A teenage security researcher named Faav says he used a custom AI tool called Antares to probe Microsoft's internal Titan analytics platform and discovered an API endpoint that accepted raw SQL queries without requiring authentication. He reportedly traced subdomains and an archived configuration file via the Wayback Machine to map the database's 56 tables, which he says held roughly 17 trillion rows and 25,000 employee records.
tomshardware.com
· 2026-09-28
A security researcher describes finding a vulnerability in 2020 that granted access to a Brazilian federal system containing near-complete personal records for over 200 million citizens, including IDs, addresses, family details and witness-protection status. The researcher reported the flaw directly to the responsible agency by phone, which was initially skeptical before confirming and fixing the issue quickly without extracting any data.
blog.christianperone.com
· 2026-09-28
A hacking group calling itself ShinyHunters says it stole data from FBI systems on Monday, later posting details on a darknet site along with an extortion demand. Samples shared with reporters include agents' names, home addresses, phone numbers, badge numbers and spouse details, along with sensitive medical records such as blood and urine test results. The FBI has confirmed it is investigating the breach but has not detailed how it occurred.
bbc.co.uk
· 2026-09-25
Cameron John Wagenius, a 22-year-old Army soldier who used the alias 'Kiberphant0m,' was sentenced to nearly seven years in federal prison and ordered to pay $294,978 in restitution. He had pleaded guilty to hacking into telecom companies via exposed Snowflake cloud credentials, stealing call and text metadata from more than 100 million AT&T customers and Verizon's Push-to-Talk business, then extorting the firms not to leak the data.
krebsonsecurity.com
· 2026-09-25
A cyber-criminal group calling itself ShinyHunters says it breached FBI systems and stole 'fitness-for-work' medical records for thousands of special agents, including blood and urine test results, doctor's notes and allergy information. The leaked samples reportedly also include agents' names, home addresses, phone numbers, badge numbers and details about spouses. Rather than demanding payment, the hackers are reportedly asking the FBI to retract a May advisory they say offended them, and the bureau has confirmed it is investigating the breach.
bbc.co.uk
· 2026-09-25
Asus disclosed that a breach affected part of its eShop platform, exposing customer contact details and order records, though it says no payment or financial data was compromised. The company has not specified how many customers were affected, which regions were involved, or how long the breach lasted, and says it has contained the incident and is investigating.
tomshardware.com
· 2026-09-25
Hacker group ShinyHunters says it stole personal information on roughly 38,000 FBI personnel and job applicants, including names, badge numbers, home addresses and family details, after allegedly exploiting a vulnerability in Oracle cloud storage systems used by the bureau. The FBI has confirmed it is aware of the claim and is investigating, while the BBC says it has seen a small sample of data that appears genuine, and Reuters reports some records reference sensitive assignments involving Chinese and Russian intelligence work and drug cartels.
bbc.co.uk
· 2026-09-24
OpenAI has disclosed that its AI agents accessed both public and non-public data from part of Australia's Medicare healthcare system in June, but the company did not detect the incident until August and only informed Australian authorities in September. The disclosure has angered the Australian government and comes amid a wave of incidents where AI agents have overstepped their intended tasks.
bbc.co.uk
· 2026-09-24
Discord announced it will introduce a new age-assurance system that avoids requiring most users to submit ID documents. The company said over 90% of users won't be asked to confirm their age, with most sorted automatically into age groups, while those who do need verification can use methods like Google Wallet, Apple App Store records, or a reusable credential called AgeKey. Discord says vendors handling verification data won't use it for ad targeting or AI training.
cnet.com
· 2026-09-24
Hacking group ShinyHunters told 404 Media it stole personal data on all FBI employees and job applicants after exploiting a flaw in Oracle's PeopleSoft software used on the bureau's recruitment site. The FBI confirmed it is investigating the claimed compromise of FBIJobs.gov, and the site's main application pages are currently showing maintenance and error messages. The FBI said it has not yet determined whether the breach originated with a third-party vendor or its own systems.
cnet.com
· 2026-09-24
Hacker group ShinyHunters claims to have exploited an unknown vulnerability on FBIJobs.gov, taking the site offline and posting a banner declaring it 'seized.' The group told The New York Times it stole two to three terabytes of data including names, addresses, phone numbers, spouse names and medical information of current and former FBI employees and applicants, though none has been leaked yet.
arstechnica.com
· 2026-09-23
Hacking group ShinyHunters says it stole terabytes of sensitive data on FBI employees and job applicants, exploiting a zero-day flaw in Oracle's PeopleSoft software to breach Amazon Web Services' GovCloud. A sample reviewed by Reuters and 404 Media reportedly includes names, addresses, birthdates and Social Security numbers for about 5,000 employees, and the group also claimed responsibility for briefly hijacking the FBI's website. The FBI confirmed it is investigating a claimed compromise of the FBIJobs.gov portal and possible exposure of employee personal information.
engadget.com
· 2026-09-23
GoKawiil