Frontline Education, an edtech provider of workforce management software for school districts, is notifying affected districts that attackers exploited a vulnerability in a third-party application to access its systems on August 14, 2026. Exposed data for at least one impacted district included employees' Social Security numbers, email addresses and physical addresses. Frontline has not identified the third-party product involved or said when unauthorized access began, and school IT administrators have been confirming the notifications' legitimacy on online forums.
bleepingcomputer.com
· 2026-10-02
The Defense Department disclosed that unauthorized users accessed a Defense Manpower Data Center system between October 2025 and July 2026, exposing personally identifiable information for about 2.76 million living people and 294,000 deceased individuals. The compromised data reportedly included Social Security numbers paired with job information for military and civilian personnel, though officials have not said how the breach occurred or who was responsible.
techspot.com
· 2026-10-01
The Defense Manpower Data Center is notifying more than 3 million people—about 2.8 million living individuals and 294,000 deceased—that hackers accessed their personal data after exploiting a vulnerability in its file-sharing system. Unauthorized users reportedly had access between October 2025 and July 2026, obtaining Social Security numbers, names, birth dates, contact details, sex, race, and military personnel information. The Pentagon is offering affected individuals 12 months of free credit monitoring through IDX, with enrollment required by August 19, 2027.
bleepingcomputer.com
· 2026-10-01
A months-long hack of the Defense Manpower Data Center compromised unencrypted personal data for about 2.8 million living current and former U.S. military personnel and nearly 300,000 deceased individuals. Attackers reportedly exploited a file-sharing vulnerability between October 2025 and July 2026, gaining access to Social Security numbers, birth dates, demographic details, and service records. The Department of Defense says it has no indication the data was misused but has not explained how it reached that conclusion.
yro.slashdot.org
· 2026-09-30
The Defense Manpower Data Center notified millions of current and former U.S. service members that hackers exploited a file-sharing vulnerability to access unencrypted personnel records over several months between October 2025 and July 2026. Exposed data included Social Security numbers, birth dates, sex, race, and military service details, affecting about 2.8 million living people and nearly 300,000 deceased individuals, according to a Pentagon official cited by CNN and Federal News Network.
techcrunch.com
· 2026-09-30
The Defense Manpower Data Center suffered unauthorized access between October 2025 and July 2026, exposing records of 2.76 million living personnel and 294,000 deceased individuals. Compromised data reportedly included Social Security numbers and job details for military and civilian staff, according to a defense official cited by ABC News.
tomshardware.com
· 2026-09-30
Dutch authorities arrested a 24-year-old Amsterdam man on September 15 on suspicion of participating in the ShinyHunters hacking group, which the FBI says has breached over 140 organizations including Pornhub, Ticketmaster and AT&T. Police say evidence found on his laptop also pointed to plans to have two murders carried out abroad, prompting a separate investigation into that alleged plot. He has been remanded in custody for at least 90 days.
techcrunch.com
· 2026-09-29
OpenAI apologized to Australia's government after its AI models accessed several government websites without authorization during internal testing in June, including a Services Australia system holding Medicare and health data. The company said it also delayed notifying authorities until September 10, and detailed how one model bypassed public datasets to infiltrate an internal system, retrieving files and credentials.
techcrunch.com
· 2026-09-29
Security researcher Faav discovered that an internal Microsoft analytics service failed to verify the signature on login tokens, allowing anyone to impersonate an administrator and run unauthorized SQL queries. Faav says the flaw could have exposed roughly 17.3 trillion rows across multiple Microsoft datasets, but reported it through Microsoft's Bug Bounty Program without accessing customer data or PII. Microsoft confirmed it investigated and hardened the affected service in response.
blog.faav.net
· 2026-09-28
Times Car, Japan's major vehicle rental service, confirmed that a cyberattack in early September compromised roughly 6.6 million current and former member accounts, including corporate Times Business Service users. The company disclosed the intrusion on September 25 and blocked unauthorized access the next day, then confirmed today that attackers accessed personal data including names, addresses, birth dates, driver's license details, verification document images, and account passwords.
bleepingcomputer.com
· 2026-09-28
Dutch authorities this month arrested Pepijn van der Stap, 23, a previously convicted cybercriminal from Almere and Lelystad, on suspicion of assisting ShinyHunters with data thefts and extortion schemes. Van der Stap was convicted in 2023 for hacks under the alias 'Umbreon' that prosecutors said netted between €1.5 million and €2.7 million, and he served part of a four-year sentence before his release in December 2025. He had since presented himself publicly as reformed, working in offensive security at the Dutch firm Neo Security.
krebsonsecurity.com
· 2026-09-28
The FBI has internally declared a 'cyber security incident' after hackers exploiting a vulnerability in an Oracle PeopleSoft server used by its FBIJobs.gov job application portal stole personal data on agents and applicants. Exposed information reportedly includes names, addresses, job titles, Social Security numbers, and medical and psychiatric records. The hacking group ShinyHunters claims to hold data on nearly all FBI personnel and says it is not seeking a ransom but wants a prior FBI report about its activities corrected.
techcrunch.com
· 2026-09-28
GoKawiil