[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongData Breaches
Google Docs Exposes Staging Server Credentials in Search Results
A simple Google search led to a major security slip-up when a developer stumbled upon a publicly indexed Google Doc containing sensitive staging server credentials. A careless mistake by an outside contractor had left the confidential info exposed, and a curious autocomplete suggestion revealed it all.
City-Forum Attacks Exploit Salesforce, ServiceNow Portals for Data Theft
A single IP address, 158.220.87.79, has been linked to a massive data-theft campaign targeting corporate and public portals, including Salesforce and ServiceNow, for over a year with no signs of slowing down. This persistent threat has compromised multiple organizations worldwide, spanning industries from telecom and finance to security and government.
Uber Freight Probes Data Breach by Helix Extortion Group
Uber Freight is investigating a data security incident after a hacktivist group claimed to have breached its systems, but fortunately, the issue has been identified, contained, and resolved, with operations now secure and running smoothly. The breach hasn't disrupted daily operations, and the company is working to put customers' minds at ease.
UK Criminal Records Office Breach Exposes 11,000 People's Sensitive Data
A shocking data breach at the UK's Criminal Records Office has left 11,000 individuals vulnerable after sensitive information was exposed due to basic cyber security failings. The breach went undetected for seven months, highlighting the devastating consequences of neglecting online security.
Tribeca Film Festival Data Leak Reveals Celebrity Records
The Tribeca Film Festival recently suffered a data leak, exposing a whopping 666,369 records, including sensitive celebrity information, after a cybersecurity researcher discovered three unsecured databases left vulnerable to public access. The festival has since taken swift action, assuring the researcher that they are actively investigating and taking data security very seriously.
Wesco Probes Data Exfiltration After ExfilSquad Leak Claim
Wesco is investigating a cybersecurity incident involving its cloud CRM environment after a third-party group, ExfilSquad, claimed to have exfiltrated company data. The company says it has contained the issue, found no evidence of sensitive data being compromised, and continues to operate as usual.
Ceva Logistics Breach Exposes European Client Data
A data breach at Ceva Logistics has compromised sensitive information of European clients, affecting eight warehouses and disrupting contract logistics operations. The breach, described as a "textbook supply chain breach," was contained within European operations, with no impact on global systems.
Levi's Probes Data Breach After Social Engineering Attack
Levi's is investigating a data breach after a sneaky social engineering attack tricked three employees into giving hackers access to their work computers, compromising certain corporate information. Fortunately, the company says consumer data appears to be safe and operations are running smoothly.
LexisNexis Disrupts Services Amid Server Breach Probe
LexisNexis swiftly pulled the plug on three key services - Nexis Diligence, Metabase API, and Newsdesk - after detecting suspicious activity on servers managed by a third-party vendor, taking swift action to safeguard customers and contain the breach. The move comes as the company investigates the unusual server activity.
Valve Exposes Steam Hardware Customer Data Breach
A recent cyberattack on CEVA Logistics, a shipping partner for Steam hardware in Europe, exposed sensitive customer data, including names, addresses, phone numbers, emails, and order details, between July 29 and August 1, 2026. Valve has notified affected customers about the breach, which may have compromised their personal information.
Metabase Zero-Day Exploited to Breach Framework Customer Data
A zero-day exploit in analytics provider Metabase has led to a data breach at laptop maker Framework, exposing personal customer information, and prompting a review of its data storage methods with external vendors. Metabase has since patched the bug, blocked attack endpoints, and deployed a fix across its cloud service to prevent further exploitation.
Metabase Zero-Day Exploited in Data-Theft Attacks
Metabase Cloud was recently hit by a data-theft attack, exploiting a previously unknown security vulnerability in versions 1.58 and above, which the company has since patched and confirmed had a maximum severity rating. If you're a self-hosted customer, you'll need to update manually to protect yourself.
Unlimited Technology Systems Breach Exposes 3.8 Million People
A shocking data breach at Unlimited Technology Systems has put the personal information of 3.8 million people at risk, after a server hack exposed sensitive data for a five-day window in October 2025. The breach was only detected on October 19, 2025, and it took until July 2026 for the company to notify authorities and affected individuals.
US Coast Guard Monitors Cyberattack Disrupting North Carolina Ports
A cyberattack brought North Carolina's ports to a grinding halt, forcing delays and manual processing at the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port. The U.S. Coast Guard is now monitoring the situation and coordinating a response with partner agencies to get operations back on track.
Levi Strauss & Co. Breach Exposes Corporate Data
Levi Strauss & Co. recently suffered a cybersecurity breach, but fortunately, it was quickly contained and terminated, protecting consumer data from exposure. The incident did, however, involve the unauthorized access and exfiltration of certain corporate information.
NHS Trust Probes Unauthorized Access to Girl's Medical Records
NHS Tayside is launching an investigation into a disturbing data breach at Ninewells Hospital, where a nine-year-old girl's medical records were allegedly accessed without authorization by staff. The incident has triggered a probe into how sensitive patient information was compromised.
[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Cyberattack Disrupts North Carolina Ports Operations
A cyberattack has brought North Carolina's ports to a grinding halt, causing a systems-wide outage that has delayed operations and truckers at the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port. Gates at all three locations are now back to a normal operating schedule, but the impact of the disruption is still being felt.
Beacon Cyber Incident Exposes Data of 1500 UK Charities
A cyber incident at CRM provider Beacon has potentially exposed the sensitive data of 1,500 UK charities, prompting swift notification and containment efforts by the company. Beacon is now working closely with its customers to help them communicate with those potentially affected.
Phisher Breaches US Defense Supplier's Microsoft 365 Account
A phishing scam led to a breach of a US defense supplier's Microsoft 365 account, exposing sensitive data including customer communications, engineering docs, and potentially export-controlled tech info. The intruder gained access to mailbox contents, but the company found no evidence that the data was copied or exfiltrated.
Canadian Hacker Pleads Guilty to Snowflake Extortion Scheme
A 26-year-old Canadian hacker has pleaded guilty to masterminding a massive Snowflake extortion scheme that compromised over 100 million AT&T customers' sensitive call and text history records. Connor Riley Moucka faces up to 30 years in prison for his role in the cross-border hacking and extortion operation.
Swiss Government SharePoint Breach Exposes 200 Accounts
The Swiss government's Microsoft SharePoint system was breached, compromising the login credentials of around 200 accounts, after security specialists detected unusual activity on July 28. The breach was quickly contained and remediated, with external internet access to the SharePoint environment blocked and patches applied.
Snowflake hacker pleads guilty to massive data extortion scheme
In a major win for justice, Connor Moucka, a Canadian national, has pleaded guilty to masterminding a massive data extortion scheme targeting Snowflake customer environments, a case that could put him behind bars for up to 32 years. The guilty plea marks a significant milestone in one of the most expansive data-theft-and-extortion campaigns of 2024.
Snowflake Breaches Expose 100 Million People as Hacker Pleads Guilty
A massive data breach at Snowflake has left a staggering 100 million people vulnerable, after hackers exploited stolen credentials to access sensitive records at over 165 organizations. The mastermind behind the breach, Connor Riley Moucka, has pleaded guilty to multiple charges, including computer fraud and identity theft.
Canadian Hacker Pleads Guilty to Snowflake Data Theft Extortion Scheme
A Canadian hacker has pleaded guilty to stealing sensitive data and extorting victims, including one instance where he re-extorted a victim by threatening to disclose their stolen information. The 26-year-old faces up to 32 years in prison when sentenced on October 27.