Data Breaches
Trump Mobile confirmed customer names, email and mailing addresses, phone numbers, and order identifiers were exposed to the open internet via a third-party platform provider, and said it is still evaluating whether it must notify affected customers.
Cyber Attacks
GitHub confirmed TeamPCP (UNC6780) exfiltrated roughly 3,800 internal repositories after an employee installed a poisoned Visual Studio Code extension. The same actor behind the Mini Shai-Hulud worm listed the data for $50,000+ on BreachForums — framed as a sale, not a ransom.
Trending
ShinyHunters claims 9.4 million Amtrak records via Salesforce — 2.1 million accounts independently confirmed on Have I Been Pwned. The latest target in the group's coordinated 2026 campaign that has hit ADT, Udemy, Medtronic, Vimeo, and Cisco.
Data Breaches
Vimeo has confirmed a data breach affecting portions of its user database following a compromise at Anodot, a third-party analytics vendor. The breach has been attributed to ShinyHunters, which exploited trusted API connections between Anodot and its enterprise clients to access Vimeo's environment without directly targeting Vimeo&
Data Breaches
Major Dutch e-commerce platform bol.com is investigating unverified claims that a database containing approximately 400,000 customer records was offered for sale online, though the company currently reports no evidence of a security incident. UTRECHT, NETHERLANDS — Leading Dutch retailer bol.com addressed a series of unverified allegations between
Data Breaches
Agoda has issued a formal denial following unverified claims on a dark web forum that a dataset containing 82 million customer records was stolen from its systems. SINGAPORE — Digital travel platform Agoda denied unverified claims on April 22, 2026, that a threat actor exfiltrated a database containing 82 million user
Data Breaches
Citizens Financial Group has confirmed it is managing a data security incident involving a third-party vendor, following claims by the Everest ransomware group that they exfiltrated sensitive corporate and customer data. Providence, RI — Citizens Financial Group (CFG) has become the latest major financial institution to grapple with the fallout
Vulnerabilities
A widespread misconfiguration in Perforce Helix Core servers has left the proprietary source code and sensitive internal data of major global organizations accessible to the public internet. MINNEAPOLIS, MN — Security researchers have issued a stark warning regarding Perforce Helix Core, the industry-standard version control system used by gaming giants,
Data Breaches
New forensic details reveal that the massive data exfiltration at Vercel began with a single employee downloading a compromised Roblox game cheat, highlighting the catastrophic intersection of personal device use and enterprise SaaS permissions. SAN FRANCISCO, CA — The security community is processing the full scope of the breach involving Vercel
Data Breaches
The French National Agency for Secure Documents (ANTS) has confirmed a significant security incident targeting its central portal, as threat actors move to monetize a database allegedly containing millions of sensitive user records. PARIS, FRA — The French government is grappling with a severe compromise of its digital identity infrastructure. The
Mobile Security
A sophisticated "FakeWallet" campaign has bypassed Apple’s stringent review process, leading to the theft of millions in digital assets through fraudulent Ledger and Trezor clones. CUPERTINO, CA — Apple’s reputation for hosting a "curated and secure" ecosystem is facing renewed scrutiny following the discovery of
Vulnerabilities
Researchers at Pillar Security successfully bypassed Antigravity’s most restrictive "Secure Mode" using a prompt injection that transformed a simple file-search tool into an arbitrary command execution engine. MOUNTAIN VIEW, CA — Google has issued a critical patch for Antigravity, its flagship agentic Integrated Development Environment (IDE), after