Category Archives: Breach

Newsletter platform Substack notifies users of data breach

Posted on

Newsletter platform Substack is notifying users of a data breach after attackers stole their email addresses and phone numbers in October 2025.

Although the incident occurred four months ago, CEO Chris Best told affected users that Substack only discovered the breach this week. However, while the attackers stole some users’ data, Best added that they didn’t access credentials or financial information.

“On February 3rd, we identified evidence of a problem with our systems that allowed an unauthorized third party to access limited user data without permission, including email addresses, phone numbers, and other internal metadata,” Best said in breach notification emails sent today.

“This data was accessed in October 2025. Importantly, credit card numbers, passwords, and financial information were not accessed.”

Although Substack has yet to share how many users were affected by the incident, on Monday, a threat actor leaked a database on the BreachForums hacking forum containing 697,313 records of allegedly stolen data.

They also claim to have scraped the data and noted that “the scraping method used was noisy and patched fast.”

Substack data leak on BreachForums
Substack data leak on BreachForums (BleepingComputer)

While it didn’t explain how the attacker gained access to the stolen data or reveal the full impact of the data breach, Substack says it has addressed the flaw exploited in the attack and warned of potential phishing attempts that could exploit the stolen information.

“We have fixed the problem with our system that allowed this to happen,” Best added. “We do not have evidence that this information is being misused, but we encourage you to take extra caution with any emails or text messages you receive that may be suspicious.”

A Substack spokesperson didn’t share further details regarding the incident when BleepingComputer reached out, but said that “safeguards have been put in place to help prevent this issue from happening again.”

Almost six years ago, in July 2020, Substack accidentally exposed some users’ email addresses in a privacy policy update email by including them in the ‘to’ line instead of the ‘bcc’ field.

Since its launch in 2017, Substack has gained popularity among independent journalists and content creators, reaching five million paid subscriptions by March 2025.

Source: https://www.bleepingcomputer.com/news/security/newsletter-platform-substack-notifies-users-of-data-breach/

Conduent cyberattack has now affected more than 25 million Americans

Posted on

Buried in the news this week was that Conduent, the main processor for the Supplemental Nutrition Assistance Program (SNAP), which supports nearly 10 million cases monthly and processes over 1.5 billion EBT transactions annually, was hacked.

The spillover from a ransomware attack on one of the largest government contractors in the United States keeps getting bigger: More than 25 million people have now had personal data stolen in the hack.

Conduent provides printing, mailroom services, and document and payment processing services for state government benefit operations, such as food assistance, as well as workplace and unemployment benefits for large corporations. As such, the company handles a large amount of personal information belonging to a large swath of the United States. Conduent says its technology and operational support services reach more than 100 million people.

But since the January 2025 cyberattack, which a ransomware group claimed credit for, the corporate giant has said little about the data breach, such as how it was caused and how many people are affected.

An update to the state of Wisconsin’s data breach notification page now shows the Conduent breach affects at least 25 million people across the United States.

TechCrunch’s ongoing tally from various data breach notification letters that we have seen also amounts to about 25 million people, with Oregon (10.5 million) and Texas (15.4 million) accounting for the majority of those affected. Other data breach notices seen by TechCrunch include another few hundred thousand individuals across Massachusetts, New Hampshire, and Washington.

The breach is known to have compromised individuals’ names, dates of birth, addresses, Social Security numbers, health insurance information, and medical data.

Conduent has said little outside of its data breach notifications, and in some cases has made it more difficult for affected individuals to learn about the breach.

A page on Conduent’s website, titled â€œIncident Notice” that was published in October 2025 at the same time as its first data breach notification, does not explicitly mention a cybersecurity incident. The page contains a hidden “noindex” tag in its source code, which tells search engines to not list the page in search results, making it difficult for anyone searching the web to find it.

When reached by TechCrunch, Conduent spokesperson Sean Collins would not say how many notifications the company has sent to date, or why the company is hiding its incident notice from search engines.

Conduent’s breach has been billed as one of the “largest ever,” but likely trails behind the Change Healthcare hack, which affected more than 190 million people following a ransomware attack in February 2024. A Russian-speaking ransomware gang stole reams of health and medical data from Change Healthcare using a stolen credential that wasn’t protected with multi-factor authentication, prompting the healthcare tech giant to pay at least two ransoms to keep most of the stolen data off the internet.

Source: https://techcrunch.com/2026/02/24/conduent-data-breach-grows-affecting-at-least-25m-people/

See also: https://www.linkedin.com/news/story/conduent-data-breach-was-far-larger-than-first-thought-7035380/

Internet users advised to change passwords after 16bn logins exposed

Posted on

Hacked credentials could give cybercriminals access to Facebook, Meta and Google accounts among others

Internet users have been told to change their passwords and upgrade their digital security after researchers claimed to have revealed the scale of sensitive information – 16bn login records – potentially available to cybercriminals.

Researchers at Cybernews, an online tech publication, said they had found 30 datasets stuffed with credentials harvested from malicious software known as “infostealers” and leaks.

The researchers said the datasets were exposed “only briefly” but amounted to 16bn login records, with an unspecified number of overlapping records – meaning it is difficult to say definitively how many accounts or people have been exposed.

Cybernews said the credentials could open access to services including Facebook, Apple and Google – although there had been no “centralised data breach” at those companies.

Bob Diachenko, the Ukrainian cybersecurity specialist behind the research, said the datasets had become temporarily available after being poorly stored on remote servers – before being removed again. Diachenko said he was able to download the files and would aim to contact individuals and companies that had been exposed.

“It will take some time of course because it is an enormous amount of data,” he said.

Diachenko said the information he had seen in infostealer logs included login URLs to Apple, Facebook and Google login pages. Apple and Facebook’s parent, Meta, have been contacted for comment.

A Google spokesperson said the data reported by Cybernews did not stem from a Google data breach – and recommended people use tools like Google’s password manager to protect their accounts.

Internet users are also able to check if their email has been compromised in a data breach by using the website haveibeenpwned.com. Cybernews said the information seen in the datasets followed a “clear structure: URL, followed by login details and a password”.

Diachenko said the data appeared to be “85% infostealers” and about 15% from historical data breaches such as a leak suffered by LinkedIn.

Experts said the research underlined the need to update passwords regularly and adopt tough security measures such as multifactor authentication – or combining a password with another form of verification such as a code texted from a phone. Other recommended measures include passkeys, a password-free method championed by Google and Facebook’s owner, Meta.

“While you’d be right to be startled at the huge volume of data exposed in this leak it’s important to note that there is no new threat here: this data will have already likely have been in circulation,” said Peter Mackenzie, the director of incident response and readiness at the cybersecurity firm Sophos.

Mackenzie said the research underlined the scale of data that can be accessed by online criminals.

“What we are understanding is the depth of information available to cybercriminals.”

He added: “It is an important reminder to everyone to take proactive steps to update passwords, use a password manager and employ multifactor authentication to avoid credential issues in the future.”

Toby Lewis, the global head of threat analysis at the cybersecurity firm Darktrace, said the data flagged in the research is hard to verify but infostealers – the malware reportedly behind the data theft – are “very much real and in use by bad actors”.

He said: “They don’t access a user’s account but instead scrape information from their browser cookies and metadata. If you’re following good practice of using password managers, turning on two-factor authentication and checking suspicious logins, this isn’t something you should be greatly worried about.”

Cybernews said none of the datasets have been reported previously barring one revealed in May with 184m records. It described the datasets as a “blueprint for mass exploitation” including “account takeover, identity theft, and highly targeted phishing”.

The researchers added: “The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data.”

Alan Woodward, a professor of cybersecurity at Surrey University, said the news was a reminder to carry out “password spring cleaning”. He added: “The fact that everything seems to be breached eventually is why there is such a big push for zero trust security measures.”

Source: https://www.theguardian.com/technology/2025/jun/21/internet-users-advised-to-change-passwords-after-16bn-logins-exposed

EFF’s The Breachies 2024: The Worst, Weirdest, Most Impactful Data Breaches of the Year

Posted on

Every year, countless emails hit our inboxes telling us that our personal information was accessed, shared, or stolen in a data breach. In many cases, there is little we can do. Most of us can assume that at least our phone numbers, emails, addresses, credit card numbers, and social security numbers are all available somewhere on the internet.

But some of these data breaches are more noteworthy than others, because they include novel information about us, are the result of particularly noteworthy security flaws, or are just so massive they’re impossible to ignore. For that reason, we are introducing the Breachies, a series of tongue-in-cheek “awards” for some of the most egregious data breaches of the year.

If these companies practiced a privacy first approach and focused on data minimization, only collecting and storing what they absolutely need to provide the services they promise, many data breaches would be far less harmful to the victims. But instead, companies gobble up as much as they can, store it for as long as possible, and inevitably at some point someone decides to poke in and steal that data.

Once all that personal data is stolen, it can be used against the breach victims for identity theft, ransomware attacks, and to send unwanted spam. The risk of these attacks isn’t just a minor annoyance: research shows it can cause psychological injury, including anxiety, depression, and PTSD. To avoid these attacks, breach victims must spend time and money to freeze and unfreeze their credit reports, to monitor their credit reports, and to obtain identity theft prevention services.

This year we’ve got some real stinkers, ranging from private health information to—you guessed it—credit cards and social security numbers.

The Winners

Source: https://www.eff.org/deeplinks/2024/12/breachies-2024-worst-weirdest-most-impactful-data-breaches-year#effector

390,000 WordPress accounts stolen from hackers in supply chain attack

Posted on

A threat actor tracked as MUT-1244 has stolen over 390,000 WordPress credentials in a large-scale, year-long campaign targeting other threat actors using a trojanized WordPress credentials checker.

Researchers at Datadog Security Labs, who spotted the attacks, say that SSH private keys and AWS access keys were also stolen from the compromised systems of hundreds of other victims, believed to include red teamers, penetration testers, security researchers, as well as malicious actors.

The victims were infected using the same second-stage payload pushed via dozens of trojanized GitHub repositories delivering malicious proof-of-concept (PoC) exploits that targeted known security flaws, along with a phishing campaign prompting targets to install a fake kernel upgrade camouflaged as a CPU microcode update.

While the phishing emails tricked victims into executing commands that installed the malware, the fake repositories duped security professionals and threat actors seeking exploit code for specific vulnerabilities.

Threat actors have used fake proof-of-concept exploits in the past to target researchers, hoping to steal valuable research or gain access to the networks of cybersecurity firms.

“Due to their naming, several of these repositories are automatically included in legitimate sources, such as Feedly Threat Intelligence or Vulnmon, as proof-of-concept repositories for these vulnerabilities,” the researchers said.” This increases their look of legitimacy and the likelihood that someone will run them.”

The payloads were dropped via GitHub repos using multiple methods, including backdoored configure compilation files, malicious PDF files, Python droppers, and malicious npm packages included in the projects’ dependencies.

As Datadog Security Labs found, this campaign overlaps with one highlighted in a November Checkmarkx report about a year-long supply-chain attack in which the “hpc20235/yawp” GitHub project was trojanized using malicious code in the “0xengine/xmlrpc” npm package to steal data and mine Monero cryptocurrency.

Malware deployed in these attacks includes a cryptocurrency miner and a backdoor that helped MUT-1244 collect and exfiltrate private SSH keys, AWS credentials, environment variables, and key directory contents such as “~/.aws.” 

The second-stage payload, hosted on a separate platform, allowed the attackers to exfiltrate data to file-sharing services like Dropbox and file.io, with the investigators finding hardcoded credentials for these platforms within the payload, giving the attackers easy access to the stolen info.

“MUT-1244 was able to gain access to over 390,000 credentials, believed to be WordPress ones. We assess with high confidence that before these credentials were exfiltrated to Dropbox, they were in the hands of offensive actors, who likely acquired them through illicit means,” Datadog Security Labs researchers said.

“These actors were then compromised through the yawpp tool they used to check the validity of these credentials. Since MUT-1244 advertised yawpp as a “credentials checker” for WordPress, it’s no surprise that an attacker with a set of stolen credentials (which are often purchased from underground markets as a way to speed up threat actor operations) would use yawpp to validate them.”

The attackers successfully exploited trust within the cybersecurity community to compromise dozens of machines belonging to both white hat and black hat hackers after the targets unknowingly executed the threat actor’s malware, leading to data theft that included SSH keys, AWS access tokens, and command histories.

Datadog Security Labs estimates that hundreds of systems remain compromised, and others are still getting infected as part of this ongoing campaign.

Source: https://www.bleepingcomputer.com/news/security/390-000-wordpress-accounts-stolen-from-hackers-in-supply-chain-attack/

800,000 people had their full names, SSNs, and more exposed in massive insurance admin company data breach

Posted on

How to see if your data was exposed and what to do next

Staying safe from hackers is hard enough as it is but even if you take all the necessary precautions, your personal data could still end up being exposed online as the result of a data breach and that’s exactly what just happened to more than 800,000 people.

As reported by BleepingComputer, the insurance administrative services company Landmark Admin has revealed that it suffered a data breach following a cyberattack that occurred back in May of this year. While you likely haven’t heard of this company before, there’s a chance it could have access to your sensitive personal information.

Landmark Admin is a third-party administrator for a number of insurance companies and it provides back-office services for them such as new business processing and claims administration. In fact, some of the insurance companies it works with include American Monumental Life Insurance Company, Pellerin Life Insurance Company, American Benefit Life Insurance Company, Liberty Bankers Life Insurance Company, Continental Mutual Insurance Company and the Capitol Life Insurance Company.

If any of the companies listed above happen to be your insurance company, then there’s a chance you may receive a data breach notification letter in the mail, if you haven’t already. Here’s everything you need to know about this latest data breach and what steps you should take next if your personal data was exposed online.

Source: https://www.tomsguide.com/computing/online-security/800-000-people-just-had-their-full-names-ssns-and-more-exposed-in-a-massive-insurance-admin-company-data-breach

‘RockYou2024’: Nearly 10 billion passwords leaked online

Posted on

On a popular hacking form, a user has leaked a file that contains 9,948,575,739 unique plaintext passwords. The list appears to be a compilation of passwords that were obtained during several old and more recent data breaches.

The list is referred to as RockYou2024 because of its filename, rockyou.txt.

To cybercriminals the list has some value because it contains real-world passwords. This means if an attacker tried this list of passwords to try to break into an account (known as a brute force attack) they’s be more likely to get in than just trying a list of any old letters and words. However, it’s highly unlikely that there are any services or websites that would allow anyone to try such an enormous number of passwords, so it’s really only useful to attackers who have stolen a password database and are trying to crack its passwords offline, on their own computer.

Another possible use for cybercriminals is to combine the list with data from other breaches, such as combinations of usernames and passwords, which could get results if the password has been reused. If the cybercriminals also have a list that contains hashed passwords, they could even try to match the hash values of the passwords.

Having the actual password makes an attack a lot easier than when you’re trying a pass-the-hash attack, where an attacker tries to authenticate to a remote server or service by using the hash of a user’s password. However, this only works on services that are vulnerable to pass-the-hash attacks, instead of requiring the associated plaintext password as is normally the case.

To cut a long story short, if you don’t reuse passwords and never use “simple” passwords, like single words, then this release should not concern you. If you use multi-factor authentication (MFA), and you should everywhere you can, there’s also no reason to worry about this.

Source and more details: https://www.malwarebytes.com/blog/news/2024/07/rockyou2024-nearly-10-billion-passwords-leaked-online

Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs

Posted on

Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code.

The intrusion, which took place between November 14 and 24, 2023, and detected on November 23, was carried out “with the goal of obtaining persistent and widespread access to Cloudflare’s global network,” the web infrastructure company said, describing the actor as “sophisticated” and one who “operated in a thoughtful and methodical manner.”

As a precautionary measure, the company further said it rotated more than 5,000 production credentials, physically segmented test and staging systems, carried out forensic triages on 4,893 systems, reimaged and rebooted every machine across its global network.

The incident involved a four-day reconnaissance period to access Atlassian Confluence and Jira portals, following which the adversary created a rogue Atlassian user account and established persistent access to its Atlassian server to ultimately obtain access to the Bitbucket source code management system by means of the Sliver adversary simulation framework.

As many as 120 code repositories were viewed, out of which 76 are estimated to have been exfiltrated by the attacker.

“The 76 source code repositories were almost all related to how backups work, how the global network is configured and managed, how identity works at Cloudflare, remote access, and our use of Terraform and Kubernetes,” Cloudflare said.

“A small number of the repositories contained encrypted secrets which were rotated immediately even though they were strongly encrypted themselves.”

The threat actor is then said to have unsuccessfully attempted to “access a console server that had access to the data center that Cloudflare had not yet put into production in SĂŁo Paulo, Brazil.”

The attack was made possible by using one access token and three service account credentials associated with Amazon Web Services (AWS), Atlassian Bitbucket, Moveworks, and Smartsheet that were stolen following the October 2023 hack of Okta’s support case management system.

Cloudflare acknowledged that it had failed to rotate these credentials, mistakenly assuming they were unused.

The company also said it took steps to terminate all malicious connections originating from the threat actor on November 24, 2023. It also involved cybersecurity firm CrowdStrike to perform an independent assessment of the incident.

“The only production systems the threat actor could access using the stolen credentials was our Atlassian environment. Analyzing the wiki pages they accessed, bug database issues, and source code repositories, it appears they were looking for information about the architecture, security, and management of our global network,” Cloudflare said.

Source: https://thehackernews.com/2024/02/cloudflare-breach-nation-state-hackers.html

The LastPass hack saga just keeps getting worse

Posted on

Already smarting from a breach that stole customer vaults, LastPass has more bad news.

Already smarting from a breach that put partially encrypted login data into a threat actor’s hands, LastPass on Monday said that the same attacker hacked an employee’s home computer and obtained a decrypted vault available to only a handful of company developers.

Although an initial intrusion into LastPass ended on August 12, officials with the leading password manager said the threat actor “was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activity” from August 12 to August 26. In the process, the unknown threat actor was able to steal valid credentials from a senior DevOps engineer and access the contents of a LastPass data vault. Among other things, the vault gave access to a shared cloud-storage environment that contained the encryption keys for customer vault backups stored in Amazon S3 buckets.

“This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,” LastPass officials wrote. “The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.”

The hacked DevOps engineer was one of only four LastPass employees with access to the corporate vault. Once in possession of the decrypted vault, the threat actor exported the entries, including the “decryption keys needed to access the AWS S3 LastPass production backups, other cloud-based storage resources, and some related critical database backups.”

Monday’s update comes two months after LastPass issued a previous bombshell update that for the first time said that, contrary to previous assertions, the attackers had obtained customer vault data containing both encrypted and plaintext data. LastPass said then that the threat actor had also obtained a cloud storage access key and dual storage container decryption keys, allowing for the copying of customer vault backup data from the encrypted storage container.

The backup data contained both unencrypted data, such as website URLs, as well as website usernames and passwords, secure notes, and form-filled data, which had an additional layer of encryption using 256-bit AES. The new details explain how the threat actor obtained the S3 encryption keys.

Monday’s update said that the tactics, techniques, and procedures used in the first incident were different from those used in the second one and that, as a result, it wasn’t initially clear to investigators that the two were directly related. During the second incident, the threat actor used information obtained during the first one to enumerate and exfiltrate the data stored in the S3 buckets.

“Alerting and logging was enabled during these events, but did not immediately indicate the anomalous behavior that became clearer in retrospect during the investigation,” LastPass officials wrote. “Specifically, the threat actor was able to leverage valid credentials stolen from a senior DevOps engineer to access a shared cloud-storage environment, which initially made it difficult for investigators to differentiate between threat actor activity and ongoing legitimate activity.”

LastPass learned of the second incident from Amazon’s warnings of anomalous behavior when the threat actor tried to use Cloud Identity and Access Management (IAM) roles to perform unauthorized activity.

According to a person briefed on a private report from LastPass who spoke on the condition of anonymity, the media software package that was exploited on the employee’s home computer was Plex. Interestingly, Plex reported its own network intrusion on August 24, just 12 days after the second incident commenced. The breach allowed the threat actor to access a proprietary database and make off with password data, usernames, and emails belonging to some of its 30 million customers. Plex is a major provider of media streaming services that allow users to stream movies and audio, play games, and access their own content hosted on home or on-premises media servers.

It’s not clear if the Plex breach has any connection to the LastPass intrusions. Representatives of LastPass and Plex didn’t respond to emails seeking comment for this story.

The threat actor behind the LastPass breach has proven especially resourceful, and the revelation that it successfully exploited a software vulnerability on the home computer of an employee further reinforces that view. As Ars advised in December, all LastPass users should change their master passwords and all passwords stored in their vaults. While it’s not clear whether the threat actor has access to either, the precautions are warranted.

Sources: https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/