Current security news from curated sources

Abbott Labs Subsidiary Breached

Am 16. Juli 2026 meldete der Gesundheitskonzern Abbott Laboratories einen Cyberangriff auf die Legacy-Systeme seiner Tochtergesellschaft Exact Sciences, einem Unternehmen für Krebsdiagnostik. Die Systems sind von den eigenen Systemen Abotts getrennt und es wird kein Einfluss auf Dienste oder Geschäftsbetrieb erwartet. Der Vorfall wurde nicht in der 8-K Meldung erwähnt. Abbott hat Dritte zur Untersuchung hinzugezogen und die Behörden informiert.

Ernst & Young Notifies Clients of Data Theft Following Breach of Third-Party IT Ticketing System

Ernst & Young (EY) hat seine Kunden über einen Cyberangriff auf ein Drittanbieter-IT-Ticketing-System informiert, bei dem persönliche und finanzielle Informationen kompromittiert wurden. Zwischen dem 28. März und dem 12. April 2026 hatte eine unbefugte Partei Zugriff auf das System und stahl Dokumente von EY-Kunden, die für Steuererklärungen verwendet werden. Die Untersuchung bestätigte, dass der unautorisierte Zugang gestoppt wurde und die Systeme von EY nun sicher sind.

KDDI Breach Affects Other ISPs

Die japanische Telekommunikationsfirma KDDI hat bestätigt, dass Angreifer eine Schwachstelle in Drittanbieter-Software ausnutzten, um auf ein E-Mail-System von KDDI zuzugreifen. Das kompromittierte System wird auch von fünf anderen ISPs genutzt: STNet Inc., JCOM Co. Ltd., Chubu Telecommunications C. Inc., NIFTY Corporation und BIGLOBE Inc. Es könnte die E-Mail-Adressen und Passwörter von 14,2 Millionen Konten betroffen sein; Kunden werden gebeten, ihre Passwörter zu ändern. Die Untersuchung läuft noch.

Klue Integrations Breached Using 2022 Credential

Ein Datenleck bei der Marktanalyseplattform Klue und deren Integrationen in Software wie Salesforce wurde durch kompromittierte Zugangsdaten aus einem Pilotprogramm im Jahr 2022 verursacht. Der Angreifer erlangte OAuth-Token, um Kundendaten zu stehlen. Nach Erkennung der unautorisierten Aktivität am 12. Juni 2026 wurden die betroffenen Anmeldedaten zurückgezogen und verdächtige Codeabschnitte entfernt. Klue arbeitet mit Kunden an den Schadensbegrenzungsmaßnahmen, während eine interne Überprüfung der Sicherheitskontrollen stattfindet. TechCrunch berichtet, dass Klue in Verhandlungen mit dem Angreifer "Icarus" steht, der angeblich die gestohlenen Daten löscht. Ein zweiter Angreifer versucht, Klue-Kunden direkt zu erpressen. Salesforce und Gong haben die Integration von Klue vorübergehend dea

Fortinet PSIRT Advisory · June 2026

Dashlane 2FA brute-force; encrypted vaults for <20 accounts

Beginning May 31 2026 attackers brute-forced six-digit 2FA codes to register new devices on Dashlane accounts and downloaded encrypted vaults for fewer than 20 personal accounts. Dashlane said its own systems were not compromised and worked with affected customers.

Verizon Releases 2026 Data Breach Investigations Report

NEOSEC summary pending — original source not mirrored verbatim.

GitHub Internal Repos Stolen via VS Code Supply Chain Compromise

NEOSEC summary pending — original source not mirrored verbatim.

Microsoft Patch Tuesday · May 2026

Anthropic investigates unauthorized access to Claude Mythos Preview via vendor

In April 2026 Anthropic said it was investigating reports that unauthorized users accessed its unreleased vulnerability-discovery tool Claude Mythos Preview through a third-party vendor environment rather than a direct Anthropic system compromise (Bloomberg / CRN reporting).

LexisNexis breach (FulcrumSec claims React2Shell path)

In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.

ShinyHunters leak Crunchbase data (~2M records)

In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.

Navigate360 breach exposes Crime Stoppers tips from its P3 platform, Canada's privacy commissioner investigates

Navigate360, the US company behind the P3 tip platform used by Crime Stoppers programs, disclosed on Oct 23 2026 that an unauthorized third party was in one of its systems from Nov 21 2025 to Mar 5 2026 and copied data. It says the files may include names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses and other sensitive information. CBC News reports more than 1.5 million Canadian tips from the past 25 years were compromised, and Toronto Crime Stoppers says 176,859 of its tips were affected. On Oct 27 Canada's Privacy Commissioner opened an investigation into Navigate360.

Mixpanel smishing breach exposes OpenAI API users' names and emails

Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen

The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.

SonicWall: state actor stole firewall config backups of every cloud-backup customer

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen

F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.

Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)

Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)

UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.