← Feed

Posts

• View post

  The FBI is investigating claims by hacker group ShinyHunters that it exploited a zero-day bug in software used by FBIJobs and stole 2–3 TB of data, potentially including personal information on current/former employees and applicants. #databreach https://arstechnica.com/tech-policy/2026/09/fbi-rushes-to-investigate-if-shinyhunters-hack-of-thousands-of-employees-is-real/

• View post

  Four of the files I read for the catalog aren't breaches at all. They're combolists. Someone else's homework: old email and password pairs from dozens of leaks, stacked into one file so the lot can be tried at once. 1,433,283,890 rows. Dull as a phone book. Still works, because a password from a 2016 forum is somebody's email password tonight. That's why I stopped remembering mine. Free alerts when yours turns up, on @XposedOrNot@infosec.exchange https://blog.xposedorno...

• View post

  Framework says a third-party #databreach impacted all of its customers after hackers exploited a zero-day vulnerability at business intelligence provider Metabase. Exposed data includes names, emails, phone numbers, and physical addresses. Payment information was not compromised. https://techcrunch.com/2026/08/07/computer-maker-framework-notifies-all-customers-of-a-data-breach/

• View post

  A misconfigured database exposed 102,215 records (79GB) from Brazil’s Health Surveillance Information System (SISVISA), including IDs, tax numbers, addresses, inspection reports, and medical credentials. The database was secured after disclosure, but it's unclear how long it was exposed or if the data was accessed. #DataBreach https://hackread.com/brazil-health-surveillance-database-exposed-records/

• View post

  A cyberattack on the U.K.'s Police National Legal Database (PNLD) exposed the names, organizations, and email addresses of 100,000+ police officers and criminal justice professionals. ExfilSquad claims to have stolen 135,000 records, while authorities investigate. #databreach https://www.bleepingcomputer.com/news/security/exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff/

• View post

  "Free breach monitoring" usually means "we eat the cost until we can't." Here is how @XposedOrNot@infosec.exchange stays free: Google Cloud with Datastore for the breach index, Cloudflare in front for caching and abuse handling, and a codebase you can read end to end. The expensive part of this problem is curation, not serving. Serving your slice of already-compiled breach data costs close to nothing at the edge. The code is public. If it earns it, a star helps other...

• View post

  SysAdmin Day gift from XposedOrNot: a breach-monitoring toolkit that is free and open source (MIT), end-to-end. - check an address for breach exposure from a script, no API key - RSS feed of newly indexed breaches - verify your domain once, get alerts for every address on it - Microsoft Sentinel connector if you live in a SIEM Built by someone who did the job. Setup fits in a coffee break: https://blog.xposedornot.com/free-breach-monitoring-toolkit-sysadmins

• View post

  The UK's Department for Education (DfE) has confirmed a #databreach affecting around 607,000 records following a cyberattack. Exposed data includes phone numbers and email addresses of individuals and organizations. https://www.bbc.com/news/articles/cq6dmgrp21po?at_medium=RSS&at_campaign=rss

• View post

  The best sysadmin work leaves no trace. Certs renewed. Backups that actually restore. Maintenance windows you slept through. Tools, tech, the thinking. All learned on the job. Happy SysAdmin Day. If you work with one, say it out loud today.

• View post

  CareCloud says a March cyberattack exposed sensitive medical, financial, and personal data of at least 345,000 people after hackers accessed an AWS-hosted health records database for six days. #databreach https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/

• View post

  NYC Health + Hospitals faces new claims from extortion group LeakNet, which alleges it stole an 11TB archive affecting 12M people. So far, only 1.8M victims have been officially confirmed. The leaked samples appear sensitive, but the 12M claim remains unverified pending independent review and an official response. #databreach https://hackread.com/leaknet-11tb-stolen-nyc-health-hospitals-data-breach/

• View post

  Breach check with no API key, no signup, one line: curl "https://api.xposedornot.com/v1/check-email/you@example.com" Returns every breach from the @XposedOrNot@infosec.exchange index the email appears in, as JSON. Free.

• View post

  Healthcare billing company MCBS has disclosed a #databreach affecting 1.26M+ individuals after attackers accessed its network in 2025. Exposed data may include names, SSNs, dates of birth, insurance details, and medical records. https://www.bleepingcomputer.com/news/security/data-breach-at-medical-billing-firm-mcbs-affects-126-million-people/

• View post

  You fix the family printer. You get the scary emails forwarded to you. My Circle on @XposedOrNot@infosec.exchange: invite up to 25 family and friends. Once they accept, you see their breaches, what data leaked, and which are sensitive. Open source, free, no card. https://blog.xposedornot.com/introducing-my-circle/

• View post

  Bank of Baroda confirmed that an employee email account was compromised, exposing some customer data, though core banking systems remain unaffected. #databreach https://www.indiatoday.in/business/companies/story/bank-of-baroda-data-leak-1tb-breach-rbi-cert-in-face-penalties-rbi-customer-safety-2957745-2026-07-28

• View post

  The oldest breach in @XposedOrNot@infosec.exchange: gPotato 2007, exposing 2.1 million records. Nineteen years old. The people in it changed jobs, emails, and countries. The data went nowhere. Breach data doesn't expire. What's the oldest breach your email is in? Free, 10 seconds: xposedornot.com

• View post

  ShinyHunters has claimed responsibility for Ernst & Young's recent data breach, alleging it used a supply-chain attack to steal credentials and access EY's Jira, GitHub, and Azure environments. EY has not confirmed the claims, but says attackers stole tax-related support ticket data and is offering affected clients 24 months of identity monitoring. #databreach https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/

• View post

  OnTrac disclosed a cyberattack after hackers accessed its corporate network between Mar. 20–22, with the breach detected on Mar. 23. Customer names were exposed, while other affected data remains undisclosed. #databreach https://www.bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hack/

• View post

  I maintain @XposedOrNot@infosec.exchange , a catalog of 770 data breaches. 84 stored passwords in plaintext. Not hashed. Not encrypted. Just text. 1 in 9. Newest: this year. Reused a password anywhere? Assume it's readable. Here, it literally is. Free check, no signup:

• View post

  Across the 770 breaches in the @XposedOrNot@infosec.exchange catalog, which industry shows up most often?

• View post

  Click To Pray, the Pope-backed prayer app, reportedly exposed users' names and email addresses due to a basic security flaw. A hacker says she reported it 6 months ago, but it’s still unfixed. With over 719K accounts at risk, experts warn the leaked data could be used for phishing scams. #dataleak https://www.theregister.com/security/2026/07/24/popes-official-prayer-app-commits-cardinal-sin-leaks-700k-users-info/5278603

• View post

  From our H1 breach report: 10 entries held 81.9% of the half-billion records. But the median breach? 922,685 records. Mid-sized, no headlines, same per-person damage. Mega breaches get the coverage. Median breaches get the victims. Check yours: xposedornot.com

• View post

  One thing I did not expect in our @XposedOrNot@infosec.exchange H1 data: months have personalities. March was a museum. Median lag 1,328 days, mostly old breaches finally making it into the catalog. April was a newsroom. Median lag 34 days, and 17 of its 22 additions were brand new. That is the healthy version, by the way. An index should breathe in both directions: surfacing the new, deepening the old. We just never let the two mix in the stats. Full report: https://blog.xposedornot.com/...

• View post

  Chick-fil-A disclosed a credential stuffing attack that compromised an undisclosed number of customer accounts between June 17–19, 2026. Exposed data may include names, emails, membership details, payment info, and more. Impacted users were logged out, payment methods removed, and urged to change passwords. #databreach https://www.bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/

• View post

  Origin Energy is investigating a potential cyber incident involving unauthorized access to some customer data. The company says no credit card or bank details are believed to be affected, but has notified the ACSC and AFP as investigations continue. https://www.nine.com.au/australia-news/origin-energy-security-incident-20260722-p60hjj.html

• View post

  South Korea disclosed a #databreach of its National Diplomatic Academy after hackers exploited a server flaw, maintaining access for 10 months (Apr 2025–Feb 2026). At least 6,000 MFA employees and diplomats had personal data (IDs, names, emails, encrypted passwords) exposed. https://www.bleepingcomputer.com/news/security/south-korea-discloses-data-breach-impacting-diplomats-worldwide/

• View post

  Small update from my side. @XposedOrNot@infosec.exchange now works in Turkish and Polish too. Alongside English, that is 14 other languages you can now use, so more people can check for data breaches in the language they think in. More coming soon.

• View post

  Estée Lauder says hackers broke into its HR system using an Oracle software flaw and stole personal data like names, emails, SSNs, bank details, and health info. #databreach https://www.bleepingcomputer.com/news/security/est-e-lauder-discloses-data-breach-via-oracle-e-business-flaw/

• View post

  My Circle is live on @XposedOrNot@infosec.exchange: free breach monitoring for the family you look after. They accept before you see anything. They can withdraw at any time; up to 25 people, free, open source. You are the family tech person. This is for you. https://blog.xposedornot.com/introducing-my-circle

• View post

  Healthcare billing software company Craneware confirmed a cyberattack where hackers stole a significant amount of customer, employee, and partner data. #databreach https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/