Data Breaches

World's largest electronics manufacturer acknowledges cyberattack claimed by Nitrogen ransomware group on North American factories; attackers allege 8 TB data theft including confidential schematics for Apple, Nvidia, Google and others, with production now resuming.

Israeli security firm RedAccess says vibe-coding platforms ship apps that default to public, exposing medical, financial and corporate data to anyone who can find them.

Instructure says names, email addresses, student IDs and user messages were exposed in a breach disclosed May 1. ShinyHunters then listed the firm on its leak site, claiming 3.65 TB of data tied to 275 million people at close to 9,000 institutions.

Home security giant ADT says attackers detected on April 20 stole names, phone numbers and addresses for 5.5 million customers after voice-phishing an employee's Okta single sign-on. ShinyHunters published an 11GB archive when the company refused to pay.

A Lumma Stealer infection at AI startup Context.ai escalated into a cross-tenant OAuth attack on Vercel, exposing employee accounts, environment variables, and customer credentials, with attackers reportedly demanding a $2 million ransom in Telegram messages with the company.

France's national identity document agency confirmed hackers breached its portal and stole data on up to 12 million citizens, while the threat actor claims 19 million records are for sale.

Hackers exploited Anodot's integration with Rockstar's Snowflake cloud to steal nearly 80 million records of financial and analytics data, then published them after the studio refused to pay.

The European Commission confirms a breach of its AWS-hosted Europa.eu platform after ShinyHunters published over 90 GB of stolen data. CERT-EU traces the intrusion to a supply chain attack on the Trivy security scanner.

Attackers used Solana's durable nonce feature to hijack Drift's governance and drain $285 million in 12 minutes, with blockchain forensics firms linking the heist to North Korean operatives.

Italy's data protection authority hit the country's largest bank with two separate fines totaling nearly 50 million euros for an insider data breach and unlawful customer profiling.

A misconfigured npm package exposed 512,000 lines of Claude Code's TypeScript source code via a source map file pointing to Anthropic's cloud storage, marking the company's second data exposure in less than a week.

A software defect during an overnight update let Lloyds, Halifax, and Bank of Scotland app users see other customers' transactions, account numbers, and National Insurance numbers for nearly five hours.