Evanston Township High School
Cyberattack disrupted phone systems; students and parents advised to use email
Law Firm Data Breaches (10303 indexed)
Securonix said the Veil#Drop campaign abuses Google Blogspot to deliver PureLog Stealer
Securonix said the Veil#Drop campaign abuses Google Blogspot to deliver PureLog Stealer in memory
Clover Health
Health insurer data breach; type and volume of exposed data still unknown
South Florida Injury Centers
1,525 individuals affected; SSNs and medical records (PHI/PII) exposed
Hugging Face
Breach affected internal datasets and credentials, users urged to rotate access tokens
Threat actors don't need any special authentication to reach a target endpoint — they
Threat actors don't need any special authentication to reach a target endpoint — they just need to know where it is.
Nissan
Nissan says employees' data was stolen via the Oracle PeopleSoft zero-day campaign
An attacker has exploited a zero day in Oracle Peoplesoft to gain access to the IT
An attacker has exploited a zero day in Oracle Peoplesoft to gain access to the IT systems of the NAIC, the standard-setting association for the US federal insurance system
SimpleHelp SimpleHelp
SimpleHelp Authentication Bypass Vulnerability — SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login
Nation-state attackers breach water systems through weak passwords, exposed PLCs, and
Nation-state attackers breach water systems through weak passwords, exposed PLCs, and poor segmentation — not sophisticated malware.
Sysco
2,691,852 records exposed — Customer feedback, Email addresses, Employers, Job titles and 4 more
View incident → Indexed 2 months ago
The UK Cyber Monitoring Centre reviews the Canvas breach affecting 160 UK universities,
The UK Cyber Monitoring Centre reviews the Canvas breach affecting 160 UK universities, highlighting data theft risks and financial impacts of cyber incidents
American Tower
216,601 records exposed — Email addresses, Job titles, Names, Phone numbers and 1 more
View incident → Indexed 2 months ago
Cisco Unified Communications Manager
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability — Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SM
PTC Windchill and FlexPLM
PTC Windchill and FlexPLM Improper Input Validation Vulnerability — PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by
Customers of the affected Japanese email services are “strongly advised” to change their
Customers of the affected Japanese email services are “strongly advised” to change their email passwords
Madison Square Garden Sports
9,796,738 records exposed — Customer service records, Email addresses, Names, Phone numbers and 1 more
View incident → Indexed 2 months ago
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Great
Ubiquiti UniFi OS
Ubiquiti UniFi OS Path Traversal Vulnerability — Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that coul
Ubiquiti UniFi OS
Ubiquiti UniFi OS Improper Access Control Vulnerability — Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to
Ubiquiti UniFi OS
Ubiquiti UniFi OS Improper Input Validation Vulnerability — Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injectio
Lantronix EDS5000
Lantronix EDS5000 Code Injection Vulnerability — Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are exe
JCPenney
368,418 records exposed — Dates of birth, Email addresses, Government issued IDs, Job titles and 4 more
View incident → Indexed 2 months, 1 week ago
Splunk Enterprise
Splunk Enterprise Missing Authentication for Critical Function Vulnerability — Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create o