11 articles
Berlin's stolen government data has been released after an extortion deadline expired. The next phase is credential rotation, exposure analysis, victim notification, and long-term fraud monitoring.
CISA added an old ownCloud WebDAV authentication bypass to KEV after reported exploitation against Philippine research and defense-linked targets. The lesson is not novelty. It is exposed file infrastructure.
Berlin isolated two state ministries after a cyberattack on the Landesnetz. The incident is a practical lesson in public-sector segmentation, crisis communications, and data-theft triage.
KrebsOnSecurity reports that the FBI is investigating a dark web service selling more than 153 million driver's license scans. The lesson is not just identity theft. It is vendor concentration around identity proofing.
The Vastaamo case was not just a Finnish hacker story. It showed how exposed databases, weak governance, poor logging, and delayed breach response can turn clinical records into direct extortion against patients.
MOVEit, GoAnywhere, Cleo, Accellion — the same extortion playbook keeps working on enterprise file-transfer software. Here's the structural reason why, and what to do about it.
The 2022 LastPass breach led to real crypto thefts years later. Here's what actually went wrong, why zero-knowledge encryption still matters, and how to pick a safe password manager in 2026.
A zero-day in unnamed third-party software let attackers sit inside KDDI's shared ISP email platform for a month, exposing email addresses and passwords used by @nifty, BIGLOBE, J:COM, and three other providers. Here's what's confirmed and what isn't.
A critical, unauthenticated RCE in Oracle PeopleSoft let ShinyHunters compromise universities and other organizations for weeks before Oracle's advisory caught up. Google notified 100+ potentially exposed organizations. The technical breakdown, IOCs, and what to hunt for.
ShinyHunters breached Canvas LMS, stole 275 million students' data, took the ransom — and attacked again four days later. Here's who they are and why arrests haven't stopped them.
Your email and password are probably already on the dark web. Here's how to check using real tools — no Tor browser, no .onion sites, no technical expertise needed.