← Feed

Posts

• Post #4476538

  One of the dozens of new #ransomware groups this year is a group calling itself #Orova. Since early May, they appear to have dozens of victims in about half a dozen countries. Three of the listings are U.S. medical entities, so, of course, I reached out to them to find out more. My new report: Cardiology Associates of Port Huron remains silent although they were allegedly hacked and had patient data stolen in June. https://databreaches.net/2026/08/06/cardiology-associates-of-port-huron-re...

• Post #4476537

  New York State Department of Financial Services announced on August 5 that Order Express, Inc., a licensed money transmitter, will pay a $250,000 penalty for violations of DFS’s cybersecurity regulation (23 NYCRR Part 500). Order Express suffered a ransomware attack in 2022, which they reported appropriately. But then the DFS's investigation revealed that the entity did not have adequate cybersecurity risk assessment or plan. Read more at: https://www.dfs.ny.gov/reports_and_publications/...

• Post #4476536

  The city manager of the City of Coweta is refusing to even contact unnamed threat actors and says the city will not pay any ransom in response to a recent ransomware attack. Why? Because the city manager was with another city that was attacked; even though that city paid the ransom, it was reinfected two weeks later. So now she is very anti-paying. Read more at KTUL: https://ktul.com/news/local/city-of-coweta-refuses-to-pay-ransom-after-system-wide-cyberattack-08-08-2026 And as I previousl...

• Post #4398359

  RE: https://infosec.exchange/@chum1ng0/117044228483502361 You weren't alone, @chum1ng0@infosec.exchange . Their misclassification reportedly affected thousands of blogs: https://cybersecuritynews.com/google-blogger-locked-legitimate-websites/ But this is a good time for you to think about backups and alternatives. :)

• Post #4379826

  More than a dozen Republican attorneys general are calling on #OpenAI to preserve records on its models’ recent breach of #HuggingFace, suggesting the #AI firm may have violated state or federal laws in the incident. Press release: https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-leads-coalition-demanding-transparency-from-openai-after-ai-breach-and Direct link to full letter: https://www.iowaattorneygeneral.gov/media/cms/08_5392C9E17791C.pdf

• Post #4176409

  More than 30 Minnesota water systems targeted in cyberattack: https://www.fox9.com/news/30-minnesota-water-systems-targeted-cyber-attack I haven't seen Handala or any group claim responsibility yet, but it's noteworthy that the quality of drinking water does not appear to have been tampered with. #cyberwar #Handala #criticalinfrastructure #water

• Post #4148712

  "Marco Rubio says the US will deny visas to foreign nationals involved in cybercrime and may extend the restrictions to their immediate families.......... Marco Rubio says the US will deny visas to foreign nationals involved in cybercrime and may extend the restrictions to their immediate families." (see on The Register) Why not allow the suspected criminals to get visas, allow them to fly over here, and then arrest them and prosecute them?

• Post #4147752

  NEW by me: It appears that Frontier Airlines may have had a third security incident this year. A new group called ExfilSquad claims to have hacked them -- and no, they say they are not connected to ShinyHunters or ScatteredLapsus$Hunters. NOTE: Frontier Airlines hasn't confirmed this claimed breach. Then again, they haven't denied it, either. They haven't responded to email inquiries. Hackers Breached an Airline as Known Vulnerabilities Went Unpatched. Now Another Gang Claims It...

• Post #4142338

  TFW you finish entering all your new appointments for this week, only to realize you entered them in last week's calendar and now mucked everything up. 😭 🤦‍♀️

• Post #4113652

  Developing: AnMed reports phone and internet outage impacting all 4 hospital locations in South Carolina and Georgia. Emergency rooms remain open. No group has claimed responsibility as yet. #cyberattack #healthsec

• Post #4063682

  In January 2025, the WA attorney general sued T-Mobile over a data breach that affected 2M residents (this was the 79M T-Mobile breach). One of the issues in the litigation was that T-Mobile didn't properly notify those affected of the breach -- it omitted telling them in SMS notifications that their SSN had been acquired. For background, see https://www.atg.wa.gov/news/news-releases/ag-ferguson-files-lawsuit-against-t-mobile-massive-data-breach Now a court has agreed with the state that...

• Post #4063280

  NEW by me: more analysis of the Navigate360 data breach, this one focusing on Crime Stoppers and crime-oriented tip lines using P3 Global Intel: Crime Stoppers assured people their tips would be anonymous. Then more than 1 million tips leaked: https://databreaches.net/2026/07/24/crime-stoppers-assured-people-their-tips-would-be-anonymous-then-more-than-1-million-tips-leaked/ If anyone has a connection in their state attorney general's office, encourage them to read this and open an invest...

• Post #4021655

  GovTech reoorts on the ITRC's H1 report: "[ITRC]found that 1,029 data compromises generated 471 million breach notices in the first half of the year, with one incident — the breach involving Instructure’s Canvas platform — accounting for 275 million of those notices, or about 58 percent of the total."

• Post #4016954

  It has been four months since a hacktivist obtained 8.3 million tips submitted to organizations such as Crime Stoppers and Sandy Hook Promise. What the hacktivist found in terms of lack of security was appalling. In the four months since Navigate360 (the parent company for P3 Global Intel and P3 Campus) learned of the breach, they have made zero public statements after the first day when they said they were investigating. Their wall of silence, and the conspiracy of silence involving programs...

• Post #4001268

  Milford, New Hampshire seems to be dealing with a cyberattack since July 15, but they don’t call it that and haven’t revealed many detail details. A resident wonders whether the breach was caused by a vulnerability he reported to them in May that they did not address. My post about it all: https://databreaches.net/2026/07/21/milford-new-hampshire-confirms-unauthorized-activity-withholds-details-of-suspected-cyberattack/ #govsec #cybersecurity

• Post #3766974

  Another entity files for insolvency after a data breach. Sounds like the data breach was responsible in this case. From ZEGO's notice: "The cyberattack of March 29, 2026, however, impacted our company to an extent that we could not fully compensate for despite our best efforts. The consequences resulted in a production outage of nearly six weeks and significant financial strain. These effects ultimately impacted our financial situation so severely that filing for insolvency became ne...

• Post #3684151

  NEW by me: Fintech firm Nayax investigating breach; The Syndicate claims it acquired 1 billion card records and other important data (It appears there's another TA that I had never heard of before. And note that the TA has offered no POC at this point). https://databreaches.net/2026/07/08/nayax-investigating-breach-the-syndicate-claims-it-acquired-1-billion-card-records-and-other-important-data/ #databreach #fintech #Nayax

• Post #3656354

  OT: My health system asked for my feedback about a recent hospital experience. I gave everything a good rating until we got to the survey questions on anesthesia, and I wrote, "The anesthesiologist should be shot and killed....." Well, they asked for feedback. 😡

• Post #3638955

  NEW by me: The “Anonymous” Tip System That Wasn’t: Three Months Later, Why Hasn’t Navigate360 Notified Anyone? Note: there is a trigger warning at the top of this article as it contains sensitive material from tips submitted to and about students on what were supposed to be "anonymous" tiplines. https://databreaches.net/2026/07/06/the-anonymous-tip-system-that-wasnt-three-months-later-why-hasnt-navigate360-notified-anyone/ This is the longest post I have ever done because people n...

• Post #3568102

  Why is it "semiquincentennial" and not "quadrimillenial?"

• Post #3494337

  RE: https://infosec.exchange/@PogoWasRight/116835745279468635 If you know a law firm that hasn't been attacked by Silent Ransom Group yet, urge them to read the FBI's alerts on this gang and my new reporting on what to expect if you're attacked.

• Post #2148940

  RE: https://freeradical.zone/@funnymonkey/116529490033852866 That's an incredibly well-written piece. Thanks for pointing to it.

• Post #2113064

  From the "no-need-to-hack-when-it's-leaking-and-leaking-and-leaking" dept: Website Planet recently reported on a leak Jeremiah Fowler discovered. But it wasn't the Gladney Adoption Center's first leak. And while Fowler praised the center for their response to his alert, DataBreaches wants to know what the Gladney Adoption Center is going to do to prevent more leaks. They've had 3 in the past few months alone. https://databreaches.net/2025/07/17/gladney-adoption-cente...

• Post #2113062

  Promises, promises. Exclusive: Brosix and Chatox promised to keep your chats secured. They didn’t. A researcher found a misconfigured backup with -- yes, you guessed it -- everything in plaintext instead of encrypted. Some entities that used the service are medical entities that were actually mentioning protected health information or attaching files with #PHI in the chat. There were almost 5k Allstate employees using the service and sharing customer #PII in files. And oh yeah, I fou...

• Post #2113061

  Correcting this because it looks like this doesn't involve any federal court. But there are exposed sensitive records, some of which were ordered sealed. NEW: Federal judiciary says it is boosting security after cyberattack; researcher finds new leaks More of those frustrating leaks where, despite our best efforts, we have been unable to get the network shares locked down so far, even with the host's assistance. This one involves two courts: and yes, we saw some files that were supp...

• Post #2113060

  So yesterday, I emailed a state court system that appears to be linked to the exposed data I mentioned recently and that the host notified on or about July 28. No reply was received. Today, I sent a contact form message to the lawyer for a juvenile whose records were sealed. Sealed, except 11 of them were exposed to anyone who can access the data. I told him what was going on and suggested he contact the court and tell them to get the data secured. No reply was received. Today, I sent...

• Post #2113058

  NEW: Archer Health was leaking protected health information. Criminals appear to have found it. From the "No Need to Hack When It's Leaking" files: https://databreaches.net/2025/09/26/archer-health-was-leaking-protected-health-information-criminals-appear-to-have-found-it/ #dataleak #databreach #healthsec #cybersecurity #HIPAA

• Post #2113057

  NEW, by me, the one some of you have been asking about: Months After Being Notified, a Software Vendor is Still Exposing Confidential and Sealed Court Records https://databreaches.net/2025/10/13/months-after-being-notified-a-software-vendor-is-still-exposing-confidential-and-sealed-court-records/ I don't usually ask for boosts, but if you are in a position to help spread the word about this vendor and that its clients need to check their security, that would be great. #dataleak, #incide...

• Post #2113056

  Remember that frustrating situation where some of us couldn't get a vendor to respond to notifications that court-sealed records and sensitive files were exposed? One entity eventually reached the vendor by phone and was so angry at their response that they wound up canceling their account with them. Yesterday, I finally reached the second court entity. They, too, wound up telling the vendor to take the share down. How many other clients may still have exposed data because the vendor te...

• Post #2113054

  ANNOUNCE: Survey on threats experienced by journalists and security researchers Are you a security researcher or a journalist in the cybersecurity/cybercrime space? DataBreaches.net and Zack Whittaker at this.weekinsecurity.com are conducting a survey on the types of threats researchers and journalists have faced, including legal threats or legal process and threats of violence from cybercriminals. The survey is at https://forms.gle/P9jr6VxfD1LV6odg9 Please complete the survey and share the...