Topic: corporate security
-
Education Tech Giant Instructure Breached, Hackers Steal Student Data
Instructure confirmed a data breach of its Canvas platform, with ShinyHunters hacking group stealing sensitive student data including names, email addresses, and teacher-student messages. ShinyHunters provided a sample of stolen data from two U.S. schools and claimed roughly 8,800 schools were im...
Read More » -
Why JLR’s CISO Mandated In-Person Password Resets After Cyber-Attack
Jaguar Land Rover's former CISO Ashish Shrestha required over 30,000 employees to reset their passwords in person after a major cyber-attack, prioritizing security over convenience. The in-person resets allowed the security team to verify identities, educate staff on threats, and enforce stronger...
Read More » -
Cosmetics brand Rituals reveals customer data breach
Rituals confirmed a data breach of its "My Rituals" membership database, compromising customer names, email addresses, phone numbers, and shipping addresses, but not financial payment details. The company notified affected customers, reported the incident to Dutch authorities, and advised custome...
Read More » -
AkzoNobel U.S. Site Hit by Cyberattack, Company Confirms
AkzoNobel, a major paints and coatings company, confirmed a contained cybersecurity breach at a U.S. facility, with the impact appearing limited. The Anubis ransomware gang claimed responsibility, alleging theft of 170 GB of sensitive data, including confidential agreements and employee personal ...
Read More » -
Nation-State Hackers Breach F5, Endangering Thousands of Customers
A nation-state hacking group infiltrated F5's networks, compromising thousands of organizations, including US government agencies and Fortune 500 companies, posing a severe global cybersecurity threat. The attackers maintained undetected access for years, enabling them to steal BIG-IP source code...
Read More » -
Scammers Impersonate Police to Steal Private Data From Tech Giants
Hackers are impersonating law enforcement to fraudulently obtain private customer data from major tech companies like Apple and Amazon, exploiting weak corporate verification processes for emergency data requests. A criminal group operates a "doxing-as-a-service" model, boasting hundreds of succe...
Read More » -
Microsoft Disrupts AI Platform That Compromised 12,000 Accounts
Microsoft dismantled the EvilTokens AI scam infrastructure, which used an automated chatbot to breach 12,000 user accounts across thousands of organizations for a subscription fee. The platform exploited OAuth device code authentication to gain unauthorized email access without passwords or MFA a...
Read More » -
1Password's New Anti-Phishing Tool Protects Your Weakest Link
AI-powered phishing scams are creating sophisticated, convincing fake websites at scale, posing a significant threat to both individuals and corporations as a common entry point for attacks. 1Password's new phishing protection feature counters this by issuing a warning when users manually paste c...
Read More » -
Basic-Fit Data Breach Impacts 1 Million Gym Members
A major data breach at European fitness chain Basic-Fit has compromised the personal information of approximately one million members across its operating regions. The exposed data likely includes sensitive details like names and contact information, prompting the company to activate its incident...
Read More » -
Urgent: Hackers Exploit Unpatched Oracle EBS Vulnerabilities
Oracle has confirmed active exploitation of unpatched vulnerabilities in its E-Business Suite, with hackers sending extortion emails claiming to have stolen sensitive corporate data. The vulnerabilities were resolved in the July 2025 Critical Patch Update, which addressed nine EBS flaws, includin...
Read More » -
LastPass confirms breach in Klue supply chain attack
LastPass confirmed a data breach after attackers stole OAuth tokens during the Klue supply chain attack, compromising customer data in its Salesforce environment without affecting core password vaults or master passwords. Hackers exploited vulnerabilities in the third-party platform Klue to captu...
Read More » -
Securing the AI blind spot from virtual barbarians at the gate
The rapid integration of AI into business operations has created unfamiliar attack surfaces and novel exploitation methods that traditional security tools cannot detect. AI applications behave in non-deterministic ways, making it difficult for security teams to predict how attackers might exploit...
Read More » -
Okta Users Targeted by Advanced Phishing & Vishing Kits
New phishing kits enable real-time credential interception and control of authentication flows, targeting users of major identity platforms like Google and Microsoft. These attacks combine voice phishing with dynamic, convincing fake login pages that bypass multi-factor authentication methods lik...
Read More » -
Report: Chinese hackers exploited VPN flaws to breach Ivanti customers
State-linked Chinese hackers exploited a hidden backdoor in Ivanti's Pulse Secure VPN in February 2021, compromising 119 organizations including government agencies and military contractors. The breach is linked to corporate restructuring after Ivanti's 2017 acquisition, where cost-cutting and la...
Read More » -
Beware: Hackers Hijack Calendar Subscriptions for Attacks
Hackers exploit digital calendar subscriptions by using deceptive systems to deliver malicious content like phishing links and malware through third-party feeds. BitSight's investigation revealed that expired or hijacked domains were used in large-scale campaigns, affecting millions of users thro...
Read More » -
Microsoft Teams Targeted by Fake IT Support Scams
A new wave of phishing attacks is exploiting Microsoft Teams, using fake IT support accounts to trick employees into installing malware that gives attackers full network control. Attackers are shifting from email to Teams due to its trusted role in business, impersonating IT staff to deploy remot...
Read More » -
Microsoft Teams vishing leads to Chaos ransomware attacks
Cybercriminals posing as IT support staff over Microsoft Teams calls have targeted North American businesses, with 95% of attacks hitting Canadian (50%) and U.S. (45%) entities across services, manufacturing, energy, and construction sectors. The scheme uses external Teams accounts and IT-themed ...
Read More » -
Oracle Hackers Target Executives with Extortion Emails
A sophisticated hacking campaign is targeting top-level executives at major corporations with extortion emails, claiming to have stolen sensitive data from Oracle's widely used business software products, though these claims remain unverified. The attackers, linked to the Clop ransomware gang, us...
Read More » -
Microsoft Confirms Active 0-Day - Apply Emergency Fix Now
Microsoft has confirmed the CVE-2026-42897 zero-day spoofing flaw in on-premises Exchange Server 2016, 2019, and Subscription Edition, which CISA has added to its Known Exploited Vulnerabilities Catalog due to active exploitation. Microsoft urges organizations to immediately enable and verify the...
Read More » -
48 Million Gmail Credentials Leaked Online
A database containing nearly 149 million login credentials, including an estimated 48 million Gmail accounts, was exposed online, compiled from past breaches and infostealer malware. The primary risk is credential stuffing attacks, where stolen usernames and passwords are used to access other acc...
Read More »