grep -rl "data-breach" ./articles
Revolut handed passports, verification selfies and full transaction histories for a limited number of customers to someone writing from a genuine government agency email domain. SPF, DKIM and DMARC all passed, correctly. Those checks confirm which domain sent a message. They say nothing about whether the sender has any right to ask.
McKesson has confirmed a breach involving third-party applications. ShinyHunters claims a terabyte and 284 million records including Social Security numbers and medical histories, and demanded $55.236 million. The group has also clarified that the figure counts records, not individuals. Nobody knows how many people are affected, including them.
A seller calling himself ZeroBytes listed DGFiP data on 12 August. The French finance ministry says 678,000 individuals and professionals had data extracted, that a property-registry platform exposed around two million more, and that of those only 252,149 were actually stolen. No passwords or online accounts were touched — which matters less than it sounds.
Hudson Rock reported on 16 August that a seller calling himself TheHatman is offering Entra directory exports from McDonald's, TCS, Vodafone, HCL and five others. TCS says it found no credible evidence and the data is at least four years old. Gap says the same. Nobody has independently authenticated any of it — and the records would still be useful to an attacker if every word of the denials is true.
The viral version says a hacker exposed 2 million stolen songs. The number is one line item from one of ten sources, it is ten times smaller than what Suno told a court in 2024, and the labels had the real figure in discovery two months earlier. Underneath it is a breach Suno described as involving no sensitive personal information.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.
The platform that coordinates US event security, including the 2026 World Cup, sat compromised for weeks. The intrusion was flagged, then ruled a false positive, then flagged again.