data breach – Page 7

AnyDesk Breach: Production Compromise and a Certificate Sprint

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Identity & Phishing Security Supply Chain Security

Remote-access maker AnyDesk confirmed in February 2024 that attackers had compromised production systems using valid credentials traced to infostealer logs — forcing a certificate rotation, password resets, and a rushed 8.1.1 release whose code-signing was intact but whose credibility needed rebuilding. This piece covers the infostealer-to-supply-chain escalation path that rewired vendor-risk thinking, and why remote-admin tooling became a tier-one identity perimeter.

MOAB: The 26 Billion-Record Compilation That Wasn’t a Breach

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Identity & Phishing Security

The January 2024 ‘Mother of All Breaches’ headline turned out to be a compilation of thousands of prior incidents re-hosted in a misconfigured bucket — 26 billion rows of recycled credentials stacked into a credential-stuffing goldmine. This piece explains why aggregations are not new breaches but still multiply risk, how the 12-terabyte trove mapped to old LinkedIn, Adobe and MyFitnessPal leaks, and why password reuse makes every old breach a live 2024 attack.

DP World Australia: When a Cyber Incident Stopped the Cranes

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

On 13 November 2023, DP World Australia disconnected its port systems from the internet to contain an intrusion — and container operations at Sydney, Melbourne, Brisbane and Fremantle stopped cold, stranding roughly 30,000 containers for three days. Operations resumed by 16 November, personnel data exposure was later confirmed, and no ransom payment was disclosed. The episode became Australia’s reference case for cyber-driven supply-chain disruption and a model of disciplined containment, rapid restoration and honest capacity communication under SOI-Act scrutiny.

ownCloud CVE-2023-49103: The CVSS 10.0 in the Docker Image

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Security

The graphapi app bundled in ownCloud’s Docker deployment images exposed mail credentials, database passwords, and S3 keys to unauthenticated visitors — a mis-packaged dependency that became full infrastructure compromise. CISA KEV-listed it within ten days.

ChatGPT’s November 2023 DDoS Outages, Explained

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:AI & Agent Security Cloud & Infrastructure Security

For much of 8 November 2023, ChatGPT and parts of OpenAI’s API cycled in and out of service under a denial-of-service wave claimed by Anonymous Sudan, with smaller recurrences through the month. OpenAI confirmed the DDoS, rolled global WAF rules, and absorbed a false-positive tax on legitimate users. Nothing was breached — the story is availability risk wrapped around AI dependence. This post walks the campaign’s anatomy, Microsoft’s Storm-1359 telemetry link, and the business-continuity lessons for anyone running on AI vendors.

LockBit, CitrixBleed, and the ICBC Treasury Hack

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Ransomware & Malware Security Web & API Security

When LockBit hit ICBC’s US broker-dealer on 9 November 2023, Treasury-market connectivity went dark and manual settlement took over for days. The entry path traced to CitrixBleed session tokens stolen before the October patch and never invalidated — exactly what CISA’s Emergency Directive 23-08 had warned. LockBit claimed a roughly $9 million ransom demand, never verified. The post walks the token-replay kill chain, the disclosure-era aftermath, and the defensive lesson that remediation includes revocation.

WinRAR’s 19-Year-Old Bug: When Legacy Code Turns Lethal

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Security Web & API Security

CVE-2023-38831 let a crafted WinRAR archive execute attacker code off a decoy file click — and researchers proved APT campaigns had been exploiting the 2004-era parser flaw for months before the August 2023 fix.

FortiOS SSL-VPN Heap Overflow: Pre-Auth Emergency

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2022-42475 was a CVSS 9.8 pre-auth heap overflow in FortiOS SSL-VPN, patched silently then confirmed exploited. Edge memory safety lessons.

LastPass 2022: The Dev-Environment Breach That Came Back

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

August’s ‘contained’ developer-account compromise returned in December as stolen vault backups. Inside the two-act breach.

Plex’s 15M Credential Leak: When Your Forum Post Becomes a Combo List

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Identity & Phishing Security

A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.

Solana’s 9,000-Wallet Drain: Who Logged the Seed Phrases?

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:Cryptography & PKI Identity & Phishing Security

Slope’s telemetry backend held plaintext seed phrases, and attackers harvested them. The chain saw only valid signatures — and that is the whole lesson.

0ktapus: The SMS Phishing Wave That Hit 130+ Companies

Post author:Prabhu Kalyan Samal
Post published:September 3, 2026
Post category:AI & Agent Security Identity & Phishing Security

Fake Okta pages, real-time MFA relay, and one crew harvesting 10,000 identities. Why Cloudflare walked away clean and Twilio didn’t.