Data Breach Security News

Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.

A data breach is an incident where sensitive information (customer records, credentials, source code, internal documents) is accessed or exfiltrated without authorization. Newly disclosed breaches land here as organizations, researchers or the attackers themselves report them, including what was exposed and how the compromise happened. These disclosures are often incomplete at first and get revised as investigations continue.

Recent Data Breach items

CVE-2026-116413 Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized acc...
@cveNotify · Nov 13, 2026
In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach https://ift.tt/zxhI2aX
@ctinow · Nov 13, 2026
CVE-2026-116413 Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized acc...
@cveNotify · Nov 13, 2026
Attackers in Binance Breach Targeted Known Weakness, Missing Controls https://ift.tt/RC0GULh
@ctinow · Nov 13, 2026
Chinese-Speaking Hackers Weaponize Cairn AI Framework to Breach Semiconductor and Defense Organizations https://gbhackers.com/cairn-ai-framework/
@PentestingNews · Nov 13, 2026
TSMC Reports Data Breach After Hackers Access Employee Information Through Cloud Provider https://gbhackers.com/tsmc-reports-data-breach/
@PentestingNews · Nov 13, 2026
Cyber Alert ‼️ 🇲🇾 Malaysia - 𝗠𝗶𝗻𝗶𝘀𝘁𝗿𝘆 𝗼𝗳 𝗛𝗲𝗮𝗹𝘁𝗵 𝗠𝗮𝗹𝗮𝘆𝘀𝗶𝗮 (𝗞𝗞𝗠) Panzer hacking group claims to have breached the Ministry of Health Malaysia (KKM) and allegedly exfiltrated 16 GB of data. Threat actor:...
@hackmanac_cybernews · Nov 13, 2026
CVE-2026-116453 Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vul...
@cveNotify · Nov 13, 2026
CVE-2026-116436 Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could...
@cveNotify · Nov 13, 2026
CVE-2026-116425 Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnera...
@cveNotify · Nov 13, 2026
CVE-2026-116424 Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnera...
@cveNotify · Nov 13, 2026
CVE-2026-116417 Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially...
@cveNotify · Nov 13, 2026
Cyber Alert ‼️ 🇯🇵 Japan - 𝗖𝗶𝘁𝘆 𝗼𝗳 𝗢𝘀𝗮𝗸𝗮 The City of Osaka, Japan, confirmed a third-party data breach exposing 1,078,713 email address records associated with its online administrative services platfo...
@hackmanac_cybernews · Nov 13, 2026
A data breach can begin with an alert your team can’t validate fast enough. When threat data needs checking too, triage slows down. ⚡️ ~30% of unique malicious IOCs identified in analyzed Sandbox sess...
@anyrun_app · Nov 13, 2026
The School Bomb Threats Came From Accounts Already in Stolen Data https://securityaffairs.com/202941/security/the-school-bomb-threats-came-from-accounts-already-in-stolen-data.html
@PentestingNews · Nov 13, 2026
CVE-2026-127063 The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the defa...
@cveNotify · Nov 13, 2026
Maersk Reveals Data Breach as Extortion Group Demands $5m 📔 Maersk has revealed a threat actor extracted data from one of its legacy systems. 📖 Read more. 🔗 Via " Infosecurity Magazine " ---------- 👁️...
@cibsecurity · Nov 13, 2026
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients 🖋️ ConnectWise has taken the precautionary step of disabling five thirdparty extensions in partner enviro...
@cibsecurity · Nov 13, 2026
The School Bomb Threats Came From Accounts Already in Stolen Data https://ift.tt/aQ64ubH
@ctinow · Nov 12, 2026
CVE-2026-127211 MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to ac...
@cveNotify · Nov 12, 2026
Hackers compromise 4,800 GitHub accounts to steal cloud credentials A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 reposito...
@bleepingcomputer · Nov 12, 2026
CVE-2026-127058 WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password w...
@cveNotify · Nov 12, 2026
Runaway AI Hacking Agent Behind WorkOS Breach After Escaping Sandbox WorkOS confirmed that an autonomous AI hacking agent, run by a researcher testing the ARTEX framework, escaped its sandbox and brea...
@Cyber_Security_Channel · Nov 12, 2026
CVE-2026-127063 The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the defa...
@cveNotify · Nov 12, 2026
CVE-2026-127063 The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the defa...
@cveNotify · Nov 12, 2026
Apify rotates API tokens, prompts 2FA resets after breach Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal...
@bleepingcomputer · Nov 12, 2026
CVE-2026-86378 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80 , LTS2025 release versions 8.3.1.0 through 8.3.1.40 , LT...
@cveNotify · Nov 12, 2026
Apify rotates API tokens, prompts 2FA resets after breach https://ift.tt/ChumjX3
@ctinow · Nov 12, 2026
CVE-2026-127058 WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password w...
@cveNotify · Nov 12, 2026
Cyber Alert ‼️ 🇯🇵 Japan - 𝗧𝗮𝗸𝗮𝗿𝗮𝗸𝘂𝗷𝗶 Japan's official lottery service, Takarakuji, confirmed unauthorized access to customer accounts, resulting in password changes and potential exposure of personal...
@hackmanac_cybernews · Nov 12, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.
Patch
Vendor patches, security updates and fix releases for previously disclosed vulnerabilities.