GoKawiil
Tech News
Breaches now travel sideways: a provider you have never heard of holds credentials for a service you rely on. Here is how to work out whether it reaches you, and what to do.
OpenCode said it suffered a security breach described as a large-scale distillation attack, which affected 1.4% of its Console users. The company notified affected users by email and says the incident is still ongoing, so further details are not yet available. OpenCode stated it is working with Anthropic, OpenAI, and Google to address the issue.
California's Department of Education disclosed that a stolen login credential was used to access and copy personal data—names, birth dates, and addresses—of millions of current and former public-school students who took state standardized tests. The breach, tied to testing vendor Educational Testing Service, affected files dating back to 2006 and involved unauthorized access occurring over several months in 2026. Officials are offering affected individuals free identity-protection and restoration services, and recommend credit freezes for minors.
Burger King Japan disclosed that unauthorized third parties accessed a server managing its official app's member data between October 2 and 7, 2026, exposing 11.18 million records including names, birth dates, gender, emails, phone numbers and order history. The company said it blocked the intrusion upon discovery, completed a follow-up investigation on October 13, and reported the incident to Japan's Personal Information Protection Commission.
Security researcher Azdoufal found that Energize Lab's Eiliko robot companion, which uses AI to converse with owners, stored conversation data on servers with no apparent access protections. The exposed database reportedly contained roughly 13 million conversations tied to about 68,000 active devices worldwide, including over 31,000 profiles linked to children in the US. The Verge says it purchased and tested the device, confirming a conversation was accessible almost immediately after being recorded.
The UK's Legal Aid Agency said further analysis of an April 2025 breach found that roughly 250,000 stolen records predate 2007, with the earliest verified record from 1978. Most stolen data covers applications, claims and payments from January 2007 to May 2025, but the agency confirmed a smaller, older trove was also taken. The agency had previously disclosed theft of applicant and provider data including contact details, national ID numbers, criminal history, financial information and portal credentials.
A hacker told Danish outlet Politiken that they accessed Denmark's Central Register of Persons by breaching accounts at Pays ApS, a private firm with authorized CPR access, several of which used the password '123456.' The breach exposed names, addresses and ID numbers of 8.8 million living and deceased Danes, and records show the attacker ran roughly 14 million automated searches over about ten days in September before a staffer at another government ministry flagged unusual billing activity.
A hacker claims they breached Denmark's Central Register of Persons by exploiting a Pays ApS account secured only with the password '123456'. The Danish government confirmed 8.8 million records were extracted, discovering the breach 12 days later via an unusual invoice, and Pays ApS's managing director Sophie Laursen confirmed the access point. The hacker says they do not intend to sell or leak the data.
The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive and ransomware expert, in connection with a hack that exposed sensitive data of current and former FBI employees. He faces extortion and threat-related charges and has been moved to Texas's Eastern District for a detention hearing. FBI Director Kash Patel announced the arrest without naming the suspect, but sources confirmed Dubrovsky's identity to CNN.
Danish newspaper Politiken reported that at least three accounts at Odense-based IT firm Pays, including an administrator account, used the password '123456' when hackers accessed Denmark's CPR civil registration database. The breach reportedly exposed data linked to about 8.8 million CPR numbers, with an anonymous hacker claiming access lasted over 21 days starting 10 September after obtaining a leaked password from a former employee of another small Danish firm.
Sen. Maggie Hassan sent a letter to Trump Mobile CEO Patrick O'Brien alleging the company has not obtained FCC authorization under Section 214 to provide international calling despite advertising service to over 230 countries. She also said Trump Mobile and partner Liberty Mobile Wireless failed to file a complete robocall-mitigation plan, and raised concerns tied to a reported breach exposing data on 3,615 customers.
Asos has confirmed that hackers breached a third-party platform hosting customer communication data, stealing names, home addresses, phone numbers, emails, and profile notes such as search queries. The attackers, identifying themselves as the Xuanye Group, used Asos's own app notification system to alert customers directly, demanding the company engage with them or risk having the stolen data leaked online.