Alert feed
The alert feed
Live feed — entries drawn from official exploited-vulnerability catalogues and public filings, graded and explained in plain English. Feed generated daily; newest entries are dated on the board.
Wire generated 2026-10-28T11:15:00Z · BreachWatch wire — the same entries the site's registers carry
- Feed reviewed daily at 07:00 America/Denver
- Public record only — no classified or private feeds
- Silence is not evidence of safety
On the wire — 28 alerts
CRITICAL
Adobe Commerce and Magento unrestricted file upload allows arbitrary code execution
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
U.S. impact: Added to the national exploited-vulnerability catalogue on 27 October 2026 with a federal remediation deadline of 10 November 2026. Unlike the PHP entries beneath it, this one does not carry the forensic-triage flag, so the guidance is to apply the vendor's mitigations rather than to hunt for evidence of compromise. Magento sits under a large share of mid-size online stores, so the exposure reaches the merchant's own server, order history and customer records rather than a third-party platform. The flaw class matters: an unrestricted upload ends in a web shell on the store's own host. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-48356 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-27
CRITICAL
Google Brotli unchecked return value corrupts decoder memory
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
U.S. impact: Added to the national exploited-vulnerability catalogue on 27 October 2026 with a federal remediation deadline of 10 November 2026 and no forensic-triage flag. Brotli is a compression library rather than a product anyone chooses: it sits inside browsers, web servers and content delivery networks, so most affected organisations inherited it through something else. The catalogue notes it affects an open-source component that different products embed. A remote unauthenticated attacker can corrupt decoder memory and potentially execute code using a crafted compressed stream, which means the input is ordinary web traffic. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-111497 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-27
CRITICAL
PHP memory corruption flaw allows unauthenticated remote code execution
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
U.S. impact: Added to the national exploited-vulnerability catalogue on 26 October 2026 with a federal remediation deadline of 29 October 2026, and it carries the catalogue's forensic-triage flag — the guidance is to look for evidence of compromise, not only to patch. PHP runs underneath a large share of the public web, including WordPress, Drupal, Joomla and Magento, so the exposure reaches small-business, school, clinic and municipal sites whose owners never touch the language directly. The catalogue notes the flaw affects an open-source component that different products can embed, so the affected list is wider than PHP itself. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-109618 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-26
CRITICAL
PHP stale internal request-state flaw allows unauthenticated remote code execution
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
U.S. impact: Added to the national exploited-vulnerability catalogue on 26 October 2026 alongside CVE-2026-109618, with the same federal remediation deadline of 29 October 2026 and the same forensic-triage flag. The two are separate flaws in the same component and should be treated as one patching job: if you update PHP, you close both. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-109619 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-26
CRITICAL
Arista VeloCloud Orchestrator SQL injection reaches privileged internal functionality
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
U.S. impact: Added to the national exploited-vulnerability catalogue on 23 October 2026 with a federal remediation deadline of 26 October 2026, and it carries the catalogue's forensic-triage flag — the guidance is to look for evidence of compromise, not only to patch. The orchestrator is the control plane for an SD-WAN estate, so what is at risk is the data the orchestrator manages, not just the host it runs on. Apply the vendor's mitigations, and discontinue use where none are available.
Exploited-vulnerability catalogue — CVE-2026-114625 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-23
CRITICAL
Collabora Online built-in CODE Server OS command injection allows remote code execution
Collabora Online — Built-in CODE Server, when used within the Nextcloud platform, contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
U.S. impact: Added to the national exploited-vulnerability catalogue on 23 October 2026. This is the document layer inside Nextcloud, so code execution here reaches the files a team shares rather than a single machine. The condition in the vendor description — exploitation when the CODE server isn't running — is worth noting for anyone whose deployment has the service stopped or partially configured.
Exploited-vulnerability catalogue — CVE-2026-110447 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-23
CRITICAL
EG Secure Solutions SiteGuard Server Edition OS command injection reaches root
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
U.S. impact: Added to the national exploited-vulnerability catalogue on 20 October 2026 with a federal remediation deadline of 23 October 2026, and it carries the catalogue's forensic-triage flag — the guidance is to look for evidence of compromise on the system, not only to patch it. Administrators are directed to apply the vendor's mitigations and to discontinue use of the product where none are available.
Exploited-vulnerability catalogue — CVE-2026-106931 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-20
HIGH
Plex Media Server file-path control lets an admin write files that execute on load
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
U.S. impact: Added to the national exploited-vulnerability catalogue on 20 October 2026 with a federal remediation deadline of 23 October 2026. The chain is the story: four individually moderate flaws combine into arbitrary file write with execution on load, so a self-hosted Plex server reachable from outside a home or office network is the asset in scope.
Exploited-vulnerability catalogue — CVE-2026-96656 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-20
HIGH
Plex Media Server server-side request forgery in the transcode path
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:transcode/universal' path parameter.
U.S. impact: Added to the national exploited-vulnerability catalogue on 20 October 2026 with a federal remediation deadline of 23 October 2026. One of the four Plex flaws listed the same day; the request forgery lets an authenticated user point the server at internal addresses a remote attacker cannot otherwise reach.
Exploited-vulnerability catalogue — CVE-2026-96655 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-20
HIGH
Plex Media Server plugin call weakness from unneutralised URI schemes
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
U.S. impact: Added to the national exploited-vulnerability catalogue on 20 October 2026 with a federal remediation deadline of 23 October 2026. One of the four Plex flaws listed the same day; this is the link in the chain that lets the other three cross from a request into code.
Exploited-vulnerability catalogue — CVE-2026-96654 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-20
HIGH
Plex Media Server request forgery via the protocol parameter
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
U.S. impact: Added to the national exploited-vulnerability catalogue on 20 October 2026 with a federal remediation deadline of 23 October 2026. One of the four Plex flaws listed the same day; needing only any X-Plex-Token value lowers the bar to a user who is authenticated but not privileged on the server.
Exploited-vulnerability catalogue — CVE-2026-96652 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-20
HIGH
Siemens Software Center uncontrolled search path allows local code execution
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the application.
U.S. impact: Added to the national exploited-vulnerability catalogue on 20 October 2026 with a federal remediation deadline of 23 October 2026. Local and authenticated rather than remote, so the exposure sits on engineering workstations rather than the perimeter — for operational and industrial sites that makes it a lateral-movement concern rather than an outside attack.
Exploited-vulnerability catalogue — CVE-2026-110936 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-20
CRITICAL
BeyondTrust Remote Support authentication bypass by spoofing
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
U.S. impact: Added to the national exploited-vulnerability catalogue on 16 October 2026 with a federal remediation deadline of 19 October 2026, and the agency has publicly urged patching of the flaw. Holders of internet-facing appliances are directed to apply the vendor's mitigations and to account for each asset's exposure.
Exploited-vulnerability catalogue — CVE-2026-102764 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-16
HIGH
Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager path traversal
FortiOS, FortiPAM, FortiProxy and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with an admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
U.S. impact: Added to the national exploited-vulnerability catalogue on 16 October 2026 with a federal remediation deadline of 19 October 2026. The directive guidance directs asset owners to evaluate each asset's internet exposure and to apply the vendor's mitigations.
Exploited-vulnerability catalogue — CVE-2025-61624 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-16
HIGH
Atlassian data centre and server products expose files to unauthenticated access
Multiple Atlassian products — Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye — contain a files-or-directories-accessible-to-external-parties vulnerability that could allow an unauthenticated attacker to access specific files within the web application root directory.
U.S. impact: Added to the national exploited-vulnerability catalogue on 15 October 2026 with a federal remediation deadline of 18 October 2026. Self-hosted Atlassian deployments reachable from the internet are the assets the entry puts in scope.
Exploited-vulnerability catalogue — CVE-2026-21589 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-15
CRITICAL
Palo Alto Networks PAN-OS code injection reaches root on the firewall
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
U.S. impact: Added to the national exploited-vulnerability catalogue on 14 October 2026 with a federal remediation deadline of 17 October 2026. Perimeter firewalls are internet-facing by function, and the catalogue entry directs owners to apply the vendor's mitigations.
Exploited-vulnerability catalogue — CVE-2026-0322 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-14
CRITICAL
Ahsay AhsayCBS command injection in the replication receiver
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint. The flaw can be chained with CVE-2026-105133.
U.S. impact: Added to the national exploited-vulnerability catalogue on 14 October 2026 with a federal remediation deadline of 17 October 2026. Backups and hosted service platforms are the assets the flaw reaches, and the entry directs owners to apply the vendor's mitigations.
Exploited-vulnerability catalogue — CVE-2026-105134 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-14
HIGH
Ahsay AhsayCBS authentication bypass in the API component
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component's checkSysPwd function. The flaw can be chained with CVE-2026-105134.
U.S. impact: Added to the national exploited-vulnerability catalogue on 14 October 2026 with a federal remediation deadline of 17 October 2026. The entry names no sector; owners of internet-facing AhsayCBS installations are the assets in scope.
Exploited-vulnerability catalogue — CVE-2026-105133 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-14
CRITICAL
Cisco Secure Email Gateway relative path traversal allows unauthenticated file write
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
U.S. impact: Added to the national exploited-vulnerability catalogue on 14 October 2026 with a federal remediation deadline of 17 October 2026. Mail gateways are internet-facing by function, so the catalogue entry applies to any organisation running the appliance at the perimeter.
Exploited-vulnerability catalogue — CVE-2026-76519 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-14
CRITICAL
Ivanti Connect Secure authentication bypass leads to arbitrary command execution
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
U.S. impact: Added to the national exploited-vulnerability catalogue on 13 October 2026 with a federal remediation deadline of 16 October 2026. Unauthenticated command execution on a remote-access gateway is the class of flaw the catalogue exists to flag.
Exploited-vulnerability catalogue — CVE-2026-104935 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-13
HIGH
Microsoft Windows Shell command injection bypasses a security feature
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
U.S. impact: Added to the national exploited-vulnerability catalogue on 13 October 2026 with a federal remediation deadline of 16 October 2026. Windows estates of every size carry the affected component, and the entry directs owners to apply the vendor's mitigations.
Exploited-vulnerability catalogue — CVE-2026-96951 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-13
HIGH
ProFTPD improper access control allows arbitrary file read and write
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
U.S. impact: Added to the national exploited-vulnerability catalogue on 8 October 2026 with a federal remediation deadline of 11 October 2026. File-transfer servers left internet-facing are the assets the entry puts in scope.
Exploited-vulnerability catalogue — CVE-2015-3306 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-08
HIGH
ISC BIND denial of service through TKEY queries
ISC BIND contains a data processing error vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
U.S. impact: Added to the national exploited-vulnerability catalogue on 8 October 2026 with a federal remediation deadline of 11 October 2026. The stated impact is availability only, but DNS resolvers sit under most public-facing services.
Exploited-vulnerability catalogue — CVE-2015-5477 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-08
CRITICAL
Apache Struts command injection with dynamic method invocation enabled
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
U.S. impact: Added to the national exploited-vulnerability catalogue on 8 October 2026 with a federal remediation deadline of 11 October 2026. The flaw sits in a Java framework embedded in older business applications that are often internet-facing.
Exploited-vulnerability catalogue — CVE-2016-3081 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-08
CRITICAL
ONLYOFFICE Docs path traversal can reach remote code execution
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter, and could allow for remote code execution.
U.S. impact: Added to the national exploited-vulnerability catalogue on 8 October 2026 with a federal remediation deadline of 11 October 2026. Self-hosted document servers reachable from outside the network are the assets in scope.
Exploited-vulnerability catalogue — CVE-2021-3199 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-08
HIGH
Strapi stores sensitive user details in cleartext and is reachable through the query filter
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product could be end-of-life or end-of-service, and users are advised to discontinue use or transition to a supported version. The vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
U.S. impact: Added to the national exploited-vulnerability catalogue on 8 October 2026 with a federal remediation deadline of 11 October 2026. The record itself notes the product may be past end-of-life, in which case discontinuing use is the advised response.
Exploited-vulnerability catalogue — CVE-2023-22894 · Tier 1 · Exploited-vulnerability catalogue · 2026-10-08
WATCH
Change Healthcare claims-processing network
Health, billing and insurance-claims records were copied out of a claims-processing network, and parts of the health system that depend on it could not process claims for weeks.
U.S. impact: The company said roughly 190 million people in the United States had data in scope — a very large share of the country. Notification letters and identity-protection cover followed over the months after the filing.
SEC EDGAR — Form 8-K filings · Tier 1 · Official filing · 2024-04-22
WATCH
MOVEit Transfer file-theft campaign
Organisations that used a particular file-transfer product had files stolen straight out of it — client lists, payroll files, health records and benefit data held by government agencies, banks, universities and hospitals.
U.S. impact: United States agencies, universities, insurers and benefit administrators were among the victims and published notices at different times. A notice from an organisation you have been a customer, patient or employee of is the reliable signal.
CISA cybersecurity advisories · Tier 1 · Official advisory · 2023-06-02
The register
Nothing reaches these pages without a person having read it. Each item is checked against its source, labelled with a confidence tag, and given an attribution qualifier that stays exactly as the source stated it.
- Confirmed — acknowledged by the organisation or a filing
- Reported — named reporting, specifics not acknowledged
- Unverified — circulating, nothing established
Confirmed
Change Healthcare claims-processing network
Change Healthcare, a claims-processing subsidiary of UnitedHealth Group. · Healthcare · Tier 1 · Official filing
| What | Health, billing and insurance-claims records were copied out of a claims-processing network, and parts of the health system that depend on it could not process claims for weeks. |
| When | 22 April 2024 |
| Where | Claims-processing, billing and prescription-related systems. The company has said roughly 190 million people had data in scope — a very large share of the United States. |
| How | Stolen remote-access credentials used to log in to a remote-access service that was not protected by multi-factor authentication. |
| Who | Self-claimed by ALPHV/BlackCat; a ransom was reportedly paid. A second group, RansomHub, later claimed it held the data. No government agency has published an attribution. |
| Exposure window | Intrusion is reported to have started around 12 February 2024. The network was disconnected on 21 February 2024, which is when the access ended. |
| Am I affected? | ['Look for a notice letter from Change Healthcare or UnitedHealth Group. If you were in scope you should have been offered identity-protection cover.', 'Read your insurance explanation-of-benefits statements and medical bills for treatment you never had. That is the signature of medical identity theft.', 'If you were notified, enrol in the monitoring and place a freeze or fraud alert with all three credit bureaus — it is free and takes about ten minutes each.', "Treat any call, text or email that cites this breach and asks you to 'verify' details as suspect. Ring your insurer on the number printed on your card."] |
Source: SEC EDGAR — Form 8-K filings
Confirmed
Microsoft corporate email accounts
Microsoft Corporation. · Cloud & Big Tech · Tier 2 · Victim organisation disclosure
| What | A small number of Microsoft employee email accounts were read, including accounts belonging to senior leadership and to staff who work on security and legal matters. |
| When | 19 January 2024 |
| Where | A legacy, non-production test tenant account, and through it a small number of corporate email accounts — including members of the senior leadership team and employees in cyber-security and legal functions. Customer systems and production services were not the target. |
| How | A password-spray attack against a legacy test account, then abuse of an over-permissive permission setting to move from that account to email. |
| Who | Attributed by Microsoft to Midnight Blizzard, a group Microsoft links to Russia's foreign-intelligence service, the SVR. Other national agencies track the same activity under their own names. |
| Exposure window | Access began in late November 2023 and continued until it was detected and cut off in January 2024. |
| Am I affected? | ["This one concerns Microsoft's own corporate email, not customer accounts — most people are not in scope.", 'If you are a Microsoft customer: no customer data was reported as taken, and no action is required on your part.', 'If you administer Microsoft 365 for an organisation, use this as a prompt: enforce phishing-resistant multi-factor authentication on mail, and remove legacy test tenants nobody owns.'] |
Source: Microsoft Security Blog
Confirmed
AT&T wireless call and text records
AT&T Inc. · Telecom · Tier 1 · Official filing
| What | Records showing who wireless customers called and texted, and when, were downloaded from a cloud platform. The contents of the calls and messages were not taken. |
| When | 12 July 2024 |
| Where | Customer call and text metadata — phone numbers and timestamps — held on a third-party cloud data platform. Names were not included, and neither was the content of any call or message. |
| How | Credentials for an account on a cloud data platform, used without multi-factor authentication — the same pattern seen across a cluster of mid-2024 incidents at other companies that used the same platform. |
| Who | Unknown. Neither the company nor any agency has published a credible attribution, and no group has been publicly confirmed as responsible. |
| Exposure window | Call and text records from 1 May to 31 October 2022, plus single-day records from 2 January 2023. |
| Am I affected? | ['These are metadata records: who you called, not what was said. Expect phishing that names a real contact or an organisation you really deal with — that detail is now cheap for an attacker to get.', 'Verify any unexpected message by ringing the organisation back on a number you already have, not one in the message.', 'Ask your carrier to add a port-freeze and an account passcode. That makes SIM-swap fraud much harder.', 'Move your important accounts — email first, then banking — off SMS codes and onto an authenticator app or a hardware key.'] |
Source: SEC EDGAR — Form 8-K filings
Confirmed
MOVEit Transfer file-theft campaign
Progress Software (the product vendor), and the many organisations using its MOVEit Transfer product — the campaign reached victims across several countries. · Government & Infrastructure · Tier 1 · Official advisory
| What | Organisations that used a particular file-transfer product had files stolen straight out of it — client lists, payroll files, health records and benefit data held by government agencies, banks, universities and hospitals. |
| When | 2 June 2023 |
| Where | Files stored inside MOVEit Transfer instances: client records, employee and health data, benefit files. Data was taken in batches rather than all at once. |
| How | A flaw in the product's web interface that let an attacker run their own database commands and pull files out without logging in through the front door. |
| Who | Self-claimed by Cl0p, the group Microsoft tracks as Lace Tempest. CISA and the FBI confirmed widespread exploitation but published no formal state attribution. |
| Exposure window | Exploitation was confirmed from late May 2023 and continued well past the first patch, for as long as organisations were unpatched or had not rotated credentials. |
| Am I affected? | ['The signal here is a notice from an organisation you have been a customer, patient or employee of. MOVEit took files, so the notice is the only reliable way to know.', 'Check whether an insurer, pension scheme, university or state agency you deal with published a MOVEit notice — many did, at different times.', 'Watch for phishing that quotes details an organisation would hold about you. That is the extra leverage a stolen file gives an attacker.', 'If you get a notice, ask plainly what was taken. In most jurisdictions you are entitled to be told.'] |
Source: CISA cybersecurity advisories
Confirmed
23andMe customer profile and ancestry data
23andMe Holding Co. · Social & Identity · Tier 2 · Victim organisation disclosure
| What | Names, contact details, birth years and some genetic-relative information for millions of customers were accessed — the kind of data that cannot be reissued the way a password can. |
| When | 1 December 2023 |
| Where | Customer profile data and the company's 'DNA Relatives' feature, plus a subset of health-related reports. The company said roughly 6.9 million profiles were in scope. |
| How | Credential stuffing: passwords reused from other breached sites were tried against 23andMe accounts. Around 14,000 customer accounts were used as the way in to the rest. |
| Who | Unknown. No agency has published an attribution and no group has been publicly confirmed as responsible. |
| Exposure window | Access from around April 2023 until October 2023, entering through individual customer accounts. |
| Am I affected? | ['Change the password on that account and make it unique. If you used the same password anywhere else, change it there too — that reuse is how the entry happened.', 'Turn on two-factor authentication, ideally with an app rather than SMS.', 'Assume the family and ancestry detail is now permanently out there, and be sceptical of messages that reference your relatives, ethnicity or health by name.', 'Do not re-upload the same genetic data elsewhere without thinking about who else is in those family trees — you are not the only person a match reveals.'] |
Source: California Attorney General — breach notifications
Claimed
Ticketmaster customer data via cloud account
Ticketmaster (Live Nation Entertainment). · Booking & Travel · Tier 3 · Victim disclosure plus named-outlet reporting
| What | Customer names, contact details and some order information were taken from a database held with a cloud data provider. Some affected people were told limited card details were in scope. |
| When | 31 May 2024 |
| Where | A customer account on a third-party cloud data platform holding Ticketmaster data. The company said its own production systems and databases were not the route in. |
| How | Credentials for a customer account on a cloud data platform, with no multi-factor authentication in place on that account. |
| Who | Self-claimed by ShinyHunters on a criminal forum, including figures that have never been verified. The platform vendor and its affected customers confirmed the incidents happened; no agency published an attribution. |
| Exposure window | Not publicly disclosed. |
| Am I affected? | ['Expect email that references a real order, seat or event. That context came from the stolen data, so relevance is not proof the message is genuine.', 'Sign in to your ticketing account from a bookmark you trust, change the password, and turn on two-factor authentication.', 'Check card statements for small unfamiliar charges around the disclosure window and dispute anything you do not recognise.', 'If you were notified, the notice will say whether identity monitoring was offered and how to claim it. Keep the letter.'] |
Source: California Attorney General — breach notifications
Reported
Banco Santander third-party database access
Banco Santander. · Credit & Banking · Tier 2 · Victim organisation statement
| What | Customer information held in a database run by a third-party provider was accessed by someone outside the bank. |
| When | 14 May 2024 |
| Where | A database hosted by a third-party cloud provider. The bank said customer information relating to Spain, Chile and Uruguay, and information on some current and former employees, was in scope. Customer transactions and its own systems were not affected. |
| How | Credentials for a customer account on a cloud data platform, used without multi-factor authentication. |
| Who | Self-claimed by ShinyHunters on a criminal forum. The bank confirmed the unauthorised access. No agency has published an attribution. |
| Exposure window | Not publicly disclosed. |
| Am I affected? | ['If you bank with Santander, check whether the bank contacted you and whether your country was named in its statement.', 'Treat email or SMS that quotes your real name, branch or account type as unverified — that is exactly the detail a database record supplies. Log in through your own app or bookmark instead.', 'Change your online banking password if you have reused it anywhere else, and turn on whatever strong authentication the bank offers.', 'Read statements for unfamiliar direct debits or small test payments, which are often used to check whether an account is live.'] |
Source: Banco Santander press room
Unverified
Email-address dataset offered as Twitter data
X Corp. (Twitter, Inc. at the time). · Retail & Websites · Tier 4 · Attacker claim, named-outlet reporting
| What | A file containing roughly 200 million email addresses said to be linked to Twitter accounts was offered for sale. Whether it came from a systems breach or from public scraping has never been established. |
| When | January 2023 |
| Where | Email addresses, and in some cases a name or handle already visible on the public profile. No passwords and no private messages. |
| How | Not established publicly. The company's position was that the data had been collected by scraping public profiles; the seller claimed it came from a systems flaw. Neither claim has been independently verified. |
| Who | Unknown. The offer was posted under a forum handle only, and no credible attribution has been published. |
| Exposure window | Not publicly disclosed. |
| Am I affected? | ['Check whether the email address you use for social accounts has been included in any published breach dataset, then assume it is on marketing and phishing lists regardless.', 'Give that account a unique password and two-factor authentication, and check what else uses that address as a recovery route for something sensitive.', 'Be sceptical of follower, verification or appeal messages arriving by email — address lists of this kind feed exactly that scam.', "Treat the claim itself with care: because it is unverified, 'my email was in the Twitter leak' is not a fact anyone can confirm."] |
Source: Have I Been Pwned — breach directory
Ahead of the wire means published earlier than the typical news cycle. It never means unverified, and it never means first to know.