CyberSecurity news
FlagThis - #databreach
|
@databreaches.net
//
McDonald's has been at the center of a significant data security incident involving its AI-powered hiring tool, Olivia. The vulnerability, discovered by security researchers, allowed unauthorized access to the personal information of approximately 64 million job applicants. This breach was attributed to a shockingly basic security flaw: the AI hiring platform's administrator account was protected by the default password "123456." This weak credential meant that malicious actors could potentially gain access to sensitive applicant data, including chat logs containing personal details, by simply guessing the username and password. The incident raises serious concerns about the security measures in place for AI-driven recruitment processes.
The McHire platform, which is utilized by a vast majority of McDonald's franchisees to streamline the recruitment process, collects a wide range of applicant information. Researchers were able to access chat logs and personal data, such as names, email addresses, phone numbers, and even home addresses, by exploiting the weak password and an additional vulnerability in an internal API. This means that millions of individuals who applied for positions at McDonald's may have had their private information compromised. The ease with which this access was gained highlights a critical oversight in the implementation of the AI hiring system, underscoring the risks associated with inadequate security practices when handling large volumes of sensitive personal data. While the security vulnerability has reportedly been fixed, and there are no known instances of the exposed data being misused, the incident serves as a stark reminder of the potential consequences of weak security protocols, particularly with third-party vendors. The responsibility for maintaining robust cybersecurity standards falls on both the companies utilizing these technologies and the vendors providing them. This breach emphasizes the need for rigorous security testing and the implementation of strong, unique passwords and multi-factor authentication to protect applicant data from falling into the wrong hands. Companies employing AI in sensitive processes like hiring must prioritize data security to maintain the trust of job seekers and prevent future breaches. Recommended read:
References :
@www.bleepingcomputer.com
//
The Hunters International ransomware operation has announced its shutdown, stating they will release free decryption keys to their past victims. The group made the announcement on its dark web leak site, removing all previous victim data. In a statement, Hunters International acknowledged the impact their actions have had on organizations, stating the decision to close down was not made lightly. Victims are instructed to visit the ransomware gang's website to obtain the decryption keys and recovery guidance, though some sources indicate victims need to log in to a portal mentioned in the ransom note using existing credentials to obtain the decryption software.
The move to shut down has been met with skepticism from the threat intel community. Several ransomware gangs in the past have released their victims’ decryption keys, then shut down, each of them for different reasons. Some shut down only to return under a new name, perhaps in an attempt to confuse researchers and law enforcement agencies and sometimes toescape sanctions. There is speculation that Hunters International may be rebranding and transitioning to new infrastructure to avoid increased scrutiny from law enforcement. It emerged in late 2023 and was flagged by security researchers and ransomware experts as apotential rebrand of Hive, which had its infrastructure seized earlier that year. Reports indicate that Hunters International launched a separate platform named "World Leaks" in January, advising its affiliates to switch to this new operation. At the time, the group claimed that encryption-based ransomware was no longer profitable and they would be shifting to a hack-and-extort model. However, some sources have found World Leaks victims who also had ransomware deployed on their networks. Hunters International has been linked to almost 300 attacks worldwide including India's Tata Technologies and the US Marshals Service and has earned millions in cryptocurrency. Recommended read:
References :
Ashish Khaitan@The Cyber Express
//
Australia's national carrier, Qantas Airways, has disclosed a significant cyberattack affecting approximately six million customers. The breach occurred through unauthorized access to a third-party customer service platform used by a Qantas call center. Exposed data includes customer names, email addresses, phone numbers, birth dates, and frequent flyer numbers, however, the company reports that no financial data, passport details, passwords, or login credentials were compromised. The airline detected the unusual activity on Monday and took immediate action to bring the system back under control.
Qantas has launched an investigation into the incident, working closely with government authorities and cybersecurity experts. The airline has notified Australia’s National Cyber Security Coordinator, the Australian Cyber Security Centre, the Privacy Commissioner, and the Federal Police, reflecting the severity of the situation. Initial reports suggest the Scattered Spider group, known for targeting the aviation sector, may be linked to the attack. Qantas is also enhancing security measures by tightening access controls and improving system monitoring. Vanessa Hudson, Qantas Group Managing Director, has sincerely apologized to customers, acknowledging the uncertainty caused by the breach. A special customer support hotline and dedicated webpage have been established to provide information and assistance to those affected. While Qantas assures that the cyberattack has not impacted flight operations or the safety of the airline, cybersecurity experts warn that the stolen customer data could potentially be used for identity theft and other fraudulent activities. This incident underscores the importance of robust cybersecurity measures and vigilance in protecting sensitive customer information, particularly within third-party platforms. Recommended read:
References :
@x.com
//
References:
thecyberexpress.com
, cyble.com
Reports indicate a surge in sophisticated ransomware attacks throughout 2025, with groups like Qilin leading the charge. Qilin has solidified its position as a top ransomware group, demonstrating significant success in recruiting affiliates and providing advanced tools. Cybercriminal forums play a crucial role in simplifying ransomware crime development, allowing new threat actors to launch attacks without extensive technical skills. This rise in activity makes it easier than ever for malicious actors to execute ransomware operations through Ransomware-as-a-Service (RaaS) models, employing readily available tools and malware.
Qilin ransomware group topped June 2025 with a staggering 86 victims, surpassing rivals and indicating a shifting threat landscape. One notable victim was newspaper giant Lee Enterprises, where a Qilin attack exposed nearly 40,000 Social Security numbers. This attack not only disrupted publishing operations nationwide but also incurred significant financial damage, with recovery costs reaching $2 million alongside substantial revenue losses. The impact extends beyond financial losses, causing significant operational disruptions and underscoring the widespread threat to businesses of all sizes. The consequences of these attacks are far-reaching. Major organizations have been hit by ransomware and data breaches, emphasizing the urgent need for robust cyber resilience and incident response plans. Cyber incidents have led to unauthorized access to internal systems, disruptions in operations, and the compromise of millions of customer and employee accounts. Experts emphasize that preparedness against cybercrime and building cyber resilience is a critical priority, urging businesses to invest in comprehensive Cyber Incident Response Plans and regular cyber tabletop exercises to simulate real-world attack scenarios and stress-test response capabilities. Recommended read:
References :
Pierluigi Paganini@Security Affairs
//
McLaren Health Care, a nonprofit healthcare organization based in Grand Blanc, Michigan, is notifying over 743,000 individuals of a significant data breach. The breach, stemming from a ransomware attack that occurred in July 2024, involved unauthorized access to the healthcare provider's systems. The incident was discovered on August 5, 2024, after McLaren detected suspicious activity on its and Karmanos Cancer Institute’s computer systems.
Following the discovery, McLaren Health Care launched an investigation with the assistance of third-party forensic specialists to secure their network and determine the nature and scope of the activity. The investigation revealed that unauthorized access to the network occurred between July 17, 2024, and August 3, 2024. A comprehensive forensic review of the potentially impacted files concluded on May 5, 2025, confirming that personal and protected health information was compromised. The INC ransomware gang was identified as the cause of the breach. The compromised information may include names, Social Security numbers, driver’s license numbers, medical information, and health insurance details. McLaren Health Care is providing impacted individuals with 12 months of free credit monitoring services and guidance on protecting themselves against fraud and identity theft. Written communications outlining the nature of the breach and the steps being taken were sent directly to the affected individuals. As of June 20, 2025, written notification has been issued to those affected by this data breach. Recommended read:
References :
@kirbyidau.com
//
MKA Accountants, a Victorian accounting firm, has confirmed it fell victim to a ransomware attack by the Qilin group. The incident, which occurred in May 2025, resulted in the publication of sensitive company documents on Qilin's leak site. The stolen data included internal correspondence, financial statements, and insurance information, highlighting the severity of the breach and the potential impact on the firm's operations and client relationships. This attack underscores the growing threat posed by ransomware groups to organizations of all sizes, regardless of their industry.
The Qilin ransomware group has been rapidly gaining prominence in the cybercrime landscape. As established players like RansomHub and LockBit face internal turmoil and operational setbacks, Qilin has emerged as a technically advanced and full-service cybercrime platform. Recent reports indicate that Qilin is actively recruiting affiliates, possibly absorbing talent from defunct groups, and bolstering its capabilities to conduct sophisticated ransomware attacks. This rise in prominence positions Qilin as a major player in the evolving ransomware-as-a-service (RaaS) ecosystem, posing a significant threat to businesses worldwide. To further pressure victims into paying ransoms, Qilin now offers a "Call Lawyer" feature within its affiliate panel. This addition aims to provide affiliates with legal counsel during ransom negotiations, potentially intimidating victims and increasing the likelihood of payment. Furthermore, Qilin provides other services to help affiliates maximize their success. This includes spam services, PB-scale data storage, a team of in-house journalists, and even the ability to conduct distributed denial-of-service (DDoS) attacks, positioning Qilin as a comprehensive cybercrime operation and increasing it's market share. Recommended read:
References :
@www.oxford.gov.uk
//
Oxford City Council has suffered a cyberattack resulting in the potential exposure of personal data relating to election workers. The incident, which occurred the weekend of June 7th and 8th, involved unauthorized access to the council's network. Automated security systems detected and contained the intrusion, minimizing the attackers' access to systems and databases.
As a precaution, the council took down its main systems to conduct thorough security checks. Most systems are now safely operational, with the remainder expected to be back online shortly. While email systems and wider digital services remain secure, the attackers managed to access historic data on legacy systems, specifically impacting individuals who worked on Oxford City Council-administered elections between 2001 and 2022, including poll station workers and ballot counters. The council has stated that there is no evidence to suggest the accessed information has been shared with third parties, and investigations are ongoing to determine the precise nature and extent of the data compromised. Impacted individuals have been contacted, and the council has reported the incident to relevant government authorities and law enforcement agencies, assuring the public that actions have been taken to prevent further unauthorized access and that a full investigation is underway. Recommended read:
References :
@cyberscoop.com
//
Aflac Incorporated, the insurance giant, has confirmed a cybersecurity incident that occurred on June 12, 2025. The company detected suspicious activity on its US network and promptly initiated its cyber incident response protocols, successfully stopping the intrusion within hours. According to Aflac's official disclosure, their systems were not affected by ransomware, ensuring business operations such as underwriting, claims processing, and customer support remain uninterrupted. However, Aflac warns that sensitive customer information may have been exposed during the breach.
Preliminary findings indicate that the unauthorized party used sophisticated social engineering tactics to gain access to Aflac's network. This method often involves tricking individuals into revealing sensitive information or granting access. Aflac has engaged leading third-party cybersecurity experts to assist with the ongoing investigation. CNN, citing sources familiar with the investigation, reported that this incident, along with others recently affecting the insurance sector, is consistent with the techniques of a cybercrime group known as “Scattered Spider.” Aflac acknowledged the broader context of the attack, stating, "This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group." The review of potentially impacted files is still in its early stages, and Aflac has not yet determined the total number of individuals affected. However, the company has indicated that the compromised files may contain sensitive information. The Aflac breach is the latest cyberattack against the insurance industry. Recommended read:
References :
Dissent@DataBreaches.Net
//
A massive collection of 16 billion login credentials has been discovered, representing one of the largest data thefts in history. Cybernews reports that the exposed data likely originates from various infostealers, malicious software designed to gather sensitive information from infected devices. Researchers have uncovered 30 exposed data sets containing millions to over 3.5 billion records each, totaling the astounding 16 billion credentials. These datasets include logins for major platforms like Apple, Google, Facebook, and Telegram, raising significant concerns about widespread account compromise.
Researchers noted that these datasets were not simply recycled from old data leaks but represent new, potentially "weaponized" information. The exposed data contains a mix of details from stealer malware, credential stuffing sets, and repackaged leaks. While it was not possible to compare data between the different sets effectively, the sheer volume and the platforms targeted highlight the severity of the situation. The data sets were only exposed for a short period and it remains unknown who controlled the large amount of data. The exposure of these 16 billion credentials poses a significant risk of account takeovers, identity theft, and targeted phishing attacks. Cybercriminals now have access to an unprecedented volume of personal data. Users are advised to take immediate action to protect their accounts, including enabling multi-factor authentication and using strong, unique passwords for all online services. News sources indicate that this is not a new data breach but is rather a compilation of previously leaked credentials. Recommended read:
References :
AFox@www.healthcareitnews.com
//
References:
www.comparitech.com
,
,
The healthcare sector has been rocked by a recent ransomware attack on Episource, a medical coding, risk adjustment services, and software company. The breach, which occurred in February 2025, resulted in the compromise of sensitive patient health information. According to reports, unauthorized access to Episource's computer systems allowed cybercriminals to view and copy data belonging to the company's healthcare provider and health plan customers. The exposed information includes personal contact information, health insurance plan data, medical diagnoses, test results, and images, raising serious concerns about patient privacy and security.
Sharp Community Medical Group and Sharp Healthcare, Episource clients, have confirmed that patient data was compromised in the attack. While the incident did not involve unauthorized access to electronic health records or patient portals, the exposed data includes health insurance information and health data, such as medical record numbers, doctors, diagnoses, medications, test results, images, care, and treatments. Episource began notifying affected customers about which individuals and specific data may have been involved starting on April 23, 2025. Sharp Healthcare has also started sending out patient breach notifications. This incident highlights the increasing vulnerability of healthcare organizations to ransomware attacks. Microsoft reports that 389 healthcare companies have been hit by ransomware this year alone, resulting in network shutdowns, offline systems, rescheduled appointments, and delays in critical procedures. The financial impact is significant, with healthcare organizations losing up to $900,000 per day on downtime. Experts emphasize the importance of strengthening cybersecurity measures, including employee training and awareness programs, to protect sensitive patient data and mitigate the risk of future attacks. Episource is working to strengthen its computer systems and has notified law enforcement. Recommended read:
References :
@www.healthcarefinancenews.com
//
References:
cyble.com
, cybersecurityventures.com
,
Ransomware groups are continually evolving their tactics, posing an increasing threat to organizations worldwide. Recent reports highlight the exploitation of vulnerabilities in software and the use of sophisticated techniques, such as abusing legitimate employee monitoring software, to breach systems. A Symantec report revealed the discovery of Fog Ransomware, showcasing the attackers' innovative use of tools, including a legitimate security solution (Syteca) capable of recording on-screen activity and monitoring keystrokes, which they deployed using PsExec and SMBExec.
The Cybersecurity and Infrastructure Security Agency (CISA) issued Advisory AA25‑163A, warning of ransomware actors exploiting CVE-2024-57727 in unpatched SimpleHelp Remote Monitoring and Management (RMM) software, specifically versions 5.5.7 and earlier. This vulnerability allowed attackers to compromise a utility billing software provider and initiate double-extortion attacks. The attacks targeting unpatched SimpleHelp deployments have been observed since January 2025, indicating a sustained and targeted effort to exploit this vulnerability. In addition to software vulnerabilities, data breaches are also occurring through direct hacks. Zoomcar, an Indian car-sharing company, recently acknowledged a data breach affecting 8.4 million users, where hackers accessed customer names, phone numbers, car registration numbers, personal addresses, and emails. While sensitive information like passwords and financial details were reportedly not exposed, the breach raises concerns about the security of personal data stored by such platforms. Furthermore, the DragonForce group has started posting new victims to their darknet site, publicly extorting two new organizations, highlighting the continued use of double extortion tactics by ransomware groups. Recommended read:
References :
Bill Toulas@BleepingComputer
//
The Texas Department of Transportation (TxDOT) is alerting the public to a significant data breach that compromised nearly 300,000 crash records. The incident, discovered on May 12th, 2025, involved unauthorized access to its Crash Records Information System (CRIS). Texas officials revealed that a hacker gained entry through a compromised user account and proceeded to download a large volume of sensitive data. This data included personally identifiable information such as names, addresses, driver's license numbers, license plate numbers, and car insurance policy numbers.
The compromised crash reports contain detailed information about individuals involved in traffic accidents, including summaries of injuries sustained during the crash and narratives of the incidents. While TxDOT is not legally obligated to notify the public, it has chosen to proactively inform those affected by sending letters to individuals whose information was included in the stolen crash reports. TxDOT immediately disabled access from the compromised account upon discovering the unusual activity and launched an investigation into the matter. The Texas Department of Public Safety is currently investigating how the breach occurred and is attempting to determine the identity of the responsible parties. TxDOT is urging individuals who may have been affected to be cautious of potential scams and fraudulent activities. Letters sent to victims advise them to be wary of unsolicited emails, texts, or calls related to past crashes, and a dedicated call line has been established to address any questions or concerns. The exposed data poses a significant risk of financial fraud and identity theft for those affected, as the compromised information can be valuable for malicious actors. Recommended read:
References :
@cyberpress.org
//
Marks & Spencer (M&S), the prominent retail giant, was recently hit by a significant ransomware attack over the Easter period. The cyberattack, orchestrated by the DragonForce hacker group, disrupted crucial business functions, including online ordering and staff clocking systems. The attackers employed "double extortion" tactics, indicating that they stole sensitive data before encrypting the company's servers. This aggressive move puts M&S at risk of both data loss and public exposure.
An exclusive report reveals that the CEO of M&S received an offensive extortion email detailing the timeline and nature of the attack. The email, reportedly filled with abusive language, claimed that DragonForce had "mercilessly raped" the company and encrypted its servers. In response to the attack, M&S took drastic measures by switching off the VPN used by staff for remote work, which successfully contained the spread of the ransomware, but further disrupted business operations. The financial impact of this cyber incident has been substantial, with reports indicating losses of approximately £40 million per week in sales. DragonForce, the ransomware group behind the attack, has reportedly compromised over 120 victims in the past year, establishing itself as a major player in the cybercrime landscape. The group has evolved from a Ransomware-as-a-Service (RaaS) model to a fully-fledged ransomware cartel, targeting organizations across various sectors, including manufacturing, healthcare, and retail. While the origins of DragonForce are speculative, technical indicators suggest a Russian alignment, including the use of Russian-linked infrastructure and recruitment efforts through Russian-speaking cybercrime forums. M&S has pointed to "human error" as the cause of the breach, with scrutiny falling on an employee of Tata Consultancy Services (TCS), which provides IT services to the retailer, although M&S has officially disputed claims that it didn't have proper plans to handle a ransomware incident. Recommended read:
References :
|