Topic
Attacks that monetize stolen data through staged public release and escalating pressure rather than encryption-based ransom.
iRhythm, maker of the Zio patch, says attackers who social-engineered access to third-party-hosted apps took data on at least 360,000 patients. The records link patients' insurance numbers to their device serial numbers, enough detail for a caller to pass as the company.
Reality
Luna Moth's leaked vishing playbook, which has not been verified, coaches callers to keep victims calm while a second operator works their machine, Check Point reported. The method needs no new malware, only a phone call and a legitimate remote-support tool, so the defense sits at the help desk.
Reality
Extortionists sent ASOS app users an apparently genuine ASOS push alert on October 6 claiming they had fully compromised the retailer's Snowflake instance. The alert is the only access anyone outside ASOS has seen; the entry route and any data taken are unknown.
Perspective Coverage
11 publishersReality
Apparent hackers sent an extortion note through ASOS's app to UK customers, claiming to have "fully compromised" its Snowflake instance. ASOS has not confirmed a breach, so the only compromise anyone has seen is that outsiders could message its app users.
Perspective Coverage
15 publishersReality
Texas's attorney general puts the breach of Oracle Health's legacy Cerner systems at nearly 20 million people, according to Bloomberg. Oracle has not confirmed the figure, far above the counts in earlier state filings and patient notices.
Perspective Coverage
3 publishersReality
Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
13 publishersReality
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishersReality
Group-IB found the Telegram channel in ASOS's October 6 rogue push alert was opened that day by an account once used for gaming-item trading. Until data surfaces, the Snowflake claim is unproven and the abused messaging platform is the lead to work.
Reality
Hackers used the Asos app on Tuesday to send UK users an extortion demand claiming they had compromised the retailer's Snowflake instance. Because the demand went to shoppers, the attackers decided when Asos had to speak to customers, before it could say what data, if any, was taken.
Reality
DataSuckers demanded $400,000 from ATB, Ukraine's largest grocer, claiming records on 7.9 million customers that the company denies were compromised. The samples it posted on Telegram are the only public evidence against ATB's statement that its data is protected.
Reality
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishersReality
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
Perspective Coverage
9 publishersReality
Dutch police detained an alleged ShinyHunters leader on September 15, seven days before the group defaced the FBI's jobs website. The FBI says it is still chasing the rest of the group, so the vendor services and web portals it has used to get in remain the exposure to manage.
Perspective Coverage
3 publishersReality
Dodo Pizza confirmed hackers accessed customer names, addresses, birth dates and order details, while the DataSuckers group claims 68 million records. How many of its customers across 28 countries are affected rests, for now, on the attackers' word.
Reality
ShinyHunters says it will never publish the 2-3TB of FBI data it took, allegedly through the agency's online jobs board. The agents whose records were taken still have to plan as if the files are loose, because the pledge covers only publication.
Reality
Mandiant says ShinyHunters has planted web shells on dozens of Oracle PeopleSoft systems by URL-encoding one character to get past firewall rules. Employers that treated June's stopgap as the fix now have to patch and also look for any access the attackers left behind.
Reality
Kiteworks told customers to shut its file-transfer servers for nine hours this weekend after a federal warning. The company says its current release fixes every known flaw, so the outage guards against one it does not know about.
Perspective Coverage
3 publishersReality
Fortra researchers say the extortion crew likely read Dynamics 365 data straight out of portals where a table was exposed to the Anonymous Users web role.
Reality
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishersReality
Security · August 21, 2026 · Confirmed2 publishers
Security · August 25, 2026 · Confirmed5 publishers
Security · August 28, 2026 · Confirmed6 publishers
Security · August 28, 2026 · Confirmed9 publishers
Security · August 28, 2026 · Confirmed6 publishers
Security · September 7, 2026 · Confirmed3 publishers
Security · September 25, 2026 · One report1 publisher
Invest · September 17, 2026 · Confirmed3 publishers
Invest · September 19, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed14 publishers
Product · September 24, 2026 · One report1 publisher
Leadership · September 23, 2026 · Confirmed3 publishers
Product · September 23, 2026 · One report1 publisher
Leadership · September 22, 2026 · One report1 publisher
Security · September 19, 2026 · Confirmed6 publishers
Security · September 22, 2026 · One report1 publisher
Security · September 21, 2026 · One report1 publisher
Security · September 12, 2026 · Confirmed2 publishers
Security · September 8, 2026 · One report1 publisher
Security · August 25, 2026 · One report1 publisher