Cybersecurity writer and analyst. Covering breaches, threats, and vulnerabilities — analysis beyond the headline.
Data Breaches
Vendors' pen-testing credentials and URL guessing gave Discord hackers weeks of access to a cybersecurity superweapon Anthropic warned was too risky for public release. SAN FRANCISCO, CA — On the same day Anthropic prepared to roll out its most powerful and restricted cybersecurity model to date, an unauthorized group
Data Breaches
ShinyHunters ransomware group accessed names, SSNs, and financial accounts of 47,876 customers; multiple class actions allege inadequate security. MINNEAPOLIS, MN — For the second time in less than half a year, financial services giant Ameriprise Financial is reeling from a major cybersecurity failure. The firm has confirmed that an unauthorized
Threat Actors
Leaked database reveals a structured cybercrime market connecting access brokers to 14 RaaS affiliates targeting US government and finance sectors in 40% of listings. MOSCOW / WASHINGTON, D.C. — A massive leak of the RAMP (Ransomware Access and Market Place) database has pulled back the curtain on Russia’s most structured
Data Breaches
Quorum Cyber analysis reveals ransomware (+21%), hacktivism (+75%), and data breaches (+73%) converging on research-rich academic targets. EDINBURGH, UK — Global higher education is facing a "convergence of threats" as a new analysis from Quorum Cyber reveals a staggering 63% year-over-year increase in verified cyberattacks. Between
Data Breaches
PIPC's record penalty cites an employee workstation hack, a 72-hour reporting delay, and nonexistent database security controls. SEOUL, South Korea — South Korea’s Personal Information Protection Commission (PIPC) has levied a record 1.21 billion KRW ($815,000) fine against Duo, the nation’s largest matchmaking service,
Vulnerabilities
Microsoft Defender LPE (CVE-2026-33825) added to KEV catalog after Huntress confirms wild exploitation; 2 related zero-days remain unpatched. WASHINGTON, D.C. — The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent mandate for all Federal Civilian Executive Branch (FCEB) agencies to patch a high-severity Microsoft
Vulnerabilities
iOS 18.7.8 fixes a notification retention flaw after the FBI used Cellebrite to extract cached Signal message previews from deleted iPhone apps in a high-profile Texas criminal case. CUPERTINO, CA — Apple has released a critical out-of-band security update — iOS 18.7.8 and iPadOS 26.
Venture Capital
Rilian has emerged from stealth with $17.5 million in seed funding to scale its "Caspian" platform, aiming to automate the complex lifecycle of security software procurement and deployment for defense and enterprise sectors. SAN FRANCISCO, CA — Rilian announced on April 23, 2026, that it has secured $17.
Nation-State Cyber Threats
17 international agencies issue a joint advisory revealing a strategic shift by Chinese actors toward commercially-maintained covert networks, enabling full cyber kill chains against global critical infrastructure. WASHINGTON, D.C. — In a massive display of intelligence community consensus, the National Security Agency (NSA), the FBI’s IC3, and the
Data Breaches
The Los Angeles County Office of Education (LACOE) has launched a forensic investigation into potential unauthorized access to its tax document portal after fraudulent tax returns were reportedly filed in the names of school district employees. DOWNEY, CA — The Los Angeles County Office of Education (LACOE) is investigating a potential
Data Breaches
Major Dutch e-commerce platform bol.com is investigating unverified claims that a database containing approximately 400,000 customer records was offered for sale online, though the company currently reports no evidence of a security incident. UTRECHT, NETHERLANDS — Leading Dutch retailer bol.com addressed a series of unverified allegations between
Data Breaches
Agoda has issued a formal denial following unverified claims on a dark web forum that a dataset containing 82 million customer records was stolen from its systems. SINGAPORE — Digital travel platform Agoda denied unverified claims on April 22, 2026, that a threat actor exfiltrated a database containing 82 million user