A Heights Finance breach exposed personal and financial data of over 1.2 million people after hackers compromised a third-party cloud platform. Heights Finance is a U.S. consumer finance company that provides personal loans and related lending services, mainly to customers who may have limited access to traditional bank credit. It is part of Heights Finance Holdings Co. Heights Finance Holdings is notifying more than 1.2 million people that on May 7, 2026, Heights Finance discovered unauthorized access to a third-party cloud platform storing customer data. The company launched an investigation with external cybersecurity experts and notified federal law enforcement. “On May 7, 2026, Heights discovered that an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data. This activity was limited to the cloud-based platform only—it did not affect any of our loan management systems or other computer systems or networks. We immediately activated our incident response protocols, brought in outside cybersecurity specialists to investigate, and reported the incident to federal law enforcement.” reads the notice of data breach. “We have since confirmed that the cloud-based platform is secure and that there is no ongoing security threat. Our operations were not impacted by this incident and have continued safely and securely.” Heights said its internal systems and operations were not affected, the platform has been secured, and there is no ongoing threat. The compromised customer information included contact details, financial and bank account data, government IDs and dates of birth. The affected data varies by person and may involve Heights Finance customers, loan applicants, people who inquired about its products, or former borrowers of Curo Management and related brands. Heights Finance is offering affected individuals 24 months of free credit monitoring and identity protection. The company said dark web monitoring has found no evidence that the stolen data has been published. No threat actor has claimed responsibility, and no known ransomware or extortion group has been linked to the breach so far. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Heights Finance)
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," ReliaQuest said in a report shared with BleepingComputer.
Researchers tested 31 million patterns to disrupt surveillance AI, with promising results but significant gaps between simulation and real-world use. The Kansas City-based cybersecurity researcher Bill Swearingen spent the past year doing something that sounds almost too simple to work: printing patterns, watching cameras fail to detect them, and repeating. TechCrunch reports that after roughly 31 million tests, he can now generate patterns on demand that block license plate readers and surveillance cameras from recognizing whatever the pattern covers, whether that’s a person or a vehicle. The project is called noRecognition, and the core idea isn’t stealth in the traditional sense. The camera still records everything just fine. What breaks is the detection layer sitting on top of the footage, the software that flags license plates, tracks faces, or spots “activity of interest” across thousands of hours of video. Swearingen’s patterns don’t hide you from the lens; they make the algorithm looking through that lens shrug and move on. Swearingen, co-founder of the SecKC meetup, said his project started for personal reasons. He became concerned about the growing number of surveillance cameras in his town and the possibility of being tracked while attending a protest. What started as a simple experiment later became a reinforcement learning system. He taught the model to create patterns, learn from failures and keep improving. Over time, it learned how to avoid detection by several camera systems. Every time a pattern failed and got detected, the system adjusted and tried again, eventually learning to defeat multiple detection algorithms simultaneously rather than just one at a time. The research dashboard behind the project, published at sandbox.norecognition.org, goes considerably deeper into the numbers than the headline claim suggests, and it’s refreshingly upfront about what’s proven versus what isn’t. The team states its overall objective plainly as “one pattern that defeats every detector,” and by their own account that goal remains only partially met. Their strongest validated result against a detector extracted directly from a real deployed surveillance camera sits at 61.7% non-detection across held-out test subjects, a solid number, but nowhere near total, and still a digital simulation rather than a real-world fabric test. That distinction matters more than it might seem. Most of the dashboard’s headline figures are explicitly labeled as digital, simulated results, meaning the pattern was tested against a virtual camera and printed ink model rather than an actual garment photographed by an actual camera in the field. The gap between “works in simulation” and “works when Donut Media wraps a real 2009 Toyota Yaris in it,” which is the physical test Swearingen ran live at DEF CON, is exactly the gap this kind of research has to close before anyone should treat it as a reliable, everyday privacy tool. “On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera.” reports TechCrunch. “We proved it was effective,” said Swearingen, though the wheels were a challenge. The video of the demo will be out in the next few weeks, said Donut Media.” That DEF CON demo is where things got concrete. Swearingen covered a car in one of his newest patterns and tested it against a Flock Safety camera, the kind widely deployed for automated license plate reading across the US. He said the test proved effective, though the vehicle’s wheels turned out to be a persistent weak point, curved surfaces apparently don’t cooperate with flat printed patterns the way a car door does. Source Tech Crunch – A photo of a 2009 Toyota Yaris at the Def Con conference in Las Vegas, covered in a pattern made by Bill Swearingen, as part of a test to see if it can defeat surveillance camera detection. Image Credits:Bill Swearingen / Donut Media Swearingen is not publishing his best patterns because he does not want camera makers to easily find and block them. Instead, he is using crowdfunding to develop and sell printed products such as T-shirts and hoodies, with vehicle wraps possibly coming later. It is still unclear whether the project will become a practical privacy tool for everyday users or remain mainly a DEF CON demonstration. Its real effectiveness will depend on how well the patterns work on real clothing, in different weather and camera conditions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Surveillance camera)
Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. As the File Explorer team explained in a Monday blog post, the changes focus on improving File Explorer speed, performance, and reliability and addressing customer-reported issues. The redesigned context menu experience also aims to make it faster, reduce clutter, and make it more customizable than ever before. At the bottom of the new right-click menu, Microsoft also added a "Customize menu" shortcut to the Settings page, where users can tweak the context menu to suit their preferences. "We've continued refining File Explorer based on that feedback, removing friction and improving the details that help make everyday tasks feel more natural and predictable. For example, file renames no longer get interrupted by background file synchronization, and case-only filename changes now appear immediately," Microsoft said.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. Task Host is a core Windows system component that allows DLL-based processes to run in the background and prevents data corruption by ensuring they close properly during shutdown. Tracked as CVE-2025-60710, this Windows privilege escalation security flaw was patched by Microsoft in November 2025 and stems from a link following weakness that affects Windows 11 and Windows Server 2025 devices. Following successful exploitation, local attackers with basic user permissions can gain SYSTEM privileges and take full control of unpatched devices. While it didn't share any details regarding ongoing attacks and Microsoft has yet to update its security advisory to confirm in-the-wild exploitation, CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and gave Federal Civilian Executive Branch (FCEB) agencies two weeks to secure their systems.
Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts. According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows -
A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research
A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. Starting July 31st, multiple posts from someone using the alias “TheHatman” advertised data dumps from major organizations, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels (IHG), and Kyndryl. In total, the threat actor claims to have 3.64 million data records, with the most recent breach posted on Sunday, containing an alleged 1.7 million employee records from McDonalds. “I’m selling McDonald’s Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials,” the threat actor says in the post.
Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. While CEVA's systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who submitted orders on the site. The company then shared this information with the logistics provider to fulfill and ship PokemonCenter.com orders. CEVA Logistics is a subsidiary of the CMA CGM Group, the world's third-largest shipping company. The logistics provider operates 1,000 warehouses, handled 15 million shipments last year, and reported $18.3 billion in revenue in 2025. The company recently suffered a cyberattack in which attackers breached its servers between July 29 and August 1, affecting multiple retailers in Europe.
The SANDCLOCK LiteLLM supply-chain attack exposed credentials across 2,038 repositories, affecting technology, finance, healthcare, retail and more. Resecurity (USA) estimated the most affected sectors by the “SANDCLOCK” backdoor, which was planted as a result of the code repository compromise. According to cybersecurity experts, LiteLLM / TeamPCP Supply-Chain Attack will have long-lasting consequences. By compromising a well-known component in AI applications, adversaries will multiply the blast radius—some of the victim organizations are still unaware of the backdoor and its impact. LiteLLM is a popular open-soure AI gateway and utility library that unifies API calls for over 100 large language model providers, such as OpenAI, Anthropic, Google Gemini, and local Ollama models. Such incidents involve substantial MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026 – creating a window of exposure lasting at least a few months. Over 2,500+ organizations and hundreds of thousands of CI/CD environments suffered full-credential exposure, compromising cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys (such as OpenAI and Anthropic). Resecurity has acquired the 150GB archive attributed to the LiteLLM supply-chain attack conducted by TeamPCP using the “SANDCLOCK” credential-stealer. Per published incident reporting — accompanying victim manifests enumerate 898 compromised GitHub owners (organisations/accounts) across 2,038 repositories. The affected owners include major global enterprises — among them Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84.51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID.me and 1inch. Top 10 the most impacted sectors (by victim organization profile): Technology / Software Banking / Finance / Insurance Healthcare / Pharma / Medtech Retail / E-Commerce Media / Gaming / Adtech Manufacturing / Industrial Professional Services Cybersecurity Crypto Government Resecurity enumerated 2,146 records by key name (values never inspected beyond structural masking). The composition is overwhelmingly GitHub CI-CD identity material, with a long tail of high-value cloud and registry credentials. Victim manifests (owners.txt, repos.txt) enumerate 898 distinct compromised GitHub owners across 2,038 repositories. The distribution is long-tailed: 631 owners have a single affected repo, while the most-affected owner (Cencosud-Cencommerce) has 64. Critically, the owner list includes major global enterprises and regulated organisations. Every organization affected by the LiteLLM incident should revoke or rotate GitHub App private keys, PATs, AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and signing passwords, and invalidate sessions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Confirm this action.
Leaving now will discard your changes.