Data Breaches

Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

Hackers have stolen the personal information of current and former So-net and Plala internet subscribers in Japan, Sony Network Communications announced on October 27. Nearly 2.6 million records were impacted. The attackers broke into the So-net member database on October 19. The company first spotted the intrusion on October 23, then took the targeted server offline and cut off traffic coming from the attackers. By the following day, its investigators had confirmed that personal data…

Read More

11 Million Impacted by Capcom Data Breach

Japanese gaming company Capcom has disclosed a data breach impacting 11 million email addresses and the personal information of a small number of individuals. The incident, the gaming giant says, was discovered on October 19 and involved unauthorized access to CAPCOM ID, its shared service used for accessing online services and for playing online games. During the intrusion, the hackers stole the email addresses of 11,774,247 people, along with account data such as creation date,…

Read More

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. Hackers aligned with ShinyHunters have claimed credit for dozens of…

Read More

Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts

Southern Company is notifying roughly 400,000 customers that their utility account information was accessed by an unauthorized third party through its online customer portal. The Atlanta-based energy holding company serves more than 9 million customers through electric utilities in three states and natural gas distribution businesses in four. Its electric subsidiaries are Georgia Power, Alabama Power and Mississippi Power. Roughly 300,000 of the affected accounts belong to Georgia Power customers. According to Southern Company, the…

Read More

ShinyHunters Extorted Boeing Spin-off Prior to Arrests

A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “Rey,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by…

Read More

Telus Warns Customers of Account Breaches

Telus, one of Canada’s largest telecom providers, is notifying some customers that their accounts have been breached and their personal information has been accessed. In data breach notifications sent to customers whose consumer telecom accounts were affected, Telus said the intrusions occurred between February 2025 and June 2026.  According to the company, the attacker used compromised credentials to access Telus accounts and the information they store, including names, account numbers, phone numbers, billing addresses, email…

Read More

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

Data allegedly stolen from the Manchester Airports Group (MAG) and leaked online this week includes the email addresses and phone numbers of 8.8 million people. MAG disclosed the incident last week, warning that hackers had breached its systems, stealing car park, lounge, and Fast Track booking data, along with in-airport Wi-Fi sign-ups at the Manchester, London Stansted, and East Midlands airports. The airport operator disclosed that hackers had exfiltrated email addresses, phone numbers, vehicle registrations,…

Read More

FBI Probes Service Selling 153M+ Drivers Licenses

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau…

Read More

Hasbro Data Breach Exposed Employee Personal Information

Toy and game giant Hasbro is notifying employees that their personal information may have been compromised in a data breach. The notifications sent to affected individuals contain little detail, but they indicate that the exposed information, which varies by individual, may include names, email addresses, postal addresses, phone numbers, national ID numbers, and financial information.  The information comes from notification letters that Hasbro submitted to the Massachusetts Attorney General’s Office.  It’s unclear how many individuals…

Read More

ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited

Cybersecurity firm ReliaQuest has confirmed being targeted by hackers affiliated with the notorious ShinyHunters group, but claims the impact of the attack was limited. ReliaQuest revealed on August 17 in a post on X that it had been tracking a widespread ShinyHunters phishing campaign involving domains with the ‘company.claims’ URL pattern.  The company also warned that the hacker gang has been expanding its social engineering tactics to include legal team impersonation alongside IT and help…

Read More