FBI said a contractor's failure to apply a security patch on a third-party platform let ShinyHunters steal personal details of thousands of bureau employees. The patch had already been issued, so the breach came down to one missed update on a platform the Bureau did not manage itself.
Perspective Coverage
11 publishers
- Builder
- Builder 24%
- Operator
- Operator 60%
- Investor
- Investor 16%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+20
- Incentives65
- Confidence66
Osaka Metropolitan University cancelled classes after a suspected ransomware attack stopped about 500 servers, Japanese media reported. Records on at least 130,000 current and former students, faculty and others may be exposed, though the university has not confirmed any theft.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
Technical University of Denmark says a login with compromised credentials to its IAM system may have exposed data on up to 200,000 people. The records reach back to 2003, and active users' entries include CPR national ID numbers that DTU warns can be used for identity fraud.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher ANSSI traces the DGFIP tax breach to stolen passwords on password-only staff portals
ANSSI says an attacker used dozens of stolen DGFIP staff passwords on password-only portals to take data on over 600,000 French taxpayers and businesses. For other operators, the fixes are login checks on devices they do not manage and a password reset that also ends live sessions.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence55
Metabase published a critical fix on August 6, Mathspace's escalation process never surfaced it, and by the time the update went in on August 29 an intruder had been inside the reporting instance for 19 days and had already exported 1,079,819 records.
Perspective Coverage
4 publishers
- Builder
- Builder 36%
- Operator
- Operator 53%
- Investor
- Investor 11%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+5
- Incentives45
- Confidence74
Japan's Digital Agency says an intruder used a medium-severity VPN bug that already had a patch, then worked through a maintenance account on a file platform shared by 23 ministries. Disclosure came 78 days after detection.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 70%
- Investor
- Investor 7%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence70
Latvian police say one man with an automated scanner and an anonymous mailbox turned two mid-sized company websites into an extortion business. Investigators linked the two cases on similarities in the methods used.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+8
- Incentives45
- Confidence72
Forged government requests pulled passport data out of Revolut for five months
A hacker used a government employee's infostealer-compromised mailbox to send fraudulent requests to Revolut's Lithuanian subsidiary for about five months, and roughly 680 customers' passports and financial data went out.
Reality
- Evidence45
- Adoption55
- Hype gap+20
- Incentives65
- Confidence50
Nexus advertises 153 million driver's license scans with infrared and UV captures
KrebsOnSecurity traced the records toward New Orleans ID-verification vendor IDScan after nine people matched timestamps on their stolen scans to the day they handed a license over. The FBI's New Orleans field office says it is looking into the incident.
Reality
- Evidence58
- Adoption60
- Hype gap+14
- Incentives70
- Confidence54
Krebs traced 153 million leaked driver's licence scans to a single Louisiana ID verifier
IDScan.net sells the compliance layer behind age and ID checks at thousands of dispensaries and at Hertz, and Techdirt notes its trust page stayed up for days after the dark web store opened. The FBI is now asking where the images came from.
Reality
- Evidence44
- Adoption66
- Hype gap+26
- Incentives71
- Confidence52