#breach

DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 and July 2, 2026. Most were contact details; a small minority included driver's licenses, passports or utility bills. Certificates were not affected.

AI workflow platform Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables for a subset of organizations. It says the exploit is blocked and affected owners were emailed, but has not said how it happened or how many customers were hit.

Chainalysis said on November 4 that names, usernames, password hashes and live tokens for all users were exposed, reversing its October 30 statement that no session tokens were accessed. It took KYT, address screening and its login page offline after abnormal activity.

DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of everyone who logged in from about August to October 23, 2026, and may have exposed webmail session data, emails and files.

Binance's initial findings trace the $6.34 billion theft to a September fake recruiter whose coding assignment infected an engineer's Mac. An internal AI tool let the attacker reach two wallet engineers, and a container deployment token on one laptop opened the signing service.

Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached production on October 29 and accessed customer names, emails and password hashes before being cut off on October 31.

mSecure's developer emailed current and former customers on November 3 about suspicious activity linked to the password manager, advising them to change passwords, reset two-factor authentication and possibly remove passkeys. It has not said what happened or whether vault data was exposed.

WorkOS found unauthorized access on October 30 to an internal tool its sales and customer teams use, exposing CRM contacts, call and Slack excerpts, and directory health metadata. It saw an AI-assisted offensive framework and no access to production or application data.

Binance said on October 30 that attackers used a DevOps engineer's compromised laptop to reach a service container and submit unauthorized withdrawals, moving about $6.3 billion on October 29. TRM Labs attributes the theft to North Korea's TraderTraitor; about $2.7 billion was frozen.

After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.

Sony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala records plus 54,401 email addresses with their passwords. It reset those mail passwords the same day.

Railway's October 22 preliminary report says an attacker pulled encrypted customer environment variables, obtained CI credentials to decrypt a subset, and hunted for AI provider keys. At most 1.85% of workspaces, about 100,000, may be affected; all Railway API tokens were revoked.

The UK ICO reprimanded Ogi Networks and Data Cymru on October 20 over a November 2024 ransomware attack that entered through a test account named Test2, created in 2012 with the password Password1, and exposed data on 3,300 people, mostly children.

Zeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private config repo, to read 3.2 million environment-variable records. The developer hosting platform will close by December 31, 2026.

OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed OpenAI, Anthropic and Google keys that 1.4% of OpenCode Console users had saved. Keys stored locally by the CLI and desktop apps were not affected. Some users report unexplained charges.

Someone abused a private company's lawful search access to Denmark's CPR register and pulled names, addresses and CPR numbers for about 8.8 million people. A person claiming responsibility says the account password was 123456.

Glucose monitor maker Dexcom says targeted voice phishing gave an unauthorized party access to limited information in certain internal documents. It reports no impact on products or operations and has brought in an outside forensics firm.

ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.

The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters names the platform as Oracle PeopleSoft and the firm as Accenture.

Attackers exploited a zero-day in an unnamed security product Bitget used, reached an internal management system, and inserted withdrawal commands while posing as administrators. Private keys were never touched; they did not need to be.

An attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs and X integration tokens, plus 490 million image metadata records.

The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and set a deadline before threatening to release data including client tax information.

Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts over three days in June, exposing membership numbers, stored credit, and partial card numbers.

Abbott confirmed unauthorized access to legacy Exact Sciences systems after a mid-June vishing attack compromised a Microsoft Entra single sign-on account. ShinyHunters claims a large data theft, unverified. A second, smaller incident used stolen customer credentials on a portal.