Nearly 1M SSNs and Health Records Exposed in Marijuana Patient Database

Ohio Medical Alliance exposed a medical marijuana patient database containing 957,000 records, including SSNs, IDs, health files, and…...

Australian ISP iiNet Reports Data Breach, Customer Accounts Stolen

Australian ISP iiNet confirms data breach as hackers stole 280,000 email accounts, phone numbers and user data using…...

Why Your Security Culture is Critical to Mitigating Cyber Risk

After two decades of developing increasingly mature security architectures, organizations are running up against a hard truth: tools and technologies alone are not enough to mitigate cyber risk. As tech stacks have grown more sophisticated and capable, attackers have shifted their focus. They are...

A week in security (August 11 – August 17)

Last week on Malwarebytes Labs: Italian hotels breached for tens of thousands of scanned IDs National Public Data returns after massive Social Security Number leak Romance scammers in Ghana charged with more than $100 million in theft Netflix scammers target jobseekers to trick them into handing...

The vulnerability of the formSetWanPPTPcallback() function in the HTTP POST Request Handler of the D-Link DIR-513 router’s microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetWanPPTPcallback function /goform/formSetWanPPTPpath of the HTTP POST Request Handler component in the microprogramming software for D-Link DIR-513 is caused by a buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials

A seller named ChuckyBF is offering 15.8M PayPal logins with emails, passwords, and URLs. The data may come…...

National Public Data returns after massive Social Security Number leak

Remember that data broker nobody had ever heard of, but managed to leak a database which contained the data of some 2.9 billion people? It's back, and this time with a search function. National Public Data suffered an alleged breach in 2024 against a data base that, it turned out, carried 272...

IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security

IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...

Connex Credit Union Data Breach Affects 172,000 Members

Connex Credit Union breach exposes data of 172000 members, legal probe launched, experts urge victims to monitor accounts…...

Bouygues Telecom Hit by Cyberattack, 6.4 Million Customers Affected

A cyberattack on Bouygues Telecom exposed data for 6.4 million customers. Find out what information was compromised and…...

Vehicle Management addcompany.php File SQL Injection Vulnerability

Vehicle Management is a vehicle management system. Vehicle Management suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter company in the file /addcompany.php. An attacker can exploit this vulnerability to execute...

Vehicle Management /filter.php File SQL Injection Vulnerability

Vehicle Management is a vehicle management system. Vehicle Management suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter from in the file /filter.php. An attacker can exploit this vulnerability to execute illegal...

Leaked Credentials Up 160%: What Attackers Are Doing With Them

When an organization's credentials are leaked, the immediate consequences are rarely visible—but the long-term impact is far-reaching. Far from the cloak-and-dagger tactics seen in fiction, many real-world cyber breaches begin with something deceptively simple: a username and password. According ...

Google Confirms Salesforce Data Breach by ShinyHunters via Vishing Scam

Google confirms a data breach by ShinyHunters hackers, who used a vishing scam to access a Salesforce database with small business customer info...

CVE-2025-47188

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

KLM Confirms Customer Data Breach Linked to Third-Party System

KLM confirms a data breach exposing customer info via a third-party system, affecting names, contact details and Flying Blue membership data...

A week in security (July 28 – August 3)

Last week on Malwarebytes Labs: Apple ID scam leads to $27,000 in-person theft of Ohio man OpenAI kills "short-lived experiment" where ChatGPT chats could be found on Google Trump Administration and Big Tech want you to share your health data Prison visitor details shared with all inmates at...

Prison visitor details shared with all inmates at correctional facility

The Everglades Correctional Institution ECI in Miami-Dade County has leaked the names, email addresses, and telephone numbers of visitors to the facility to every inmate. The inmates received an email last week sent by a staff member that included the personal information of the visitors. Inmates...

Inc Ransomware Claims 1.2TB Data Breach at Dollar Tree

The notorious INC Ransomware group is claiming responsibility for a data breach at Dollar Tree, the American retail…...

Tea Dating Advice app has users’ private messages disclosed

A few days after Tea Dating Advice discovered unauthorized access to one of its systems that leaked 72,000 user images, the popular mobile app faced a second issue involving a separate database, as a researcher reported to 404Media that they were able to access private conversations. Tea Dating...