A court reversed an earlier plea deal and sentenced Conor Fitzpatrick, founder of BreachForums, to three years — a decision prosecutors say holds platform operators accountable after the site turned stolen data into a lucrative hub that harmed thousands.
Conor “Pompompurin” Fitzpatrick, the 22‑year‑old former admin of BreachForums, was resentenced to three years in prison after pleading guilty to access‑device conspiracy and possession of CSAM. The sentence signals that law enforcement can reach the digital underground — but it also highlights how much work remains to shut down the markets that fuel identity theft and abuse.
Luxury shoppers were jolted this week after a reported breach tied to ShinyHunters exposed millions of email addresses linked to Gucci and Alexander McQueen. Change your passwords, enable MFA, and watch for phishing while the brands investigate and disclose what was taken.
FinWise Bank says an insider breach may have exposed data for about 689,000 customers — names, contact details and in some cases account info — and is working with law enforcement and cybersecurity experts to investigate. If you’re notified, act quickly: enroll in any monitoring offered, watch your accounts closely, and consider fraud alerts or a credit freeze to reduce identity-theft risk.
A new ICO warning shows student hacks are increasingly exposing sensitive school data and could be training tomorrow’s cybercriminals. Schools urgently need practical security upgrades, ethics lessons and better funding to protect pupils and restore parental trust.
A March compromise of a Salesloft GitHub repo was used to pivot into Drift, touching hundreds of companies — including Google, Palo Alto Networks and Cloudflare — and exposing how fragile software supply chains and leaked tokens can be. Now’s the time to assume compromise: scan repos for secrets, rotate credentials, lock down permissions, and demand better transparency from your vendors.
When attackers siphoned customer data from Salesloft and Drift this week and impacted security names like Qualys and Tenable, it became painfully clear that your defenses are only as strong as the third‑party tools your team uses. Now’s the time to tighten API tokens, enforce MFA, and treat vendor risk as a core part of your security posture before contact lists become high‑value phishing and BEC fodder.
A South Carolina school district just confirmed a data breach exposing personal information for about 31,000 students, staff and families—now the community needs quick containment, clear communication and stronger safeguards. Parents should monitor accounts, use any offered identity protection, and press for transparent answers while the district upgrades its cybersecurity.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
When a RAID array failed on Matrix.org this September, engineers paused the flagship homeserver, launched a painstaking 55‑TB database restore and queued millions of messages — a stark reminder that even decentralized networks need rock‑solid backups and recovery drills.
A single exposed ClickHouse instance showed how quiet misconfigurations can hand attackers the breadcrumbs they need; detecting leaks early turns that slow-burning risk into a manageable incident. Start with inventory, automated scans, and clear playbooks to stop a minor misstep from becoming a full-blown disaster.
Last week’s Salesloft–Salesforce supply‑chain breach that exposed Zscaler customer data is a wake‑up call: attackers are increasingly moving laterally through trusted cloud integrations to harvest high‑value corporate data. Now is the time to map dependencies, tighten access, and embrace zero‑trust before the next incident.
TransUnion says a vendor’s hacked app exposed data for about 4.5 million U.S. consumers — a stark reminder that third-party flaws can put your most sensitive financial information at risk. If you’re affected, check your credit, consider freezes or alerts, and watch for notifications about monitoring and identity restoration.
A TransUnion support-app breach exposed personal data for about 4.5 million people, a stark reminder that trusting a handful of giant firms with your identity can amplify risk. Take it as a wake-up call to balance digital convenience with protection—consider credit freezes, monitoring, and reviewing your accounts regularly.
A London law firm’s mass-email blunder exposed nearly 200 Church of England abuse survivors, shredding fragile trust and reigniting fears about privacy and stigma. Survivors are asking for concrete, survivor-led fixes—independent audits, better tech and trauma‑informed protections—if an apology is to mean anything.
Group-IB says ShadowSilk quietly siphoned sensitive data from 36 government-linked targets across Central Asia and the Asia‑Pacific, proving stealthy, data-driven espionage can outflank regional defenses. Its modular tools and persistent backdoors underscore why governments must share intelligence, harden networks, and treat cybersecurity as an ongoing strategic priority.
Google says attackers stole OAuth tokens from Salesloft’s Drift app to siphon Salesforce CRM records, leaving customers scrambling as missing or altered data disrupts sales operations. It’s a sharp reminder that convenient third‑party integrations can become powerful attack vectors unless tokens, permissions and vendor vetting are tightly managed.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
A recent campaign abused compromised OAuth and refresh tokens tied to the Drift AI chat agent to siphon data from Salesloft—potentially creating a corridor into downstream Salesforce records. If you used Salesloft–Drift integrations, assume exposure: revoke tokens, rotate credentials, enable MFA, and audit access immediately.
When a vendor breach exposed personal data for more than 1.1 million Farmers customers, it proved outsourcing can make even trusted brands vulnerable — even if their own systems weren’t hit. This is a wake‑up call for stronger vendor security, smarter contracts, and practical steps customers should take now.
A ransomware attack that exposed health records, tax IDs and check images for roughly 2.4 million DaVita patients lays bare how fragile our medical data really is — and the fallout ranges from identity fraud to disrupted care for some of the most vulnerable. Now patients, providers and policymakers must act quickly to shore up defenses, demand accountability and protect both health and financial security.
APCS — a major UK criminal‑records checker — was caught up in a supply‑chain breach at a third‑party developer, raising urgent questions about which sensitive records were exposed. Employers, applicants and regulators now need clear answers and stronger vendor security to restore trust.
A massive breach at Orange Belgium has put about 850,000 customers’ personal details into criminal hands, raising risks like SIM‑swap, targeted phishing and identity theft. If you might be affected, check what was exposed, lock down your carrier account with app‑based 2FA or a unique PIN, and be extra skeptical of unsolicited calls, texts or emails.
Colt warns customer data was likely stolen in a recent cyberattack and is offering a filename list to help clients check exposure. If you rely on its network services, now’s the time for targeted searches, credential rotation, and coordinated incident response.
A stolen login at iiNet has put roughly 280,000 customers’ names, emails, phone numbers and addresses in the hands of attackers — the exact kind of info scammers use to launch convincing phishing and account-fraud attempts. If you’re affected, enable MFA, stay alert for suspicious messages, and follow any guidance from your provider.
About 1.1 million Allianz Life customers may have had personal data exposed in a breach tied to the ShinyHunters group — here’s what to watch for and the quick steps you can take now to protect your identity and finances.