soundcloud

The European Commission has confirmed a data breach after its Europa.eu web platform was hacked in a cyberattack claimed by the ShinyHunters extortion gang. BleepingComputer first reported on Friday that this breach affects at least one of the Commission's AWS (Amazon Web Services) accounts. The Commission says the attack didn't disrupt any Europa websites and that its staff took measures to contain the incident and prevent further data theft. "Early findings of our ongoing investigation suggest that data have been taken from those websites. The Commission is duly notifying the Union entities who might have been affected by the incident. The Commission's services are still investigating the full impact of the incident," the European Union's main executive body said in a Friday press release published after BleepingComputer reached out for more details on the cyberattack. "The Commission's internal systems were not affected by the cyber-attack. The Commission will continue to monitor the situation and take all necessary measures to ensure the security of its internal systems and data. It will analyse the incident and use the results to further enhance its cybersecurity capabilities." While the Commission didn't share further information regarding the attack, the threat actor who claimed responsibility for the breach told BleepingComputer last week that they had stolen over 350 GB of data before their access was blocked, including multiple databases. Although they didn't share how they breached the Commission's Amazon AWS accounts, they provided screenshots proving they had access to some European Commission employees' data. Data extortion group ShinyHunters has also added an European Commission entry to its dark web leak site, claiming that the theft of "data dumps of mail servers, datavases, confidential documents, contracts, and much more sensitive material," and released an archive of over 90GB of files allegedly stolen from the Commission's compromised cloud environment. In recent months, ShinyHunters has claimed breaches at Infinite Campus, CarGurus, Canada Goose, Panera Bread, Betterment, SoundCloud, PornHub, and online dating giant Match Group (which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid). Some of these victims were breached in a large-scale voice phishing (vishing) campaign that targeted single sign-on (SSO) accounts at Okta, Microsoft, and Google across more than 100 high-profile organizations. The Commission was hit by another data breach in February after discovering that the mobile device management platform it uses to manage staff's devices had been hacked. These security breaches were disclosed after the Commission's proposed new cybersecurity legislation to strengthen member states' defenses against state-backed actors and cybercrime groups targeting their critical infrastructure. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher’s home. This post examines what is knowable about Dort based on public information. A public “dox” created in 2020 asserted Dort was a teenager from Canada (DOB August 2003) who used the aliases “CPacket” and “M1ce.” A search on the username CPacket at the open source intelligence platform OSINT Industries finds a GitHub account under the names Dort and CPacket that was created in 2017 using the email address [email protected]. The cyber intelligence firm Intel 471 says [email protected] was used between 2015 and 2019 to create accounts at multiple cybercrime forums, including Nulled (username “Uubuntuu”) and Cracked (user “Dorted”); Intel 471 reports that both of these accounts were created from the same Internet address at Rogers Canada (99.241.112.24). Dort was an extremely active player in the Microsoft game Minecraft who gained notoriety for their “Dortware” software that helped players cheat. But somewhere along the way, Dort graduated from hacking Minecraft games to enabling far more serious crimes. Dort also used the nickname DortDev, an identity that was active in March 2022 on the chat server for the prolific cybercrime group known as LAPSUS$. Dort peddled a service for registering temporary email addresses, as well as “Dortsolver,” code that could bypass various CAPTCHA services designed to prevent automated account abuse. Both of these offerings were advertised in 2022 on SIM Land, a Telegram channel dedicated to SIM-swapping and account takeover activity. The cyber intelligence firm Flashpoint indexed 2022 posts on SIM Land by Dort that show this person developed the disposable email and CAPTCHA bypass services with the help of another hacker who went by the handle “Qoft.” “I legit just work with Jacob,” Qoft said in 2022 in reply to another user, referring to their exclusive business partner Dort. In the same conversation, Qoft bragged that the two had stolen more than $250,000 worth of Microsoft Xbox Game Pass accounts by developing a program that mass-created Game Pass identities using stolen payment card data. Who is the Jacob that Qoft referred to as their business partner? The breach tracking service Constella Intelligence finds the password used by [email protected] was reused by just one other email address: [email protected]. Recall that the 2020 dox of Dort said their date of birth was August 2003 (8/03). Searching this email address at DomainTools.com reveals it was used in 2015 to register several Minecraft-themed domains, all assigned to a Jacob Butler in Ottawa, Canada and to the Ottawa phone number 613-909-9727. Constella Intelligence finds [email protected] was used to register an account on the hacker forum Nulled in 2016, as well as the account name “M1CE” on Minecraft. Pivoting off the password used by their Nulled account shows it was shared by the email addresses [email protected] and [email protected], the latter being an address at a domain for the Ottawa-Carelton District School Board. Data indexed by the breach tracking service Spycloud suggests that at one point Jacob Butler shared a computer with his mother and a sibling, which might explain why their email accounts were connected to the password “jacobsplugs.” Neither Jacob nor any of the other Butler household members responded to requests for comment. The open source intelligence service Epieos finds [email protected] created the GitHub account “MemeClient.” Meanwhile, Flashpoint indexed a deleted anonymous Pastebin.com post from 2017 declaring that MemeClient was the creation of a user named CPacket — one of Dort’s early monikers. Why is Dort so mad? On January 2, KrebsOnSecurity published The Kimwolf Botnet is Stalking Your Local Network, which explored research into the botnet by Benjamin Brundage, founder of the proxy tracking service Synthient. Brundage figured out that the Kimwolf botmasters were exploiting a little-known weakness in residential proxy services to infect poorly-defended devices — like TV boxes and digital photo frames — plugged into the internal, private networks of proxy endpoints. By the time that story went live, most of the vulnerable proxy providers had been notified by Brundage and had fixed the weaknesses in their systems. That vulnerability remediation process massively slowed Kimwolf’s ability to spread, and within hours of the story’s publication Dort created a Discord server in my name that began publishing personal information about and violent threats against Brundage, Yours Truly, and others. Last week, Dort and friends used that same Discord server (then named “Krebs’s Koinbase Kallers”) to threaten a swatting attack against Brundage, again posting his home address and personal information. Brundage told KrebsOnSecurity that local police officers subsequently visited his home in response to a swatting hoax which occurred around the same time that another member of the server posted a door emoji and taunted Brundage further. Someone on the server then linked to a cringeworthy (and NSFW) new Soundcloud diss track recorded by the user DortDev that included a stickied message from Dort saying, “Ur dead nigga. u better watch ur fucking back. sleep with one eye open. bitch.” “It’s a pretty hefty penny for a new front door,” the diss track intoned. “If his head doesn’t get blown off by SWAT officers. What’s it like not having a front door?” With any luck, Dort will soon be able to tell us all exactly what it’s like. Update, 10:29 a.m.: Jacob Butler responded to requests for comment, speaking with KrebsOnSecurity briefly via telephone. Butler said he didn’t notice earlier requests for comment because he hasn’t really been online since 2021, after his home was swatted multiple times. He acknowledged making and distributing a Minecraft cheat long ago, but said he hasn’t played the game in years and was not involved in Dortsolver or any other activity attributed to the Dort nickname after 2021. “It was a really old cheat and I don’t remember the name of it,” Butler said of his Minecraft modification. “I’m very stressed, man. I don’t know if people are going to swat me again or what. After that, I pretty much walked away from everything, logged off and said fuck that. I don’t go online anymore. I don’t know why people would still be going after me, to be completely honest.” When asked what he does for a living, Butler said he mostly stays home and helps his mom around the house because he struggles with autism and social interaction. He maintains that someone must have compromised one or more of his old accounts and is impersonating him online as Dort. “Someone is actually probably impersonating me, and now I’m really worried,” Butler said. “This is making me relive everything.” But there are issues with Butler’s timeline. For example, Jacob’s voice in our phone conversation was remarkably similar to the Jacob/Dort whose voice can be heard in this Sept. 2022 Clash of Code competition between Dort and another coder (Dort lost). At around 6 minutes and 10 seconds into the recording, Dort launches into a cursing tirade that mirrors the stream of profanity in the diss rap that Dortdev posted threatening Brundage. Dort can be heard again at around 16 minutes; at around 26:00, Dort threatens to swat his opponent. Butler said the voice of Dort is not his, exactly, but rather that of an impersonator who had likely cloned his voice. “I would like to clarify that was absolutely not me,” Butler said. “There must be someone using a voice changer. Or something of the sorts. Because people were cloning my voice before and sending audio clips of ‘me’ saying outrageous stuff.” Further reading:

Las Vegas-based high-end casino and hotel operator Wynn Resorts has confirmed that hackers have stolen employee data. “We have learned that an unauthorized third party acquired certain employee data,” the company told SecurityWeek. “Upon discovery, we immediately activated our incident response protocols and launched a thorough investigation with the help of external cybersecurity experts.” “This incident has had no impact on our guest experience, our operations or our physical properties, which are all fully operational and open for business,” it added. Wynn Resorts was added to the ShinyHunters data leak website on February 20, when the hackers claimed to have stolen more than 800,000 records containing personally identifiable information (including SSNs) and employee data. “This is a final warning to reach out by 24 Feb 2026 before we leak along with several annoying (digital) problems that’ll come your way. Make the right decision, don’t be the next headline,” the hackers said in a message addressed to Wynn Resorts at the time. Wynn Resorts has since been removed from the ShinyHunters website and the company’s statement suggests a ransom may have been paid. “The unauthorized third party has stated that the stolen data has been deleted,” the company said in an emailed statement. “We are monitoring and to date have not seen any evidence that the data has been published or otherwise misused.” SecurityWeek has asked Wynn for confirmation that a ransom has indeed been paid, but the company declined to comment. The Register previously reported that the cybercrime group had demanded a ransom of 22.34 bitcoin (roughly $1.5 million). The luxury hospitality and gaming company said its investigation is ongoing, but it has decided to offer credit monitoring and identity protection services to affected employees. “The security and confidentiality of our employees, as well as our guest data, is our top priority,” Wynn said. “While no company can ever eliminate the risk of a cyberattack, we are taking appropriate steps and working with industry-leading third-party IT advisors to strengthen our systems to protect against future incidents.” The ShinyHunters group is believed to have targeted more than 100 organizations in recent campaigns, which often involve vishing and compromised SSO credentials. The cybercriminals have named several major companies on their leak site in recent weeks, including Figure, Betterment, Crunchbase, SoundCloud, and Panera Bread. Related: Ad Tech Company Optimizely Targeted in Cyberattack Related: Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter

Wynn Resorts has confirmed that a hacker stole employee data from its systems after the company was listed on the ShinyHunters extortion gang's data leak site. In a statement shared today, the company said it activated its incident response procedures and launched an investigation, with assistance from external cybersecurity experts, after discovering the breach. "We have learned that an unauthorized third party acquired certain employee data," reads a statement shared with BleepingComputer. "Upon discovery, we immediately activated our incident response protocols and launched a thorough investigation with the help of external cybersecurity experts." While Wynn has not stated whether it paid a ransom to prevent the data leak, the company said the attackers confirmed the stolen data had been deleted. In past extortion cases, threat actors have typically only claimed data was deleted after reaching an agreement with a victim. "The unauthorized third party has stated that the stolen data has been deleted. We are monitoring and to date have not seen any evidence that the data has been published or otherwise misused," the statement continued. The company added that the incident did not impact guest operations or its physical properties, which remain fully operational, and that it is offering complimentary credit monitoring and identity protection services to employees. ShinyHunters leak site listing This statement comes after Wynn Resorts appeared on the ShinyHunters data leak site on Thursday. In the threat actors' post, the group claimed it had stolen "PII (SSNs, etc) and employee data" and warned the company to make contact before February 23, 2026, or the data would be published. "Over 800k records containing PII(SSNs, etc) and employee data have been compromised," reads the now-deleted post on ShinyHunters data leak site. "This is a final warning to reach out by 23 Feb 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headling." Shortly after, the Wynn entry was removed from the site, a move that often occurs when negotiations are underway or claims are disputed. Wynn Resorts did not answer questions about whether a ransom was paid or how many people were affected. Similarly, ShinyHunters told BleepingComputer that they had no comment on whether they received a payment. However, the threat actors did previously claim to have stolen the data from the company's Oracle PeopleSoft environment. ShinyHunters is a data extortion group known for breaching organizations and threatening to publish stolen data unless a ransom is paid. The group has previously claimed responsibility for multiple high-profile data theft incidents and has operated across various underground forums and extortion portals over the years. Last year, ShinyHunters conducted a widespread campaign to steal Salesforce data, targeting numerous companies through social engineering and stolen third-party OAuth tokens. In recent weeks, ShinyHunters has claimed responsibility for a wave of other security breaches, including Panera Bread, Betterment, SoundCloud, Canada Goose, PornHub, and online dating giant Match Group. Some of the victims were compromised through voice phishing (vishing) attacks targeting single sign-on (SSO) accounts at Google, Microsoft, and Okta, where the threat actors posed as IT support staff to trick employees into entering credentials and multi-factor authentication (MFA) codes on phishing sites. As BleepingComputer first reported, the ShinyHunters group more recently adopted device code vishing to obtain Microsoft Entra authentication tokens. After stealing their targets' credentials and auth codes, the threat actors hijack the victims' SSO accounts to steal data from connected SaaS applications such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The ShinyHunters extortion group has published personal information in more than 12 million records allegedly stolen from CarGurus, a U.S.-based digital auto platform. CarGurus is a publicly traded automotive research and shopping company that operates in the U.S., Canada, and the U.K. Its website has an estimated 40 million monthly visitors and helps people find, compare, and contact sellers of new and used vehicles. On February 21, the threat group published a 6.1GB archive containing 12.4 million records, saying it was from CarGurus. A day later, the HaveIBeenPwned (HIBP) data breach monitoring and alerting platform added the dataset, listing the following data types as compromised: Email addresses IP addresses Full names Phone numbers Physical addresses User account IDs Finance pre-qualification application data Finance application outcomes Dealer account details Subscription information Although CarGurus has not released an official statement disclosing a data breach and did not respond to BleepingComputer's request for comment, it is important to note that HIBP attempts to confirm the validity/authenticity of the leaked records before adding them. HIBP reports that 70% of the leaked data was already on its database from previous incidents, so roughly 3.7 million records are fresh. Since the information is freely available for download, cybercriminals could take advantage of it for phishing attacks. CarGurus users are advised to stay alert for potentially malicious communications and scam attempts leveraging the leaked information. The ShinyHunters data extortion group has been very active recently, claiming multiple attacks on large companies and leaking their data when negotiations reached a dead end. The most recent examples include Dutch telecommunications provider Odido, ad tech firm Optimizely, fintech firm Figure, outerwear brand Canada Goose, restaurant chain Panera Bread, online dating company Match Group, and music streaming platform SoundCloud. The threat group typically uses social engineering, most commonly voice phishing, to breach organizations, directing victims to credential-harvesting pages that grant them access to SaaS platforms such as Salesforce, Okta, and Microsoft 365. Previous ShinyHunters campaigns also involved tricking employees into installing malicious OAuth applications that granted them API-level read access to customer data tables inside Salesforce instances. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The ShinyHunters extortion gang has claimed responsibility for breaching Dutch telecommunications provider Odido and stealing millions of user records from its compromised systems. Odido is one of the largest telecommunications companies in the Netherlands and offers mobile, broadband, and television services to millions of customers nationwide. The company disclosed the breach on February 12, revealing that attackers downloaded the personal data of many of its users after gaining access to its customer contact system on February 7. However, Odido added that no Mijn Odido passwords, call details, location, data, billing data, or scans of identity documents were exposed during the incident. According to the telecom firm, the exposed information varies per customer and may include a combination of full name, address and city of residence, mobile number, customer number, email address, IBAN (bank account number), date of birth, and some identification details (passport or driver's license number and validity). It also told local media at the time that the data breach affected 6.2 million customers and that the threat actors reached out to say they had stolen millions of user records. After discovering the incident, Odido has reported the breach to the Dutch Data Protection Authority, blocked the attackers' access to its systems, and hired external cybersecurity experts to assist with incident response and mitigation. An Odido spokesperson didn't provide further information on the incident when asked about which threat group was behind the attack and whether they demanded a ransom "due to the ongoing investigations." While Odido has yet to attribute the attack, the ShinyHunters extortion gang has now added the company to its dark web leak site, claiming they've stolen nearly 21 million records containing data the company already revealed as exposed in the breach. ShinyHunters also told BleepingComputer on Monday that the stolen data also contains internal corporate data and plaintext passwords. However, an Odido spokesperson denied their claims in a statement to BleepingComputer, reiterating that "no passwords, call details, social security numbers, or billing data are involved." "This is a final warning to come back to our chat and finish what we set out to do before we leak along with several annoying (digital) problems that'll come your way," the extortion gang says on the leak site. "Make the right decision, don't be the next headline. You know where to find us." In recent weeks, ShinyHunters has claimed responsibility for a wave of other security breaches, including Panera Bread, Betterment, SoundCloud, Canada Goose, PornHub, and online dating giant Match Group (which owns the Tinder, Hinge, Meetic, Match.com, and OkCupid dating platforms). Some of their victims had their systems compromised in voice phishing (vishing) attacks targeting single sign-on (SSO) accounts at Google, Microsoft, and Okta, where the threat actors call employees while impersonating IT support staff and trick them into entering credentials and multi-factor authentication (MFA) codes on phishing sites that mimic their companies' login portals. As BleepingComputer first reported, the ShinyHunters group has also recently adopted device code vishing, abusing the OAuth 2.0 device authorization grant flow to obtain Microsoft Entra authentication tokens. After stealing their targets' credentials and auth codes, the threat actors hijack the victims' SSO accounts to breach connected enterprise services like Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

New York-based ad tech company Optimizely has notified an undisclosed number of customers of a data breach after threat actors compromised some of its systems in a voice phishing attack. Optimizely has nearly 1,500 employees across 21 global offices, and its customer list includes over 10,000 businesses, including high-profile brands like H&M, PayPal, Zoom, Toyota, Vodafone, Shell, Salesforce, and Nike. In breach notification letters sent to affected customers, the company, the threat actors reached out on February 11, claiming they had access to its systems. Optimizely also told BleepingComputer that the attackers breached some of its systems and stole what it described as "basic business contact information." "The threat actor gained access to Optimizely's systems through a sophisticated voice-phishing attack, but was unable to escalate privileges, install software, or create any backdoors in the Optimizely environment, and we have no evidence that the threat actor was able to access sensitive customer data or personal information beyond basic business contact information," it said. Optimizely also noted the "incident was confined to certain internal business systems, records in our CRM, and a limited set of internal documents used for back-office operations," and added that its "business operations continue without disruption." The company also warned customers to be wary of attacks that could use some of the stolen data in further phishing attempts, which may use calls, texts, or emails to ask for passwords, MFA codes, or other credentials. ShinyHunters links While Optimizely didn't share how many customers had their information exposed in the data breach and has yet to name the threat actor behind the attack, it told affected customers that "the communication we received is consistent with the behavior of a loosely affiliated group who use sophisticated and aggressive social engineering tactics, most often involving voice phishing, to attempt to access their victims systems." This hints that the attackers are likely part of the ShinyHunters extortion operation, which has claimed similar breaches at Canada Goose, Panera Bread, Betterment, SoundCloud, PornHub, fintech firm Figure, and online dating giant Match Group (which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid) in recent weeks. While not all of these breaches are part of the same campaign, some victims had their systems compromised in a voice phishing (vishing) campaign targeting single sign-on (SSO) accounts at Microsoft, Okta, and Google across over 100 high-profile organizations. In these attacks, threat actors impersonate targets' IT support, call employees, and trick them into entering credentials and multi-factor authentication (MFA) codes on phishing sites mimicking their companies' login portals. As BleepingComputer first reported, the threat actors have also recently altered their social engineering attacks to use device code vishing, abusing the legitimate OAuth 2.0 device authorization grant flow to obtain Microsoft Entra authentication tokens. Once in, they hijack the victim's SSO account and gain access to connected enterprise services, including Salesforce, Microsoft 365, Google Workspace, Zendesk, Dropbox, SAP, Slack, Adobe, Atlassian, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Hackers have stolen the personal and contact information of nearly 1 million accounts after breaching the systems of Figure Technology Solutions, a self-described blockchain-native financial technology company. Founded in 2018, Figure uses the Provenance blockchain for lending, borrowing, and securities trading, and has unlocked over $22 billion in home equity with over 250 partners, including banks, credit unions, fintechs, and home improvement companies. While the blockchain lender didn't publicly disclose the incident, a Figure spokesperson told TechCrunch on Friday that the attackers stole "a limited number of files" in a social engineering attack. BleepingComputer has also reached out to Figure with further questions about the breach, but a response was not immediately available. Although the company has yet to share how many individuals were affected 967,200 accounts was stolen in the attack. "In February 2026, data obtained from the fintech lending platform Figure was publicly posted online," Have I Been Pwned said on Wednesday. "The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access." The ShinyHunters extortion group claimed responsibility for the breach and added the company to its dark web leak site, leaking 2.5GB of data allegedly stolen from thousands of loan applicants. In recent weeks, ShinyHunters claimed similar breaches at Canada Goose, Panera Bread, Betterment, SoundCloud, and PornHub. While not all of them are part of the same campaign, some of these victims were breached in a voice phishing (vishing) campaign targeting single sign-on (SSO) accounts at Okta, Microsoft, and Google across more than 100 high-profile organizations. The attackers are impersonating IT support, calling their targets' employees and tricking them into entering credentials and multi-factor authentication (MFA) codes on phishing sites that impersonate their companies' login portals. Once in, they gain access to the victim's SSO account, which provides them with access to other connected enterprise applications and services, including Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Zendesk, Dropbox, Adobe, Atlassian, and many others. As part of this campaign, ShinyHunters also breached online dating giant Match Group, which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

ShinyHunters flip the script on MFA in new data theft attacks Multi-factor authentication (MFA) is supposed to defend against phishing attacks, but threat actors operating under the ShinyHunters banner are using it as a pretext in ongoing social engineering attacks aimed at bypassing it. Among those successfully targeted in these latest hacking spree are Panera Bread, SoundCloud, Match Group (owner of online dating services Tinder, Hinge, Match and OkCupid) and Crunchbase. There will likely be many more victims, as Silent Push researchers detected active targeting or infrastructure preparation directed at domains of a wide variety of organizations in the tech and fintech, financial services, real estate, energy, healthcare, logistics, retail, and many other sectors. Synchronized vishing-phishing attacks Ten days ago, Okta warned about a new tool used by threat actors who specialize in voice phishing: custom-made phishing kits that allow them to syncronize the authentication flow on phishing pages with the request they make over the phone. “It’s worth noting that these hybrid phishing operations are also capable of bypassing push notifications that use number challenge/number matching as an additional method of verification,” Okta researchers noted. “A social engineer interacting on the phone with a targeted user can simply request a user to choose or enter a specific number.” Identifying the attack groups Mandiant, Google Cloud’s threat intelligence and incident response arm, says there are several seemingly independent groups that are using the same or a similar approach: UNC6661 and UNC6671. “In incidents spanning early to mid-January 2026, UNC6661 pretended to be IT staff and called employees at targeted victim organizations claiming that the company was updating MFA settings. The threat actor directed the employees to victim-branded credential harvesting sites to capture their SSO credentials and MFA codes, and then registered their own device for MFA. In at least some cases, the threat actor gained access to accounts belonging to Okta customers,” the researchers noted. The attackers moved laterally through victim customer environments to access various SaaS platforms and exfiltrate specific data from them: they searched for documents containing personally identifiable information, but also containing words such as “poc,” “confidential,” “internal,” “proposal,” “salesforce,” and “vpn”. In at least one incident where these attacker gained access to an Okta customer account, the group tried to minimize the possibility of detection by deleting a “Security method enrolled” email from Okta, and by deleting phishing emails sent from compromised email accounts to contacts working at cryptocurrency-focused companies. Around the same time, the UNC6671 threat actor impersonated IT staff over the phone and directed victims to enter their credentials and MFA authentication codes into phishing sites that were made to look like they belonged to their employer. Once they gained access to Okta customer accounts, the group leveraged PowerShell to download sensitive data from SharePoint and OneDrive. And after they made off with the data, during the extortion process, they used aggressive tactics such as harassing the victimized personnel. Based on details such as phishing domain hosting, Tox Chat accounts used for negotiation and other indicators, Mandiant researchers believe these are two separate groups or individuals. Based on overlapping tactics, techniques, and procedures used, UNC6661 can be tied to UNC6040, i.e., the ShinyHunters cyber extortion group. “GTIG also observed extortion text messages sent to employees and received reports of victim websites being targeted with distributed denial-of-service (DDoS) attacks,” the researchers also shared. The researchers have shared indicators of compromise related to the attacks as well as threat hunting queries. Mandiant has also published thorough guidance for organizations on how to avoid becoming a victim in these attacks, how to detect intrusions, and how to minimize the scope of the compromise if they do become a victim. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Hackers have stolen the personal and contact information belonging to over 29.8 million SoundCloud user accounts after breaching the audio streaming platform's systems. SoundCloud was founded in 2007 as an artist-first platform that now provides access to over 400 million tracks from more than 40 million artists worldwide. The company confirmed the breach on December 15, following widespread reports from users who were unable to access SoundCloud and saw 403 "Forbidden" errors when connecting via VPN. SoundCloud told BleepingComputer at the time that it had activated its incident response procedures after detecting unauthorized activity involving an ancillary service dashboard. "We understand that a purported threat actor group accessed certain limited data that we hold," SoundCloud said. "We have completed an investigation into the data that was impacted, and no sensitive data (such as financial or password data) has been accessed. The data involved consisted only of email addresses and information already visible on public SoundCloud profiles." While SoundCloud didn't provide further details regarding the incident, BleepingComputer learned that the breach affected 20% of all SoundCloud users, roughly 28 million accounts based on publicly reported user figures (SoundCloud later published a security notice confirming the information provided by BleepingComputer's sources). After the breach, BleepingComputer also learned that the ShinyHunters extortion gang was responsible for the attack, with sources saying that the threat group was also attempting to extort SoundCloud. This was confirmed by SoundCloud in a January 15 update, which said the threat actors had "made demands and deployed email flooding tactics to harass users, employees, and partners." Although SoundCloud has yet to share how many users' data was stolen, data breach notification service Have I Been Pwned revealed the extent of the breach on Monday, reporting that it affected 29.8 million accounts whose email addresses, geographic locations, names, usernames, and profile statistics were harvested in the incident. "In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users," said data breach notification service Have I Been Pwned. "The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user's country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month." BleepingComputer reached out to SoundCloud again today with questions about the December incident, but a response was not immediately available. Last week, ShinyHunters also claimed responsibility for a wave of ongoing voice phishing attacks targeting single sign-on (SSO) accounts at Okta, Microsoft, and Google, which could enable attackers to breach corporate SaaS platforms and steal data for extortion. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Market intelligence firm Crunchbase has confirmed a data breach after hackers published files allegedly stolen from its systems. The notorious ShinyHunters cybercrime group claims to have stolen more than 2 million records containing personal information from Crunchbase. The hackers have made available more than 400 MB of compressed files for download on their website after the company refused to pay a ransom. “Crunchbase detected a cybersecurity incident where a threat actor exfiltrated certain documents from our corporate network. No business operations have been disrupted by this incident. We have contained the incident and our systems are secure,” Crunchbase said in a statement to SecurityWeek. “Upon detecting the incident we engaged cybersecurity experts to assist us and we contacted federal law enforcement. Crunchbase is aware that the threat actor posted certain information online. As part of our incident response procedures we are reviewing the impacted information to determine if any notifications are required consistent with applicable legal requirements,” it added. Alon Gal, CTO of threat intelligence company Hudson Rock, has analyzed the leaked Crunchbase data and found personally identifiable information (PII), contracts, and other corporate data. Other ShinyHunters hacking victims The ShinyHunters leak website also lists SoundCloud and the robo-advisor firm Betterment, from which the hackers claim to have stolen several gigabytes of files containing tens of millions of records that include PII. SoundCloud confirmed a data breach in mid-December, saying that email addresses and publicly available profile data belonging to roughly 20% of its users had been accessed by threat actors. Passwords and financial information were not compromised, the music streaming service said. In a statement sent to SecurityWeek last week after the hackers published the stolen data, SoundCloud said it is reviewing the leaked files. In an update shared on January 13, the company revealed that the hackers had been harassing users, employees, and partners, but it had found no evidence to confirm the attackers’ claims about sensitive data being stolen. As for investment advisor Betterment, the company disclosed a cybersecurity incident on January 12, saying that threat actors had penetrated its systems through social engineering, using their access to send cryptocurrency-related scam messages to some customers. Okta vishing Hudson Rock’s Gal learned from ShinyHunters that the hackers claim to be behind a recent Okta SSO vishing campaign, and that Crunchbase, SoundCloud, and Betterment are among its victims. Okta has issued a private warning to customers regarding vishing attacks. A public blog post describes custom phishing kits that enable advanced voice-based social engineering for vishing campaigns. The identity solutions provider pointed out that such phishing kits have been used to target Google, Microsoft, Okta, and cryptocurrency services. However, it has not said whether these campaigns are linked to the recent ShinyHunters attacks. Related: Nike Probing Potential Security Incident as Hackers Threaten to Leak Data Related: Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses

Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How researchers are teaching AI agents to ask for permission the right way People are starting to hand more decisions to AI agents, from booking trips to sorting digital files. The idea sounds simple. Tell the agent what you want, then let it work through the steps. The hard part is what the agent does with personal data along the way. A new research study digs into this problem, and asks a basic question. How should an AI agent know when to use someone’s data without asking every time? Ro’s CISO on managing data flows in telehealth In this Help Net Security interview, Scott Bachand, CIO/CISO at Ro, discusses how telehealth reshapes the flow of patient data and what that means for security. He explains why organizations must strengthen data classification and visibility as systems and vendors multiply. He also outlines how regulations and new technologies are driving a more adaptive approach to protecting patient information. Why vulnerability reports stall inside shared hosting companies Security teams keep sending vulnerability notifications, and the same pattern keeps repeating. Many alerts land, few lead to fixes. A new qualitative study digs into what happens after those reports arrive and explains why remediation so often stops short. Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718) Attackers are exploiting a recently revealed vulnerability (CVE-2025-59718) to bypass authentication on Fortinet’s FortiGate firewalls, and are leveraging the achieved access to export their system configuration files, Arctic Wolf researchers warned on Tuesday. Exploited SonicWall zero-day patched (CVE-2025-40602) SonicWall has patched a local privilege escalation vulnerability (CVE-2025-40602) affecting its Secure Mobile Access (SMA) 1000 appliances and is urging customers to apply the provided hotfix, as the flaw has been exploited by attackers. Cisco email security appliances rooted and backdoored via still unpatched zero-day A suspected Chinese-nexus threat group has been compromising Cisco email security devices and planting backdoors and log-purging tools on them since at least late November 2025, Cisco Talos researchers have shared. The soft underbelly of space isn’t in orbit, it’s on the ground In this Help Net Security interview, Øystein Thorvaldsen, CISO at KSAT, discusses how adversaries view the ground segment as the practical way to reach space systems and why stations remain a focal point for security efforts. He notes that many risks stem from supply chain gaps and legacy infrastructure that supports critical missions. He also explains how KSAT works to keep latency low while maintaining security across global operations. AI isn’t one system, and your threat model shouldn’t be either In this Help Net Security interview, Naor Penso, CISO at Cerebras Systems, explains how to threat model modern AI stacks without treating them as a single risk. He discusses why partitioning AI systems by function and impact matters, how to frame threat modeling for business leaders, and which assumptions break down as AI becomes core infrastructure. Kali Linux 2025.4: New tools and “quality-of-life” improvements OffSec has released Kali Linux 2025.4, a new version of its widely used penetration testing and digital forensics platform. Most of the changes are related to appearance and usability. Update your Apple devices to fix actively exploited vulnerabilities! (CVE-2025-14174, CVE-2025-43529) Apple has issued security updates with fixes for two WebKit vulnerabilities (CVE-2025-14174, CVE-2025-43529) that have been exploited as zero-days. Several days before the release of these updates, Google fixed CVE-2025-14174 in the desktop version of Chrome, though at the time the issue did not have a CVE number nor a description. SoundCloud breached, hit by DoS attacks Audio streaming service SoundCloud has suffered a breach and has been repeatedly hit by denial of service attacks, the company confirmed on Monday. In the days leading up to the confirmation, users accessing SoundCloud through VPNs reported connection failures and error messages. European police busts Ukraine scam call centers Law enforcement agencies from several European countries have arrested twelve persons suspected of being involved in scamming victims across Europe, Eurojust announced. The fraudsters used various scams, such as posing as police officers to withdraw money using their victims’ cards and details, or pretending that their victims’ bank accounts had been hacked. Microsoft 365 users targeted in device code phishing attacks Attackers are targeting Microsoft 365 users with device code authorization phishing, a technique that fools users into approving access tokens, Proofpoint warns. The method abuses Microsoft’s OAuth 2.0 device authorization grant flow by presenting users with device codes that, when entered, inadvertently grant attackers control of enterprise accounts. Crypto theft in 2025: North Korean hackers continue to dominate When they strike cryptocurrency-related targets, North Korean hacking groups are increasingly aiming for large services where a single breach can move serious money, a new Chainalysis report on crypto theft in 2025 revealed. Clipping Scripted Sparrow’s wings: Tracking a global phishing ring Between June 2024 and December 2025, Fortra analysts tracked a persistent business email compromise (BEC) operation that we have now classified as Scripted Sparrow. The group carries out well-crafted highly targeted phishing campaigns that masquerade as professional services firms to mislead finance teams into transferring money to fraudsters’ accounts. More than half of public vulnerabilities bypass leading WAFs Miggo Security has released a new report that examines how web application firewalls are used across real-world security programs. The research outlines the role WAFs play as foundational infrastructure and evaluates their effectiveness against critical vulnerabilities, CVEs, and AI-driven threats. How exposure management changes cyber defense In this Help Net Security video, Larry Slusser, VP of Strategy at SixMap, explains why endpoint detection and response is only part of the security story. Drawing on his work as an incident responder, engagement manager, and ransomware negotiator, he describes EDR as the armed guard that reacts after an intruder crosses the line. What types of compliance should your password manager support? Lost credentials and weak authentication controls still sit at the center of many security incidents. IT leaders and CISOs know this problem well. They also know that regulators watch how organizations protect passwords, track access, and document security decisions. That is why password managers have become part of compliance conversations rather than optional add ons. AI might be the answer for better phishing resilience Phishing is still a go-to tactic for attackers, which is why even small gains in user training are worth noticing. A recent research project from the University of Bari looked at whether LLMs can produce training that helps people spot suspicious emails with better accuracy. Banks built rules for yesterday’s crime and RegTech is trying to fix that Criminals are moving money across borders faster, and financial institutions are feeling the squeeze. Compliance teams feel this strain every day as they try to keep up with schemes that shift through accounts, intermediaries, and digital channels. A new academic review of regulatory technology, or RegTech, shows how this pressure is reshaping compliance work and why research in this field is gaining new weight. Should AI access be treated as a civil right across generations? AI use is expanding faster than the infrastructure that supports it, and that gap is starting to matter for security, resilience, and access. A new position paper argues that access to AI should be treated as an intergenerational civil right, rather than a service shaped mainly by market forces. Privacy risks sit inside the ads that fill your social media feed Regulatory limits on explicit targeting have not stopped algorithmic profiling on the web. Ad optimization systems still adapt which ads appear based on users’ private attributes. At the same time, multimodal LLMs have lowered the barrier for turning these hidden signals into profiling tools. A new study examines this risk and asks how outside parties could use these signals to infer private attributes from ad exposure alone. LLMs work better together in smart contract audits Smart contract bugs continue to drain real money from blockchain systems, even after years of tooling and research. A new academic study suggests that large language models can spot more of those flaws when they work in coordinated groups instead of alone. Manufacturing is becoming a test bed for ransomware shifts Manufacturing leaders may feel that ransomware risk has settled, but new data shows the threat is shifting in ways that require attention, according to a Sophos report. A global survey of 332 IT and security leaders outlines how attackers are adjusting tactics and how organizations are absorbing the impact of those changes. Europe’s DMA raises new security worries for mobile ecosystems Mobile security has long depended on tight control over how apps and services interact with a device. A new paper from the Center for Cybersecurity Policy and Law warns that this control may weaken as the European Union’s Digital Markets Act pushes mobile platforms to open core functions to outside developers. Prometheus: Open-source metrics and monitoring systems and services Prometheus is an open-source monitoring and alerting system built for environments where services change often and failures can spread fast. For security teams and DevOps engineers, it has become a common way to track system behavior, spot early warning signs, and understand what is happening across large sets of workloads. What Cloudflare’s 2025 internet review says about attacks, outages, and traffic shifts The internet stayed busy, brittle, and under constant pressure in 2025. Cloudflare’s annual Radar Year in Review offers a wide view of how traffic moved, where attacks clustered, and what failed when systems were stressed. Passwordless is finally happening, and users barely notice Security teams know the strain that comes from tightening authentication controls while keeping users productive. A new report from Okta suggests this strain is easing. Stronger authentication methods are gaining traction, and many of them let users move through sign in flows with less effort than before. The report indicates that the long held belief that better security slows people down is becoming less relevant as these methods improve both protection and usability. Product showcase: GlassWire mobile firewall for Android GlassWire is a free network monitoring and security application for Windows and Android. It lets you see how your system communicates over the internet and local network. The Windows version also offers a Premium tier with advanced features, while the Android app focuses on monitoring and control. By combining visual network activity with simple controls, GlassWire helps you understand what’s happening behind the scenes and take action when something looks out of the ordinary. AI breaks the old security playbook AI has moved into enterprise operations faster than many security programs expected. It is embedded in workflows, physical systems, and core infrastructure. Some AI tools reach hundreds of millions of users each week. Inference costs have fallen 280 fold, but overall spending is still rising because usage keeps growing. Zabbix: Open-source IT and OT observability solution Zabbix is an open source monitoring platform designed to track the availability, performance, and integrity of IT environments. It monitors networks along with servers, virtual machines, applications, services, databases, websites, and cloud resources. What cybersecurity leaders are reading to stay ahead If you’re looking for holiday gift ideas, books remain one of the simplest ways to spark curiosity and support someone’s growth. Whether the person on your list is exploring cybersecurity, AI, engineering, or career development, these titles offer something useful for readers at every stage of their professional journey. Group Policy abuse reveals China-aligned espionage group targeting governments ESET Research has identified a previously undocumented China-aligned advanced persistent threat group that uses Windows Group Policy to deploy malware and move through victim networks. The group, tracked as LongNosedGoblin, has targeted government institutions in Southeast Asia and Japan with a toolset built for long-term surveillance. Identity risk is changing faster than most security teams expect Security leaders are starting to see a shift in digital identity risk. Fraud activity is becoming coordinated, automated, and self-improving. Synthetic personas, credential replay, and high speed onboarding attempts now operate through shared infrastructures that behave less like scattered threats and more like systems that learn as they run, according to a report by AU10TIX. Product showcase: NAKIVO v11.1 advances MSP service delivery with secure multi-tenant management NAKIVO Backup & Replication v11.1 brings a host of benefits to MSPs and their clients. It eliminates the need for client-side port configuration, enhances security with encrypted multi-platform support, and introduces automated failover capabilities. These features are designed specifically for managed service providers, offering them a more efficient and secure way to protect client infrastructure. Cybersecurity jobs available right now: December 16, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: December 19, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Apiiro, Astra Security, Push Security, Trellix, and XM Cyber.

Millions impacted by PornHub, SoundCloud data breaches Music sharing platform Soundcloud and pornography giant PornHub both warned customers this week of recent cybersecurity intrusions that gave hackers access to internal data. PornHub, which is owned by Canada-based Ethical Capital Partners, sent emails out to many users and published a statement warning that it was affected by a recent breach of data analytics service provider Mixpanel. The hackers used their access through Mixpanel to “extract a limited set of analytics events for some users,” PornHub said in a statement. The company said its Pornhub Premium systems were not breached and no payment details or financial information was exposed. When reached for comment, PornHub declined to say how many users were affected and what information was stolen. Several news outlets reported on a prominent group of hackers allegedly extorting PornHub with threats of leaking stolen data but their claims could not be verified. The company said it is working with law enforcement and Mixpanel to investigate the issue. In comments to Reuters, Mixpanel denied that it was at fault for the data that was allegedly stolen from PornHub. Mixpanel itself reported a security incident on November 27, with CEO Jen Taylor writing that the cyberattack was first discovered on November 8. The company shared few details about the breach, only writing that it was the victim of a “smishing” campaign and has contacted all of the customers affected by the attacks. OpenAI came forward one day earlier as one of the Mixpanel customers impacted by the breach. OpenAI uses Mixpanel for web analytics and said some of its API users had data stolen as part of the incident. “On November 9, 2025, Mixpanel became aware of an attacker that gained unauthorized access to part of their systems and exported a dataset containing limited customer identifiable information and analytics information,” OpenAI said in a statement on November 26. “Mixpanel notified OpenAI that they were investigating, and on November 25, 2025, they shared the affected dataset with us.” The information stolen from OpenAI included names, email addresses, location, operating system and other technical information on API users. OpenAI says it removed Mixpanel from its production services and is in the process of notifying impacted organizations. Soundcloud breached On Monday, music sharing platform Soundcloud also came forward to warn customers about a similar data breach. While SoundCloud did not name Mixpanel, the company said it “recently detected unauthorized activity in an ancillary service dashboard.” SoundCloud’s IT team attempted to contain the activity and hired cybersecurity experts to handle the response. But when they tried to limit the hackers’ access, the site “experienced denial of service attacks, two of which were able to temporarily disable our platform's availability on the web only.” “We understand that a purported threat actor group accessed certain limited data that we hold. We have completed an investigation into the data that was impacted, and no sensitive data (such as financial or password data) has been accessed,” the company said. “The data involved consisted only of email addresses and information already visible on public SoundCloud profiles and affected approximately 20% of SoundCloud users. We are confident that any access to SoundCloud data has been curtailed.” SoundCloud has about 200 million users, meaning the incident likely impacted about 40 million customers. The company noted that some of the security changes made over the last week have caused users with VPNs to experience connectivity issues. BleepingComputer spoke with members of a prominent cybercriminal group called ShinyHunters that allegedly took credit for the Mixpanel attacks. If accurate, the claims would represent yet another high-profile hacking campaign launched by members of the group this year. Members of the group previously breached customers of Salesforce and exploited loopholes in a related platform that allowed them to harass and extort companies in aviation, insurance and retail throughout the summer. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Comparing data breaches is like comparing apples and oranges. They differ on many levels. To news media, the size of the brand, how many users were impacted, and how it was done often dominate the headlines. For victims, what really matters is the type of information stolen. And for the organizations involved, the focus is on how they will handle the incident. So, let’s have a look at the three that showed up in the news feeds today. 700Credit 700Credit is a US provider of credit reports, preliminary credit checks, identity verification, fraud detection, and compliance tools for automobile, recreational vehicle, powersports, and marine dealerships. In a notice on its website, 700Credit informed media, partners, and affected individuals that it suffered a third-party supply-chain attack in late October 2025. According to the notice, an attacker gained unauthorized access to personally identifiable information (PII), including names, addresses, dates of birth, and Social Security numbers (SSNs). The breach involves data collected between May and October, impacting roughly 5.6 million people. The supply-chain attack demonstrates the importance of how you handle attacks. Reportedly, 700Credit communicates with more than 200 integration partners through application programming interfaces (APIs). When one of the partners was compromised in July, they failed to notify 700Credit. As a result, unnamed cybercriminals broke into that third-party’s system and exploited an API used to pull consumer information. 700Credit shut down the exposed third-party API, notified the FBI and FTC, and is mailing letters to victims offering credit monitoring while coordinating with dealers and state regulators. SoundCloud SoundCloud is a leading audio streaming platform where users can upload, promote, stream, and share music, podcasts, and other audio content. SoundCloud posted a notice on its website stating that it recently detected unauthorized activity in an ancillary service dashboard. Ancillary services refer to specialized functions that help maintain stability and reliability. When SoundCloud contained the attack, it experienced denial-of-service attacks, two of which were able to temporarily disable its platform’s availability on the web. An investigation found that no sensitive data such as financial or password data was accessed. The exposed data consisted of email addresses and information already visible on public SoundCloud profiles. The company estimates the incident affected roughly 20% of its user base. Pornhub Pornhub is one of the world’s most visited adult video-sharing websites, allowing users to view content anonymously or create accounts to upload and interact with videos. Reportedly, Pornhub disclosed that on November 8, 2025, a security breach at third-party analytics provider Mixpanel exposed “a limited set of analytics events for certain users.” Pornhub stressed that this was not a breach of Pornhub’s own systems, and said that passwords, payment details, and financial information were not exposed. Mixpanel, however, disputes that the data originated from its November 2025 security incident. According to reports, the ShinyHunters ransomware group claims to have obtained about 94 GB of data containing more than 200 million analytics records tied to Pornhub Premium activity. ShinyHunters shared a data sample with BleepingComputer that included a Pornhub Premium member’s email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. ShinyHunters has told BleepingComputer that it sent extortion demands to Pornhub, and the nature of the exposed data creates clear risks for blackmail, outing, and reputational harm—even though no Social Security numbers, government IDs, or payment card details are in the scope of the breach. Comparing apples and oranges As you can see, these are three very different data breaches. Not just in how they happened, but in what they mean for the people affected. While email addresses and knowing that someone uses SoundCloud could be useful for phishers and scammers, it’s a long way from the leverage that comes with detailed records of Pornhub Premium activity. If that doesn’t get you on the list of a “hello pervert” scammer, I don’t know what will. But undoubtedly the most dangerous one for those affected is the 700Credit breach which provides an attacker with enough information for identity theft. In the other cases an attacker will have to penetrate another defense layer, but with a successful identity theft the attacker has reached an important goal. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.

SoundCloud breached, hit by DoS attacks Audio streaming service SoundCloud has suffered a breach and has been repeatedly hit by denial of service attacks, the company confirmed on Monday. In the days leading up to the confirmation, users accessing SoundCloud through VPNs reported connection failures and error messages. It has now been revealed that these connectivity issues were due to configuration changes made by SoundCloud in the wake of the attacks, and that the company is working on resolving them. The breach “SoundCloud recently detected unauthorized activity in an ancillary service dashboard,” the company stated, and immediately activated its incident response protocols and called in a third-party cybersecurity experts to help with the investigation and response. “We understand that a purported threat actor group accessed certain limited data that we hold,” the company added. “The data involved consisted only of email addresses and information already visible on public SoundCloud profiles and affected approximately 20% of SoundCloud users.” Financial data, passwords or other sensitive data has not been accessed, and the company believes that the attackers no longer have any access to SoundCloud data. The DoS attacks SoundCloud is officially blocked in Russia, mainland China, and Turkey, and to access it, users resort to using VPN services. Its temporary unavailability made users fear that the streaming service had permanently blocked access via VPN. SoundCloud also confirmed that once the incident had been contained and the attackers booted out, the service was hit by denial of service attacks, two of which made the streaming platform temporarily unavailable for users accessing it via the website. At the moment, the platform is again available via apps and web, meaning that the service is either no longer being hammered with malicious requests or is able to withstand their onslaught. SoundCloud did not name the attackers, but according to Lawrence Abrams, it’s the ShinyHunters cyber extortion group and they are trying to get SoundCloud to pay them not to leak the stolen data. It’s currently unknown whether the breach and the DoS attacks were perpetrated by the same group. “We’ll continue to share updates as we learn more and are committed to keeping you informed. We’re taking steps to reduce the risk of similar issues in the future,” the company concluded. UPDATE (January 27, 2026, 05:45 a.m. ET): The attackers have leaked the accessed information, which includes names, usernames, email addresses, geographic locations, profile statistics and avatars of approximately 20% of Soundcloud’s users. You can check whether your info is included in this batch via the Have I Been Pwned service. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Hackers have targeted SoundCloud and accessed some user data stored on its systems, the music streaming giant said on Monday. Reports that SoundCloud may have banned VPN access started circulating in recent days after some users complained they were no longer able to access the music streaming service through a VPN. However, the company revealed on Monday that it has been responding to a cyberattack, and VPN issues were caused by the actions taken to secure its systems. According to SoundCloud, it initiated incident response protocols after discovering unauthorized activity in an “ancillary service dashboard”. An investigation conducted with the aid of third-party cybersecurity experts showed that the attacker gained access to “certain limited data”, including email addresses and information visible on public SoundCloud profiles. The company said sensitive data, such as passwords or financial information, was not exposed. SoundCloud said roughly 20% of its users are affected. According to some estimates, SoundCloud has well over 100 million users, translating to tens of millions of users who are likely impacted. While the compromised information may not be particularly sensitive, the company did urge users to keep an eye out for phishing attempts. The company is confident that the attackers have been kicked out of its systems. However, following containment measures, distributed denial-of-service (DDoS) attacks were launched against SoundCloud, and two of the attacks managed to temporarily disrupt the platform’s web version. As for the VPN issues experienced by some users, the company said they were caused by configuration changes implemented in response to the incident. SoundCloud said on Monday that it had been working on addressing the VPN access problems. Related: 700Credit Data Breach Impacts 5.8 Million Individuals Related: Fieldtex Data Breach Impacts 238,000

ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Audio streaming platform SoundCloud has confirmed that outages and VPN connection issues over the past few days were caused by a security breach in which threat actors stole a database exposing users' email addresses and profile information. The disclosure follows widespread reports over the past four days from users who were unable to access SoundCloud when connecting via VPN, with attempts resulting in the site displaying 403 "forbidden" errors. In a statement shared with BleepingComputer, SoundCloud said it recently detected unauthorized activity involving an ancillary service dashboard and activated its incident response procedures. SoundCloud acknowledged that a threat actor accessed some of its data but said the exposure was limited in scope. "We understand that a purported threat actor group accessed certain limited data that we hold," SoundCloud told BleepingComputer. "We have completed an investigation into the data that was impacted, and no sensitive data (such as financial or password data) has been accessed. The data involved consisted only of email addresses and information already visible on public SoundCloud profiles." BleepingComputer has learned that the breach affects 20% of SoundCloud’s users, which, based on publicly reported user figures, could impact roughly 28 million accounts. The company said it is confident that all unauthorized access to SoundCloud systems has been blocked and that there is no ongoing risk to the platform. Working with third-party cybersecurity experts, the company said it took additional steps to strengthen its security, including improving monitoring and threat detection, reviewing identity and access controls, and conducting an assessment of related systems. However, the company's response included a configuration change that disrupted VPN connectivity to the site. SoundCloud has not provided a timeline for when VPN access will be fully restored. Following the response, SoundCloud experienced denial-of-service attacks that temporarily disabled the platform's web availability. After publishing our story, SoundCloud published a security notice with this information. While SoundCloud has not shared details about the threat actor behind the breach, BleepingComputer received a tip earlier today stating that the ShinyHunters extortion gang was responsible. Our source said that ShinyHunters is now extorting SoundCloud after allegedly stealing a database containing information about its users. ShinyHunters is also responsible for the PornHub data breach that was first reported today by BleepingComputer. This is a developing story, and we will update it as more information becomes available. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Users accessing the SoundCloud audio streaming platform through a virtual private network (VPN) connection are denied access to the service and see a 403 'forbidden' error. SoundCloud is a large audio distribution platform focused on user-uploaded content, built around independent creators rather than licensed music from major labels. It has at least 140 million registered users and 40 million creators. Due to its open, unmoderated nature, the platform has been banned in China since 2014, in Russia since 2022, and is restricted in Venezuela, Kazakhstan, and other countries. Because of this, users in these regions rely on a VPN or proxy solution to bypass the blocks. The VPN connection problem when accessing SoundCloud has persisted for the past four days, as the platform announced today that it is working to fix it. BleepingComputer independently confirmed the VPN connection issue after multiple users complained on Reddit. In a statement for BleepingComputer, SoundCloud's senior director of communications Sade Ayodele said that "some configuration changes have caused some users on VPNs to experience temporary connectivity issues." Ayodele confirmed that they are working to resolve the issues, as the platform also announced earlier today on social media in a post from the support team. It is unclear what prompted the configuration changes and the company has not provided a timeline for when users will be able to access the service over VPN. Reddit users have pointed out that the issue has been going on for four days now, preventing access to all accounts regardless of their membership status. Some users have reported that specific services or server locations unlocked access to the service, though others who have tried the proposed workarounds reported little luck. This is a developing story, and we will update the article as soon as we have more information Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Prometheus: Open-source metrics and monitoring systems and services Prometheus is an open-source monitoring and alerting system built for environments where services change often and failures can spread fast. For security teams and DevOps engineers, it has become a common way to track system behavior, spot early warning signs, and understand what is happening across large sets of workloads. The project began at SoundCloud and is now hosted by the Cloud Native Computing Foundation, where it sits alongside Kubernetes and other core cloud-native tools. Prometheus is designed around a simple idea, collect metrics from systems, store them locally, and make them easy to query and alert on. A metrics model built for scale Prometheus uses a time series data model. Every metric is stored with a name and a set of labels that describe the source. Labels can include details such as service name, instance, region, or role. This structure lets teams slice and group data without redefining metrics every time infrastructure changes. Metrics are numeric and sampled at regular intervals. That makes them suitable for tracking system health indicators like CPU usage, memory pressure, request rates, and error counts. For security teams, the same model can support signals such as authentication failures, unusual traffic spikes, or service restarts. Prometheus stores data locally on disk. The design avoids a dependency on remote storage during collection, which helps keep monitoring available during outages or network issues. Long-term storage can be added through remote write integrations when needed. Pull-based collection and service discovery One of the defining features is its pull-based approach to data collection. Prometheus scrapes metrics from targets over HTTP at defined intervals. Each target exposes a metrics endpoint, often at a standard path. This model fits dynamic environments. Prometheus includes service discovery mechanisms for platforms like Kubernetes, cloud providers, and virtual machine fleets. Targets can appear and disappear without manual updates to configuration files. Security teams benefit from this approach when monitoring ephemeral workloads such as containers or short-lived jobs. Visibility does not depend on agents pushing data to a central point, which can reduce complexity and limit the risk of blind spots. PromQL gives teams direct answers Prometheus includes its own query language called PromQL. The language is designed to work directly with time series data. Queries can filter metrics by label, calculate rates, aggregate values, and compare current behavior with historical baselines. PromQL is used across the Prometheus ecosystem. Dashboards, alerts, and ad hoc investigations rely on the same query language. That consistency helps teams share queries and understand each other’s work. For incident response, PromQL supports fast exploration. Teams can ask focused questions such as which services are seeing rising error rates or which nodes are under memory pressure right now. Alerting tied to behavior, not static rules Prometheus includes an alerting system that evaluates PromQL expressions over time. Alerts fire when conditions hold true for a defined duration. This reduces noise from brief spikes or transient issues. Alerts describe symptoms rather than events. A rule might watch for sustained increases in failed login attempts or sudden drops in service availability. Alertmanager, a companion component, handles grouping, routing, and notification delivery. This approach aligns with how security and operations teams work during incidents. Alerts point to patterns that need attention instead of individual log entries. An ecosystem that grows with the platform Prometheus has a large ecosystem of exporters that expose metrics from databases, operating systems, network devices, and applications. Many security tools and infrastructure platforms provide Prometheus-compatible endpoints by default. The project documentation emphasizes simplicity and composability. Prometheus does one job, collect and query metrics. Visualization tools like Grafana and long-term storage systems can be added without changing the core design. Prometheus is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack OpenGuardrails: A new open-source model aims to make AI safer for real-world use Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!