Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. While CEVA's systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who submitted orders on the site. The company then shared this information with the logistics provider to fulfill and ship PokemonCenter.com orders. CEVA Logistics is a subsidiary of the CMA CGM Group, the world's third-largest shipping company. The logistics provider operates 1,000 warehouses, handled 15 million shipments last year, and reported $18.3 billion in revenue in 2025. The company recently suffered a cyberattack in which attackers breached its servers between July 29 and August 1, affecting multiple retailers in Europe.
SafePal says a breach exposed personal data of 39,798 customers, but not wallet credentials, private keys, seed phrases, or payment information. SafePal disclosed a data breach affecting about 39,798 customers after hackers exploited a vulnerability in its order-tracking plugin. The flaw exposed information linked to orders placed between March 2, 2025, and April 11, 2026, including names, addresses, email addresses, phone numbers and order details. “Recently, the team identified an authorization flaw in the order-tracking function for a plug-in associated with customer order information. Under certain conditions, the flaw allowed unauthorized access to another customer’s order information.” reads the notice published by the company. “We are extremely sorry to inform the community that order information for customers who placed orders between March 2, 2025 and April 11, 2026. Information including name, email address, shipping address, phone number, and purchase details, was accessed externally without authorization due to the flaw. The affected data involves approximately 39,798 customers.” SafePal is a Singapore-based company focused on cryptocurrency security. It develops hardware and software wallets that let users securely store and manage digital assets. Its products include hardware wallets, a mobile app and browser-based tools supporting multiple blockchains and cryptocurrencies. The disclosure came as a threat actor began advertising the stolen data on a cybercrime forum, claiming the same number of affected customers. SafePal confirmed the security breach incident, while warning users about the exposure of their personal and order-related information. The company said all affected customers were notified individually by email on August 16 and urged them to check their status. The exposed order data could enable more convincing phishing attempts, including fake support calls, emails, refund offers, firmware updates or malicious websites designed to steal additional information. SafePal stressed that seed phrases, private keys and wallet passwords were not exposed, so customers do not need to move their assets solely because of the breach. However, anyone who has shared a seed phrase or private key with an attacker should consider the wallet compromised, create a new one using a trusted device or official app, and immediately transfer the remaining funds. The crypto firm said the breach did not expose seed phrases, private keys, wallet passwords or other wallet credentials. Bank details, payment card numbers and government IDs were also not involved. The company pointed out it does not collect or store such information and found no evidence that the incident compromised access to customer wallets or funds. “However, if you have already shared or entered your seed phrase or private key in response to a suspicious message, website, phone call, or letter, treat that wallet as compromised.” continyes the notice. “Create a new wallet using a trusted SafePal device or official SafePal application, and move your remaining assets to the new wallet immediately. Lastly, contact SafePal through our official support channel.” SafePal said it has fixed the vulnerability and added further security measures, with an independent security firm reviewing the fix and order-processing systems. The company also reduced data retention to 90 days, contacted affected customers and logistics partners, and opened a dedicated support channel. The firm identified more than 30 fraudulent websites and phishing links and removed them. It will continue monitoring scams, investigating potential risks and sharing updates through its official channels. SafePal urges customers who suffered financial losses linked to the breach to contact the company, which is working with specialists to trace stolen on-chain assets. “For more FAQs and details, we will keep updating the dedicated webpage for this incident.” concludes the notice. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SafePal)
The SANDCLOCK LiteLLM supply-chain attack exposed credentials across 2,038 repositories, affecting technology, finance, healthcare, retail and more. Resecurity (USA) estimated the most affected sectors by the “SANDCLOCK” backdoor, which was planted as a result of the code repository compromise. According to cybersecurity experts, LiteLLM / TeamPCP Supply-Chain Attack will have long-lasting consequences. By compromising a well-known component in AI applications, adversaries will multiply the blast radius—some of the victim organizations are still unaware of the backdoor and its impact. LiteLLM is a popular open-soure AI gateway and utility library that unifies API calls for over 100 large language model providers, such as OpenAI, Anthropic, Google Gemini, and local Ollama models. Such incidents involve substantial MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026 – creating a window of exposure lasting at least a few months. Over 2,500+ organizations and hundreds of thousands of CI/CD environments suffered full-credential exposure, compromising cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys (such as OpenAI and Anthropic). Resecurity has acquired the 150GB archive attributed to the LiteLLM supply-chain attack conducted by TeamPCP using the “SANDCLOCK” credential-stealer. Per published incident reporting — accompanying victim manifests enumerate 898 compromised GitHub owners (organisations/accounts) across 2,038 repositories. The affected owners include major global enterprises — among them Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84.51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID.me and 1inch. Top 10 the most impacted sectors (by victim organization profile): Technology / Software Banking / Finance / Insurance Healthcare / Pharma / Medtech Retail / E-Commerce Media / Gaming / Adtech Manufacturing / Industrial Professional Services Cybersecurity Crypto Government Resecurity enumerated 2,146 records by key name (values never inspected beyond structural masking). The composition is overwhelmingly GitHub CI-CD identity material, with a long tail of high-value cloud and registry credentials. Victim manifests (owners.txt, repos.txt) enumerate 898 distinct compromised GitHub owners across 2,038 repositories. The distribution is long-tailed: 631 owners have a single affected repo, while the most-affected owner (Cencosud-Cencommerce) has 64. Critically, the owner list includes major global enterprises and regulated organisations. Every organization affected by the LiteLLM incident should revoke or rotate GitHub App private keys, PATs, AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and signing passwords, and invalidate sessions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests, and several other services. GitHub confirmed the outage at 9:40 AM EDT on August 17, 2026, when it said it was investigating reports of performance problems affecting some of its services. The problems quickly spread across several parts of GitHub that developers rely on, including API Requests, Actions, Webhooks, Issues, and Pull Requests. According to GitHub's status page, the company is seeing error rates of around 20% across its web experience and API traffic. GitHub says archive downloads and raw repository content downloads are experiencing error rates of approximately 50%. Likewise, authentication-related services are also having problems, with SAML and OIDC authentication, SCIM, and Team Sync affected by the incident.
Author: Len Noe, Solutions Architect, BeyondTrust Every mature Active Directory environment has a component that quietly holds more power than the people running it usually admit: the Certification Authority (CA). The thing your entire estate has agreed to believe. When it signs a certificate, every machine, service, and authentication flow downstream treats that signature as truth. That is an enormous amount of trust concentrated in one system, and most organizations manage it like a utility installed once and never thought about again. Certighost, tracked as CVE-2026-54121, is a reminder of what happens when that trust is misplaced. Researchers published a working proof-of-concept on July 24, 2026, demonstrating that a low-privileged Active Directory user (holding nothing more than a standard domain account) can coerce an Enterprise CA into issuing a valid authentication certificate for a Domain Controller, then use that certificate to become the Domain Controller.
The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. This incident was discovered after a threat actor using the "ZeroBytes" handle claimed the attack and listed a stolen database for sale on August 12 on the PwnForums hacking forum. "The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number," the French Finance Ministry said.
A seller claims 1.7M McDonald’s employee records were stolen from Azure. An 8,000-row sample appears genuine, but its age and full size remain unconfirmed. A seller on a data-trading forum posted an 8,000-row sample this week claiming it came from McDonald’s own Azure tenant, part of a supposed 1.7 million-record employee directory obtained using stolen credentials. Ransomnews’s technical breakdown found the sample holds up as genuine on every test that can be run against it. What it can’t confirm, notably, is exactly how old the data is or whether the full 1.7 million figure is real. “The listing is a straightforward private sale, posted at 4:08 AM forum time under the title “McDonalds 1.7M+ Azure Internal Employee Dump”. The seller, an account called TheHatman, writes that the data was “downloaded directly from Azure Tenant using compromised credentials” and that it contains “employee accounts, service accounts, and other tenant account records”. No price is named. Buyers are invited to make offers.” reads the report published by Ransomnews. “To evidence the claim, the seller attached a free 8,000-record sample. That file is the entire basis for what follows. Ransomnews analysed it offline. We did not access, probe or authenticate against any McDonald’s system, and we have redacted the sample’s download location from the screenshot below because it still resolves to real people’s contact details.” The file’s structure gives away exactly what it is before you even read a single row. Column names like FacsimileTelephoneNumber and PhysicalDeliveryOfficeName aren’t something anyone invents; they’re the exact property names Microsoft’s own PowerShell directory tools return when an administrator exports a user list from Entra ID, the modern name for Azure Active Directory. Whoever produced this file ran a standard Microsoft export command and saved the output, nothing more exotic than that. Every one of the 50 email domains found in the sample is genuinely McDonald’s-controlled, spanning corporate staff, restaurant crew accounts, franchisee logins, and vendor guest access across more than thirty countries. Three rows even carry the tenant’s own built-in Microsoft address, mcdonaldscorp.onmicrosoft.com, something that’s invisible from outside the organization and simply isn’t guessable or scrapeable. Add in 233 rows with the exact kind of garbled text encoding that happens when someone forgets to specify UTF-8 during an export, plus 85 job titles cut off at precisely 30 characters mid-word, the unmistakable fingerprint of a fixed-width HR system field bleeding into the directory, and you get a picture consistent with a real export rather than something assembled from public sources. “The file is broken in the ways real exports are broken. 233 rows contain mangled characters: Königswinter appears as “Königswinter”, München as “München”, and Ukrainian job titles are rendered as unreadable strings of Cyrillic run through the wrong character set. This is what happens when somebody runs Export-Csv without specifying UTF-8 encoding.” continues the report. “It’s a mistake, and it is not the kind of mistake anybody makes on purpose. A fabricated dataset doesn’t come with authentic encoding damage.” One detail actually reaches outside the file entirely. A restaurant entry for “556 Upton” on Upton By-Pass in Wirral, complete with phone number, matches a real, publicly listed McDonald’s location down to the digit. That’s a small anchor, but it’s the kind of anchor fabricated data doesn’t usually survive contact with. What the sample genuinely can’t settle is timing. There isn’t a single date field anywhere in the schema, no creation date, no last login, nothing to age a row by. “We can say with confidence that the data came out of McDonald’s directory. We cannot say from the file alone when it came out.” The best clue available is McDonald’s own market footprint: no Russian records at all, consistent with the company’s 2022 exit, and no Kazakh ones either, which points to sometime in 2023 or later, a wide window rather than a firm date. The 1.7 million headline number also isn’t something 8,000 rows can verify. That sample is under half a percent of the claim, and while nothing in it looks implausible given McDonald’s global workforce size, plausible isn’t the same thing as confirmed. A seller running a volume trade across multiple companies has every incentive to round the number up in the listing title. This McDonald’s post wasn’t an isolated event either. The same account, going by TheHatman, posted nine listings in total over sixteen days, claiming roughly 3.6 million records combined across McDonald’s, Vodafone, Gap, two hotel chains, and four major IT outsourcing firms including Kyndryl and Tata Consultancy Services. Every listing uses an identical 19-column schema and nearly identical wording, the kind of consistency you get from one person running the same export script against whatever tenant they currently hold a working login for, not from someone fabricating nine separate datasets by hand. That pattern points toward something fairly mundane and fairly common: infostealer malware harvesting saved credentials at scale, feeding a resale market that lets one operator walk into tenant after tenant using logins nobody bothered to protect with multi-factor authentication. Reading an entire company directory doesn’t require a sophisticated intrusion; it requires one working account in a tenant that hasn’t restricted user enumeration, which is Entra ID’s default setting unless an administrator has explicitly locked it down. For anyone at McDonald’s or one of the other eight listed companies, the real risk here isn’t account takeover, since there are no passwords or hashes in the sample at all. It’s social engineering: full names, job titles, direct phone numbers, and internal email formats are more than enough to make a fake helpdesk call or a fraudulent invoice sound completely legitimate. Treat unsolicited contact that already knows your role and your location with more suspicion than usual, because that’s precisely the kind of detail this file was built to hand someone. “For individuals named in the data, there is no action that removes the exposure.” concludes the report.”The realistic response is scepticism about unsolicited contact that arrives already knowing your role and your store, and a refusal to act on instructions that arrive by phone or email without out-of-band confirmation.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, McDonald’s)
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Confirm this action.
Leaving now will discard your changes.