Undisclosed U.S. telecommunications company
December 27, 2024
•[ hack, technology ]
A White House official adds a ninth U.S. telecommunications company to the list of telecoms breached in a Chinese hacking campaign that impacted dozens of countries.
Fraunhofer Institute for Industrial Engineering IAO
December 27, 2024
•[ ransomware, malware, technology ]
On December 27, 2024, Fraunhofer IAO in Stuttgart suffered a ransomware attack that encrypted and disrupted internal systems. The institute reported the incident to the Bavarian Data Protection Authority and law enforcement within statutory deadlines. While research data is typically anonymized, unauthorized disclosure cannot be ruled out, though no confirmed exfiltration has been identified.
CyberHaven
December 24, 2024
•[ hack, malware, technology ]
Data-loss prevention startup Cyberhaven says threat actors published a malicious update to its Chrome extension that was capable of stealing customer passwords and session tokens.
Speedio
December 24, 2024
•[ leak, misconfiguration, technology ]
In December 2024, data alleged to have been taken from the Brazilian lead generation platform Speedio was posted for sale to a popular hacking forum. The data was allegedly obtained from an unsecured Elasticsearch instance and contained over 62M records of largely public business information including company names, phone numbers and physical addresses, along with 27M unique email addresses, predominantly from public services such as Gmail and Outlook. Speedio did not respond to multiple attempts to disclose the incident, and the origin of the data could not be independently verified. The data was provided to HIBP by a source who requested it be attributed to "ayame@xmpp.jp".
Multiple Organizations
December 19, 2024
•[ hack, malware, technology ]
The developers of Rspack reveal that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware.
Microsoft/Google
December 15, 2024
•[ hack, sqlinjection, technology ]
The GhostRedirector group stealthily hijacked Windows servers using malwareRungan and Gamshento inject SEO content visible only to Googlebot, boosting gambling site rankings without user impact. Servers were targeted via SQL injection and privilege escalation exploits.
BitView
December 14, 2024
•[ insider, misconfiguration, technology ]
In December 2024, the video sharing Community BitView suffered a data breach that exposed 63k customer records. Attributed to a backup taken by a previous administrator earlier in the year, the breach exposed email and IP addresses, bcrypt password hashes, usernames, bios, private messages, video comments and for some records, gender, date of birth and country of location.
Telecom Namibia
December 11, 2024
•[ ransomware, malware, technology ]
Namibia Telecom is hit with a ransomware attack by the Hunters International gang.
BeyondTrust
December 8, 2024
•[ hack, technology ]
Privileged access management company BeyondTrust suffers a cyberattack after threat actors breached some of its Remote Support SaaS instances.
BT Group
December 4, 2024
•[ ransomware, technology ]
BT Group confirmed that its BT Conferencing services were impacted in a ransomware incident by Black Basta.
Senior Dating
November 23, 2024
•[ leak, misconfiguration, technology ]
In 2024, the 40+ dating website Senior Dating suffered a data breach. Attributed to an exposed Firebase database, the breach included extensive personal information on 766k users of the service including email addresses, photos, genders, links to Facebook accounts, dates of birth and precise latitude and longitude, among other personal attributes. The website was shut down after the breach was acknowledged by the site operator in December, along with a breach of the "ladies.com" website run by the same organisation.
Numocity
November 21, 2024
•[ leak, technology ]
The threat actor named CyberN-----s claims to have breached Tesla leaking 116,000 rows of data. in reality the data belongs to Numocity, a manufacturer of EV charging software, middleware, smart charges and more.
Human rights groups, private security companies, and state and educational institutions in Central Asia, East Asia, and Europe
November 21, 2024
•[ espionage, malware, government ]
Researchers at Recorded Future identify an ongoing Russia-linked cyber-espionage campaign targeting human rights groups, private security companies, and state and educational institutions in Central Asia, East Asia, and Europe using custom malware.
Blue Yonder
November 21, 2024
•[ ransomware, malware, technology ]
Supply chain management firm Blue Yonder warns that a ransomware attack caused significant disruption to its services, with the outages impacting grocery store chains in the UK.
iLearningEngines
November 18, 2024
•[ financial, hack, technology ]
iLearningEngines, an artificial intelligence company, says that a threat actor breached its network and stole a $250,000 wire payment.
FlipaClip
November 18, 2024
•[ leak, misconfiguration, technology ]
In November 2024, the animation app FlipaClip suffered a data breach that exposed almost 900k records due to an exposed Firebase server. The impacted data included name, email address, country and date of birth. FlipaClip advised the issue has since been rectified.
International Game Technology
November 17, 2024
•[ hack, technology ]
International Game Technology (IGT), one of the largest gambling companies in the U.S. says that a cyberattack caused massive disruptions to their operations, forcing them to take some systems offline.
Call of Duty gamers
November 7, 2024
•[ hack, misconfiguration, technology ]
A threat actor dubbed Vizor reveals that they banned thousands of Call of Duty gamers by abusing anti-cheat flaw.
MIT’s Technology Review
November 4, 2024
•[ leak, misconfiguration, technology ]
The threat actor known as Intel Broker claims to have stolen the personal data of 290,762 individuals from MITs Technology Review website via a third-party contractor.
Metawin
November 3, 2024
•[ financial, malware, technology ]
A threat actor steals over $4 million from crypto casino Metawin's Ethereum and Solana hot wallets
