Dissent Doe

@realhackhistory@chaos.social Yeah... but I do distinguish between ShinyHunters and Scattered and Lapsus$ even though they collaborated. And if you were watching them, you may remember times when Shiny showed up and deleted a lot of their stuff or told them to knock it off. It was like herding cats or misbehaving children. And I do think that Shiny announcing they were all one was a huge mistake for ShinyHunters. He even acknowledged that to me months later.

What's going on with ShinyHunters? First they accuse Clop of stealing their zero-day for Oracle, then they start hitting medical sector, then they deface and threaten Clop, and now we learn they ratted out TeamPCP? Something's very different.

I'm always curious to see what cyber insurers are doing on coverage for different scenarios. The Revolut incident reportedly has some insurers re-thinking. Matthew Sellers reports: "Most social engineering endorsements are triggered by a transfer of funds, not a transfer of data. A scam where nothing is paid out but a large volume of identity and biometric data leaves the building can fall between a crime policy, built for financial loss, and a data breach policy, often built around unauthorised access rather than a fraudulent-but-convincing request. Brokers reviewing fintech and financial services clients’ wording may want to check whether “fraudulent instruction” definitions extend to information requests, not just payment instructions." Source: Insurance Business Magazine: https://www.insurancebusinessmag.com/uk/news/cyber/revoluts-paperwork-breach-shows-why-insurers-are-rethinking-what-counts-as-a-cyber-attack-589775.aspx #databreach #cyberinsurance #Revolut

RE: https://mastodon.social/@brianhonan/117275280843738578 Ooh. Interesting thought, thanks. Have you come across situations in which insurers denied coverage for regulator fines but paid other incident response costs from data breaches?

In January 2025, the WA attorney general sued T-Mobile over a data breach that affected 2M residents (this was the 79M T-Mobile breach). One of the issues in the litigation was that T-Mobile didn't properly notify those affected of the breach -- it omitted telling them in SMS notifications that their SSN had been acquired. For background, see https://www.atg.wa.gov/news/news-releases/ag-ferguson-files-lawsuit-against-t-mobile-massive-data-breach Now a court has agreed with the state that the text message notifications did not comply with the state's breach notification law: https://www.seattletimes.com/business/t-mobile-violated-wa-data-breach-notification-law-judge-rules/ T-Mobile says it will appeal. #databreach #incidentresponse #notifications #TMobile

"Marco Rubio says the US will deny visas to foreign nationals involved in cybercrime and may extend the restrictions to their immediate families.......... Marco Rubio says the US will deny visas to foreign nationals involved in cybercrime and may extend the restrictions to their immediate families." (see on The Register) Why not allow the suspected criminals to get visas, allow them to fly over here, and then arrest them and prosecute them?

NEW by me: The “Anonymous” Tip System That Wasn’t: Three Months Later, Why Hasn’t Navigate360 Notified Anyone? Note: there is a trigger warning at the top of this article as it contains sensitive material from tips submitted to and about students on what were supposed to be "anonymous" tiplines. https://databreaches.net/2026/07/06/the-anonymous-tip-system-that-wasnt-three-months-later-why-hasnt-navigate360-notified-anyone/ This is the longest post I have ever done because people need to be more aware that this was the worst breach EVER in terms of highly sensitive personal information of students and their peers and families. Great thanks to @douglevin@infosec.exchange for his comments and suggestions on the post. @funnymonkey@freeradical.zone @mkeierleber@journa.host @euroinfosec@infosec.exchange @jgreig@ioc.exchange @zackwhittaker@mastodon.social @campuscodi@mastodon.social @politico@newsie.social @dustinvolz@journa.host #databreach #anonymity #infosec #cybersecurity #Navigate360 #P3Campus #P3Global

I wish this wasn't being handled in a partisan way. Surely Democrat and Republican state attorneys general can agree that questions need answers about this incident. I really wish they had collaborated on this one.

GovTech reoorts on the ITRC's H1 report: "[ITRC]found that 1,029 data compromises generated 471 million breach notices in the first half of the year, with one incident — the breach involving Instructure’s Canvas platform — accounting for 275 million of those notices, or about 58 percent of the total."

More than 30 Minnesota water systems targeted in cyberattack: https://www.fox9.com/news/30-minnesota-water-systems-targeted-cyber-attack I haven't seen Handala or any group claim responsibility yet, but it's noteworthy that the quality of drinking water does not appear to have been tampered with. #cyberwar #Handala #criticalinfrastructure #water

NEW by me: more analysis of the Navigate360 data breach, this one focusing on Crime Stoppers and crime-oriented tip lines using P3 Global Intel: Crime Stoppers assured people their tips would be anonymous. Then more than 1 million tips leaked: https://databreaches.net/2026/07/24/crime-stoppers-assured-people-their-tips-would-be-anonymous-then-more-than-1-million-tips-leaked/ If anyone has a connection in their state attorney general's office, encourage them to read this and open an investigation. A table in the article shows how many tips were submitted for each chapter of Crime Stoppers that appeared in the dataset. #databreach #cybersecurity #infosec #Navigate360 #CrimeStoppers @zackwhittaker@mastodon.social @campuscodi@mastodon.social @jgreig@ioc.exchange @douglevin@infosec.exchange @ajvicens@mastodon.socialspill.com

Another entity files for insolvency after a data breach. Sounds like the data breach was responsible in this case. From ZEGO's notice: "The cyberattack of March 29, 2026, however, impacted our company to an extent that we could not fully compensate for despite our best efforts. The consequences resulted in a production outage of nearly six weeks and significant financial strain. These effects ultimately impacted our financial situation so severely that filing for insolvency became necessary. " https://www.zego-tvz.com/wichtige-information/ I didn't find any group listed as claiming responsibility for this incident. @sawaba@infosec.exchange #databreach #insolvency

TFW you finish entering all your new appointments for this week, only to realize you entered them in last week's calendar and now mucked everything up. 😭 🤦‍♀️

NEW by me: Fintech firm Nayax investigating breach; The Syndicate claims it acquired 1 billion card records and other important data (It appears there's another TA that I had never heard of before. And note that the TA has offered no POC at this point). https://databreaches.net/2026/07/08/nayax-investigating-breach-the-syndicate-claims-it-acquired-1-billion-card-records-and-other-important-data/ #databreach #fintech #Nayax

RE: https://infosec.exchange/@chum1ng0/117044228483502361 You weren't alone, @chum1ng0@infosec.exchange . Their misclassification reportedly affected thousands of blogs: https://cybersecuritynews.com/google-blogger-locked-legitimate-websites/ But this is a good time for you to think about backups and alternatives. :)

It has been four months since a hacktivist obtained 8.3 million tips submitted to organizations such as Crime Stoppers and Sandy Hook Promise. What the hacktivist found in terms of lack of security was appalling. In the four months since Navigate360 (the parent company for P3 Global Intel and P3 Campus) learned of the breach, they have made zero public statements after the first day when they said they were investigating. Their wall of silence, and the conspiracy of silence involving programs like Safe2Say, Safe2Tell, SilentWitness, and Crime Stoppers has been unacceptable. No one has been notified, it seems. And we cannot find any state regulator that has been notified, either. DataBreaches wrote about the disgraceful lack of transparency in a new post this week: Broken Promises of Anonymity: Four Months Later, Still No Transparency. Now We’re Seeking Accountability. https://databreaches.net/2026/07/20/broken-promises-of-anonymity-four-months-later-still-no-transparency-now-were-seeking-accountability/ In conjunction with that post, I filed a formal FTC complaint against Navigate360 under Section 5 of the FTC Act and also notified the National Association of Attorneys General, saying that states should be protecting their residents by investigating the breach and incident response. And that's not all. Today, I have filed a complaint with one state attorney general's office and will be filing with others. I will also be publishing a post this week about the Crime Stoppers data in the dataset and the ridiculous response by legal counsel for Crime Stoppers USA to inquiries by DataBreaches about what was being done to improve security. I have not written up anything specific to all of the Canadian data in the dataset, but yes, Canadian crime stoppers and police organizations are in there, too. Take Action: If you know anyone in a state attorney general's office, encourage them to read up on the breach on my site, where I have also published tables with data for easy reference. If you know anyone in the FTC, encourage them to read the complaint I filed and to act on it. If you know any personal injury lawyer who should be handling a massive lawsuit alleging privacy harms, point them to my coverage. Children and adults who tried to be good citizens and relied on promises of anonymity have been put in harm's way. We cannot allow this to be minimized or covered up. @zackwhittaker@mastodon.social @nytimes@mediastodon.com @caparsons@mastodon.social @douglevin@infosec.exchange #databreach #infosec #Navigate360 #CrimeStoppers #Safe2Tell #Safe2Say #SilentWitness #SandyHookPromise #transparency #notification #NAAG #FTC

Milford, New Hampshire seems to be dealing with a cyberattack since July 15, but they don’t call it that and haven’t revealed many detail details. A resident wonders whether the breach was caused by a vulnerability he reported to them in May that they did not address. My post about it all: https://databreaches.net/2026/07/21/milford-new-hampshire-confirms-unauthorized-activity-withholds-details-of-suspected-cyberattack/ #govsec #cybersecurity

@hnapel@mastodon.social That's somewhat lost on me... I never really watched that show more than once or twice. All I remember about it was that there was something about apple pie?

@sawaba@infosec.exchange @adamshostack@infosec.exchange Ah. Well, this is on YOU, then, of course. :) It's fantastic that you had the foresight to start this years ago and that you maintain it. It really is a great resource for any journalist or researcher who wants to fact-check claims about the consequences of breaches.

@sawaba@infosec.exchange @adamshostack@infosec.exchange That was my sense, too. Chapter 11 equivalence. Maybe you should have a Chapter 11/insolvency/wounded but not dead sheet. Because how do we know that a company ever successfully bounces back and doesn't wind up dead after all?

@chum1ng0@infosec.exchange Yes, Chu, you need to appeal and say there is NOTHING in your blog posts that is malware or any malicious content. Tell them to have an informed human being read the posts and they'll confirm that. @javilopezg@mastodon.social

@chum1ng0@infosec.exchange Those complaints/reports show that Blogger has a false positive problem/issue. Add your report to it and appeal the blocking.

@chum1ng0@infosec.exchange Not necessarily. Might be a script looking for certain words type of thing.

@chum1ng0@infosec.exchange It gives you the link to use to appeal.

@chum1ng0@infosec.exchange I think they made a mistake. And if they don't undo the block, maybe look at this page to get free help: https://www.trust.org/our-services/legal-services-for-media/

@chum1ng0@infosec.exchange OK, so you clearly should file an appeal and tell them that although you report about data security incidents, you never include malware or malicious content and to please re-read your posts.

@chum1ng0@infosec.exchange I responded to your message on Signal, but let's keep this here because it may be a press freedom/ free speech issue. What blog/platform banned your blog? And what reason did they give? And do you have a complete backup that you can upload elsewhere? As I mentioned the other day, there are free legal resources and help for independent media, but first explain more about what happened and why. #pressfreedom @freespeech #censorship (For those of you who don't know, Chu used to report LatAm breaches on DataBreaches.net. It's hard for me to imagine how he would get banned for the kind of reporting he does, but... let's find out. )

@husjon@fosstodon.org I dunno, but I wouldn't be surprised if Trump sued OpenAI for 43 billion dollars or something....

@fuzzyfuzzyfungus@cyberplace.social From what I am reading, Democrat attorneys general were not asked to participate or even review the letter. This was apparently intended to be partisan.

@SteveBellovin@infosec.exchange I want to see what they do with the feedback. In the past, I've gotten follow-up phone calls. In this case, I was so upset over the anethesiology situation that I actually have written a request under HIPAA to amend my medical records to remove his terrible recommendation.

ShinyHunters says the May attack wasn't them or SLH, so I corrected my post on that point. @bobdahacker@infosec.exchange @campuscodi@mastodon.social

@douglevin@infosec.exchange @funnymonkey@freeradical.zone Instructure's most recent update even tells schools that if they discover notifications need to be sent, to contact them and Instructure will make the notifications via Kroll, so yes, it looks like not all notifications have been made. I wonder if ITRC used the "275 million" number from ShinyHunter's leak site claims or some other source.

@adamshostack@infosec.exchange @sawaba@infosec.exchange My fault. I probably should have mentioned him at the top instead of the bottom.

@douglevin@infosec.exchange @funnymonkey@freeradical.zone @mkeierleber@journa.host @euroinfosec@infosec.exchange @jgreig@ioc.exchange @zackwhittaker@mastodon.social @campuscodi@mastodon.social @politico@newsie.social @dustinvolz@journa.host We both have things going on right now. Let's talk in a few weeks. I have some ideas. I #Navigate360 #P3Campus #CrimeStoppers #Safe2SayPA #Safe2Tell #SandyHookPromise #databreach #hacktivism #Anonymity #Accountability

OT: My health system asked for my feedback about a recent hospital experience. I gave everything a good rating until we got to the survey questions on anesthesia, and I wrote, "The anesthesiologist should be shot and killed....." Well, they asked for feedback. 😡

Developing: AnMed reports phone and internet outage impacting all 4 hospital locations in South Carolina and Georgia. Emergency rooms remain open. No group has claimed responsibility as yet. #cyberattack #healthsec

@cwbussard@ioc.exchange are you having trouble with the RSS feed? Email me your IP address address and I’ll whitelist it. Unfortunately, the. CF remains necessary because I continue to get DDoS attacks when I drop it.

@realhackhistory@chaos.social Well, the threats against Nixon and Larsen really caused chaos, and leaking some USgov info. After Jubair and Flowers were arrested and detained, things calmed down a bit, but still not a good look.

RE: https://chaos.social/@realhackhistory/117300415989405928 @realhackhistory@chaos.social So the shift in behavior I notice with ShinyHunters has also been seen in other groups. It seems to me that we should be paying more attention to this to figure out how to use it to aid in disruption, and not just write it off as so many kids being "nuts."

@SteveBellovin@infosec.exchange 😂

@amvinfe@infosec.exchange I have no idea what to make of all that. Do you believe any of it?

@octothorpe@mastodon.online (1) if they're employees for tax records, (2) for customers who want to finance a phone and they'll do a credit check, and (3) to verify identity if people call with a support request. 4).... ??? I dunno.

@realhackhistory@chaos.social Did you see the 2020 - 2023 ShinyHunters as "nuts?"

@realhackhistory@chaos.social In them, no. Monitoring them, yes. And of course, they ultimately claimed it was all a big disinformation and distraction ruse.

@SteveBellovin@infosec.exchange You're right. I brought it with me to the pre-surgical appointment for an upcoming surgery and they didn't know what to do with it. They finally decided to scan it in, but that is probably not going to trigger the HIPAA review.