Planned Parenthood partly offline after ransomware attack

In late August, Intermountain Planned Parenthood of Montana suffered a cyberattack which is still under investigation. The attack has been claimed by a ransomware group. Intermountain Planned Parenthood Inc., doing business as Planned Parenthood Of Montana, is a nonprofit organization that provid...

MAL-2024-8800 Malicious code in saptiya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e761bb75d4a0bad96ad666c358c5b3eccdc0f47e5e6622a536496b9ee2fa49b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

City of Columbus tries to silence security researcher

The City of Columbus, Ohio is suing a security researcher for sharing stolen data. All the complaint will accomplish, we imagine, is spotlight the ignorance of certain city officials in handling a common security matter. What happened is that the City of Columbus was attacked by a ransomware grou...

Secrets Exposed: Why Your CISO Should Worry About Slack

In the digital realm, secrets API keys, private keys, username and password combos, etc. are the keys to the kingdom. But what if those keys were accidentally left out in the open in the very tools we use to collaborate every day? A Single Secret Can Wreak Havoc Imagine this: It's a typical Tuesd...

Ex-Engineer Charged in Missouri for Failed $750,000 Bitcoin Extortion Attempt

A 57-year-old man from the U.S. state of Missouri has been arrested in connection with a failed data extortion campaign that targeted his former employer. Daniel Rhyne of Kansas City, Missouri, has been charged with one count of extortion in relation to a threat to cause damage to a protected...

Hacker Leaks Data of 390 Million Users from VK, a Russian Social Network

Hacker HikkI-Chan leaks personal data of over 390 million VK users on Breach Forums, including city, country, full…...

Tracelo Location Tracker Data Breach: 1.4 Million Users’ Data Dumped Online

Tracelo, a smartphone geolocation tracker service, was breached on September 1, 2024, exposing data from both its customers…...

Why Incident Response Planning is Critical for Cybersecurity Resilience

Cyber threats are inevitable, making preparedness necessary. In 2023, the average cost of a data breach reached $4.45…...

A week in security (August 26 – September 1)

Last week on Malwarebytes Labs: Iranian cybercriminals are targeting WhatsApp users in spear phishing campaign Fake Canva home page leads to browser lock Telegram CEO Pavel Durov charged with allowing criminal activity CODAC Behavioral Healthcare, US Marshalls are latest ransomware targets SMS...

PT-2024-30647 · Unknown · Easytest Online Test Platform

Name of the Vulnerable Software and Affected Versions: Easytest Online Test Platform versions 24E01 and earlier Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the search parameter in the search course titles function. This enables attackers to run...

BIT-JUPYTERLAB-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user c...

SportsNET SQL注入漏洞

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

CODAC Behavioral Healthcare, US Marshalls are latest ransomware targets

The Qilin ransomware group listed CODAC Behavioral Healthcare, a nonprofit health care treatment organization, as one of their latest victims. Qilin seems to have a preference for healthcare and support organizations. One of their most well-known victims was the pathology lab services provider...

Basecamp: Critical Data Breach - Big Data for all domains

The researcher provided an Excel sheet that appeared to be a dump of a breach database. The origin of the data entries in the database was unclear. A small number of valid HEY accounts with enabled 2FA were found, as well as a slightly larger number of other product accounts with valid passwords...

MAL-2024-8056 Malicious code in bit-node-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 375c209857233b09af6c89beaadb9668701896b791ba2fb5271b0568fca81346 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TDECU data breach affects half a million people

The Texas Dow Employees Credit Union TDECU has filed a data breach notification, reporting that the data of 500,474 people has been accessed in an external system breach. TDECU is the largest Houston-area credit union, and the fourth largest in the state of Texas. The credit union was founded by...

TDECU Data Breach: 500,000+ Members Affected by MOVEit Exploit

TDECU reports a data breach affecting over 500,000 members due to a MOVEit vulnerability. Compromised data includes Social…...

Unpacking Slack Hacks: 6 Ways to Protect Sensitive Data with Secure Collaboration

Nowadays, sensitive and critical data is traveling in everyday business channels that offer only the basic level of security and encryption, and companies are often oblivious to the risk. A case in point: Disney suffered a devastating data leak by a hacktivist group known as NullBulge that got ho...

USDoD Hacker Behind $3 Billion SSN Leak Reveals Himself as Brazilian Citizen

Infamous hacker USDoD, linked to major data breaches, reveals his identity as a Brazilian citizen. Discover the implications…...

No, not every Social Security number in the U.S. was stolen

My current least favorite thing about the churn of social media that Ive seen over the past week is waves of stories, posts and videos saying that every U.S. citizens Social Security number has been stolen or potentially viewed by a threat actor. The claim comes from a class action lawsuit filed ...