Data-Breach
Supply Chain Security Vendor RapidFort Allegedly Breached in CanisterWorm Fallout — 569GB of Customer Pipeline Data Listed for Sale
A threat actor claims to be selling 569GB of RapidFort's internal pipeline data — including customer cross-account IAM templates, kubeconfigs, and plaintext AWS credentials — allegedly extracted during the March 2026 CanisterWorm/TeamPCP campaign.
Metabase Zero-Day: Unauthenticated SQL Injection (CVSS 10.0) Exploited to Breach Framework and Tally
A pre-auth SQL injection in Metabase's password-reset endpoint let attackers hijack admin access on customer instances, hitting Metabase Cloud tenants Framework and Tally before a patch shipped.
ExfilSquad's Power Pages Rampage Hits UK Police Legal Database, 14 Other Victims
A new extortion group, ExfilSquad, is scraping data straight out of misconfigured Microsoft Power Pages portals with no exploit required — its highest-profile victim so far is the UK's Police National Legal Database, exposing contact data for 135,000 officers and justice staff.
Ransomware Halts US Production at Coca-Cola's Fairlife Dairy Unit
A ransomware intrusion at Coca-Cola-owned Fairlife forced a shutdown of US dairy production lines, disclosed via SEC 8-K filing — no gang has claimed the attack and no ransom demand has been confirmed publicly.
AssuranceAmerica Breach Exposes 7 Million Driver's Licenses After a Single Phished Employee Account
A single compromised employee credential at auto insurer AssuranceAmerica led to the theft of driver's license numbers, SSNs, and policy data for nearly 7 million people — one of the largest driver's-license breaches disclosed in the US this year.
Accenture Confirms Breach After Threat Actor '888' Lists 35GB of Source Code and Azure Credentials for Sale
A threat actor known as 888 is selling 35GB of alleged Accenture source code, RSA/SSH keys, and Azure access tokens on a cybercrime forum; Accenture has confirmed an incident but not disclosed the access vector.
DHS Confirms Breach of HSIN, the Federal-State-Local Information-Sharing Backbone
DHS confirms an unattributed threat actor breached HSIN and a connected SharePoint environment used by fusion centers and law enforcement nationwide, with the intrusion window overlapping World Cup security planning.
Klue OAuth Breach Feeds 'Icarus' Salesforce Data-Theft Spree
A dormant legacy credential at market-intelligence vendor Klue let the new Icarus extortion crew steal customer OAuth tokens and bulk-export Salesforce CRM data from Huntress, Recorded Future, Tanium, Jamf, and more.
ShinyHunters Hits Instructure Again: 3.65TB, 275M Canvas Users, May 6 Ransom Deadline
ShinyHunters claims 3.65TB stolen from Instructure's Canvas platform — 275M users across ~9,000 institutions. Second hit in eight months. Ransom timer expires tomorrow.
ShinyHunters Dumps 3M Cisco Salesforce Records as UNC6040 Vishing Campaign Expands
ShinyHunters leaks 3M+ Cisco Salesforce CRM records tied to the UNC6040 vishing/OAuth-abuse campaign, exposing federal procurement data, AWS resource references, and GitHub repo names.
Anubis Ransomware Gang Claims 2TB Exfiltration from Signature Healthcare as Brockton Hospital Diverts Ambulances
Anubis RaaS group claims theft of 2TB of patient data from Signature Healthcare while Brockton Hospital diverts ambulances, cancels chemo, and operates on paper charts a week after the attack.
European Commission Confirms Cloud Breach — Trivy Supply Chain Attack Cascades Into 30+ EU Entities
The European Commission confirms a data breach affecting 30+ EU entities after the compromised Trivy scanner leaked AWS API keys to TeamPCP. ShinyHunters published 92 GB of stolen data.