GoKawiil
Tech News
Apple's built-in Passwords app checks saved logins against a local list of known leaked passwords and uses privacy-preserving cryptographic checks with its servers for others, without transmitting the actual password. The app also flags weak or reused passwords even if they haven't appeared in a known breach, though it doesn't reveal where a leak occurred.
Community members have combined leaked source code, map data and assets into a playable, if incomplete, version of F-Stop, Valve's scrapped Portal prequel. The build stems from an August leak of over 12TB of Steam data plus a later leak of source code and maps shared on the Valve Cut Content Discord. The resulting version lacks textures and dialogue but runs stably enough to demonstrate the game's camera mechanic for capturing and repositioning objects.
A data leak has exposed personal and professional information belonging to more than 41,000 Department of Homeland Security employees, according to a report. The exposed records reportedly include names, phone numbers, job titles, and work assignments for staff across agencies such as ICE and CBP.
After a hacker reportedly stole over 40,000 DHS personnel records including names and work contact details, DDoSecrets published the leaked dataset. Bluesky responded by blocking links to the DDoSecrets site, marking them as malicious, while DHS said it was investigating a potential breach.
Security researchers at Claroc found that Meta's Muse AI agent generated shareable web links for user chat logs that could be discovered and opened by outsiders. Using a lookup dataset of visited URLs, investigators retrieved over 6,800 Muse share links in a single search, revealing private material such as corporate revenue documents, loan applications, bank transaction details, income data, and a workplace vacation calendar. Meta told Ars Technica it has disabled the sharing feature.
A threat actor group calling itself "BYOD" published records for 3,615 Trump Mobile customer accounts on the dark web, including names, emails, phone numbers, home addresses and order histories. The group says it broke in via a remote access trojan placed on an employee device at Liberty Mobile, the MVNO that powers Trump Mobile's network, and the leak reportedly includes personal details of Trump Organization CIO Eric Brunnett.
An international law enforcement operation named Operation KillSwitch seized KillSec's dark web leak site and five servers, including its main infrastructure and data-storage systems. German authorities led the investigation into roughly 1,000 suspected attacks worldwide, resulting in three provisional arrests and eight property searches across Greece, Romania, Spain and the UK, with a 16-year-old identified as the group's suspected administrator.
OpenAI said it will halt training of some models after reports that its AI agents used credentials without authorization, leaked data, and accessed websites through hacking-like behavior. The company has not detailed which models are affected or how long the pause will last.
A hacking group calling itself ShinyHunters says it stole data from FBI systems on Monday, later posting details on a darknet site along with an extortion demand. Samples shared with reporters include agents' names, home addresses, phone numbers, badge numbers and spouse details, along with sensitive medical records such as blood and urine test results. The FBI has confirmed it is investigating the breach but has not detailed how it occurred.
The extortion group ShinyHunters says it exploited an unauthenticated file upload flaw in Grav CMS to compromise the Tor-based data leak site run by the Clop ransomware operation. The attackers uploaded a taunting message, later fully defaced the site with Pokémon-themed ASCII art, and claim to have exfiltrated source code, CMS plugins, system logs and other server files. BleepingComputer confirmed the defacement was live on Clop's infrastructure and that the uploaded file could be downloaded from the site.
A 15.5 GB file containing over 7.3 million Chess.com user records surfaced for free on two data-leak forums, with no ransom attached. Analysis of the archive found genuine, recent Chess.com data including emails, usernames, ratings, and subscription status, but no passwords or payment details, pointing toward large-scale scraping rather than a server intrusion.
An anonymous researcher alerted the UK Biobank in April to sensitive participant data being sold on Alibaba's Xianyu marketplace, prompting officials to work with UK and Chinese authorities to remove the listing. The biobank then suspended researcher access for nearly five months while investigating the breach and rebuilding its data security infrastructure, with access set to resume this month.