Cyber attacks are still hitting businesses, despite increasing awareness following high-profile incidents such as the Jaguar Land Rover (JLR) and Marks and Spencer (M&S) breaches.

According to the UK government’s Cyber Security Breaches Survey, four in 10 businesses (43%) and three in ten charities (28%) fell victim to attacks in 2025.

The problem has not improved over the last year, with cybersecurity minister Liz Lloyd issuing a warning that business leaders must take action now to ensure robust security.

Regulations such as the incoming UK Cyber Security and Resilience Bill mandate that resilience is baked into organizations and their supply chains. How can firms boost cyber resilience as the risk of attack surges?

Resilience gaps

The price of failing to be resilient is already clear. The JLR attack cost the business and its partners up to £1.9 billion, while it’s estimated the M&S breach cost the company over £100 million.

These headlines are difficult to ignore. Yet despite growing awareness of cyber risk following the incidents, many organizations are still struggling to translate awareness into “meaningful resilience improvements”, says Chris Brown, SVP UK market leader at NCC Group.

This is partly due to over-confidence in cybersecurity, which is leading businesses into “an under-preparation trap”, according to Brown.

“The growing interconnectedness of digital systems and third-party suppliers means leaders face an increasingly complex landscape of vulnerabilities and cyber risks, often without clear visibility of where their greatest exposures lie – or how to begin addressing them.”

The Cyber Security Breaches Survey also identified persistent resilience gaps linked to the rapid adoption of AI without adequate governance or security controls.

“While board-level engagement with cyber risk is increasing, stronger operational action remains essential,” says Brown.

Pace of change

Technology such as AI does have the potential to help boost productivity and improve security, but the pressure to adopt it quickly can lead firms to take unnecessary risks. The pace of change is one of the biggest challenges facing businesses, according to Rob O’Connor, Insight's CISO for EMEA.

“Organizations are under pressure to adopt technologies such as AI to improve efficiency, reduce costs and create new ways of working, but every new capability introduces new risks too,” he says.

The challenge, O’Connor adds, is implementing change securely, and doing so at a pace that keeps up with the wider business.

Company culture is another problem. One of the biggest barriers is that many firms still treat cybersecurity as a “specialist technical function” rather than a “core business resilience issue”, says Scott Beange, head of cyber strategy at Projective Group.

“Boards often receive large volumes of cyber reporting and compliance metrics, but relatively little clarity around operational survivability, recovery capability or dependency risk.”

The issue is made worse by a growing disconnect between modern digital ecosystems and traditional governance approaches, according to Beange.

“Organizations are now heavily reliant on cloud providers, Software as a Service (SaaS) platforms, managed services and interconnected supply chains. In many cases, firms no longer fully understand where their operational dependencies sit until disruption occurs.”

At the same time, attackers are increasingly targeting the areas organizations struggle to rehearse properly: Recovery processes and operational coordination under stress, says Beange. “Too many businesses still test intrusion prevention far more rigorously than degraded operations or prolonged recovery conditions.”

Regulation resilience

It comes at a time when regulations such as the European Union's Digital Operational Resilience Act (DORA) and the UK’s Cyber Security and Resilience legislation are mandating resilience across the board.

At the EU level, a proposed update to the EU Cybersecurity Act seeks to address fragmentation in requirements under the Network and Information Systems 2 Directive (NIS2) and EU-wide certification schemes.

“But even with a more coherent framework including outcome-focused minimum standards and technical criteria, global organizations must still navigate evolving regulatory expectations across multiple jurisdictions,” Brown warns.

AI adoption is also mandating resilience, Brown points out. However, rather than introducing entirely new legislation to ensure secure and responsible AI adoption, states are weaving it into existing sector regulation, he says. He cites the example of the UK’s Online Safety Act, which is being amended to close loopholes for chatbot providers.

Steps to boost resilience

With so many factors at play, it might seem complex, but there are a number of steps businesses can take to boost resilience now.

A “small set of controls taken together” will “eliminate the majority of preventable incidents”, according to Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University.

The starting point is Cyber Essentials Plus, he says. “It is not glamorous, but it forces patching discipline, multi-factor authentication (MFA), access control and boundary firewalling, and it is already a precondition for many public sector contracts, so the cost is recoverable."

From there, the “single highest-value technical investment” is phishing-resistant MFA such as hardware security keys or platform passkeys on every privileged account, he says.

Beyond identity, firms should segment their networks, particularly between IT and operational technology environments, says Curran.

“A compromised office laptop should never be able to reach a production line controller, and yet in many manufacturing firms it still can.”

Alongside segmentation sits the discipline of tested backups, Curran adds. He advocates the 3-2-1 rule, “with at least one copy offline or immutable, and a restore rehearsed at least quarterly”.

Beange recommends making an effort to understand critical business services and the dependencies that underpin them.

“Firms should be regularly testing how they would operate under degraded conditions as rigorously as whether their security controls detect attacks.”

Boards should also demand clearer reporting focused on operational impact and decision-making rather than excessive technical detail, says Beange.

Questions such as, “how long could we operate without this supplier?”, or “what happens if identity systems fail for 48 hours?” are often more valuable than “another dashboard full of vulnerability statistics”, he advises.

O'Connor concurs that cyber resilience starts with understanding what matters most to your business, saying “Organizations should think like an attacker and ask: What are the assets or operations we simply cannot afford to lose?”

For some organizations, that may be customer data, for others intellectual property, or production systems, explains O’Connor. “Once you understand what would have the biggest operational and financial impact, security priorities become much clearer.”

Scottish health tech company Craneware has revealed customer and employee data has been exposed in a “security incident”.

In a notice filed with the London Stock Exchange (LSEG) on 20 July, the company said it had launched an investigation into the attack, which has now been contained.

“The company's incident response plan has been activated, including the appointment by the Board of external cybersecurity and forensic specialists,” the advisory reads.

“Their investigation is ongoing, alongside the Craneware IT team and the Company's retained cyber security service providers. There has been no disruption to customer services or to the company’s operations.”

A preliminary investigation into the breach found that a “significant volume” of file names was viewed and exfiltrated by unauthorized individuals, although the company noted these weren’t sensitive and were already publicly available.

“A percentage of employee data as well as a subset of customer and partner records have been accessed and exfiltrated,” Craneware added.

Craneware has since notified relevant regulators and law enforcement agencies, including the UK Information Commissioner’s Office (ICO) and the FBI.

The Edinburgh-headquartered company provides accounting and billing software for US healthcare operators, partnering with around 2,000 hospitals across the country.

This makes it a prime target for cyber criminals, according to Trevor Dearing, director of critical infrastructure at Illumio.

“Healthcare technology providers have become prime targets because they offer cybercriminals a shortcut into the healthcare supply chain,” he said. “Why target one hospital when you can target a provider connected to thousands?”

Attacks on the UK healthcare system and associated vendors have increased significantly over the last year, according to a recent study from SonicWall. Figures published by the cybersecurity firm in June highlighted a tenfold increase in attacks so far in 2026.

Data collected through SonicWall's Intrusion Prevention System (IPS) showed upwards of 260,000 attempted cyber attacks between January and May this year.

While the Craneware incident has been contained, Dearing noted that employees and customers should still remain vigilant for potential follow-up attacks such as phishing - a common tactic employed in the wake of breaches.

“Even where stolen information appears low risk, employee, customer and partner data can be used to fuel phishing, social engineering and follow-on attacks,” he said.

“Employees, customers, and partners should remain cautious of any unsolicited communication or suspicious activity on their networks.”

FOLLOW US ON SOCIAL MEDIA

Supermarket chain Lidl has urged customers to remain vigilant after a data breach exposed personal information.

In an advisory, the firm revealed the ‘IT incident’ at a third-party service provider has impacted customers in Belgium, Germany, and the Netherlands.

"We were notified of this incident earlier this week," the message reads.

"Despite high IT security standards, unauthorized parties briefly gained access to a separately stored file containing customer data, and some of that data was stolen. The online shop system itself was not affected."

The stolen data relates to customers of Lidl's online shop, and includes first and last names, telephone numbers, email addresses, dates of birth, and customer numbers.

Lidl noted that data exposed in the incident does not include passwords, billing and delivery addresses, bank details, or other payment information.

Lidl warns customers over phishing risks

The company said that while it currently has no concrete evidence this data has been misused, customers should remain vigilant for potential phishing attacks or identity theft.

Customers should be wary of unexpected messages, always verify the authenticity of the sender, and avoid providing any information or clicking on unknown links.

Boris Cipot, principal security engineer at Black Duck, said the incident is a “textbook reminder” of the risks posed by third-party vendors.

"Even when a retailer's own systems hold, a compromised service provider can expose millions of customers to identity fraud, phishing, and account takeover attacks," Cipot commented.

"Personal data like names, birthdates, phone numbers, and email addresses may seem low-risk in isolation, but combined they become a powerful toolkit for social engineering. Additionally, the downstream costs to consumers and brand trust can far outlast the incident itself."

Lidl vendor acted swiftly

Lidl said its IT service provider responded immediately to fully restore the security of the affected IT systems, filed a report with the authorities and immediately engaged IT forensic experts to investigate the incident.

The company has also notified the relevant data protection authorities. Cipot commended the supermarket chain for its swift response and up-front communication with affected customers.

"Lidl deserves credit for moving quickly to notify customers and being transparent about what they don't yet know, including the possibility that passwords, addresses, and payment data could be involved. That kind of candor presents the appropriate posture under GDPR," he said.

"The real test now is follow-through: how quickly they complete the forensic investigation, how clearly they communicate updates as the scope becomes known, and how rigorously they reassess the security requirements they place on their service providers going forward."

Lidl, which operates around 12,900 stores across 32 countries in Europe and the US, is just the latest retailer to be hit by a supply chain breach.

In the last year or so, victims have included Marks and Spencer, Co-op, Louis Vuitton, Pandora, and Harrods. Many of these attacks have been linked to the Scattered Spider hacking group.

FOLLOW US ON SOCIAL MEDIA

Nissan has revealed it suffered a data breach after threat actors exploited flaws in Oracle’s PeopleSoft software, with information on both current and former staff exposed.

In a filing with the California Attorney General’s Office, the car manufacturer said it is “working as quickly as possible” to establish the full scale and scope of the breach.

An initial investigation by the company reveals that personal information such as contact and banking information, social security numbers, and financial and tax data was exposed in the breach.

Current and former employees in the US, Canada, Mexico, and Brazil are among those affected, the company said.

“As we continue our investigation, individuals whose personal information has been exposed will receive further communication with additional details and next steps,” the filing reads.

Nissan urged employees to take a number of precautionary steps in the meantime, including remaining vigilant for phishing emails or fraudulent phone calls and text messages.

Staff were also advised to monitor financial accounts and credit reports for unusual activity, and urged to change passwords for “all significant accounts” - such as banking services.

Nissan noted that systems have since been secured and the company is working with technical experts to prevent further leaks.

“Upon learning about this issue, we quickly activated incident response protocols. We have been in communication with authorities throughout our response to this attack,” the filing reads.

“Our technical teams, along with external experts, have secured our systems and will continue to work with Oracle to address this issue. We have taken steps designed to end unauthorized access and to prevent further disclosure of the information.”

Oracle PeopleSoft breach

The announcement by Nissan comes in the wake of a “cyber event” involving Oracle’s PeopleSoft software, which is used to manage employee information such as payroll, tax, and other personnel details.

More than 100 organizations are believed to have been affected by the breach so far, which has been linked to the ShinyHunters threat group.

Earlier this month, the University of Nottingham was among those impacted by the breach, with data belonging to around 450,000 present and former students compromised in the attack.

Simon Pamplin, CTO at Certes, said the breach is a single zero-day in “widely deployed enterprise software can become a mass-casualty event”.

“Nissan was not the target of a bespoke attack. It was one of many companies caught in a campaign exploiting a shared vulnerability in HR and payroll infrastructure used across industries,” he said.

“The data involved here is particularly serious. Social Security numbers, banking details, tax information and dependent records are not generic employee data. They are the durable financial backbone of a person's identity, and they were sitting inside a system many organisations treat as core infrastructure rather than a high-value target.”

FOLLOW US ON SOCIAL MEDIA

Cloud development platform Vercel has confirmed it experienced a data breach after hackers claimed to have accessed its systems.

The Vercel platform is best known for supporting frameworks like Next.js, used by around two-thirds of JavaScript developers.

The attackers gained entry through the compromise of Context.ai, a third-party AI tool used by a Vercel employee.

That access was then used to take over the employee's Google Workspace account, giving the hackers access to some Vercel environments and variables that weren't marked as 'sensitive'.

"We assess the attacker as highly sophisticated based on their operational velocity and detailed understanding of Vercel's systems,” the company said in a statement.

“We are working with Mandiant, additional cybersecurity firms, industry peers, and law enforcement. We have also engaged Context.ai directly to understand the full scope of the underlying compromise.”

Vercel added that it worked closely with GitHub, Microsoft, npm, and Socket in the wake of the breach, stating that no npm packages were compromised.

“There is no evidence of tampering, and we believe the supply chain remains safe,” Vercel continued.

Some customers impacted in Vercel data breach

Vercel said it has identified a number of customers whose non-sensitive environment variables – those that decrypt to plaintext – were compromised.

The company has contacted affected customers and recommended an immediate rotation of credentials.

Vercel added it will keep customers updated if it finds any evidence of further compromise.

Who is responsible?

A threat group claiming to be ShinyHunters has claimed responsibility for the attack in a post on Telegram, offering data that includes access keys, source code, and databases for sale, along with access to internal deployments and API keys

The attackers said they had been in touch with Vercel and were demanding a ransom of $2 million.

However, Austin Larsen, principal threat analyst at Google Threat Intelligence, cast doubt on these claims in a post on LinkedIn. In this instance, the threat actors behind the attack could be bluffing.

"It is likely this is an imposter attempting to use an established name to inflate their notoriety,” he said.

What should Vercel users do?

Vercel advised customers to add an additional layer of security by requiring at least two methods of authentication, configuring an authenticator app, and creating a passkey.

The company emphasized that simply deleting a project or account won’t work, as compromised secrets could still provide threat actors with access to production systems. Users are advised to rotate them first.

Customers should also take advantage of the sensitive environment variables feature so that secret values are protected from being read in the future.

Similarly, users are advised to review account activity logs and environments for suspicious activity, either through the dashboard or CLI.

Other tips included:

• Look out for recent, unexpected or suspicious-looking deployments
• Delete those that arouse suspicious
• Ensure Deployment Protect is set to Standard at a minimum
• Rotate Deployment Protection tokens, if set

Who else should worry?

Vercel said the attack on Context’s Google Workspace OAuth app was the subject of a “broader compromise, potentially affecting its hundreds of users across many organisations”.

Meanwhile, Context AI has confirmed that the hackers “likely compromised OAuth tokens for some of our consumer users”.

The firm said it in the process of contacting everyone identified as potentially impacted, with specific guidance on next steps.

Jaime Blasco, CTO of Nudge Security, advised users to switch to an “admin-managed consent” model when dealing with third-party applications.

"Start with OAuth consent. Most Google Workspace and Microsoft 365 environments are still configured to let any employee grant third-party apps access to their enterprise account,” he said.

"Inventory what you already have. OAuth grants accumulate, People try a tool, forget about it, leave the company, and the grant keeps living in the tenant with whatever scopes it asked for. Quarterly audits aren't enough especially when now we have agents using these grants. You need continuous visibility into who granted what, what scopes they granted, and whether the integration is even still being used."

FOLLOW US ON SOCIAL MEDIA

Boris Cherny, creator of Anthropic’s Claude Code tool, has revealed the cause of a leak that saw 500,000+ lines of source code exposed online.

In a post on X, Cherny said “mistakes happen” amid reports the leak was an accident on the part of an Anthropic employee.

“As a team, the important thing is to recognize it’s never an individual’s fault - it’s the process, the culture, or the infra,” he said.

In this instance, Cherny noted there was a “manual deploy step that should have been better automated”.

“Our team has made a few improvements to the automation for next time, a couple more on the way,” he added.

The leak marks the second for the AI provider in the space of a week. Reports from Fortune on 26 March revealed information pertaining to an upcoming AI model launch were found in a publicly accessible data cache.

Files reviewed by Fortune showed the company is working on a new model, dubbed ‘Claude Mythos’, which a spokesperson said represents a “step change” in capability and could pose cybersecurity risks.

What happened with the Claude Code leak?

Reports of a potential leak first emerged online on Tuesday 31 March, with security researcher Chaofan Shou claiming that source code was leaked through a map file in the company’s npm registry.

The leak prompted a flurry of activity online, with data backed up to a GitHub repository that was forked thousands of times, per reports from Techradar.

A Cloudflare storage bucket is believed to have contained 1,900 TypeScript files with upwards of 500,000 lines of code, as well as details on built-in tools and slash command libraries.

Anthropic has confirmed the incident and attributed the leak to human error, corroborating Cherny’s comments that steps have been taken to prevent a similar situation in future.

"A Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed," a spokesperson told ITPro.

"This was a release packaging issue caused by human error, not a security breach. We're rolling out measures to prevent this from happening again.

Claude Code has rapidly become one of Anthropic’s most popular tools since launching, helping automate code generation tasks for software developers.

Figures touted in the wake of a recent funding round for Anthropic show Claude Code’s run-rate revenue has reached more than $2.5 billion. While exact figures on user numbers are unclear, active weekly users are believed to have doubled since 1st January amid soaring popularity.

Indeed, recent analysis from Techcrunch found the tool - along with Claude Cowork - are now massive drivers of paid subscriptions at the firm.

FOLLOW US ON SOCIAL MEDIA

The European Commission has confirmed that it's been hit by a cyber attack on its Europa.eu web platform.

The Europa.eu platform hosts the websites of the Commission itself, along with the European Parliament, European Council, and other EU institutions. The attack, which has been claimed by the ShinyHunters extortion gang, targeted the website's host cloud infrastructure and was detected on 24 March.

"Immediate steps were taken to contain the attack," it said in a statement. "The Commission's swift response ensured the incident was contained and risk mitigation measures were implemented to protect services and data, without disrupting the availability of the Europa websites."

There are signs that data has been stolen, and the Commission is notifying all of the bodies that may have been affected. Internal systems weren't affected by the attack, it said.

"The Commission will continue to monitor the situation and take all necessary measures to ensure the security of its internal systems and data," it said. "It will analyze the incident and use the results to further enhance its cybersecurity capabilities."

What happened with the Commission attack?

The attack is believed to have affected the Commission's AWS account, impacting multiple databases and reportedly exposing hundreds of gigabytes of data.

According to Dark Web Informer, the extortion group ShinyHunters has claimed responsibility. The group said it had accessed mail servers, databases, confidential documents, contracts, "and much more sensitive material," and released more than 90GB of files on its Tor data leak site.

The data is believed to include emails and attachments, a full SSO user directory, DKIM signing keys, AWS config snapshots, NextCloud/Athena data and internal admin URLs.

ShinyHunters first appeared on the scene in 2020, and has recently been responsible for a series of high profile attacks, frequently targeting SSO credentials and Salesforce data.

Victims include Google, Chanel, Canada Goose, and Panera Bread. It mainly uses social engineering – particularly voice phishing – for its attacks.

Just two weeks ago, Salesforce was forced to issue another customer alert after uncovering an ongoing campaign targeting customers using misconfigured Experience Cloud platforms – a campaign claimed by ShinyHunters.

This latest attack is the second time this year that the European Commission has been hacked. In February, it revealed that a data breach impacting the central infrastructure managing mobile devices might have given attackers access to some staff names and mobile phone numbers.

No mobile devices were compromised, it said, and the incident was contained and systems cleaned within nine hours.

The Commission is promising to do better, saying: "As Europe confronts persistent cyber and hybrid attacks targeting essential services and democratic institutions, the Commission is actively working on enhancing the EU's cybersecurity resilience."

FOLLOW US ON SOCIAL MEDIA

PayPal has issued an alert after a data breach saw customers exposed for several months.

According to a notification seen by BleepingComputer and sent to affected customers on February 10, the breach was caused by an error in the firm's PayPal Working Capital (PPWC) loan application.

This saw personal data belonging to a "small number" of customers exposed to unauthorized individuals between July 1 and December 13 last year. Data exposed in the incident is believed to have included business contact information.

Some customers did have unauthorized activity on their accounts as a result, although PayPal said it's refunded those people.

"Our investigation determined that some of your personal information was affected by this incident," the letter read.

"This could have included your business contact info: name, email address, phone number, business address combined with your Social Security number, and date of birth."

The company said it has launched an investigation into the incident and terminated the unauthorized access to PayPal’s systems - rolling back the code changes that caused the breach in the first place.

Affected PayPal accounts have also had passwords reset, requiring customers to create new login details. The payments giant also confirmed it has implemented enhanced security controls.

Free credit monitoring services will be offered to affected customers through Equifax, and customers are being told to be on the alert for any suspicious activity or fraudulent transactions.

PayPal data breach could have downstream impact

While PayPal has implemented changes in the wake of the breach, Kevin Knight, CEO of Talion, warned the incident could have downstream implications for customers, particularly given contact information was exposed.

“PayPal has said it has refunded customers for the fraudulent transactions and updated the passwords on impacted accounts, but the attacker still has access to information that can’t be easily changed, which can still be of value to them in phishing scams and to sell to initial access brokers,” he said.

Phishing scams are a common occurrence in the wake of data breaches, with threat actors using exposed contact details such as email addresses to target victims.

Notably, Knight said the timing of the letter is also concerning, with the incident having first occurred months before and the fact it was discovered in December.

"What is most concerning about this breach is that an organization as large and reputable as PayPal, which holds highly sensitive data on its customers, has waited two months to notify individuals about this incident," said Knight.

"While credit monitoring has been offered, victims were left in the dark, while the actor behind the incident was able to access their financial and personal data and conduct fraudulent transactions."

In its customer notification, PayPal insisted it had not delayed the notification "as a result of any law enforcement investigation," it reads.

ITPro has approached PayPal for comment.

FOLLOW US ON SOCIAL MEDIA

Credentials stolen from a single government official enabled threat actors to access a French national database containing data on more than 1.2 million bank accounts.

The attackers were able to access the Fichier des comptes bancaires (Ficoba) database, which contains files on all bank accounts opened in France.

Stolen credentials were used by the threat actors to impersonate a civil servant and view data that included personal information such as bank account numbers, account holders' names and addresses, IBANs, and, in some cases, the account owner's tax number.

"Starting at the end of January 2026, a malicious actor, who had impersonated a civil servant with access rights as part of an inter-ministerial information exchange, was able to consult a portion of this file," Ficoba said in a statement.

"As soon as this incident was detected, immediate access restrictions were implemented to stop the attack, limit the scope of the data accessed and extracted from this database – which reportedly includes 1.2 million accounts – and prevent any further unauthorized access."

Ficoba said IT teams at the French Public Finances Directorate, along with other bodies, were working to address this incident and strengthen security. The incident has also been reported to the French Data Protection Authority (CNIL), it said.

The chief of France's Public Finances told Agence France-Presse that affected individuals will be contacted over the next few days. Officials insisted the breach did not give attackers access to account balances or transactions.

FICOBA breach prompts phishing frenzy

Security researchers at Cybernews said that this may not be the full story. While account balances can’t be accessed from this data alone, this incident “still poses risks” to users across the country.

“Exposed PII, such as names and addresses, can be combined with other leaked data to profile people and construct convincing phishing campaigns that can pose as the national bank.”

When combined with tax identification numbers, researchers said this increases the risk of fraud and identity theft, as these numbers can be used as identifiers on government platforms.

Ficoba has warned that "numerous" scams are circulating via email or SMS, aiming to obtain information or payments from users.

Individuals contacted have been urged not to reply directly, and should instead contact their local tax office directly through the secure messaging system in their online account or by phone to check out the authenticity of the message.

Meanwhile, Michael Jepson, penetration testing manager at CybaVerse, said it's worrying that a single individual within the organization was able to access large volumes of sensitive data unilaterally.

"Traditionally, access scope often increased with seniority, an approach that is now widely recognized as problematic in modern threat environments," he said.

"Modern security practice recognizes that access should be determined strictly by operational need rather than hierarchy. Senior figures are frequently primary targets for threat actors, which makes excessive privilege particularly dangerous."

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have warned Substack users to be on the lookout for potential phishing scams after the blogging platform suffered a data breach.

In an email distributed to users, CEO Chris Best revealed a “security incident” saw account email addresses, contact numbers, and “other internal metadata” exposed.

Exact details on how the breach unfolded are yet to be disclosed. However, on 3 February, the organization discovered an issue that allowed an unauthorized third-party to “access limited user data.”

A preliminary investigation found the data was first accessed in October 2025, Best added.

“Importantly, credit card numbers, passwords, and financial information were not accessed,” the email reads.

“We have fixed the problem with our system that allowed this to happen. We are conducting a full investigation and are taking steps to improve our systems and processes to prevent this type of issue from happening in the future.”

Substack hasn’t revealed information on the scale of the breach. However, reports from BleepingComputer suggest the incident could have impacted over half a million users.

On Monday 2 February, a threat actor uploaded a database to BreachForums allegedly containing 697,313 stolen records.

Substack users should remain vigilant

Best noted that there is currently no evidence that information exposed in the breach is being misused, but nonetheless warned users to remain vigilant.

“We encourage you to take extra caution with any emails or text messages you receive that may be suspicious,” he said.

That same advice has since been reiterated by cybersecurity experts. Phishing attacks are a common occurrence in the wake of a data breach as cyber criminals look to capitalize on contact information to dupe unsuspecting users.

This information often represents a goldmine for threat actors, according to Jamie Akhtar, CEO of CyberSmart.

“While Substack has stated that sensitive data such as passwords and payment information was not accessed, exposure of contact details like email addresses and phone numbers can still be highly valuable to cyber criminals,” he said.

“This type of data is often used as the foundation for targeted phishing, impersonation attempts, and wider social engineering campaigns.”

Javvad Malik, lead security awareness advocate at KnowBe4, echoed Akhtar’s comments, but noted that the information provided by Substack is limited, which could still leave some users at risk.

“It is a bit light on the details which can help people accurately judge the risk and take concrete action,” he said. The timeline is significant. If the data was accessed in October 2025, but only just disclosed, it's a significant dwell time.”

“That isn't to say there's negligence on part of Substack because detection can be difficult,” Malik added. “But impacted users deserve a clearer explanation of how the breach was identified.”

FOLLOW US ON SOCIAL MEDIA

Nike has confirmed it is investigating a potential data breach amidst claims hackers have accessed sensitive company data.

Hackers behind the WorldLeaks ransomware group claim to have accessed up to 1.4TB of internal data, adding the company to its leak site.

Exact details on the data stolen by the group are yet to be revealed. However, a sample published by the group points toward design and manufacturing information.

Data shared by WorldLeaks includes directories titled “Women’s Sportswear” and “Training Resources - Factory”, for example.

At present, it does not appear that sensitive customer or employee data was compromised in the attack.

In a statement given to Infosecurity Magazine, a spokesperson for Nike said: “We always take consumer privacy and data security very seriously. We are investigating a potential cybersecurity incident and are actively assessing the situation.”

ITPro has approached Nike for additional comment and clarification.

Nike data breach could have ramifications

Initial analysis of the data dump from threat intelligence group, Justabreach, suggests the data stolen by WorldLeaks dates as far back as 2020.

While no customer data appears to have been compromised thus far, the long-term damage of this attack could be significant for the sportswear giant.

Sensitive documents on manufacturing processes and product information have been impacted.

Shankar Haridas, head of UKI at ManageEngine, said this could have huge ramifications for the company.

“For large brands, the risk rarely stops at customer records,” he said.

“Product roadmaps, supplier contracts, pricing models, and internal comms are often just as valuable to attackers. A leak of this scale can create long-term competitive and reputational damage, even before the facts are fully confirmed.”

What you need to know about WorldLeaks

WorldLeaks has claimed a number of victims in recent years, including Dell and Tata Technologies, and is believed to be the successor group to Hunters International.

The notorious threat group confirmed plans to shut down in July last year, offering victims a decryptor to regain access to stolen data. The announcement wasn’t quite a goodwill gesture, however.

Speaking to ITPro at the time, Dray Agha, senior manager of security operations at Huntress, said the group was essentially just rebranding under a new name.

David Sancho, senior threat researcher at Trend Micro, said the attack against Nike follows a dormant period for the group, which now appears to have large corporations in its crosshairs once again.

“There’s no question that World Leaks is going after large companies,” he said. “Nike is the latest and follows a ‘quiet period’ between the last observed Hunters International attack (last July) and the first attack after the group rebranded as “World Leaks” (last September).”

Sancho noted that the “standout trait” of WorldLeaks is that it’s a data exfiltration group, meaning it focuses primarily on stealing data, then asking for money in exchange for not leaking it to the public.

“This stands in contrast with the traditional ransomware strategy of encrypting the data and asking for payment in order to decrypt it.”

FOLLOW US ON SOCIAL MEDIA

Cloud marketplace and distributor Pax8 has issued a warning about a security breach that saw data on around 1,800 customers exposed.

An email was sent to 40 of the company's UK-based managed service provider (MSP) customers with an attachment generally used for day-to-day operational reporting.

This contained Pax8 pricing and program-related information associated with 17 stock-keeping units within four Microsoft Modern Work product categories.

Almost all the customers whose data was shared were UK-based, with one located in Canada.

The email, titled "Potential Business Premium Upgrade Tactic to Save Money," was sent on January 13 and contained more than 56,000 entries in all. A follow-up email was sent immediately requesting deletion of the email, and asking recipients not to forward it.

Pax8 insists the breach did not involve any personally identifiable information (PII), authentication credentials, payment data, or any information that could enable system access.

However, the leaked data could reveal to the 40 competitors with which it was shared the MSP’s full client portfolio, what licenses they hold, and when these are due to expire, along with internal Pax8 pricing and margin information.

Threat actors are approaching affected MSPs

The data leak could help the victims' competitors poach customers by revealing which organizations use Pax8 as their distributor, the size of each customer's Microsoft environment, the timelines for contract renewal, and potentially the pricing tiers being paid.

A more sinister development has unfolded in the wake of the incident, however, with cyber criminals apparently capitalizing on the situation. According to reports from BleepingComputer, threat actors have approached some of the affected MSPs and offered to buy the data.

This information could be used by cyber criminals to craft convincing phishing attacks, for example by allowing an attacker to email a company just before their contract renewal date, pretending to be their MSP and requesting payment.

The company said it has launched an internal review to work out how the breach happened and plans to ramp up its safeguards and processes to prevent a similar incident taking place in the future.

Access instructions have now been sent to affected partners, the company revealed, allowing them to securely review information that may have been shared.

That access will be limited to the Pax8 Marketplace Primary Partner Admin and/or Partner Admin for each organization.

"Our focus continues to be on responding directly to partner questions and supporting impacted partners as they review their data and follow up with us," said the firm. "In parallel, our internal review remains ongoing as we continue to strengthen safeguards and processes."

Pax8 said partners with questions or concerns should submit a Support ticket through the Pax8 Marketplace referencing UK Partner Information Incident – Jan 13, 2026.

FOLLOW US ON SOCIAL MEDIA

Password manager provider LastPass has been hit with a £1.2 million fine for failing to prevent a massive data breach.

The Information Commissioner's Office (ICO) found that a combination of two incidents over two days in August 2022 put more than 1.6 million customers at risk.

According to the data protection watchdog, the company “failed to implement sufficiently robust technical and security measures”.

Commenting on the fine, information commissioner John Edwards said LastPass failed customers and “fell short” on expectations that the company would employ robust measures to protect personal data.

“Password managers are a safe and effective tool for businesses and the public to manage their numerous login details and we continue to encourage their use,” he said.

“However, as is clear from this incident, businesses offering these services should ensure that system access and use is restricted to ensure risks of attack are significantly reduced," Edwards added.

“LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure. However, the company fell short of this expectation, resulting in the proportionate fine being announced today."

The LastPass breach explained

The LastPass breach unfolded in two separate phases. In the first incident, a hacker compromised an employee’s corporate laptop and gained access to the company’s development environment.

While no personal information was taken, encrypted company credentials were - which, if decrypted, would allow access to the company’s backup database.

LastPass took steps to mitigate the hacker’s activity, but thought the encryption keys were safe, as they were stored in the account vaults of four senior employees, outside the area accessed by the hacker.

However, the next day, the hacker targeted one of these employees, gaining access to their personal device via a known vulnerability in a third-party streaming service.

The hacker then installed a keylogger, capturing the employee’s master password and bypassing multi-factor authentication (MFA) using a trusted device cookie. This gave access to the employee’s personal and business LastPass vaults, which were linked using a single master password.

Thereafter, the threat actor gained access to the employee’s business vault, which contained the Amazon Web Service (AWS) access key and decryption key. When combined with information taken the day before, this allowed the hacker to extract the contents of the backup database containing the customers' personal data.

LastPass’ ‘zero knowledge’ system prevented disaster

As the ICO noted in its post-mortem of the incident, the threat actor responsible for the breach wasn't able to decrypt encrypted passwords and other credentials.

This was thanks to LastPass’ use of a ‘zero knowledge’ encryption system, whereby the master password required to access a password vault is stored locally on a customer’s own device and never shared with LastPass.

While this represented a reprieve for the company and users, the impact of the breach was felt by customers as late as December 2024.

A probe by crypto investigator ZachXBT found hackers stole $12.38 million in cryptocurrency from LastPass users on 16 and 17 December 2024.

Chris Linnell, associate director of data privacy at Bridewell, said the ICO fine represents a “big moment” for the industry and highlights the need for more robust processes at password managers.

These platforms hold the keys to the castle for enterprises and consumers alike, and security practices at providers should reflect that.

"It’s not the largest penalty we’ve seen under John Edwards, but it definitely plays into public expectations - people trust password managers to keep them safe, so when they fall short, it makes headlines," he said.

"For service providers, this is a reminder that security isn’t just about the product itself. You need strong information security and privacy frameworks in place, and you can’t ignore the less obvious risks - backups, secondary databases, and other systems that attackers often target.”

MORE FROM ITPRO

• Most passwords take a matter of minutes to crack
• Passwords are a problem: why device-bound passkeys can be the future of secure
• How to create a secure password policy

OpenAI has admitted a security breach at a third-party supplier exposed customer emails, location information, and “limited analytics data related to some users of the API”.

The supplier, Mixpanel, provides data analytics services via OpenAI’s developer platform. OpenAI said the platform is used to help “understand product usage” and improve services for its API product, platform.openai.com.

On 9 November, Mixpanel discovered an attacker gained unauthorized access to systems. They then exfiltrated a dataset containing “limited customer identifiable information and analytics information”.

A full outline of data exposed, per an OpenAI statement on the breach, includes:

• Names provided via Mixpanel API accounts
• Email addresses associated with the API account
• “Aproximate course location based on API user browsers” (including city, state, and country)
• Information on operating systems and browsers used to access the API account
• Referring websites associated with the API account

OpenAI has been keen to stress that the breach only affects developers and not general ChatGPT users. It also said developer credentials – including passwords, payment information, and government IDs – weren’t exposed.

OpenAI added that it’s currently in the process of notifying those affected by the incident.

A swift response from OpenAI

Upon discovery of the breach, OpenAI said it removed Mixpanel from production services and began a review of affected datasets.

While the investigation is still ongoing, the company noted it has so far found “no evidence of any effect on systems or data outside Mixpanel’s environment”.

The company has since terminated its use of the data analytics platform and said it will conduct a review of its broader supplier ecosystem.

“Trust, security, and privacy are foundational to our products, our organisation, and our mission, OpenAI said in a statement. “We also hold our partners and vendors accountable for the highest bar for security and privacy of their services.”

Jake Moore, global cybersecurity advisor at ESET, commended OpenAI for its “swift move” in alerting users and cutting ties with the supplier. Many organizations try to minimize security incidents and keep them “under the radar”, he said.

“Companies often fear the aftermath of an attack and presume it will be brand damaging,” Moore commented. “However, openness is now deemed far more important and speed is usually of the essence in making anyone affected aware of the situation.”

Developers warned to remain vigilant

OpenAI said information exposed in the breach could be used by hackers to carry out future attacks on users and encouraged them to “remain vigilant”.

These types of warnings are common in the wake of a data breach, according to Moore.

“Even though the exposed data was low-sensitivity, it could still be misused in the likes of social engineering techniques or via phishing attacks because attackers could combine the data such as name, email, even approximate location data to craft convincing fraudulent messages,” he explained.

“As within the wake of typical data compromises, those affected need to remain vigilant for suspicious emails or other strange communications.”

MORE FROM ITPRO

• Gartner says 40% of enterprises will experience ‘shadow AI’ breaches by 2030
• AI breaches aren’t just a scare story any more – they’re happening in real life
• Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposed

Salesforce has launched an investigation into a spate of customer data theft incidents following a breach at a third-party application provider.

In a statement on Thursday 20 November, the CRM giant revealed it had revoked access and refresh tokens for Gainsight-published applications as part of its response to the breach.

Gainsight is a software as a service (SaaS) provider specializing in customer success and product experience, available to Salesforce customers via the company’s App Exchange platform.

“Salesforce has identified unusual activity involving Gainsight-published applications connected to Salesforce, which are installed and managed directly by customers,” the company said in an advisory.

Salesforce noted that a preliminary investigation suggests the breach could have enabled “unauthorized access to certain customers’ Salesforce data” through Gainsight connections.

“Upon detecting the activity, Salesforce revoked all active access and refresh tokens associated with Gainsight-published applications connected to Salesforce and temporarily removed those applications from the AppExchange while our investigation continues,” the advisory added.

Exact details on the scope of the incident and those affected are yet to be revealed. However, Salesforce confirmed that affected customers have been notified.

Gainsight the latest third-party incident for Salesforce

The Gainsight incident marks the latest third-party application breach for Salesforce in recent months.

Earlier this year, the Salesloft Drift attack impacted hundreds of companies including Google, Zscaler, Cloudflare, and Palo Alto Networks.

Hackers gained access to sensitive customer data through compromised OAuth tokens associated with the third-party application.

Brian Soby, CTO and co-founder at AppOmni, said the scale of Gainsight integrations means this latest incident could have equally wide-reaching implications for an array of businesses.

“Gainsight is widely deployed and tightly connected to Salesforce, Slack, Google, Microsoft, and numerous other SaaS environments,” he said. “Because of that footprint, customers now have to quickly identify every location where Gainsight was integrated.”

Soby added that the Gainsight incident once again highlights “persistent weaknesses” in SaaS supply chain security practices.

“The attack closely mirrors the earlier Drift breach, which also targeted Salesforce, Google Workspace, and other widely used SaaS platforms,” he told ITPro.

“The scale of the Gainsight compromise underscores that many organizations did not apply the lessons they should have learned from Drift, leaving large portions of their SaaS supply chain exposed.”

MORE FROM ITPRO

• These five countries recorded the most third-party data breaches last year
• How to help your customers close gaps in their supply chain
• Insurance sector urged to sharpen up third-party risk management as attacks surge

Google has hit back at claims of a massive Gmail breach, suggesting recent reports stem from a “misunderstanding of infostealer databases”.

In a post on X, the tech giant insisted Gmail's defenses are “strong, and users remain protected” in a bid to calm customer concerns.

“The inaccurate reports are stemming from a misunderstanding of infostealer databases, which routinely compile various credential theft activity occurring across the web,” Google said.

“It’s not reflective of a new attack aimed at any one person, tool, or platform.”

The company’s sharp response comes after a host of publications reported that 183 million Gmail accounts had been compromised in what one outlet described as a "huge data breach".

Speculation over a breach mounted after a sizable dataset was added to the Have I Been Pwned database, which allows web users to check if their credentials have been compromised.

In a blog post dissecting the dataset, which was collated by researchers at Synthient, creator Troy Hunt noted these records were the culmination of several years’ worth of infostealer activity, instead of a newly discovered breach.

Regardless, several outlets pounced on the situation. In response to a comment under his original blog post, Hunt echoed Google’s response to the coverage.

“I think they're deliberately misleading and designed to drive eyeballs on ads whilst the truth gets buried somewhere further down in the story,” he wrote.

Gmail breach claims are a dime a dozen

This isn’t the first time Google has been forced to push back against reports of a Gmail breach. Indeed, it’s the second in the space of three months.

In late August, reports of a major incident that impacted some 2.5 billion Gmail accounts began circulating online, once again prompting a statement from the tech giant in which it refuted the claims.

In a blog post, Google described reports as “entirely false” and said there was no risk to users.

"We want to reassure our users that Gmail’s protections are strong and effective,” the company said.

“Several inaccurate claims surfaced recently that incorrectly stated that we issued a broad warning to all Gmail users about a major Gmail security issue. This is entirely false.”

MORE FROM ITPRO

• Warning issued over critical flaws spotted in TP-Link routers
• CISA issues alert after botched Windows Server patch exposes critical flaw
• Enterprises can’t keep a lid on surging cyber incident costs

A data breach affecting over six million people has resulted in a £14 million fine for professional services firm Capita following an investigation by the UK Information Commissioner’s Office (ICO).

The fine is split between Capita Plc and Capita Pension Solutions, which have been billed £8 million and £6 million respectively for the March 2023 attack.

According to the ICO, the UK’s data protection authority, Capita failed in three areas: preventing privilege escalation and unauthorized lateral movement, responding appropriately to security alerts, and penetration and risk assessment.

The attack began on 22 March 2023 after an employee downloaded a malicious file, and an alert was issued within just 10 minutes. However, the company failed to act on this alert for over a day – 58 hours in total versus a target response time of one hour.

A lack of tiering for admin accounts also enabled the attacker to escalate privileges and move laterally across multiple domains, the ICO found.

According to the data protection watchdog, these actions were flagged on at least three occasions as a vulnerability but none were acted on. Ultimately this enabled the attacker to gain access to critical data, nearly one terabyte of which was exfiltrated.

On 31 March – nine days after the attack started – the threat actor deployed ransomware onto the company’s systems and reset all user passwords.

In total, 6.6 million people had their personal information stolen from Capita’s systems, including pension records, staff records, and the details of customers of organizations supported by Capita.

John Edwards, the UK’s information commissioner, said: “The scale of this breach and its impact could have been prevented had sufficient security measures been in place.

“When a company of Capita’s size falls short, the consequences can be significant. Not only for those whose data is compromised – many of whom have told us of the anxiety and stress they have suffered – but for wider trust amongst the public and for our future prosperity. As our fine shows, no organisation is too big to ignore its responsibilities.”

"Maintaining good cybersecurity is fundamental to economic growth and security,” Edwards continued. “Every organization, no matter how large, must take proactive steps to keep people's data secure. Cyber criminals don't wait, so businesses can't afford to wait either – taking action today could prevent the worst from happening tomorrow."

In response to the settlement, Capita said it’s “committed to upholding the security of its data and protection of our systems for our clients and their customers”.

The company added that it has contacted everyone affected or potentially affected by the breach.

Capita’s CEO Adolfo Hernandez, who joined the company a year after the attack, added: “When I joined as CEO … I accelerated our cybersecurity transformation, with new digital and technology leadership and significant investment. As a result, we have hugely strengthened our cybersecurity posture, built in advanced protections and embedded a culture of continuous vigilance."

MORE FROM ITPRO

• 74% of companies admit insecure code caused a security breach
• AI breaches aren’t just a scare story any more – they’re happening in real life
• Average Brit hit by five data breaches since 2004

The Plex streaming platform had told customers to reset their passwords following a data breach.

In an advisory, the company said users should also sign out of any connected devices that are currently logged in and enable two-factor authentication if they haven’t already.

"An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included device type, emails, user names and authentication data," it said.

"We’ve already addressed the method that this third party used to gain access to the system, and we’re undergoing additional reviews to ensure that the security of all of our systems is further strengthened to prevent future attacks."

Plex also said that any account passwords accessed were securely-hashed, and couldn't be read by a third party. It added that credit card data wasn't stored on its servers and was therefore secure.

Who is responsible for the Plex data breach?

No group has claimed responsibility for the attack thus far. While it's not known how many people may have been affected, the company has around 25 million users around the world.

Kev Breen, senior director of cyber threat intelligence at Immersive, said this makes Plex – and other streaming services – an attractive target.

“The infrastructure of streaming platforms often includes cloud storage, content delivery networks, APIs, and user-facing apps. This complex infrastructure creates multiple entry points for attackers to exploit," Breen commented.

"As well as personally identifiable information, streaming platforms also store data on user preferences, meaning attackers can develop more targeted social engineering campaigns. Such data is likely to be leveraged by cyber criminals to extort money from Plex, as well as for identity theft and phishing campaigns.

Plex has previous

This isn't the first time that Plex has experienced a data breach. Back in 2015, threat actors gained access to the company's forum and blog server, exposing IP addresses, private messages, emails, and encrypted forum passwords.

Similarly, in 2022 the company warned customers of a breach after a database containing account information such as usernames and passwords was compromised.

Its message to users was uncannily similar to those being received by customers today. On that occasion, though, the company's servers struggled to cope with the large volume of password reset requests being made.

Breen warned that it's not just home users that need to take the warning seriously.

"Plex is unlikely to be used in an enterprise setting; however, people often re-use passwords or follow patterns when creating them. This means that a user affected at home could also have an impact on organizations," he said.

"Business leaders must be able to demonstrate cyber capabilities across their workforce through regular exercises, and improve them through targeted skills development.”

MORE FROM ITPRO

• Zscaler is the latest company hit in the expanding Salesloft Drift victims list
• Average Brit hit by five data breaches since 2004
• 74% of companies admit insecure code caused a security breach

Cloud security firm Zscaler is latest organization to disclose that it's been hit by a data breach linked to the recent Salesloft Drift attacks.

The incident, like many others, involved the theft of OAuth tokens connected to Salesloft Drift, a third-party application used for automating sales workflows that integrates with Salesforce databases to manage leads and contact information.

"As part of this campaign, unauthorized actors gained access to Salesloft Drift credentials of its customers including Zscaler," the company said in an advisory.

"Following a detailed review as part of our ongoing investigation, we have determined that these credentials have allowed limited access to some Zscaler Salesforce information."

Data accessed in the breach consisted of publicly available details for points of contact, along with specific Salesforce-related content.

This included names, business email addresses, job titles, phone numbers, location details, Zscaler product licensing and commercial information, and plain text content from certain support cases, although this didn't include attachments, files, or images.

"After extensive investigation, Zscaler has currently found no evidence to suggest misuse of this information," said the firm.

Zscaler moved quickly to limit exposure

In its advisory, the company said it has since moved to revoke Salesloft Drift’s access to Zscaler’s Salesforce data, rotated other API access tokens to be on the safe side, and launched a detailed investigation into the scope of the event.

This includes close collaboration with Salesforce to examine the incident.

It has also implemented extra safeguards and strengthened protocols to defend against similar incidents in the future, launched a third party risk management investigation for vendors used by Zscaler, and strengthened customer authentication protocol when responding to customer calls.

This, the company said, aims to safeguard against potential phishing attacks in the wake of the incident. Like others impacted in Salesloft-related attacks, Zscaler has warned customers to remain vigilant for social engineering attempts.

"It’s crucial to exercise caution regarding unsolicited communications, including emails, phone calls, or requests for sensitive information," it said.

"Always verify the source of communication and never disclose passwords or financial data via unofficial channels."

What happened with the Salesloft Drift attacks?

The breach stems from an incident in early August, when attackers identified as UNC6395 compromised OAuth tokens associated with sales workflow automation software Salesloft Drift.

They then used these stolen tokens to extract large volumes of data from a number of corporate Salesforce instances, including sensitive credentials such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens.

Last week, Google’s Threat Intelligence Group (GTIG) warned that the breach had been broader than first thought.

"Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations," it said.

"We now advise all Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised.”

MORE FROM ITPRO

• Google says 'claims of a major Gmail security warning are false'
• 4.5 million people just had their data exposed in the TransUnion breach
• Enterprises need to patch these Citrix flaws now

Credit scoring and monitoring firm TransUnion has confirmed a data breach which exposed data belonging to nearly 4.5 million people.

TransUnion is one of the big three credit reporting agencies in the US, along with Experian and Equifax, collecting and updating credit information on consumers and businesses.

In a filing with the Office of the Maine Attorney General, the company revealed it experienced a breach on 28th July, which it discovered two days later. It said the data of 4,461,511 people had been affected.

"We recently experienced a cyber incident involving a third-party application serving our US consumer support operations. The unauthorized access includes some limited personal information belonging to you," TransUnion said in a template letter now being sent to customers.

"We regret any concern caused by this incident and take seriously the responsibility to help secure consumer information."

What data was exposed in the TransUnion breach?

According to TransUnion, no credit information was accessed during the cyber incident. The company has promised customers two years’ free credit monitoring services and proactive fraud assistance from its Cyberscout subsidiary.

The incident is widely believed to be just the latest Salesforce breach, following attacks on more than 700 companies, including Google, Adidas, Farmers Insurance, Allianz Life, Workday, Cisco, Chanel and several airlines.

These attacks have been claimed by ransomware group ShinyHunters, as well as, more recently, a group known as UNC6395.

“This incident poses a significantly higher risk to victims than many of the other Salesforce related breaches disclosed so far because it involves Social Security numbers in addition to contact and support data," said Cory Michal, chief security officer at AppOmni.

“While most of the previous attacks have exposed sensitive but less critical information, the compromise of SSNs creates far greater potential for identity theft, financial fraud, and long-term misuse of personal data," he added.

"That elevates the impact of the TransUnion breach well above other recent disclosures, even if the number of affected individuals is smaller."

Fresh Salesforce warnings issued

Earlier this week, Google's Threat Intelligence Group warned of 'widespread data theft', saying that attackers weren't just exploiting the Salesforce integration with Salesloft Drift, but that other integrations were impacted too.

Salesloft Drift customers should treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised, it said.

Many more disclosures are likely coming, Michal suggested.

“What we’re seeing now is likely the leading edge of a much larger wave of public disclosures, as investigations conclude and regulatory timelines come due," he said.

"It’s also important to note that the TransUnion disclosure appears to stem from an earlier UNC6040 campaign, based on the breach dates in their filing, which underscores that multiple overlapping threat actor groups are actively exploiting SaaS environments like Salesforce."

The breach could cost TransUnion dear. In 2017, the personal data of more than 147 million people was accessed when rival credit bureau Equifax was hacked.

The company was forced by the Federal Trade Commission to set aside $425 million to help affected consumers.

MORE FROM ITPRO

• AI breaches aren’t just a scare story any more
• Air France and KLM confirm customer data stolen in third-party breach
• Average Brit hit by five data breaches since 2004

The true scale of the Allianz Life data breach has been laid bare, with leaked credential notification site Have I Been Pwned putting the number of affected accounts at 1.1 million.

The numbers represent the vast majority of the company's 1.4 million customers in the North America region, along with the data of financial professionals and some Allianz Life employees contained in Salesforce Accounts and Contacts databases.

Data exposed in the incident is believed to include dates of birth, email addresses, genders, names, phone numbers, and physical addresses. According to Allianz, Social Security numbers were also taken.

More than seven-in-ten of the exposed email addresses had already been affected by previously-disclosed data breaches.

When the breach was first confirmed, Allianz Life said that 'most' of its North American customers had been affected, but that its core network and policy administration systems didn't appear to have been accessed.

The insurer said it would provide a full consumer notice once it has finished identifying and contacting affected individuals.

Jon Abbott, CEO of ThreatAware, described the scale of the breach as “significant”, noting that the data leaked represents a treasure trove of information to target victims.

"The sensitive and valuable information held in CRM tools is exactly why it’s targeted by attackers,” he said. “The data can be used by other cyber criminals for identity theft and phishing campaigns."

What happened with the Allianz Life data breach?

The breach, which took place on July 16 and was discovered a day later, is believed to have involved a social engineering attack that involved impersonating IT support staff.

This saw hackers ask employees to accept a connection to a Salesforce Data Loader, which was then used to exfiltrate data from the CRM system.

The attackers used malicious OAuth applications to infiltrate Salesforce instances, before downloading the company databases.

The attack has since been claimed by the notorious ShinyHunters threat group, which is believed to overlap with the Scattered Spider and Lapsus groups. They are now believed to be preparing a data leak site to pressure Allianz and other victims into making a ransom payment.

The group, which first emerged in 2020, is also believed to be responsible for attacks on Salesforce systems at several retailers, as well as at Google, Cisco, Qantas, Santander, Ticketmaster, Tokopedia, AT&T and most recently Workday.

Workday confirmed it had fallen victim to an attack last week, warning customers that exposed information could then be used in follow-up social engineering attacks - a common tactic for threat actors.

"Groups such as ShinyHunters rely on fast moving social engineering tactics – this typically involves calling and emailing employees of the victim organization and attempting to extort them. If this does not work, they then launch a leak site with the aim of pressuring victims into payment," said Abbott.

"This pattern in their attacks is why the security fundamentals are so important. Accurate asset inventories, tamper-proof identity verification and hardened service desk processes are all essential.”

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Phishing tactics: The top attack trends
• Cheap cyber crime kits can be bought on the dark web for less than $25

Workday has confirmed a data breach after threat actors gained access to a third-party customer relationship management (CRM) platform.

In a blog post on Friday, the HR tech giant said hackers gained access to sensitive information hosted on the affected CRM system, but insisted no customer tenants – or the data contained within – were accessed.

Information exposed in the breach primarily included contact details such as names, email addresses, and phone numbers, the company revealed.

“We recently identified that Workday had been targeted and threat actors were able to access some information from our third-party CRM platform,” the company stated in its advisory.

“There is no indication of access to customer tenants or the data within them. We acted quickly to cut the access and have added extra safeguards to protect against similar incidents in the future.”

Given the nature of the information exposed in the breach, Workday warned customers to be wary of potential social engineering campaigns in the wake of the incident.

“It’s important to remember that Workday will never contact anyone by phone to request a password or any other secure details,” the firm said. “All official communications from Workday come through our trusted support channels.”

Kevin Marriott, senior manager of cyber and head of SecOps at Immersive, said this is a typical tactic observed in the aftermath of a data breach.

“This information is then used in subsequent social engineering attempts, or combined with other data already collected to make future social engineering attempts even more personalized, using the data captured," he said.

Workday data breach the latest CRM-based incident

While Workday didn’t specifically identify the CRM system affected in the breach, the news comes in the wake of a string of Salesforce-based attacks on enterprises globally.

Threat intelligence research shows that the ShinyHunters threats group has conducted a wide-reaching campaign targeting Salesforce users in recent months.

Companies impacted in the campaign are believed to include Qantas, Allianz Life, Adidas, and several other retail brands worldwide.

Similarly, Google recently confirmed it had been attacked as part of the campaign. The discovery came after threat researchers at the tech giant investigating the ShinyHunters group realized it too had fallen victim.

The social engineering campaign involves duping employees into linking a malicious OAuth app to the target company’s Salesforce instances.

Once access to an impacted database has been achieved, threat actors are then able to access, query, and exfiltrate sensitive information from customer environments, according to Google’s blog post detailing the campaign.

Marriott noted that CRM tools are a popular target for threat actors, largely due to the volume of useful information hosted on these platforms.

“CRM tooling is often a key target for threat actors as they typically store limited, but valuable information that threat actors can either use themselves or sell on, with databases full of information that is useful such as email addresses and other personal information,” he said.

MORE FROM ITPRO

• Banking details of 30 million Santander customers exposed during breach
• Nearly one-third of ransomware victims are hit multiple times
• US extradites French ShinyHunters hacker, faces 123 years in prison

Bouygues Telecom, France's third-largest phone carrier, has confirmed a data breach which exposed personal data belonging to millions of customers across the country.

The company, which provides mobile, broadband, and digital TV services, said it discovered the breach, affecting 6.4 million of its 27 million customers, earlier this week.

It acted quickly to halt the attack and tighten its security procedures, the bank said in a statement, and is in the process of contacting those affected.

The data exposed in the breach includes contact details, contractual data, civil status data or, in the case of business customers, company data, as well as International Bank Account Numbers (IBANs).

Bouygues Telecom said bank card numbers and passwords were not affected.

"This situation could expose you to fraud attempts: fraudulent emails or calls. By using your information, a fraudster could pretend to be Bouygues Telecom or another company (bank, insurance company, etc.) and try, for example, to obtain additional information such as your credit card number or your usernames and passwords. We recommend that you be particularly vigilant," the firm told customers.

"Never share your usernames and passwords. Be particularly wary of calls from fake bank advisors who may try to gain your trust by giving your name or account number. If in doubt, end the call and call your bank or bank advisor back at their usual number."

While the leaked IBAN numbers aren't enough to allow attackers to carry out transactions such as direct debits or transfers, the company is warning customers to check withdrawals and be wary of phishing attempts citing their bank and account number.

The company said it has notified France’s data protection authority, the CNIL, and national cybersecurity agency the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI).

Bouygues Telecom the latest French carrier hit

Bouygues Telecom is the latest french telecoms company to be hit with a data breach in recent weeks. Late last month, Orange announced that it had fallen victim to a cyber attack.

In this case, personal data doesn't appear to have been stolen, although the company was forced to warn its customers worldwide that service disruptions were likely as it worked to fix the issue.

It's not known who was responsible, or whether the two incidents were the work of the same hackers. However, similar attacks on US phone providers have been attributed to the China-linked Salt Typhoon hacking group.

Earlier this year, ANSSI issued a warning that the telecoms sector was under what it described as an 'intense' threat, citing incidents including a DDoS attack on OVH and suggesting that they were the work of Chinese groups.

"Cyber attacks are very common and affect any company, despite all existing security tools and procedures. We are constantly evolving our security procedures to address the constantly evolving attackers' methods," said Bouygues Telecom.

"Thanks to the responsiveness of our technical teams, we were able to resolve this incident and notify our customers as quickly as possible. Protecting our customers' data is a priority at Bouygues Telecom."

MORE FROM ITPRO

• Air France and KLM confirm customer data stolen in third-party breach
• A cybersecurity researcher just discovered a treasure trove of leaked accounts
• 26 million CVs were exposed when a recruiting software firm left a misconfigured Azure container open

Hackers have gained access to the personal data of potentially hundreds of KLM and Air France customers following a supply chain attack.

News of the breach first appeared on the KLM website in Dutch, and an Air France-KLM spokesperson confirmed the situation, saying the intrusion happened last week (week commencing 28 July 2025).

In a statement to ITPro, a spokesperson said: “Air France and KLM confirm that they are investigating a fraudulent access to the data of some of our customers.

“An unusual activity was detected on a third-party platform used by our contact centers, which led our IT security team, together with the third-party system involved, to swiftly implement corrective measures to put an end to the incident.”

Protective measures have been taken to stop the same thing happening again, the spokesperson confirmed, adding that “no sensitive data such as password, travel data, Flying Blue Miles balance, passport or credit card numbers were disclosed”.

The breach only affects Air France and KLM customers, and both airlines are in the process of contacting these individuals. Customers are advised to be mindful of suspicious emails and phone calls in the wake of the incident.

The affected supplier has not been named for security reasons. However, KLM has reported the incident to the Dutch data protection regulator (Autoriteit Persoonsgegevens), while Air France has contacted the French equivalent (CNIL).

In a statement given to ITPro, a spokesperson for CNIL confirmed it has been notified of the breach and that affected individuals have been contacted.

"The CNIL is in the process of analyzing the notification," the spokesperson said. "The data involved are: Name, surname, contact information, Flying Blue membership number and status, and the subject of questions sent to the company by email."

The latest in a long-line of supply chain attacks

Supply chain attacks have become an increasingly popular method of compromise for cyber criminals.

In 2024, security firm Checkmarx revealed that 63% of companies had been the victim of a supply chain attack in the previous two years, while 75% of organizations using open source code packages said they were concerned or very concerned about software supply chain security.

Research also revealed in 2024 that nearly all (97%) of the top 100 US banks were hit by third party data breaches such as the one affecting Air France-KLM, with a similar number subject to fourth-party breaches (suppliers to their suppliers).

SecurityScorecard’s 2025 Global Third-Party Breach Report meanwhile found that the Netherlands – home to KLM – was one of the countries where businesses were most likely to suffer a third-party breach, coming in second after Singapore.

MORE FROM ITPRO

• The Scattered Spider hacker group has a new industry in its crosshairs
• Average Brit hit by five data breaches since 2004
• AI breaches aren’t just a scare story any more – they’re happening in real life

AI adoption is greatly outpacing AI security and governance – that’s the message being sent by IBM following the release of its latest Cost of Data Breach report.

According to the company, 20% of the 600 organizations it surveyed had suffered a breach “due to security incidents involving shadow AI”.

“For organizations with high levels of shadow AI, those breaches added USD 670,000 to the average breach price tag compared to those that had low levels of shadow IT or none,” it added.

While shadow AI is a problem in its own right according to the IBM report, legitimate AI tools can also cause problems.

“On average, 13% of organizations reported breaches that involved their AI models or applications,” the report reads.

Most commonly, these weren’t direct attacks, but instead took place in the supply chain, for example through compromised apps, APIs, or plug-ins. The knock-on effects include operational disruption (31%) and broad data compromise (60%).

The report goes on to note, however, that once again a lack of governance and oversight was a significant factor in these breaches. Indeed, only 3% of organizations affected had proper AI access controls in place.

Generative AI is being used as an attack tool

Poor internal AI governance and shadow AI aren’t the only risks the technology presents to organizations. Cyber criminals are themselves making use of generative AI as a new tool in their arsenal.

IBM noted that one-in-six breaches in the past year involved AI, with would-be attackers able to polish and scale phishing campaigns and other social engineering attacks.

“IBM previously found gen AI reduced the time needed to craft a convincing phishing email from 16 hours down to only five minutes,” the report noted.

“This year’s report shows the impact: on average, 16% of data breaches involved attackers using AI, most often for AI-generated phishing (37%) and deepfake impersonation attacks (35%).”

Data breach winners and losers

While it’s hard to claim there are any winners when it comes to being the receiving end of a data breach, some find themselves losing more than others.

IBM found that the cost of a data breach in the US had increased by just under $1 million, bringing the average cost from $9.36 million to $10.22 million in 2025.

Organizations in the Middle East, the second most expensive region in which to experience a data breach, faced an average cost of $7.29 million, down from $8.57 million in 2024.

Like the US, Benelux and Canada also experienced a rise in costs, albeit less significant, going from $5.90 million to $6.24 million and $4.66 million to $4.84 million respectively.

The remaining geographies surveyed all sat at $4.14 million or under, with Brazil coming in last at $1.22 million, a fall of $140,000 from $1.36 million in 2024.

Another loser on the data breach scene is hackers themselves. IBM cited what it calls “ransomware fatigue”, with a slight majority (63%) of organizations hit by ransomware attacks in 2025 saying they didn’t pay the ransom, compared to 41% that did in 2024.

MORE FROM ITPRO

• Average Brit hit by five data breaches since 2004
• These five countries recorded the most third-party data breaches last year
• Cyber attacks are costing UK firms billions every year

Insurance giant Allianz Life is investigating a breach that has reportedly seen the data of most of its North American customers stolen.

Allianz Life, a subsidiary of Germany-based financial services firm Allianz SE, sells annuities and life insurance and has around 1.4 million customers in the North America region.

The hackers are believed to have accessed personally identifiable data related to the majority of these customers, along with the data of financial professionals and some Allianz Life employees.

Customer data from other geographical regions is believed to be unaffected, and the company's core network and policy administration systems don't appear to have been accessed.

According to a filing with the attorney general in Maine, the attack took place on July 16 and was discovered a day later. Allianz Life said it would provide a full consumer notice once it has finished identifying and contacting the individuals who have been affected.

The company also stated that it has notified the FBI, and said that affected individuals will be given 24 months of credit monitoring and identity theft protection.

Who’s behind the Allianz Life breach?

The attack is believed to have taken place through a third-party provider, with the company telling TechCrunch that this was a cloud-based customer relationship management (CRM) system.

Similarly, the breach is believed to have been carried out via a social engineering attack.

Tarun Desikan, zero trust evangelist and EVP of cloud edge security at leading cybersecurity firm SonicWall, said the incident once again highlights long-running problems with social engineering and identity management.

“While multi-factor authentication is critical, it’s not bulletproof. Attackers now bypass MFA with sophisticated social engineering techniques," said Desikan

"Attack vectors are constantly evolving and cyber criminals are relentless in developing new tactics, techniques, and procedures. This necessitates a proactive and flexible approach to cybersecurity, which includes adopting protocols and security architectures like Zero Trust.”

According to BleepingComputer, the attack may have been carried out by the ShinyHunters threat group. The claims follow a warning last month from Mandiant that the group had started to target Salesforce CRM customers in social engineering attacks.

The hackers were reported to be impersonating IT support staff and asking employees to accept a connection to Salesforce Data Loader, which they are then using to exfiltrate data from Salesforce and extort the company.

ShinyHunters, which first emerged in 2020, does have a track record of similar attacks, and has targeted dozens of major organizations, including Microsoft, Santander, Ticketmaster, Tokopedia and AT&T.

In the case of AT&T, the data of 110 million users was accessed, with AT&T reportedly paying a $370,000 ransom.

ITPro has approached Allianz Life for clarification.

MORE FROM ITPRO

• Average Brit hit by five data breaches since 2004
• ‘All US forces must now assume their networks are compromised’ after Salt Typhoon breach
• Cyber attacks are costing UK firms billions every year

Security researchers have uncovered a misconfigured recruitment database leaking almost 26 million files, and security experts have warned it's a trend that's becoming far too common.

According to analysis from Cybernews, TalentHook, an online applicant tracking platform connecting HR departments with people looking for work, had left a misconfigured Azure Blob storage container open.

As a result, the resumes of millions of US citizens, including their full names, email addresses, phone numbers, education details, professional details, and employment history were exposed.

“The detailed personal information in the exposed resumes enables attackers to conduct highly targeted phishing campaigns," the Cybernews team said.

"Email addresses and phone numbers can be used in phishing emails, SMS scams, or fraudulent job offers, tricking individuals into revealing sensitive information such as ID scans or banking details."

The data could be a boon for cybercriminals looking to snare unsuspecting jobseekers, researchers have warned. In recent months, groups such as the North Korean state-sponsored Lazarus group have been specifically targeting jobseekers.

Research earlier this year showed the group has targeted victims using LinkedIn, for example, or by posing as recruiters and approaching targets via email and WhatsApp.

Sharpen up on storage configurations

Tim Mackey, head of software supply chain risk at Black Duck, said the incident shows the huge risks posed by easily overlooked misconfigurations and urged enterprises to sharpen up processes.

"Misconfigured systems, VMs, containers, micro-services, and data stores are nothing new,” he said.

"For example, the sample of the exposed data for this breach masks key identifiable information, such as email addresses and cell phone numbers, indicating that encryption of those elements wasn’t a priority or that an unsecured API was also part of the breach."

Dray Agha, senior manager of security operations at Huntress, echoed Mackey’s comments, noting that incidents like these are becoming increasingly common.

"Misconfigured cloud storage (like the unsecured Azure container in this case) remains an alarmingly common yet preventable issue, especially in sectors handling highly personal information," said Agha.

"Organizations must implement rigorous configuration audits, enforce least-privilege access controls, and conduct continuous monitoring to prevent such massive exposures of stored personal data."

The Cybernews researchers said they have contacted TalentHook, and advised the company to change the access controls to restrict public access and secure the container, and to update permissions to ensure that only authorized users or services have the necessary access.

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Phishing tactics: The top attack trends
• Hackers are using PDFs to impersonate big brands in a new threat campaign

Financial services firms across Europe are contending with a sharp rise in third-party and fourth-party breaches, new research shows, with nearly every major financial institution across the region hit during the last year.

Breaches of these kinds increased by a quarter compared to the year prior, according to SecurityScorecard. Indeed, 96% experienced at least one third-party breach in the past year, and 97% at least one fourth-party breach.

Financial services firms in the UK reported the highest number of third-party breaches, followed by Germany and Switzerland, while Malta, Luxembourg, and Portugal had the lowest exposure and highest average cybersecurity grades.

On an individual basis, Switzerland has the most third-party breaches per institution, the study found, followed by the Netherlands and UK. Researchers noted that these findings highlight an increasingly complex vendor ecosystem alongside glaring gaps in risk oversight.

"A 25% surge in third-party breaches among Europe’s top financial institutions is more than a warning, it is a call to action," said Corian Kennedy, senior manager of threat insights and attribution at SecurityScorecard.

"Cyber threats are no longer confined to the perimeter. They are embedded deep within supply chains. Institutions must evolve from reactive to proactive defense strategies to meet the escalating challenge."

Only 7% of financial institutions suffered a direct breach, down from 8% the year before, with malware and insider threats remaining key culprits. However, even without direct breaches, supplier vulnerabilities impacted nearly all the institutions surveyed.

Incidents such as the MOVEit vulnerability, which led to over $65 billion in damages, show just how bad the effects of third-party breaches can be, researchers warned.

In Europe, notable cyber attacks over the last year included the breach of Zürcher Kantonalbank, which saw customer account balances and personal information exposed via its mobile app.

In the same month, Credit Suisse - now UBS - reported a cyber attack affecting 19,000 Indian employees, compromising a raft of sensitive personal data.

According to SecurityScorecard's data, just ten threat actor groups were responsible for 44% of global cyber incidents, with Cl0p, APT28, and Cobalt Group the main culprits in third-party exploitation.

Vendor dependency is a big problem

Crucially, the report from SecurityScorecard noted that a growing dependence on a small group of vendors continues to amplify risk.

Just 15 companies now represent 62% of the global tech market, researchers found, underlining the grave risks faced by organizations if just one were to be compromised.

As a result, the company called for a more harmonized approach to third-party risk governance across Europe, particularly in high-exposure jurisdictions which are all subject to regulation under the Digital Operational Resilience Act (DORA).

Organizations should continuously monitor third- and fourth-party vendor networks and improve application and network security capabilities, researchers said.

Efforts to strengthen DNS health, endpoint security, and patching cadence in high-risk environments were also highlighted by researchers.

Similarly, SecurityScorecard advised organizations to align with DORA requirements by integrating continuous, evidence-based oversight into procurement and vendor management, it said.

MORE FROM ITPRO

• Cyber attacks against UK firms dropped by 10% last year, but experts say don't get complacent
• US healthcare data breaches are out of control
• Nearly all of the top US banks were impacted by third party breaches last year

Hackers have nabbed LexisNexis data belonging to more than 360,000 people via GitHub.

LexisNexis Risk Solutions (LNRS) began sending data breach notifications to impacted individuals last week, but admitted it was told about the leak at the beginning of April — and that the actual breach had occurred in December of last year.

The data broker said that its own systems weren't breached, explaining that the data was taken from GitHub by an "unknown threat actor" using a compromised company account, according to a company statement.

The company's investigation revealed that "software artifacts" were accessed in the breach, as well as personal information.

According to a letter sent by LNRS to affected individuals, that included names, phone numbers, postal and email addresses, social security numbers, driver's license numbers, and dates of birth.

"No financial or credit card information was affected," the letter notes. "We have no evidence that your data has been further misused."

A government filing shows that 364,333 people were affected by the break.

LNRS said in the data breach notice sent to customers that it was working with law enforcement on the incident.

In a statement given to ITPro, the company said: "On Tuesday, April 1, 2025, LexisNexis Risk Solutions (LNRS) received a report from an unknown third party claiming to have accessed certain information belonging to LNRS.

"Our Information Security team, in consultation with a forensic firm, immediately began investigating and confirmed that some data which was held in GitHub, a third-party platform used by LNRS for software development purposes, was acquired by an unknown third party."

The statement added: "There was no compromise of our own systems, infrastructure, or products. We are notifying approximately 360,000 individuals and appropriate regulators. We have also reported this incident to law enforcement."

Questionable timeline?

One security expert criticised the delay between the incident happening, LNRS being informed, and the subsequent disclosure.

Ilya Kolochenko, CEO at ImmuniWeb and a Fellow at the British Computer Society (BCS), said informing affected individuals in the wake of a breach should be of paramount importance to any organization.

"The timeline of the incident detection and disclosure is a bit surprising for a company offering legal and other comparatively sensitive services: the incident reportedly happened in December 2024, was detected in April 2025 after receiving information from the attackers, while disclosed only in May," Kolochenko said.

“Given that a lot of personal data was reportedly compromised, the incident detection and response timeline is pretty far from being perfect, to put it mildly."

That said, Kolochenko admitted that spotting such issues with partner platforms wasn't easy.

"Incidents stemming from compromised third-party repositories, like GitHub, are not trivial to detect and may even remain totally undetected," he said.

MORE FROM ITPRO

• Criminal records, financial data exposed in cyber attack on Legal Aid Agency
• US healthcare data breaches are out of control
• Hacked law firm 'didn't think it was a data breach' – the ICO disagreed

A cybersecurity researcher has uncovered a mysterious, publicly accessible database containing millions of login credentials from services including Facebook, Apple, and Microsoft.

The publicly exposed database was not password-protected or encrypted, and contained more than 184 million unique logins and passwords, adding up to 47.42GB of raw credential data.

The data included emails, usernames, passwords, and the URL links to the login or authorization for the accounts.

"The database contained login and password credentials for a wide range of services, applications, and accounts, including email providers, Microsoft products, Facebook, Instagram, Snapchat, Roblox, and many more," said cybersecurity researcher Jeremiah Fowler.

"I also saw credentials for bank and financial accounts, health platforms, and government portals from numerous countries that could put exposed individuals at significant risk."

The origin of the database is something of a mystery. The IP address linked the database to two domain names. One was parked and unavailable while the other was apparently unregistered and available to purchase.

Fowler contacted the hosting provider, which took the database down, but didn't reveal the customer's identity. One hint may be the fact that, while most text was in English, the files were listed as 'senha' - Portuguese for password.

He also messaged multiple email addresses listed in the database and was able to validate several records, with the victims confirming that they contained their accurate and valid passwords.

It's not known how long the database was exposed. However, Fowler said there are clear signs that the exposed data has been harvested by some type of infostealer malware.

"It is not known exactly how this specific data was collected, but cybercriminals use a range of methods to deploy infostealers," said Fowler.

"For instance, they often conceal malware within phishing emails, malicious websites, or cracked software. Once the infostealer is active, the stolen data is often either circulated on dark web marketplaces and Telegram channels or used directly to commit fraud, attempt identity theft, or launch further cyber attacks."

Fowler advises users to change passwords and to delete sensitive documents, such as tax forms, medical records, contracts, and passwords from their emails. They should only share data like this through encrypted cloud storage systems, rather than email, he said.

"Databases like this are regularly bought, sold, and repackaged on dark web forums like BreachForums. Massive credential dumps are part of an ongoing black market where breached data is commoditized and often aggregated from multiple incidents over time," commented Cory Michal, chief security officer at AppOmni.

"What’s new isn’t the existence of the data, but the scale, the recency of some credentials, and the targeting of identity providers that are widely used to access SaaS and cloud services — making this breach especially potent for enabling downstream account takeovers."

MORE FROM ITPRO

• Criminal records, financial data exposed in cyber attack on Legal Aid Agency
• Cyber attacks against UK firms dropped by 10% last year, but experts say don't get complacent
• US healthcare data breaches are out of control

Two new reports have highlighted the immense scale of US healthcare data breaches, with 409 million personal records exposed over the last two years.

According to research from application security firm Indusface, there were 1,200 breaches in the US healthcare sector in the last 24 months, with 83% of incidents leaving patient records exposed.

Texas recorded 66 data breaches, the most of any state, as well as the most people affected, at 14,371,828. The state’s biggest breach was that of Concentra Health Services in January 2024, which saw data belonging to nearly four million people accessed or stolen.

California had the second-highest number of individuals affected by data breaches, at 9,218,788. Notably, it also experienced the largest healthcare data breach in the study, affecting 4,700,000 people, when Blue Shield of California’s member data was shared with Google for advertising.

At the other end of the scale, Ohio saw 45 incidents affecting the data of 3,767,504 people, and Massachusetts just 28, exposing data belonging to 3,743,999.

"The healthcare sector is vulnerable to these breaches due to both the vast amount of sensitive patient data, which is often sold to third parties for a high price, and weak or outdated software and systems," said Venky Sundar, founder and president of Indusface.

"According to Verizon’s latest DBIR, vulnerability exploits have now overtaken phishing as a leading cause of data breaches. What is particularly concerning is how patching an average vulnerability takes 200-plus days."

Ransomware contributing to healthcare data breaches

The figures come after a study from Michigan State University, Yale University, and Johns Hopkins University found that ransomware-related breaches have become a key issue for healthcare providers.

Researchers found that although ransomware accounted for just 11% of breaches in 2024 by number, those attacks alone were responsible for 69% of all patient records compromised that year.

The number of attacks has also been rising steadily over the last decade. While in 2010 there were no ransomware breaches, there were 222 in 2021, accounting for nearly a third of all major healthcare breaches that year.

Similarly, the overall share of breaches caused by hacking or IT incidents surged from 4% in 2010 to 81% in 2024.

Researchers said these numbers probably underestimate the true extent of the problem thanks to underreporting, reluctance to disclose ransom payments, and the fact that the study didn't look at smaller breaches affecting fewer than 500 individuals.

"Ransomware has become the most disruptive force in healthcare cybersecurity,” said John Jiang, Eli Broad endowed professor of accounting and information systems in the MSU Broad College of Business and lead author of the study.

"Healthcare providers have limited cybersecurity resources, so it’s essential to focus protection on the most sensitive types of information. The solutions are within reach — what we need now is coordination, transparency and urgency."

MORE FROM ITPRO

• Healthcare systems are rife with exploits — and ransomware gangs have noticed
• Five ways cyber criminals target healthcare and how to stop them
• More than 5 million Americans just had their personal information exposed

A data breach at Yale New Haven Health (YNHHS) has exposed data belonging to millions of people – and lawsuits have already been filed.

YNHHS runs more than 360 locations across Connecticut, New York, and Rhode Island, and is notifying patients that their personal data might have been affected.

According to an entry on the US Department of Health and Human Services breach portal, the data breach impacted 5,556,702 patients.

"The information involved varied by patient, but may have included demographic information (such as name, date of birth, address, telephone number, email address, race or ethnicity), Social Security number, patient type, and/or medical record number," said YNHHS.

"YNHHS’ electronic medical record and treatment information were not involved or accessed, and no financial account or payment information was involved in this incident."

The breach was first discovered on March 8th when YNHHS spotted unusual activity affecting its IT systems. The organization took steps immediately to contain the incident and began an investigation with the help of external cybersecurity experts from Mandiant.

It also reported the incident to law enforcement. However, patients weren't notified of the breach until late April.

It's now offering complimentary credit monitoring and identity protection services, but only to those whose Social Security number was involved.

Yale New Haven Health faces legal action

Legal action has already been launched. Hartford law firm Cicchiello & Cicchiello has filed two identical lawsuits in the Connecticut District Court on behalf of Michael Liparulo of New London and Jon Nathanson of Fairfield.

The lawsuits allege YNHHS failed to protect personally identifiable and health information, and took too long to notify patients.

Similarly, the cases claim IT practitioners failed to encrypt files, train employees on data security, or implement basic security measures such as multi-factor authentication.

They’re calling for damages, free lifetime identity protection, and major changes to the health system’s cybersecurity practices.

Healthcare in the crosshairs

Healthcare organizations are a prime target for hackers thanks to the vast amount of highly personal data that they hold. According to recent research from Trustwave, for example, 21% of all ransomware attacks worldwide are targeted at public health and government healthcare organizations.

The study found that 45% of attacks exploited public-facing applications and 56% of public-facing applications exploited were against Log4j, with 9% of all attacks coming from the threat group RansomHub.

Third-party threats within supply chains continue to pose 'significant' risks, the researchers found.

"Healthcare artificial intelligence and technology adoption presents a spectrum of risks that few other industries need to navigate. The risk is not just incredibly sensitive data privacy, but human life and quality of patient care," said Kory Daniels, CISO at Trustwave.

"Complex supply chains, lapses in patches and credential management all have consequences too serious for anyone in the healthcare industry to ignore".

MORE FROM ITPRO

• Healthcare systems are rife with exploits — and ransomware gangs have noticed
• Healthcare organizations need to shake up email security practices
• More than 300,000 US healthcare patients impacted in suspected Rhysida cyber attacks

Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.

In a statement confirming the incident, the firm said customer data was “acquired by an unauthorized party that we understand exploited zero-day vulnerabilities within Cleo's platform in October 2024 and December 2024”.

“Hertz immediately began analyzing the data to determine the scope of the event and to identify individuals whose personal information may have been impacted,” the statement added.

Customer data exposed in the breach may vary, the company said, but is believed to include customer names, contact information, dates of birth, credit card details, and information pertaining to driver’s licenses.

Similarly, a limited number of customers may have had US social security numbers or government ID information stolen in the breach.

"A very small number of individuals may have had their Social Security or other government identification numbers, passport information, Medicare or Medicaid ID (associated with workers' compensation claims), or injury-related information associated with vehicle accident claims impacted by the event," the company warned.

Hertz said it is yet to observe any “misuse of personal information” linked to the breach, but is offering customers two years of identity monitoring services. The company also advised customers to remain vigilant for potential fraudulent activity.

Hertz the latest to disclose Cleo vulnerability impact

Hertz’ confirmation makes it the latest in a string of companies to have fallen victim to the Cleo breach. First disclosed last year, a vulnerability in the popular managed file transfer (MFT) service was pounced on by the Clop ransomware group.

The threat group initially claimed it had stolen data belonging to more than 60 companies as a result of the zero-day. This list has since grown, and earlier this year Western Alliance Bank confirmed it was among the growing list of victims.

Other confirmed victims include Chicago Public Schools, Champion Home Builders, and WK Kellogg.

Fresh research from ReliaQuest shows the impact of the Cleo breach will continue to grow for enterprises globally. Indeed, analysis by the security firm found the incident fueled a 23% increase in overall ransomware activity between Q4 and Q1 2025.

“Clop’s exploitation of Cleo highlights how weaknesses in systems can ripple across interconnected industries, disrupting supply chains, halting operations, and impacting countless businesses simultaneously,” the firm said in a blog post.

Rebecca Moody, head of data research at Comparitech, echoed this warning, noting that there’s likely to be “many more breach notifications from this exploit” as Clop has since added over 350 victims to its data leak site.

Dray Agha, senior manager of security operations at Huntress, said the incident underlines the “significant risks” posed by vulnerabilities in third-party platforms like Cleo.

“This highlights the importance of maintaining robust vulnerability management programs to identify and address security gaps in software promptly, especially those used for sensitive data transfer.”

Agha added the incident reflects a growing trend of cyber criminals targeting secure file transfer platforms. 2023, for example, saw a number of high-profile organizations impacted by the MOVEit data breach.

MORE FROM ITPRO

• The new ransomware groups worrying security researchers in 2025
• The ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry
• Warning issued over prolific 'Ghost' ransomware group

More than four-in-ten UK businesses were hit by a cyber attack last year, marking a decrease on the year prior – but security experts have warned enterprises to still remain vigilant.

The government's latest Cybersecurity Data Breaches Survey revealed that 43% of businesses were affected, with a total of 612,000 cyber attacks or breaches recorded across the year. That's noticeably fewer than in the previous year, when the figure was 50%.

There were 61,000 attacks against charities, affecting three-in-ten, down from 32% in the previous year.

But the fall wasn't spread evenly across the board. While micro and small businesses fell victim to fewer phishing attacks, the figures for medium and large businesses were pretty much the same as in 2024.

Small businesses in particular showed the most improvement in several cyber hygiene practices, with nearly half using cybersecurity risk assessments, up from 41% in 2024.

More than six-in-ten revealed they now have cyber insurance, up from 49% in 2024, and the proportion with a formal cybersecurity policy rose slightly. Meanwhile, 53% now have a business continuity plan, up from 44% in 2024.

High-income charities, though, got worse. Only three-quarters now carry out activities to identify cybersecurity risks, down from 86% in 2024.

Similarly, just one-in-five said they review immediate supplier risks, down from 36% in 2024, and the proportion having a formal cybersecurity strategy in place fell from 47% to 39%.

Cybersecurity is improving, but don’t get complacent

Jonathan Gill, CEO of Panaseer, said that while the survey showed positive signs, complacency could cause bigger problems down the line.

"Most breaches don’t happen because organizations ignored security, but because they believed they were secure when, in reality, they weren’t,” he said.

"They assume they’re covered, but blind spots in visibility mean critical assets go unpatched, misconfigurations slip through the cracks, and security gaps persist without anyone realizing it," Gill added.

The most common type of breach involved phishing attacks, which affected 85% of businesses and 86% of charities.

Matt Cooke, cybersecurity strategist for EMEA at Proofpoint, said this was unsurprising given the continued success of phishing attacks by cyber criminals globally.

"Email has been the number one threat vector for many years now – why? Because it continues to work."

The effects of these breaches included a near-doubling in temporary loss of access to files or networks - 7%, up from 4% in 2024 - while charities reported an increase in loss of access to third-party services at 5%, up from 1% in 2024.

The resulting costs were significant, the survey found, standing at around £1,600 for businesses and £3,240 for charities on average.

Both businesses and charities appear to be pretty poor at dealing with supply chain risks, the survey warned. Only 14% of businesses said they reviewed the risks posed by their immediate suppliers, and only 7% looked at their wider supply chain.

These figures were even worse for charities, at 9% and 4% respectively.

Board-level cybersecurity focus is dwindling

A concerning trend highlighted in the survey centered around board-level responsibility for cybersecurity, which has steadily declined among businesses since 2021.

Just over one-third (38%) of businesses had a board member with responsibility for cybersecurity in 2021 - this has since dropped to 27%.

Cooke noted that this is a “worrying development” and further highlights a degree of complacency among organizations of all sizes.

"Cybersecurity can’t be treated as an after-thought by anyone in an organization - particularly those at board level, who control the purse strings and business priorities."

The findings are expected to inform the upcoming Cyber Security and Resilience Bill, which is set to introduce sweeping changes to shore up national cybersecurity capabilities and impose stricter requirements on businesses.

Etay Maor, chief security strategist at Cato Networks, said the growing threats posed by cyber criminals, and the increased use of AI tools by sophisticated threat groups, poses questions for lawmakers.

"The bill should incorporate measures to address the growing threat of AI-powered attacks, ensuring businesses and consumers are adequately protected from increasingly sophisticated cyber criminals,” he said.

"A holistic approach, encompassing proactive threat prevention, robust incident response, and mandatory reporting of AI-driven attacks, is crucial to effectively mitigate the evolving cyber landscape," Maor added.

MORE FROM ITPRO

• The role of cyber security in the UK’s tech renaissance
• The UK cybersecurity sector is worth over £13 billion, but experts say there’s huge untapped potential if it can overcome these hurdles
• UK underestimates threat from hostile states, says new NCSC head

Europcar has reportedly suffered a massive data breach affecting as many as 200,000 customers.

The car rental firm has confirmed the hack to BleepingComputer, adding that it's assessing the damage and notifying affected individuals.

The statement follows a post in an underground forum from a hacker claiming to have obtained all the firm's GitLab repositories, accessing more than 9,000 SQL files with backups that contain personal data.

Similarly, the threat actor claimed to have gained access to at least 269 .ENV files used to store configuration settings for applications, environment variables, and sensitive information.

The hackers in question have threatened to publish 37GB of data, including backups and details about the company’s cloud infrastructure and internal applications.

Europcar has denied that the full repositories were stolen, however. Exposed data included only the names and email addresses of Goldcar and Ubeeqo users, with bank and card details and passwords not exposed.

Source of Europcar data breach still unknown

It's not known how the hackers were able to compromise Europcar’s GitLab account.

However, Martin Reynolds, field CTO at security firm Harness, said one of the most common ways cybercriminals compromise systems such as these is to spoof a popular code repository infected with an infostealer malware, then trick developers into downloading it.

To protect themselves from these threats, Reynolds advised organizations to make sure their repositories are protected by minimal token permissions, so only users who should have access can perform actions such as editing or downloading new code.

They should also automate scans at the moment developers add to source code repositories, so that company data won't be exposed in the event of a breach.

"This should be combined with DevSecOps best practices such as automated governance and security checks to scan new code for malicious code – like infostealer malware – before it is introduced," he said.

"These approaches make it more difficult for spoofed code repositories to make it through to live environments where they can be used to gain access to other systems.

"By embedding these types of controls early in the software lifecycle, security stays a priority, not an afterthought, and ensures that company secrets are kept under lock and key."

This attack has been confirmed - unlike an alleged intrusion last year, in which a hacker forum member claimed to have accessed the personal information of nearly 50 million customers. Europcar denied the claims.

MORE FROM ITPRO

• Everything you need to know about GitLab Duo Enterprise
• Hackers are exploiting critical GitLab password reset vulnerability
• A ‘significant increase’ in infostealer malware attacks left 3.9 billion credentials exposed to cyber criminals last year

A Birmingham-based software provider has been handed a £3 million fine for security failings that led to a ransomware attack on the NHS.

The Information Commissioner's Office (ICO) said Advanced Computer Software Group failed to use appropriate security measures before the 2022 attack, which put the personal information of tens of thousands of NHS patients at risk. 

Advanced provided the NHS with a range of patient management and health-related products, including Adastra, Caresys, Carenotes, Odyssey, Crosscare, Staffplan, and eFinancials.

But there were gaps in its use of multi-factor authentication (MFA), a lack of comprehensive vulnerability scanning, and inadequate patch management, according to the data protection watchdog.

"The security measures of Advanced’s subsidiary fell seriously short of what we would expect from an organisation processing such a large volume of sensitive information," said information commissioner John Edwards.

"While Advanced had installed multi-factor authentication across many of its systems, the lack of complete coverage meant hackers could gain access, putting thousands of people’s sensitive personal information at risk."  

The hackers, believed to be the LockBit ransomware group, accessed certain systems of Advanced’s health and care subsidiary via a customer account that lacked MFA.

Personal information belonging to 79,404 people was taken in the attack, including details of how to gain entry into the properties of 890 people who were receiving care at home.

Emergency prescription services, ambulance dispatching systems, and the non-emergency 111 phone line were affected, with some healthcare staff unable to access patient records.

"People should never have to think twice about whether their medical records are in safe hands," said Edwards.

"To use services with confidence, they must be able to trust that every organisation coming into contact with their personal information – whether that’s using it, sharing it or storing it on behalf of others – is meeting its legal obligations to protect it."

The fine forms part of a voluntary settlement. And while very large, it's less than Advanced might have been facing - the ICO warned last summer in its provisional findings that it planned to hit the company with a £6.09 million penalty.

What's changed since then is the company's proactive engagement with the National Cyber Security Centre (NCSC), the National Crime Agency (NCA) and the NHS, and the steps it's taken to mitigate the risk to those impacted by the attack. 

However, the ICO said the fine sends a salutary message to other organizations that may be a bit slapdash about the security of personal data.

"With cyber incidents increasing across all sectors, my decision today is a stark reminder that organisations risk becoming the next target without robust security measures in place," said Edwards.

"I urge all organisations to ensure that every external connection is secured with MFA today to protect the public and their personal information - there is no excuse for leaving any part of your system vulnerable." 

MORE FROM ITPRO

• More than 300,000 US healthcare patients impacted in suspected Rhysida cyber attacks
• Cyber attacks on healthcare organizations are surging
• Healthcare organizations need to shake up email security practices

Singapore and the Netherlands are the world's leading hotspots for third-party data breaches, with more than seven-in-ten organizations falling victim last year.

Figures from SecurityScorecard’s 2025 Global Third-Party Breach Report show third-party breaches are on the rise, accounting for a third of all breaches globally. However, the number is probably higher than that due to a combination of under-reporting and misclassification.

More than four-in-ten ransomware attacks now start through third parties, the study found, with the ransomware group Cl0p the most prolific offender.

"Threat actors are prioritizing third-party access for its scalability. Our research shows ransomware groups and state-sponsored attackers increasingly leveraging supply chains as entry points," said Ryan Sherstobitoff, senior vice president of SecurityScorecard’s Strike Threat Research and Intelligence.

But there's huge national variation, the company noted. For example, Singapore had the highest third-party breach rate at 71.4%, despite relatively few total breaches.

"With its significant overseas Chinese population and strategic position in China’s economic and naval power projection, it’s a prime target," points out the firm.

The Netherlands ranked second, at 70.4%, although this figure was skewed by a major breach at a communications firm that hit a number of utilities.

Japan was third, at 60%, followed by Taiwan at 57.1% and Australia at 50%.

Who’s behind the rise in third-party data breaches?

The main culprit is China, according to SecurityScorecard, with Japan subjected to the most Chinese state-sponsored attacks. Taiwan, meanwhile, was also a key focus for Chinese cyber espionage.

At the other end of the scale, the US has a supply chain attack rate of 30.9%, with the Philippines at 31%, India at 35%, and the UK at 37.2%.

Retail and hospitality was the hardest-hit sector, with a third-party breach rate of 52.4%.

The tech industry was also a leading target for threat actors alongside critical infrastructure sectors such as energy and utilities and the healthcare industry.

Varied attack vectors raising the stakes

In terms of attack vectors, the risks faced by organisations globally are expanding, according to SecurityScorecard. File transfer software topped the list, accounting for 14% of attacks, followed closely by cloud products and services at 8.3%.

"To stay ahead of these threats, security leaders must move from periodic vendor reviews to real-time monitoring to contain these risks before they escalate throughout their supply chain." said Sherstobitof.

Organizations should tailor their security strategies to their particular industry, geography, technology and organizational structure, advised the researchers.

They should mitigate fourth-party risk by requiring vendors to maintain strong third-party risk management programs themselves; and Secure by Design technology should be a must.

Protection of file transfer software, cloud infrastructure, industry-specific services and VPNs should be a priority, with speedy patching, multi-factor authentication (MFA) and continuous security assessments.

MORE FROM ITPRO

• Nearly all of the top US banks were impacted by third party breaches last year
• Insurance sector urged to sharpen up third-party risk management as attacks surge
• Third-party AI tools are muddying sustainability metrics

A war of words has erupted between Oracle and cybersecurity researchers following claims the company suffered a security breach.

In mid-March, a threat actor by the name ‘rose87168’ published six million records, claiming the data was stolen from Oracle’s Cloud federated Single Sign-On (SSO) login service and demanding payment from affected customers.

Posted to the dark web, the sample database allegedly included a list of affected companies, encrypted SSO passwords, Java KeyStore (JKS) files, LDAP information, and more.

“The SSO passwords are encrypted, they can be decrypted with the available files, also LDAP hashed passwords can be cracked,” the threat actor said.

"I'll list the domains of all the companies in this leak. Companies can pay a specific amount to remove their employees' information from the list before it's sold."

Initial analysis from researchers at CloudSEK suggested the root cause of the breach appears to have been a failure to patch a server affected by a critical vulnerability.

“The threat actor has demonstrated sophisticated capabilities by targeting a critical authentication infrastructure,” CloudSEK said in its report. “They’re not only selling the data but also actively recruiting assistance to decrypt the stolen passwords, suggesting an organized and persistent threat operation.”

Oracle hits back at data breach claims

Oracle strongly denied the claims by both the threat actor and CloudSEK, insisting no customers have been impacted.

“There has been no breach of Oracle Cloud,” a spokesperson for the firm told BleepingComputer. “The published credentials are not for Oracle Cloud. No Oracle Cloud customer experienced a breach or lost any data.”

Researchers at CloudSEK have hit back, however, publishing a follow-up report which claims their investigation “paints a different picture”.

CloudSEK said the threat actor provided a sample of customer data and a text file created on login.us2.oraclecloud.com – which researchers said equates to “evidence aligning with their claim that the SSO server was active weeks before the breach surfaced”.

In a comprehensive rebuttal to Oracle’s claims, CloudSEK said its investigation centers around a series of key findings.

This includes the fact that an archived GitHub repository from Oracle’s official “oracle-quickstart” account features a script (mpapihelper.py) using login.us2.oraclecloud.com for OAuth2 token generation.

“This endpoint authenticated API requests for the Oracle Cloud Marketplace, proving its production use,” researchers said. “OneLogin and Rainfocus documentation further validate its role in live SSO setups.”

Similarly, the security firm pointed to what it described as “real users’ exposure” as a sign the claims are legitimate. A host of domains found in public GitHub repositories and Oracle partner guides allegedly match the attacker’s leaked tenant list, CloudSEK noted.

“These are not dummy accounts but Oracle Cloud users, underscoring the breach’s scope.”

Rahul Sasi, CEO and co-founder of CloudSEK, said the firm is “driven by transparency and evidence, not speculation” in response to Oracle’s denial.

“This follow-up report equips the community and Oracle with facts to investigate and mitigate this threat responsibly.”

The potential impact of the Oracle breach

CloudSEK said the alleged breach could have profound implications for Oracle and its customers.

The company said six million records, including sensitive authentication data, could be at risk, thereby resulting in “heightened risks of authorized access and espionage”.

The risk posed by encrypted SSO and LDAP passwords could also “unlock further breaches if cracked,” CloudSEK warned.

Similarly, the supply chain fallout of the incident as a result of exposed JKS files is a serious cause for concern, enabling downstream attacks on interconnected systems.

“A suspected unpatched vulnerability suggests deeper security flaws,” CloudSEK added.

MORE FROM ITPRO

• Say goodbye to walled gardens, Oracle is doubling down on multi-cloud
• Why Oracle thinks its agents service is the gold standard
• Take a look at the best cloud computing services for business

An American bank has admitted nearly 22,000 customers had their accounts compromised following an attack that targeted a zero-day flaw in a third-party file-transfer tool.

In a regulatory filing, Arizona-based Western Alliance Bank said attackers had access between 12 and 24 October last year, though the bank reportedly only became aware of the attack in January.

Hackers accessed customers' names, social security numbers, birthdates, drivers license details, tax numbers, passport information, and account numbers. The company has begun notifying those impacted by the incident.

The filing didn't detail which software was targeted, but Western Alliance Bank was one of dozens of companies named in by the Cl0p ransomware group in January after a series of attacks using the Cleo file transfer zero-day flaw last year.

Reports online this week also suggested the source of the incident was the Cleo flaw.

Clop claimed to have accessed data by breaching the file transfer program late last year, warning that named companies had days to begin ransom negotiations before data would be published.

Other companies named included Blue Yonder and Datatrac, though some on the list have denied they were actually hacked, and Western Alliance hasn't confirmed that its attack was part of the Clop attack.

Clop has previously targeted other file-sharing products, including Progress Software's MOVEit Transfer and Fortra's GOAnywhere.

What happened with the Cleo flaw?

The Cleo attack is ranked among one of the most devastating cybersecurity incidents in recent years, affecting a host of organisations globally.

The company first warned that hackers were making use of the zero-day flaw in October, issuing a patch to mitigate the attacks.

However, a month later, security firm Huntress said attacks were continuing because the first patch didn't fully fix the flaw, advising those at risk to move any exposed systems behind a firewall.

Cleo published a subsequent patch to fix the flaw in December and advised all customers to upgrade their version of the software, though only specific editions were affected.

Incident highlights continued financial services risks

Akhil Mittal, senior security consulting manager at Black Duck, said the incident highlights the continued threats faced by financial services firms.

"Customers aren’t shocked when financial institutions get hacked; they expect it," Mittal said. "It’s essential for financial institutions to detect and notify their customers of any data loss as soon as possible to prevent further loss and ensure the right next steps are taken quickly."

Mittal added that a widespread overreliance on third-party software suppliers also exacerbates the issue, with many institutions having fallen victim to supply chain breaches in recent years.

"Organizations continue to trust third-party software without enough oversight, and every few months, the same scenario plays out—a vendor gets breached, sensitive data is stolen, and customers get offered a year of credit monitoring that does little to fix the real issue," he said.

"This isn’t just about Western Alliance — it’s a systemic problem with third-party risk," Mittal added.

MORE FROM ITPRO

• UK financial services firms are scrambling to comply with DORA regulations
• Financial services firms urged to bolster security capabilities amid surging threats
• UK finance firms facing a torrent of threats

A Dutch IT company has demonstrated exactly how not to handle data protection after a number of hard drives containing sensitive medical data were found for sale at a Belgian flea market.

First reported in Dutch broadcaster Omroep Brabant, 62-year-old Robert Polet from Breda found the hard drives on sale for roughly €5 each in a flea market after taking a pit stop on his way back from Belgium.

Polet, a computer-crazy camera enthusiast, said that on returning to his home in Breda and inspecting the hard drives, he was shocked to find they were full of medical data from the period between 2011 and 2019.

The hard drives contained the Dutch citizen service numbers (BSN), dates of birth, addresses, prescriptions, and other medical information linked to individuals from the Utrecht, Delft, and Houten regions.

After contacting the affected healthcare organisation, based in Utrecht, Polet said he was informed the data originated from an IT company that no longer exists.

Nortade ICT Solutions used to develop software for the healthcare sector but exactly how the hard drives ended up at a flea market in Belgium is still unclear.

Polet told Omroep Brabant that once he had made the discovery he returned to the flea market to buy the rest of the hard drives, but could not ascertain where the seller had acquired them due to a language barrier.

“Nightmare” breach as “painful as anyone can imagine”

Speaking to ITPro Rick Goud, CIO and co-founder at email security and file transfer platform Zivver, described the incident as a business’ ‘worst nightmare’, but noted he was not totally surprised by the incident.

“It’s your worst nightmare right? If the company wasn’t already bankrupt they probably would be by now… It is not a surprise, but of course as painful as anyone can imagine a data leak to be.”

Elaborating on this, Goud said he feels the fact that this data managed to leak via improperly handled hardware was indicative of a period where data protection was not front of mind for some organizations working with healthcare data.

“What is interesting about this case is that it’s quite old data. I think it fits the mindset of how healthcare data was treated ten years ago,” he explained.

“It’s certainly not an excuse but it is something I do recognize from the early days when I started in healthcare. Around 20 years ago you could still walk around with DVDs inside a hospital and ask the administrator to install it and put it on the mainframe and they would just do it.”

He said that thankfully the risk profile attached to data leaks, especially those affecting health data, has meant businesses take cybersecurity and data protection more seriously over the last 10 years.

Attitudes around safeguarding data are changing

Goud attributed this improvement to a higher risk awareness driven by legislation and standards such as ISO 27001 and the NEN 7510 which set out procedures and best practices for data protection and deprecating old storage devices.

But he warned some businesses will run into this type of security weakness on a day-to-day basis, particularly when they have handed off the problem to a third party.

“They do not ask the vendor the right questions to ensure that a) as a healthcare provider they are sure that the vendor treats the data as well as they do it themselves but also think that basically by hiring somebody else to process your data that you are not responsible anymore and of course that is not true.”

Victoria Hordern, partner and data protection specialist at global law firm Taylor Wessing, told ITPro that as well as Nortade itself the healthcare organization that contracted it could be subject to investigation.

"The health organizations that engaged Nortrade ICT Solutions would be required to carry out appropriate due diligence before appointing a third party provider and ensuring that data security to protect the data is adequate," Horden said.

"Therefore, to the extent this incident reveals a failure to do this, they could also be subject to investigation and enforcement action from the data protection authority."

Goud added that regulations like ISO 27001 and NEN 7510 have been around for some time but only became legally enforceable on healthcare organizations roughly four years ago, noting that he feels there has been a ‘mindset shift’ in data protection since then.

“So that has significantly changed practices, until then it was something that the early adopters that had the intrinsic motivation to adequately protect healthcare pursued because, of course, it's costly to go through that kind of certification process. Nowadays it is a must have,” he said.

“In 2011 to 2019 where this data is from you would see probably 2 – 3% of suppliers and healthcare organizations had that type of certification, nowadays I would say that it’s closer to 70 or 80% in the Netherlands at least.”

MORE FROM ITPRO

• Malware-free attacks surged in 2024 as attackers drop malicious software for legitimate tools
• Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claim
• Why government email servers are top targets for state-backed hackers

Background check firm DISA Global Solutions has revealed it suffered a data breach exposing millions of sensitive records – nearly a year after the incident first occurred.

The breach, first discovered on April 22, 2024, had been allowing an unauthorized third-party to access data on around 3.3 million people since February 9th.

"Although our forensics investigation could not definitively conclude the specific information procured, the affected files contained individuals’ personal information, which came into our possession due to the employment screening services we provide employers and prospective employers," said the firm.

"Presently, we are unaware of any attempted or actual misuse of any information involved in this incident."

However, it said, it had not been able to definitively establish exactly what data had been accessed.

The company is contacting people whose personal information was accessed - personal information that may have included name, social security number, driver’s license number, other government ID numbers, financial account information, and other data.

It's also offering those affected access to credit monitoring and identity restoration services through Experian.

"We take this incident seriously and sincerely regret any inconvenience this incident may cause affected individuals," said DISA.

"Upon discovery, we secured our network, notified law enforcement authorities, safely restored our systems and operations, and implemented additional security measures. We also offer affected individuals access to credit monitoring and identity restoration services through Experian."

DISA data breach a wake up call for background check firms

Background check companies are prime targets for cyber criminals because of their long-term storage of vast amounts of highly sensitive personal data – and this isn't always as well protected as it should be, said Cory Michal, CSO at security company AppOmni.

"Unlike financial institutions, which must adhere to strict cybersecurity regulations, these companies often operate with less security budget and weaker security controls, making them more vulnerable to attacks," he said.

"Additionally, many background check firms lack advanced monitoring and forensic capabilities, leading to prolonged undetected breaches, as seen in the DISA Global Solutions breach where attackers had access for over two months before detection."

Michal said he'd like to see background check companies made subject to stricter cybersecurity laws and standards, similar to those imposed on institutions under HIPAA or PCI-DSS.

This would mandate encryption, continuous monitoring and breach detection measures.

"Additionally, they should face clear liability for data breaches, with financial penalties and mandatory compensation for affected individuals. Stronger data retention policies should also be enforced, preventing unnecessary long-term storage of sensitive information," he said.

"Without robust federal regulations and industry-specific security mandates, these breaches will continue to expose millions to identity theft, fraud, and financial loss."

The breach has already mobilized several US law firms to launch class action lawsuits.

MORE FROM ITPRO

• The National Public Data breach exposed 270 million users
• Cisco hits back at Kraken group data breach claims
• 800,000 users exposed in Landmark Admin data breach

Zacks Investment, a leading investment research company, has allegedly suffered a data breach that could see roughly 15 million customer records exposed.

A threat actor under the name Jurak posted on the dark web hacking forum BreachForums on 24 January 2025, claiming to have breached Zacks Investment in June last year.

Zacks is a major financial analysis provider best known for its Zacks Ranks platform used to assess stock performance. The post alleges that the stolen information contains source code as well as Zacks’ database, “containing 15 million customer lines of their customers and clients”.

This includes usernames, emails, passwords, addresses, full names, and phone numbers, according to the poster, who provided a sample of the customer data as proof.

Jurak added that they considered releasing the source code publicly but opted against it, stating trustworthy users with a ‘high reputation’ could request the source code by contacting them directly.

According to Have I Been Pwned, the stolen customer information is said to affect 12 million unique email addresses, stating the number of compromised accounts was 11,994,223.

It notes the customer information included unsalted SHA-256 password hashes, which raises serious concerns as they are vulnerable to cracking via brute force methods.

The threat actor, who spoke to BleepingComputer, said they used privileges of a domain admin to gain access to the company’s active directory and stole the source code for its primary domain (zacks.com) as well as 16 other sites.

ITPro has approached Zacks Investment Research but did not receive a response by the time of publishing.

Incident marks third Zacks Investment security breach

In its post announcing the breach, the user referred to a previous breach that took place in late 2022 and exposed sensitive information relating to 820,000 customers.

In a post acknowledging the incident, the firm stated that its team had identified that an unknown actor had gained unauthorized access to customer records.

The firm initially stated the exposed customer information was limited to those who had signed up for its Zacks Elite product between 1999 and February 2005.

However, the company later clarified that it had found the attackers had gained access to encrypted passwords of ‘zacks.com’ customers up to May 2020 in a second breach that took place in June 2023.

This database contained information such as the full names, emails, usernames, unsalted SH-256 passwords, addresses, and phone numbers of 8.8 million Zacks users.

This would take the total number of exposed users to over 21 million in the last four years.

MORE FROM ITPRO

• HPE alerts affected staff after Midnight Blizzard breach
• 850,000 patients may have been affected in the Globe Life breach after firm revises victim list
• TalkTalk confirms data breach probe – but says it's not as bad as claimed

Hewlett Packard Enterprise (HPE) is notifying staff whose personal data was accessed by Russian state-sponsored hackers back in May 2023.

According to filings with the attorney general offices in New Hampshire and Massachusetts, the company has written to at least 16 people, notifying them that their driver's licenses, credit card numbers, and Social Security numbers may have been stolen in the attack.

"HPE’s forensic investigation determined that certain individuals’ personal information may have been subject to unauthorized access. With the assistance of e-discovery specialists, HPE conducted a thorough review of the data at issue to identify the types of information that may have been subject to unauthorized access and determine to whom this information relates," the filing reads.

"On January 29, 2025, HPE began providing notice of this event to impacted individuals, in accordance with applicable law."

Since the attack, HPE said it has taken a series of remediation actions, such as strengthening network security by rotating passwords, tokens and keys, expanding its monitoring and logging measures, and adding extra controls and requirements for privileged account logins.

The firm has also expanded internal communication on security measures.

In the wake of the incident, HPE is offering affected staff free memberships for Equifax Complete Premier, which provides information on changes to victims’ credit reports, as well as WebScan notifications when financial details are found on fraudulent trading platforms.

The package also includes identity restoration services and up to $1,000,000 of identity theft insurance coverage for out of pocket expenses.

"In addition to enrolling in credit monitoring, we recommend that you remain vigilant against incidents of identity theft and fraud by reviewing your account statements and monitoring your free credit reports for suspicious activity and to detect errors,” the firm said.

What happened in the HPE attack?

The HPE breach was first disclosed in January 2024 after Microsoft issued a warning that the Midnight Blizzard hacking group had breached its Office 365 email environment.

The attackers targeted several email accounts within HPE’s cybersecurity, marketing, and business teams, using a compromised account to gain access to email mailboxes and steal sensitive data.

Midnight Blizzard is believed to have ties to Russia's Foreign Intelligence Service (SVR), and are best-known for the infamous SolarWinds attack in 2019, which impacted several US governmental bodies, including the department of commerce and the treasury.

HPE has also said it believed that the hack was related to another attack in May 2023, in which Midnight Blizzard gained unauthorized access to several SharePoint files on the HPE system.

However, the firm said this attack had not materially impacted the company.

ITPro has approached HPE for comment.

MORE FROM ITPRO

• 2024 was a record year for commercial cyber attacks
• LinkedIn has become a prime hunting ground for cyber criminals
• How Russian hackers launched their latest attack using Microsoft Teams

American insurance firm Globe Life has warned that another 855,000 people were potentially impacted by a cyber attack last summer — not the original 5,000 initially reported.

Last summer, Globe Life spotted that cyber criminals had accessed customer data, reportedly via an online portal.

The insurance company — one of the biggest and oldest in the US — filed a report with the SEC on the attack, saying that details had been accessed on 5,000 individuals, but promised to update that figure after an internal investigation.

In October, Globe Life revealed that cyber criminals had contacted the insurer attempting to extort money in exchange for not leaking data.

Now, Globe Life has revealed further details of the attack, saying the initial 5,000 confirmed victims were traced to a set of specific databases maintained by third parties, or as the company put it: "a small number of independent agency owners."

The details taken were from customers of Globe Life subsidiary American Income Life Company. Those databases also included details on the additional 850,000 people, and while there's no evidence their information was leaked, the company is writing to potential victims as a precaution.

"Out of an abundance of caution, the company has also initiated the process to provide voluntary notifications to, and credit monitoring services for, approximately 850,000 additional individuals whose information was also stored in the relevant databases, even though the company has not been able to confirm if the threat actor acquired these additional individuals’ data," the company said in an SEC filing.

Globe Life insists no ransom was paid

Globe Life added that it didn't pay the ransom, and stressed the extortion attempt didn't use ransomware or impact business operations at the time.

According to the most recent filing, the data accessed includes names, email addresses, phone numbers, and addresses, as well as insurance policy information, health data, social security numbers, and date of birth, but no financial information.

Thomas Richards, principal consultant at security firm Black Duck, said the incident will still be a cause for serious concern among customers.

“The uncertainty regarding the number of individuals affected and data accessed in this breach should be concerning, especially since this is a pretty substantial breach with almost one million policyholders affected,” he said.

"Without having this information, the affected individuals may not have clarity on the best ways to protect themselves and their personal information.

“Although it is fortunate that no financial information was accessed, financial information is often the easiest to change in this kind of scenario," Richards noted.

"However, one cannot change their health-related data, date of birth, or social security number so it’s imperative that the affected individuals are notified as soon as possible to begin taking the necessary steps to protect themselves and their data."

Globe Life was one of several high-profile insurers hit by cyber criminals last year, with a spate of attacks targeting organizations operating in the industry.

The Change Healthcare cyber attack, for example, impacted around 190 million US citizens, with parent company UnitedHealth having recently revised its numbers following an investigation.

Elsewhere, a data breach at Landmark Admin saw 800,000 users exposed. A filing with the Attorney General of Maine revealed the breach exposed a broad range of personal data, including full names and addresses, social security numbers, tax ID numbers, and drivers’ license numbers.

UK telecoms firm TalkTalk has confirmed that it's suffered a data breach, with a hacker known as b0nd claiming responsibility.

According to reports from TechCrunch, b0nd is offering the personal data of more than 18.8 million current and former TalkTalk subscribers for sale on a popular cyber crime forum.

The data is claimed to include customer names, email addresses, IP addresses, phone numbers and subscriber PINs.

The threat actor is believed to have accessed the data via the systems of a third party supplier. While the supplier remains unnamed, it appears from screenshots shared by b0nd to be CSG’s Ascendon platform, which TalkTalk uses for subscription management.

TalkTalk confirmed the probe in a statement given to ITPro.

"As part of our regular security monitoring, given our ongoing focus on protecting customers’ personal data, we were made aware of unexpected access to, and misuse of, one of our third-party supplier's systems, however, no billing or financial information was stored on this system," a spokesperson told ITPro.

"Our Security Incident Response team is continuing to work with the supplier regarding this matter, and protective containment steps were taken immediately."

The spokesperson added that the claims about the number of people affected were "wholly inaccurate and very significantly overstated".

TalkTalk currently boasts around 2.4 million customers, vastly fewer than the number claimed by b0nd. The third party supplier also manages a smaller number than that.

Meanwhile, many records are duplicated.

"Based on various dark web forum postings, it appears the threat actor has gained access to one or multiple CSG Ascendon subscription management platform tenants, some of which provide reports showing stored PINs in plain text - best practice dictates these be encrypted," said Cory Michal, chief security officer at SaaS security company, AppOmni.

Michal added that b0nd appears to have only around four million data records, including PIN, name, email, IP address, and subscriber phone, in various combinations.

"b0nd is a relatively new account on the forum where the sale was posted, with the first post being on January 19 offering a Rust-based RAT for $30,000. The actor is now reposting full breach dumps from previous attacks to try and gain credibility on the account," he said.

"Additionally, one of the screenshots b0nd posted also claims to have data from 'Netflix Bundle Activations', which is something else to watch for."

It's not the first time that TalkTalk has suffered a data breach. In 2015, it revealed that personal data belonging to around four million people had been accessed in a cyber attack.

The telecoms firm was hit with a £400,000 fine from the Information Commissioner's Office (ICO) as a result.

Hewlett Packard Enterprise (HPE) has confirmed it is investigating data breach claims made by the IntelBroker threat group.

Last week, IntelBroker published a statement on a data breach forum saying it had successfully breached HPE's network and nabbed information, offering it for sale on the dark web.

According to reports, the hackers claimed to have successfully snuck into parts of HPE's network for two days, accessing HPE's private GitHub repositories, APIs, and WePay service while managing to steal certificates, source code for Zerto and iLO, Docker builds, and personal data relating to deliveries.

HPE said the apparent hack was still being investigated, but stressed there was no customer data lost and the company was operating as normal.

"HPE became aware on January 16 of claims being made by a group called IntelBroker that it was in possession of information belonging to HPE," a company spokesperson said in a statement to ITPro.

"HPE immediately activated our cyber response protocols, disabled related credentials, and launched an investigation to evaluate the validity of the claims.

"There is no operational impact to our business at this time, nor evidence that customer information is involved."

HPE isn't the only big tech firm targeted by IntelBroker

Other attacks have been attributed to IntelBroker — believed to be led by a Serbian operating out of Russia — including breaches that leaked internal Apple tools and data from Europol, as well a health care provider used by American politicians.

Indeed, HPE was hit by similar data leak claims by IntelBroker this time last year; as with this latest incident, HPE said it hadn't found any evidence of a security breach.

That is a common pattern with IntelBroker claims. Companies find out via a statement on a hacking forum, investigate the incident, and then claim the intrusion wasn't serious and the data taken wasn't of any importance.

Companies targeted by IntelBroker have repeatedly disputed claims about the seriousness of the incident, saying any access was limited to small amounts of unimportant data, suggesting the hacks listed on dark-web forums were exaggerated.

Indeed, the hacker breached Cisco's systems in October, listing 2.9 terabytes of information on the dark web. But while Cisco admitted the incident, the company has stressed that the data wasn't confidential or sensitive in nature.

That was echoed in a subsequent breach at Nokia. IntelBroker released a cache of data stolen from the telco in November, but Nokia downplayed the incident, stressing that no company or customer data was actually leaked.

IntelBroker responded to such claims by releasing more data from the Cisco breach at the end of last year, and earlier this month said: "I promise you all some HQ leaks soon."

CISOs are feeling the pressure over stories of their peers being held personally liable for cybersecurity incidents.

In the most notorious example, the US Securities and Exchange Commission (SEC) last year announced that it was filing charges against both SolarWinds and its CISO, Tim Brown, amid allegations of "fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities".

While Brown beat the charges earlier this year, others haven’t been quite as lucky.

Uber CSO Joe Sullivan, for example, was given a three-year probation sentence and a $50,000 fine for covering up a 2016 data breach. And CISOs fear such charges could potentially be filed against them.

Seven-in-ten told security firm BlackFog in a new survey that incidents like this had negatively affected their opinion of the job. Around a third said the trend was a no-win situation for security leaders, leaving them facing internal consequences if they report failings and prosecuted if they don’t.

"The role of the CISO is all about managing risk for the organization but, as regulations tighten, security leaders increasingly need to consider their own personal risk," said BlackFog founder and CEO Dr Darren Williams.

Increased accountability has, at least, led to internal changes to improve cybersecurity practices within their organisation. Nearly half (44%) of respondents said their company had already put processes in place to reduce their cyber exposure as a result.

Nearly half of all respondents believe that the potential for an individual to be prosecuted following a cyber attack would improve accountability and transparency amongst cyber professionals.

This was higher for respondents in the US, at 55%, compared with those in the UK at 43%.

When asked about the impact on the cybersecurity leaders of the future, only 15% believed that it would be a deterrent for IT professionals to become CISOs.

Meanwhile, four-in-ten said the increased scrutiny and potential of personal liability has made the board take cybersecurity more seriously. This was higher in the UK, with 47% of security leaders agreeing, compared with just 35% in the US.

This has yet to translate into more resources, though, with just 10% of all respondents saying such concerns had translated to any rise in security budget.

"High profile instances of individuals being charged will no doubt add to the pressures they feel but could also be a catalyst for boards to support their leaders," said Williams.

"Improvements to governance, clear lines of reporting and incident response procedures are vital, but this must be supported by allocated resources so that security leaders can implement the security measures they need."

Amazon has confirmed that a security incident affecting a third-party vendor has exposed employee information.

The incident saw data allegedly belonging to employees at a host of major tech firms leaked, with the data believed to have been stolen during the 2023 MOVEit breach.

An Amazon spokesperson told ITPro its internal systems remain secure, insisting the incident was isolated to one of its third-party property management systems.

“Amazon and AWS systems remain secure, and we have not experienced a security event. We were notified about a security event at one of our property management vendors that impacted several of its customers including Amazon.”

The statement added that the published information was limited to employee contact information, as well as some location data.

“The only Amazon information involved was employee work contact information, for example work email addresses, desk phone numbers, and building locations.”

Amazon did not confirm how many employees were impacted by the breach.

The tech giant isn’t the only major organization impacted in the data dump. HP, Lenovo, and other parties including HSBC and MetLife have allegedly been impacted in the breach.

ITPro has contacted the organizations for confirmation.

Leaked by a cyber criminal using the moniker ‘Nam3L3ss’, the cache is said to include a variety of employee data including names, email addresses, phone numbers, cost center codes, and, in some cases, entire organizational structures of the affected parties.

Nam3L3ss claims to have over 2.8 million records stolen from Amazon in particular, as well as half a million taken from life insurance company MetLife.

The total number of records published in the initial release was nearly five million lines of data, affecting 25 large organizations.

Nam3L3ss claimed that what they have released so far is less than 0.001% of the data they have in their possession, alleging they have 1,000 releases coming with data that has never been seen before.

The threat actor, who claims not to be a hacker, said the information was taken during the May 2023 MOVEit attacks.

Hackers affiliated with the Cl0p threat collective exploited a zero-day vulnerability in Progress’s MOVEit file transfer protocol, used by thousands of large organizations around the world.

The vulnerability, tracked as CVE-2023-34362, was an SQL injection flaw identified in the MOVEit Transfer web application that was leveraged by the threat actors to gain access to MOVEit Tranfer’s database.

It’s All Hallows’ Day, and we’ve still got Halloween on the brain. It’s that time of year when we tell the scariest stories we can – and for those in tech, there are none scarier than that of major cybersecurity incidents.

In this episode, Rory and Jane talk to Solomon Klappholz, ITPro’s cybersecurity reporter, about some of the spookiest cyber incidents of 2024 and what businesses can learn from these ghoulish tales.

Footnotes

• CrowdStrike CEO confirms update "defect" as the source of mass disruption
• Millions of devices bricked and $5.4 billion in losses: The cost of the CrowdStrike outage continues to mount
• The National Public Data breach exposed nearly three billion users – now the company has filed for bankruptcy
• National Public Data breach: Lawsuit claims failed to protect billions of personal records
• 23andMe's disastrous data breach just landed it a regulatory probe
• 23andMe data breach response has been a public relations disaster as it blames customers for data breach
• The 23andMe data breach is getting messier by the day
• World Economic Forum warns of growing ‘cyber insecurity’ amid heightened threat landscape

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn
• Follow us on YouTube

Insurance administrative services company Landmark Admin is warning 800,000 people that their sensitive data has been exposed, following a cyber attack earlier this year.

According to the firm's filing with the Attorney General of Maine, the breach involved an extremely broad range of personal data, including full names and addresses, Social Security numbers, tax identification numbers, drivers’ license numbers, and state-issued identification card numbers.

Similarly, passport numbers, bank account and routing numbers, medical information, health insurance policy numbers, dates of birth, and life and annuity policy information were all exposed in the incident.

The breach was discovered in May, and the company's systems were secured with the help of an external security firm until the attackers again gained access to Landmark's IT network in June, accessing more sensitive information.

Once again, the company's systems were secured, with Landmark saying it's now tightened up cybersecurity practices.

"As a result of the data breach, these individuals’ personal and highly sensitive information may be in the hands of cyber criminals who can place the information for sale on the dark web or use the information to perpetrate identity theft," said Murphy Law Firm, which is planning a class action lawsuit.

Several other law firms are considering the same.

Landmark is now contacting those whose data may have been leaked, offering them credit monitoring and identity theft protection services.

There's currently no indication of who was behind the attack, nor any information on ransom demands.

"The breach at Landmark Admin highlights a growing issue —third-party vendors are becoming easy targets for cyberattacks. This isn’t just a one-off; it’s part of a clear trend. As organizations rely more on outside partners, they expose themselves to more significant risks," said Akhil Mittal, senior security consulting manager at Black Duck.

"With personal and financial data now exposed, the immediate concern is identity theft, but the bigger issue is losing trust between insurers, their customers, and partners. Landmark’s security team needs to move quickly, not just by explaining what happened, but by actively helping partners strengthen security across the board."

Insurance companies, along with their partners or subsidiaries, represent a lucrative target for hackers thanks to the large amounts of highly-sensitive data that they hold.

Just last week, a third-party breach was reported by Brighthouse Life Insurance, for example, while insurance firm Globe Life reported that it's being extorted by hackers after data on more than 5,000 people was stolen from a subsidiary.

Meanwhile, health insurance firm UnitedHealth has told the US Department of Health and Human Services Office for Civil Rights that the data breach it suffered earlier this year affected 100 million people.