All articles tagged with #data breach
A California bankruptcy judge ordered Chrome Holding (operating as TTAM Research Institute) to pay about $46.75 million to victims of the 2023 23andMe data breach. Kroll Restructuring will distribute the funds to those affected, including users whose genetic data and relatives’ profiles were exposed, as 23andMe continues operating after bankruptcy and faces prior regulatory actions.
A Tata Electronics data breach reportedly exposed 630GB of Apple iPhone 18 Pro documents, detailing the A20 Pro chip with WMCM packaging, relocated RAM for better thermal management, a larger vapor chamber, a 24MP front camera, under-display Face ID, advanced computational photography, and a new C2 modem enabling 5G over satellite (Ganymede)—all while underscoring security risks in Apple’s supply chain.
A House Judiciary Committee report alleges South Korea’s National Intelligence Service pressured Coupang to retrieve a stolen laptop from a Shanghai river as part of investigating a November data breach affecting 33 million customers; Coupang complied under orders, later facing a $410 million penalty for illegal data harvesting, while Seoul denies involvement—highlighting a broader, hardening regulatory climate for US tech firms in Korea and growing US-Korea tech policy frictions.
A data breach at supplier Tata Electronics reportedly leaked iPhone 18 Pro drop-test photos and parts lists; videos surfaced on X and were pulled for violating the platform’s rules, with an EvLeaks impersonator suspended and others reposting the clips, while Reuters confirms the material also appeared on the dark web.
New footage and documents from a Tata Electronics data breach reportedly show an iPhone 18 Pro undergoing internal drop testing, with the device appearing to survive a lab drop; Reuters notes the leaked files bear Apple watermarks and internal codenames, but independent verification of the model isn’t possible yet, and attribution around the leak remains murky after Evan Blass denied association with the leak account.
Leaked iPhone 18 Pro photos and hundreds of component files surfaced on the dark web after Tata Electronics, a major Apple supplier, confirmed a data breach. Reuters reports the leak includes board layouts, data sheets for a possible A20 Pro chip, and supplier lists tied to Apple and Tesla, with the ransomware group World Leaks posting over 200,000 files. Apple has said it’s concerned about the documents being shared, and The Verge reached out for comment.
A Texas Parks and Wildlife Department data breach via its license system vendor exposed personal data for 3,087,721 hunting and fishing license customers. Although Social Security numbers, dates of birth, and financial info were not affected, threat actors may have accessed driver’s license details, passport numbers, email addresses, phone numbers, and residential addresses, creating phishing and social-engineering risks. The TPWD is updating safeguards with the vendor and offering one year of free credit monitoring; affected individuals should monitor credit reports, consider freezes or fraud alerts, and stay vigilant for scams. There is no evidence that minors were targeted.
The Texas Parks and Wildlife Department said a vendor's license system breach exposed driver's license info, passport numbers (where provided), emails, phone numbers, and residential addresses for more than 3 million hunting and fishing license customers; Social Security numbers, birth dates, and financial data were not obtained. TPWD is tightening access controls and adding safeguards, and affected customers can receive one year of free credit monitoring via Kroll (enrollment deadline Sept. 14, 2026; call center at 844-959-7123). Guidance includes monitoring credit reports, freezing credit with the three major bureaus, and fraud alerts. No evidence of under-18 victims or targeted groups; license sales continue as usual.
Security researchers say a broad breach of Fortinet firewalls exposed plaintext credentials for about 74,000 devices across 194 countries, enabling attackers to access centralized authentication systems and move laterally into networks of major organizations including Oracle, Lenovo, FedEx, and a Turkish NATO contractor; investigators note many compromised devices remained online and the attackers reportedly used a GPU-based password-cracking operation, underscoring the risk across multiple industries.
A hacker calling themselves SHADOWBYT3$ says they breached Nintendo, stealing about 859 MB of data through the TINYpulse system, including employee names, emails, analytics, W-9 forms, bank PDFs, and workplace feedback. Nintendo has not verified the breach; the hacker set a 48-hour deadline for a response before leaking the data, with the claim dating to June 13, 2026.
A ransomware group calling itself ShadowBytes claims to have breached Nintendo, stealing about 859 MB of private employee data—including names, emails, bank statements, and private messages—and is demanding $2 million. Nintendo says only internal TinyPulse survey data was involved, no customer or financial data was accessed, and it is working with the provider to address the issue; a second threat reportedly targeted TinyPulse after Nintendo declined to pay.
A hacking group calling itself ShadowByt3$ claimed to have accessed about 859MB of Nintendo employee data via the TinyPulse HR platform and demanded a $2 million ransom. Nintendo of America responded that no systems were compromised and that the data involved is limited to internal survey content for a small number of employees, with most information dating back several years and no customer or financial data affected. The update emphasizes risks from third‑party HR tools and that the breach, if true, may be more about privacy of internal feedback than gaming data, with NOA working with TinyPulse to address the issue.
Nintendo confirmed a breach tied to the TinyPulse service, saying the exposed data is limited to internal survey content for a small subset of employees and most records are from years past; no customer or financial data was accessed, Nintendo’s systems were not compromised, and employees outside North America were not involved. Some reports had claimed up to 859MB of data, but Nintendo asserts the breach did not affect external data and is working with the provider to address the issue.
A critical PeopleSoft zero-day (CVE-2026-35273) was exploited by the ShinyHunters ransomware group to target about 100 organizations, stealing gigabytes of data and pressuring victims for ransom. The flaw is a remotely exploitable SSRF vulnerability, and Oracle has issued mitigations but not a full patch yet. Roughly 68% of affected entities are in higher education, including the University of Nottingham, with attackers mapping configurations and exfiltrating data to a data-leak site, where some victims’ data was published; Mandiant and Rapid7 are providing IOCs and remediation guidance.
The World Food Programme confirmed a cyber-attack exposing personal information (names, IDs, mobile numbers, and location data) of about 600,000 Gazan households via its Palestine self-registration app. The breach, detected in mid-May and announced in late May with public confirmation on June 2, affected only the SRA/People Portal used in Palestine, which WFP shut down to contain the intrusion and bolster security. No group has claimed responsibility. The incident underscores ongoing humanitarian data-security risks in conflict zones and follows broader concerns about protecting beneficiaries’ data and the potential misuse of location information.