1,000 Data Breaches Later, the Disclosure Lag is Worse Than Ever
01 June 2026 Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number,...
have
Police arrest man following hack of Ajax football club
Dutch police have arrested a 35-year-old man suspected of hacking into the computer systems of Amsterdam football giant Ajax, after...
MyPillow listed on ransomware gang’s leak site, but denies it has been breached
The Play ransomware gang is claiming to have stolen data from US pillow manufacturer MyPillow, making off with private and...
OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack
Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that's targeting developers using OpenAI Codex through a...
Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices
Ravie LakshmananMay 31, 2026IoT Security / Network Security Dutch authorities have announced the takedown of a botnet that enslaved millions...
ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
Cybersecurity researchers have disclosed details of a vulnerability in OpenAI ChatGPT that leverages the artificial intelligence (AI) assistant's implicit trust...
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C# software development kit for Sicoob, one of...
Chilling Effects
Chilling Effects Younger Americans have soured on the second Donald Trump presidency, but they are not protesting it. Despite an...
Malicious npm Package Stole Files From Claude AI User Directory via GitHub
Ravie LakshmananMay 27, 2026Threat Intelligence / Supply Chain Attack Cybersecurity researchers have discovered a new malicious package on the npm...
Gitea Vulnerability Exposes Private Container Images without Authentication
Ravie LakshmananMay 27, 2026Vulnerability / Software Security Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform...
Welcoming the Bahamian Government to Have I Been Pwned
14 May 2026 Today, we welcome the 44th government onboarded to Have I Been Pwned’s free gov service: The Bahamas....
Welcoming the Bangladesh Government to Have I Been Pwned
12 May 2026 Today, we welcome the 43rd government onboarded to Have I Been Pwned's free gov service, Bangladesh. The...
Welcoming the Costa Rican Government to Have I Been Pwned
11 May 2026 Today, we welcome the 42nd government onboarded to Have I Been Pwned’s free gov service: Costa Rica.The...
Defenders fall behind, as AI rewrites the rules of a data breach
For almost 20 years, stolen credentials have been the most common route for attackers into organizations, according to the Verizon...
Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms
Ravie LakshmananMay 25, 2026Endpoint Security / Threat Intelligence Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that...
