Zoom meeting regarding issues surrounding police discipline is interrupted by callers shouting racist and homophobic remarks.
San Francisco Employees' Retirement System (SFERS)
June 3, 2020
•[ hack, misconfiguration, government ]
The San Francisco Employees' Retirement System (SFERS) suffers a data breach after an unauthorized person gains access to a database hosted in a test environment. The breach occurred on February 24, 2020.
HomeChef
May 8, 2020
•[ leak, misconfiguration, retail ]
A database with 8 million records belonging to the meal kit delivery service HomeChef is put on sale on the dark web.
