Current security news from curated sources

Instructure Canvas Free-for-Teacher breach (ShinyHunters)

In May 2026 Instructure confirmed a security incident involving Canvas Free-for-Teacher after ShinyHunters claimed theft of data tied to hundreds of millions of users. Exposed data included names, emails, student IDs and some private messages; Instructure said it had no evidence passwords or financial/government IDs were taken.

Itron and Medtronic Breached

NEOSEC summary pending — original source not mirrored verbatim.

ADT Discloses Data Breach

NEOSEC summary pending — original source not mirrored verbatim.

Adobe Security Bulletin · April 2026

Los Angeles City Attorney's Office Breach Exposed LAPD Files

NEOSEC summary pending — original source not mirrored verbatim.

Anthropic investigates unauthorized access to Claude Mythos Preview via vendor

In April 2026 Anthropic said it was investigating reports that unauthorized users accessed its unreleased vulnerability-discovery tool Claude Mythos Preview through a third-party vendor environment rather than a direct Anthropic system compromise (Bloomberg / CRN reporting).

December 2025 Eurail Breach Exposed Passports

NEOSEC summary pending — original source not mirrored verbatim.

European Commission & Dutch authorities hit via Ivanti EPMM zero-days

February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.

UNC3886 breaches Singapore telecom providers (CYBER GUARDIAN)

In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.

ShinyHunters leak Crunchbase data (~2M records)

In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.

Discord support vendor breach exposes ~70,000 government ID photos

An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.

Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen

The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.

Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin

Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.

SonicWall: state actor stole firewall config backups of every cloud-backup customer

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen

F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.

Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)

Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)

UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale

A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

Salt Typhoon: Chinese state hackers inside US telecom networks

PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Internet Archive hacked: 31 million user records stolen

Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.