Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. Frontline Education is an edtech company that provides administration and workforce management software and services used by school districts. Last night, a reader shared a data breach notification with BleepingComputer that Frontline sent to an impacted school district, stating that attackers breached its environment through a vulnerability in a third-party application. "On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment," the notification letter reads.
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems. The stolen data varies by person and includes Social Security numbers (SSNs), names, dates of birth, contact information, sex, race, and military personnel information. Pentagon officials told Federal News Network that the data breach affects more than 3 million people, including nearly 2.8 million living individuals and 294,000 "deceased individuals."
Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months. The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach. According to the agency, unauthorized users accessed one of its file-sharing servers for roughly nine months. The breach affects 2.76 million living people and 294,000 deceased individuals, according to a Department of War official. DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans. “The Pentagon has confirmed that the breach affects 2.76 million “living individuals,” a category that potentially includes current and former defense personnel or their dependents, and 294,000 “deceased individuals,” a Defense Department official told CNN on Monday, three days after this story was published.” CNN states. The Defense Manpower Data Center (DMDC) has notified individuals that a security vulnerability exposed personal information stored on one of its file-sharing systems. The vulnerability was discovered on July 16, 2026, and the US office quickly patched the system and restored it. An investigation found that a small number of unauthorized users had accessed files between October 2025 and the discovery date. The files contained unencrypted personal information. “On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored.” reads a data breach notification letter sent to impacted individuals. “Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII. The types of PII involved vary by individual; however, in your case, they include social security number (SSN) and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information (such as occupational specialty).” US Defense Manpower Data Center (DMDC) notice of data breach (Source Reddit) The data exposed varies by person, but in this case included Social Security numbers (SSNs) and at least one other identifier, such as name, date of birth, contact details, sex, race or military personnel information, including occupational specialty. After discovering the vulnerability, the Defense Manpower Data Center (DMDC) launched its privacy and cybersecurity incident response process in line with U.S. government policies and guidelines. The agency says it is assessing the affected system and taking steps to improve its security. DMDC is also offering 12 months of free credit monitoring through IDX, a company specializing in data breach and recovery services. Individuals affected by the breach are encouraged to contact IDX with any questions and enroll in the service. Enrollment is available through the dedicated IDX website using the enrollment code provided in the notification. The deadline to enroll is August 19, 2027. The credit monitoring is intended to help affected individuals identify potential misuse of their personal information following the breach. At this time, no known cybercrime group claimed responsibilty for the attack. DMDC says it launched privacy and cybersecurity incident response actions after finding the vulnerability. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, US Defense Manpower Data Center)
Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26. At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today. The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program. According to the update, exposed information includes the following data: The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details.
Nearly 400,000 DC Medicaid and Healthcare Alliance beneficiaries may have had personal data exposed through reports published on a public website. The District of Columbia Department of Health Care Finance is notifying nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries that their personal information may have been exposed. The incident affects people who enrolled between 2023 and 2026. A cyberattack did not cause the breach. DHCF reported the breach to the US Department of Health and Human Services, stating that 399,086 people were affected. In July, DHCF discovered that two reports published on its website contained hidden personal information that could be accessed by unauthorized individuals. The exposed data included Medicaid IDs and other beneficiary information. “On July 21, 2026, DHCF learned that two reports on DHCF’s website contained hidden personal information that could be accessed by people who did not have permission to view it. These reports were intended to display only summary information about groups of people, such as enrollment counts and other statistics, and did not show anyone’s personal details on the screen.” reads the incident notice published by DHCF. “However, underlying personal information that supported these reports may have been reachable by unauthorized users between 2023 and July 2026.” DHCF removed the affected reports after discovering the issue, launched a review and began strengthening its internal processes. Exposed data may have included Medicaid IDs, dates of birth, provider names, race, gender, ward and ethnicity, but not names, Social Security numbers or financial information. DHCF said the risk of misuse is lower because the exposed information did not include Social Security numbers or financial account details. “Because the information that could have been reached did not include Social Security numbers or financial account information, it is less likely that the information connected to you, your child, or your family member will be used in the wrong way,” reads the data breach otification letter. The agency said it has no evidence the exposed data was accessed or misused, but urged victims to remain alert for identity theft and fraud. DHCF removed the reports, launched an internal investigation and conducted system checks after discovering the exposure. “DHCF has no reason to believe anyone looked at or used any of this information in the wrong way, but it is always advisable to remain vigilant against the potential for identity theft and fraud and to monitor your accounts and credit reports for any suspicious activity.” states DC Healthcare Alliance. Under U.S. law, impacted users can get one free credit report each year from Equifax, Experian and TransUnion. They can check their reports regularly for suspicious activity or signs of identity theft. They can request them through AnnualCreditReport.com or by phone. Users can also stagger requests to check one report every four months. Users can also place a free one-year fraud alert on their credit file. It asks lenders to verify your identity before opening new accounts or changing existing ones. Contacting any one of the three credit bureaus will automatically notify the other two. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of human-written ones. Most of the fastest-growing categories of leaked credentials are now connected to AI
The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency. "We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark
A Gyazo breach exposed 23 million user records after attackers exploited a vulnerability in Helpfeel’s image upload server. Japanese software company Helpfeel is notifying Gyazo users about a data breach that compromised 23 million user records. Attackers gained unauthorized access by exploiting a vulnerability in the service’s image upload server. “We have confirmed that approximately 23.62 million records containing data related to Gyazo users were disclosed without authorization.” notice of data breach. Gyazo is a popular cross-platform tool for capturing screenshots, GIFs and short screen recordings and instantly sharing them through links. The incident highlights the risks of vulnerabilities in systems that handle and store user-generated content. Helpfeel said this week that it recently discovered unauthorized access to its Gyazo servers. The threat actor exploited a vulnerability in the image upload server on September 11 and was able to run malicious commands. The attacker was locked out the following day, but had already accessed a database containing about 23.6 million user records. The stolen data includes names, email addresses, password hashes, user and device IDs, X integration tokens, profile details, usage statistics and billing information. Helpfeel said payment card data was not affected. “Helpfeel Inc. (Head Office: Kyoto, Japan; Representative Director and CEO: Isshu Rakusai; hereinafter “Helpfeel”) has confirmed that Gyazo, our image-sharing service, was subject to unauthorized access by a third party, resulting in the unauthorized disclosure of user information and certain metadata associated with uploaded images.” continues the notice of data breach. “We have blocked all access routes used in the incident and have completed remediation of the vulnerability that was exploited. We continue to prioritize measures to prevent further harm while investigating the scope and impact of the incident.” Helpfeel confirmed that exposed data may include names or nicknames, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile information, language preferences, registration and last login dates and times, subscription plans, billing status, and usage statistics. The affected records also include anonymous accounts without registered email addresses. Helpfeel said no payment information, including credit card numbers, was exposed. The investigation is still ongoing, so further details may emerge. The company also confirmed that about 490 million image metadata records were exposed, mainly linked to images uploaded in or before January 2019. Metadata from another 2.4 million images was also accessed through specific searches. The exposed information may include image IDs, upload IP addresses, User-Agent data, EXIF location information, OCR text, image titles, source URLs, other metadata and hashed passphrases for private images. Some of this information could potentially be used to reconstruct Gyazo image URLs and access images without authorization. The company temporarily disabled access to some images and confirmed that a list of private images was obtained. It has not confirmed that image files themselves were stolen, but cannot rule out that some private images were viewed. No unauthorized disclosure has been confirmed in Helpfeel or Cosense systems. “We plan to send notifications regarding this incident to the registered email addresses of Gyazo users who may have been affected. We are currently working to identify users whose information was disclosed without authorization and will determine which users to notify based on the progress of our investigation.” continues the notice. “For users we are unable to reach by email, such as those with anonymous accounts without a registered email address or similar contact information, we plan to provide notifications through the Gyazo web interface.” The investigation is still ongoing, and the company will publish updates if further information emerges. The company is asking all Gyazo users to change their passwords, especially if the same or a similar password is used on other services. Users should also stay alert for suspicious emails, messages or other communications that may attempt to exploit the breach. These precautions are intended to reduce the risk of further account compromise or phishing attacks. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Data Breach)
The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a known large language model (LLM). The organization reporting the incident said that the AI agent searched for flaws, logged into their systems, and then probed apps for additional security issues. In the final stages of the attack, the agent modified personal data and accessed financial documents. Although the Spanish agency has yet to investigate the incident and verify the information, the AEPD says the notification shows AI-related data breaches are no longer merely theoretical. “The attacking agent began searching for vulnerabilities in generic files and successfully logged in,” describes AEPD. “Once it gained access to the system, it began autonomously searching for vulnerabilities in the application. After finding them, it was able to modify personal data and access invoices.”
Confirm this action.
Leaving now will discard your changes.