Confirmed and claimed data breaches: who was hit, what was taken, how many people are affected and what to do if your data is in it.
10 stories match your filters.
Northflank tells customers to assume all environment variables were decrypted after a breach Wiz flagged on Oct. 30; users report their stored AI API keys being abused.
Chainalysis says an outside attacker using "offensive agentic techniques" reached its internal tools and user names, emails and role labels, but no investigation data so far.
Florida's Department of Education says a breach of its Student Financial Aid website exposed names, birth dates and Social Security numbers of about 4.9 million aid applicants.
GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay.
Sony Network Communications says an Oct. 19 intrusion exposed 2.59 million So-net and Docomo Hikari customer records, plus 54,401 email addresses with passwords. No card data was taken.
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.
Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.
Quest Diagnostics says an intruder reached patient records through its Quanum Lab Services Manager platform. It hasn't said how many people are affected.
Loblaw's CEO has apologized to about two million customers whose names, addresses, birthdates and purchase details were taken in a February breach, and is offering two years of TransUnion monitoring.
An attacker used ConnectWise Cloud Backup's own app credential to sign in to 173 partner and customer Microsoft 365 tenants, per Huntress. ConnectWise has taken the service offline and disabled seven app identities.