Incidents
Sat 19 Sep
Updated Mon 26 Oct
BleepingComputer (Lawrence Abrams; 19 September 2026) reports that the ShinyHunters extortion group breached the Clop (Cl0p) ransomware operation's data-leak Tor site. BleepingComputer says it confirmed that a text file taunting Clop and linking to ShinyHunters' leak site had been uploaded to Clop's server and could be downloaded from Clop's Tor site, and that several hours later the site had been replaced with ASCII art of Umbreon, the Pokémon ShinyHunters uses as its logo, with a link to ShinyHunters' Tor site. BleepingComputer says it has not independently verified ShinyHunters' further claims about how it got in and what it took. Crime-on-crime / threat-actor infrastructure compromise — not a victim organisation's breach notice. (source: BleepingComputer) Correction (26 Oct 2026): removed ShinyHunters' own unverified claims (the access method, server access and stolen source code, logs and onion keys) from the title and summary; only what BleepingComputer confirmed remains. (source: BleepingComputer)
BleepingComputer — ShinyHunters hacks Clop leak site (19 Sep 2026)
breaches identity
Incidents
Thu 17 Sep
Updated Mon 2 Nov
CrowdSec statement (17 September 2026; informed 16 Sep) confirms a May 2026 leak of its private GitHub repositories (SaaS console, AWS cloud routines, connectors, automations). Public Security Engine repos are out of scope by design. CrowdSec says reports of ~300 repositories are accurate when 130+ intentionally public repos are included, and that the figure reflects code subdivision rather than 300 separate sensitive systems. Company assessment: TanStack npm supply-chain compromise (CVE-2026-45321; TanStack postmortem 11 May 2026 — 84 malicious versions across 42 @tanstack/* packages) is the very likely vector, similar to Mistral AI’s related case; a backdoored component appears to have extracted a CI/CD API key with read access to the private codebase during a short May window. CrowdSec says no client data, login/password, name, organisation, or PII/client logs were leaked; hunting for lateral-movement credentials found none so far; tokens/credentials rotated after confirmation. Thanks Fuites Infos for disclosure. (sources: CrowdSec; TanStack postmortem for CVE-2026-45321) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: CrowdSec; TanStack)
CrowdSec — Source Code Exposure in May 2026 (17 Sep 2026)
breaches cloud identity
Incidents
Thu 17 Sep
Updated Mon 26 Oct
CBS News (16 September 2026, 7:45 pm US Eastern; 17 September, 7:45 am Perth) reports, citing US officials, that US Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers last month after cyberattacks struck the vessels while they were travelling toward the United States. One was the VL Prosperity, a 1,093-foot Liberian-flagged crude oil tanker; public vessel data cited by CBS shows it left Egypt's Sidi Kerir oil terminal on 1 August for Galveston, and US officials say it slowed near the Strait of Gibraltar around the time of the attack. Iran's Mehr News Agency reported on 20 August that the ship was attacked on 7 August in the Strait of Gibraltar and, citing an unnamed crew member, alleged hackers breached the engine room, reducing engine cooling flow, increasing engine speed and interfering with fuel systems; Iranian state media also claimed access to its propulsion, navigation and cargo systems and a 30-hour communications outage. The Coast Guard has not publicly attributed the attacks to Iran. On 21 August, the day after Mehr's report, Coast Guard cyber personnel, law enforcement officers, a vessel inspector and FBI Cyber Action Team operators boarded the ship for four days. Rear Adm. Amy Grable, commander of US Coast Guard Cyber Command, told CBS investigators found malicious cyber activity on the vessel's IT and other onboard systems but no evidence the ship had become unsafe to navigate; the boarding was one of roughly 40 to 50 Coast Guard Cyber Protection Team missions in the past year. The US is investigating whether the two attacks are connected and whether Iran or another foreign adversary was behind them. OT/maritime relevance for AU shippers and ports. (source: CBS News) Correction (26 Oct 2026): the card now rests on CBS News's own report rather than SecurityWeek's summary of it, and a Wall Street Journal detail on when the second ship was boarded, which no source readable to Cyberstack supports, has been removed. (source: CBS News)
CBS News — Coast Guard and FBI boarded two energy tankers after cyberattacks (16 Sep 2026 US Eastern; 17 Sep Perth)
tech ot ics network
Incidents
Thu 17 Sep
Updated Mon 2 Nov
BleepingComputer (17 September 2026) reports the US FBI seized nightmare-stresser[.]com and nightmarestresser[.]org used by NightmareStresser, a long-running DDoS-for-hire (booter) service. FBI Cyber Division said that since 2022 the service was used to launch hundreds of thousands of actual or attempted DDoS attacks worldwide. Seizure banners cite Operation PowerOFF, the international law-enforcement effort against DDoS-as-a-service infrastructure. Historical context: Searchlight Cyber (2023) previously assessed ~566k registered users and up to ~200 Gbps multi-layer attacks; DOJ had seized nightmarestresser[.]com once before in December 2022 with related arrests. (source: BleepingComputer quoting FBI Cyber Division) Correction (02 Nov 2026): removed The Hacker News as a source. (source: BleepingComputer)
BleepingComputer — FBI seizes NightmareStresser (17 Sep 2026)
tech network
Incidents
Wed 16 Sep
Updated Sun 25 Oct
The US Department of Health and Human Services (HHS) Office for Civil Rights breach portal lists AngMar Management Services, a Texas business associate, with 126,196 individuals affected, in a report submitted on 16 September 2026 as a hacking/IT incident involving a network server. The portal entry does not describe what information was involved. (source: HHS OCR breach portal) Correction (25 Oct 2026): the card now rests on the HHS breach portal entry; details from a press report we cannot verify (the type of data, the timeline and a leak-site claim) have been removed. (source: HHS) Correction (25 Oct 2026): the card date has moved from 5 October to 16 September 2026, the breach report submission date the HHS portal lists; HHS gives a US date with no time. (source: HHS)
HHS Office for Civil Rights — breach portal: cases under investigation (AngMar Management Services, TX, 126,196, submitted 16 Sep 2026)
breaches
Incidents
Wed 16 Sep
Updated Mon 2 Nov
Helpfeel Inc. notice (16 September 2026 JST; Kyoto) confirms unauthorised access to Gyazo’s image-sharing service. On 11 September 2026 a third party exploited a vulnerability in Gyazo’s image upload server to run arbitrary commands; Helpfeel says it blocked access routes by early 12 September and remediated the flaw. Confirmed disclosure: ~23.62 million user-related records (fields vary — may include name/nickname, email, password hash, user/device/session IDs, X/Twitter token, Google SSO email, profile/language, registration/last-login, plan and billing status without card numbers) and ~490 million image metadata records primarily for images registered in/before January 2019 (~14.4% of image-related data), plus ~2.4 million further metadata records via filtering. Metadata includes values used to build Gyazo image URLs (upload IP, User-Agent, EXIF location, OCR text, titles, source URLs, hashed passphrases for private images); Helpfeel temporarily disabled access to files whose records were exposed and cannot rule out that some private images were viewed. Updated 19 Sep 2026 (BleepingComputer, 18 September US time; 12:00 am 19 September Perth): Gyazo service temporarily suspended for preventive maintenance while recovery continues; Helpfeel/Cosense not confirmed impacted beyond Gyazo; users being notified; no evidence of data deletion from this incident. No payment-card data confirmed disclosed. Users: change Gyazo passwords and any reused passwords; report filed with Japan’s Personal Information Protection Commission. (sources: Helpfeel corp notice; BleepingComputer) Updated 27 Sep 2026 (Helpfeel): Helpfeel says it resumed the Gyazo service on 27 September 2026 after a series of security measures and verification work (notice dated 26 September; first notice updated 27 September, 8:00 am JST, 7:00 am Perth). Updated 21 Oct 2026 (Helpfeel): Helpfeel published a further notice with its final investigation results (Update 3). (source: Helpfeel) Correction (26 Oct 2026): BleepingComputer and later Helpfeel notices now carry Updated lines with Perth dates. (sources: Helpfeel; BleepingComputer) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Helpfeel; BleepingComputer)
Helpfeel — Gyazo unauthorised access notice (16 Sep 2026)
breaches cloud identity
Incidents
Wed 16 Sep
Updated Mon 2 Nov
Mandiant AI Risk and Resilience Report 2026 (Google Cloud) case study: after compromising a SaaS provider, an attacker hijacked an active AI coding-assistant session on a developer workstation. The assistant recommended a poisoned external package; once accepted, the attacker used the session to install an infostealer via a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across about 100 internal repositories (secret theft and programmatic exfiltration). Defenders: treat AI assistant tool-install prompts as high-risk; constrain package installs; rotate GitHub tokens; audit recent repo automation. (source: Mandiant/Google Cloud report) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Google Cloud)
Mandiant AI Risk and Resilience Report 2026 (Google Cloud)
ai cloud identity
Incidents
Wed 16 Sep
Updated Sun 25 Oct
Premier Medical Group of the Hudson Valley P.C. published a Notice of Data Security Incident: after disruption of some IT systems, investigation found an unauthorized party accessed certain files on 14 June 2026; on 14 July 2026 PMG determined files may have included patient names, contact information, dates of birth, health insurance information, provider names, internal patient IDs, dates of service, medication information, and treatment/diagnostic information. Law enforcement notified; enhanced safeguards and staff training cited. The HHS breach portal lists Premier Medical Group of the Hudson Valley P.C. (NY, healthcare provider) with 282,075 individuals affected, submitted 21 August 2026, as a hacking/IT incident involving a network server. How the attack occurred not disclosed. (source: HHS OCR breach portal)
Premier Medical Group — Notice of Data Security Incident
breaches healthcare
Incidents
Tue 15 Sep
Updated Mon 26 Oct
eSentire Threat Response Unit blog (published 15 September 2026, 7:00 am US Eastern; 7:00 pm Perth) details GhostCode, a novel OAuth 2.0 device-authorization phishing kit that hijacks Microsoft 365 accounts after the victim completes legitimate MFA on Microsoft's real sign-in page. Observed chain: Salesforce contact-form lure posing as a procurement officer for BJ's Wholesale Club, sales follow-up, NDA pretext, then a WeTransfer link to a password-gated HTML lure using three evasion layers (junk padding, character-level HTML comment injection and an AES-256-GCM-encrypted redirect URL); a Cloudflare Turnstile gate filters scanners before the device-code page. Kit requests a user_code using the Microsoft Authentication Broker application ID, presents a polished fake document portal, and captures tokens once the victim approves the attacker's device. eSentire describes Primary Refresh Token capture and, in one intrusion, nine successful API calls with the stolen token across a 78-second period and three devices registered within 78 seconds, with rotating residential proxy IP addresses matching the victim's geolocation. Distinct from password-stealing kits; MFA does not stop the flow because the victim authenticates Microsoft directly. Defenders: restrict or block device-code grant where unused, alert on Authentication Broker device registrations, treat unexpected WeTransfer/NDA procurement mail as high-risk, review Entra ID sign-in and device logs. (source: eSentire TRU) Correction (26 Oct 2026): removed the Cyber Security News credit and link; every detail on this card is from eSentire's report, and the title no longer describes the 78-second window as an MFA bypass time. (source: eSentire)
eSentire TRU — GhostCode device-code phishing kit (15 Sep 2026)
tech identity cloud
Incidents
Tue 15 Sep
Updated Fri 30 Oct
Australian dealer management software maker Auto-IT says a “small number of Auto-IT customer environments” were impacted by an unauthorised external party, according to Cyber Daily (15 September 2026). Cyber Daily reports that Auto-IT is the third-party IT supplier several car dealers had pointed to as the source of their compromise. Storm claimed the attacks, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report and removed Webber Insurance's data-breaches list as a source; the card now carries only what the readable part of Cyber Daily's report states. (source: Cyber Daily)
Cyber Daily (15 Sep 2026)
australia
Incidents
Tue 15 Sep
Updated Sun 25 Oct
Developer Janis Elsts's incident notice for Admin Menu Editor Pro (published 14 September 2026, last updated 20 October) says a malicious admin-menu-editor-pro.zip was uploaded to adminmenueditor.com on 14 September 2026 and showed up as a version 2.35 update; it included a new file, includes/wp-user-consent.php, that installs a web shell. A clean 2.36 was released the same day, but later on 14 September 2.36 was also compromised; the developer says the attacker may have had root-level access to the server, which he took offline. He says anyone who installed 2.35 should treat the site as compromised and anyone who installed 2.36 as potentially compromised, particularly if downloaded after 19:00 UTC; 2.34 should be clean. He estimated that about 230 customers were affected in the initial compromise, often with multiple sites each, and identified about 300 more potentially affected customers from downloads in or near the window. Signs he lists from user reports: a new /wp-content/object-cache directory holding a hex-named web shell, wp_ocache or _wp_ocache_ options, a hidden user named wp_ followed by hex characters, hex-named MU-plugins and a _wp_cconsent_tick WP-Cron event. He advises restoring from a backup made before 14 September, or deleting the plugin and those artefacts, then changing all WordPress passwords, regenerating keys and salts and rotating other credentials stored on the site. According to BleepingComputer (15 September), Elsts said 2.35 was available from about 06:00 to 13:00 UTC, its code also created a hidden user account, the malicious build was installed on at least 1,500 sites, and the free Admin Menu Editor does not appear to be affected. Updated 25 Oct 2026: the developer says the update server has been rebuilt, downloads, licence activation and renewals are working again, and version 2.37.1 (based on the last known safe version, 2.34) adds optional checksum and signature verification for plugin updates. (source: BleepingComputer) Correction (25 Oct 2026): the card now leads with the developer's incident notice, which says 2.36 was also compromised and gives about 230 customers in the initial compromise plus about 300 more potentially affected; the 06:00–13:00 UTC window, the 1,500-site count and the free-edition note are credited to BleepingComputer. (source: Admin Menu Editor Pro developer incident notice)
Admin Menu Editor Pro — Security Incident Affecting Customers 2026-09-14 (developer notice; last updated 20 Oct 2026)
breaches cloud
Incidents
Tue 15 Sep
Updated Mon 26 Oct
BleepingComputer (15 September 2026) reports five alleged leaders of the Black Axe cybercrime syndicate — Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru — were extradited to the United States to face wire fraud and money-laundering charges. Prosecutors allege a South Africa-based internet fraud campaign (about 2011–2021; the defendants were arrested in South Africa in 2021 at the US request and extradited on 11 September 2026, per BleepingComputer) using romance and advance-fee scams, aliases, dating sites, and VoIP numbers to target US victims, including coercion via threats to publish sensitive photos. US Attorney’s Office for the District of New Jersey press release linked from the report: “Five Prominent Black Axe Members Extradited for Conspiring to Engage in Internet Scams and Money Laundering.” Law-enforcement action / charging story; not a fresh organisational data-breach notice. (sources: DOJ USAO-NJ PR; BleepingComputer) Correction (26 Oct 2026): the campaign was earlier described as Cape Town-based; BleepingComputer places it only in South Africa. (source: BleepingComputer)
DOJ USAO-NJ — Black Axe members extradited (15 Sep 2026)
breaches
