An Impostor Used a Real Government Email to Get Revolut’s Customer Records
A fraudulent request from a genuine government email domain persuaded Revolut to disclose sensitive customer records. The failure was in verifying who had authority to ask.
Data Breach
One Police Login on a Personal Device Was Enough to Breach Florida’s DMV
Florida identified one compromised police login, improperly stored on an employee's personal device, as the route into its systems. The claimed scale of exposure remains unconfirmed.
One Contractor Session Exposed Data Tied to 4.1 Million People
One compromised contractor session opened cloud applications, patient systems and external health-record portals. HHS says the AdaptHealth breach affected 4,115,802 people.
The Vendor Credentials Opened One API. Patient Social Security Numbers Left Through It.
The attacker did not need broad network access. Veradigm says credentials stolen from a third-party vendor were enough to copy patient data through one customer-service API.
The Identity Checks Meant to Stop Fraud May Have Created a 153-Million-Record Fraud Kit
The documents collected to stop fraud may now enable it. IDScan confirmed possible unauthorised access, while a vanished dark-web service claimed 153 million driver's licence records.
One User Was Enough: Two Law-Firm Breaches Exposed Client Files, SSNs and Health Data
Separate social-engineering breaches at Quinn Emanuel and McDermott show how one compromised identity can expose exceptionally sensitive legal records.
One Healthcare Archive Was Breached. 9.5 Million Patients Paid the Price.
A breach at Aesto Health reached 9.5 million people across at least two dozen providers, exposing medical, financial and identity data stored in AWS.
Who Had Access to America’s Sealed Court Records?
A breach of Thomson Reuters’ C-Track cloud may have exposed sealed and confidential court records across at least 12 US jurisdictions and Ontario.
ShinyHunters Talked Their Way Into a Major Banking Provider
Jack Henry says ShinyHunters used vishing to enter a non-production environment, exposing PII associated with fewer than ten clients.
Berlin Refused Rhysida’s Ransom and the Leaks Kept Coming
Berlin says Rhysida released a further stolen-data package containing access credentials, forcing additional safeguards and possible service restrictions.