A security researcher has uncovered a public GitHub repository exposing sensitive credentials tied to the Cybersecurity and Infrastructure Security Agency, sparking fears that malicious actors could exploit the data for nefarious purposes. The leak, linked to a contractor-maintained repository called "Private-CISA," reportedly included privileged AWS GovCloud accounts and internal CISA systems.
A massive data breach at NYC Health + Hospitals has exposed the sensitive information of 1.8 million patients, highlighting the alarming vulnerability of personal data in the healthcare system. This incident serves as a stark reminder of the devastating consequences of a breach, especially when it comes to biometric data that can never be truly reset.
A recent 7-Eleven data breach has put franchisee information at risk, with sensitive documents accessed by an unauthorized party, potentially exposing names, addresses, and other personal data. Fortunately, customers who used their credit cards to make purchases can breathe a sigh of relief, as their payment info appears to be safe.
The US's leading cyber-defense agency, CISA, made a shocking security blunder by leaving a GitHub repository open, exposing sensitive passwords, keys, and tokens with alarmingly obvious filenames. This careless mistake raises serious concerns about the agency's ability to protect itself and the nation from cyber threats.
7-Eleven recently confirmed a data breach that exposed sensitive franchisee information after a cyberattack by the group ShinyHunters, with unauthorized access detected on April 8. The company swiftly launched an investigation and began notifying affected individuals on May 1.
Vulnerability exploitation is now the top attack vector, responsible for a staggering one-third of all data breaches. This alarming trend highlights the urgent need for robust patch management and cybersecurity measures to stay ahead of threats.
Hackers recently breached Grafana Labs' security, gaining unauthorized access to a GitHub token that allowed them to download the company's source code, and subsequently attempting to extort payment to keep it under wraps. The incident was swiftly investigated, and the compromised token was promptly invalidated.
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) made a critical mistake by exposing sensitive AWS GovCloud keys, plaintext passwords, and internal files in a public GitHub repository. The leak, described as one of the worst ever witnessed, included highly privileged credentials and build artifacts for numerous internal CISA systems.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In a shocking display of vulnerability, ShinyHunters breached Instructure's Canvas platform not once, but twice in a single week, siphoning off a staggering 3.65 terabytes of data from 275 million users across 8,000 institutions. The brazen attacks left hundreds of schools reeling during final exams, forcing Canvas offline and lining the attackers' pockets with a ransom payment.
Grafana Labs revealed that hackers breached its GitHub environment using a stolen access token, downloading the company's source code, but fortunately, took swift action to invalidate the token and beef up security measures. The incident is currently under investigation, with more details to be shared once complete.
Grafana Labs sprang into action after a security breach at GitHub compromised its code, swiftly invalidating leaked credentials and bolstering defenses to prevent further unauthorized access. The company quickly responded to the breach, taking crucial steps to safeguard its environment.
Grafana recently experienced a security breach, where an unauthorized party gained access to its GitHub environment, downloading its codebase, but fortunately, no customer data or personal info was compromised. The company swiftly responded, taking measures to prevent further unauthorized access and thwarting an attempted extortion by the attacker.
Colorado Governor Jared Polis has commuted the sentence of Tina Peters, the former Mesa County election clerk behind one of the most serious election-related data breaches in US history, freeing her from a nine-year prison term after just a year and a half. Peters was convicted of abusing her position to break into county election facilities under false pretenses.
Meet the ShinyHunters, a notorious group behind a surge in public data leaks, who team up with The Com to scam victims out of cloud system access and then hold their data for ransom. This duo's alarming tactic has resulted in a steady stream of sensitive information being dumped into the public domain.
West Pharmaceutical Services suffered a significant cybersecurity breach on May 4, 2026, when hackers infiltrated their systems, encrypting certain data and making off with sensitive information, prompting a formal investigation. The company confirmed the severity of the attack three days later, on May 7.
A massive cyberattack on Instructure's Canvas platform has sparked a congressional investigation, after hackers claimed to have stolen a staggering 280 million data records from nearly 9,000 schools and online education platforms. The breach has left schools reeling, especially during final exams, and is raising urgent questions about data security.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A massive cyberattack on Foxconn's North American factories has compromised sensitive data from major tech giants, including Apple and Nvidia, with hackers allegedly making off with a staggering 8 TB of data and over 11 million files. Foxconn has confirmed the breach, assuring that production is resuming after swiftly activating its cybersecurity response mechanism.
A UK water supplier has been slapped with a $1.3 million fine after a devastating cyber attack exposed the personal data of nearly 664,000 customers and employees, with sensitive information even being published on the dark web. The hefty penalty was reduced by 40% after the company admitted liability and cooperated with investigators.
Škoda's online shop was recently hacked, exposing customer data after attackers exploited a vulnerability in the e-commerce software. The company has since fixed the issue, alerted authorities, and is working with a forensics team to investigate.
A US bank has taken swift action, self-reporting a data leak that exposed sensitive customer information to an unauthorized AI app, sparking concerns over the volume and sensitivity of the compromised data. The bank's proactive disclosure to regulators and customers highlights its commitment to transparency in the face of a data-handling lapse.
Proactive security is no longer a nicety, but a necessity - as South Staffordshire Water's £1m fine for a 2-year data breach exposing 633,000 individuals' personal info painfully illustrates. Waiting for a ransom note or performance issues to discover a breach simply isn't an option.
Instructure has taken swift action to protect its community by reaching an agreement with the ShinyHunters extortion group, successfully retrieving stolen data and ensuring its destruction. This move puts the minds of its 30 million users at ease, prioritizing their security and well-being.
In a stunning move, Instructure paid a ransom to the notorious ShinyHunters group to prevent a massive 3.65TB data leak from its Canvas learning-management system. The Utah-based company reached a deal with the hackers, securing the safe return of stolen data and a guarantee that its customers wouldn't be extorted individually.
ShinyHunters has made a brazen move, claiming to have stolen a massive 3.65 terabytes of data from Canvas, putting 275 million records across 8,809 school systems at risk. The cybercriminal group is now demanding an undisclosed ransom from Instructure, escalating threats by hijacking login pages at hundreds of institutions.