Attackers gained access through a compromised employee Google account linked to a third-party app, exposing unencrypted credentials. Vercel warns of downstream breaches across "hundreds of users across many organizations."
A ransomware attack on healthcare IT vendor ChipSoft forced 11 hospitals to disconnect patient portals after the company advised terminating VPN connections. Patient data including diagnoses and national ID numbers may have been accessed; attackers remain unidentified.
A hacker claims to have extracted 10 petabytes from China's National Supercomputing Center over six months via a compromised VPN. The dataset allegedly includes missile schematics and documents marked 'secret' from defense-linked organizations.
Unauthorized access detected March 16 in CareCloud's EHR environment; company cannot confirm if millions of patient records were exfiltrated. Investigation ongoing with external specialists and law enforcement.
TA416 resumed targeting EU and NATO diplomatic missions in mid-2025 after two years away, using OAuth redirect abuse, Cloudflare Turnstile pages, and MSBuild-based chains to deploy a constantly updated PlugX backdoor. The group's tooling and targeting both shift with geopolitical events.
Anthropic’s Claude Code npm package contained a 60 MB source-map file that let anyone reconstruct its full TypeScript source. It’s the second time the company has made the same packaging mistake.
Two poisoned Axios versions injected a fake dependency that silently installed a cross-platform remote access trojan on macOS, Windows, and Linux within 39 minutes of each other.
The new FBI chief’s private inbox wasn’t on a government server — it was on whatever email service he used in 2010. Iran’s Handala Hack Team turned that decade-old account into a geopolitical trophy.
A mis-configured blog tool spilled Anthropic’s next-gen model, Claude Mythos, plus warnings it could outrun cyber defenders. The company calls it a step-change in capability—and a cybersecurity headache.
Russian phishers steal Signal & WhatsApp accounts with fake support chats no code crack needed, just human trust.
Tax season phishing is no longer just fake IRS emails. Microsoft caught campaigns weaponizing legitimate remote-management tools—complete with QR codes, revoked certs, and 29,000-accountant targeting lists.
After touting private communication as the future, Meta is quietly retiring Instagram's encrypted chats. Users have until May 8, 2026 to save their messages before the feature disappears.
