Crypto Scandals, Insider Crimes & Global Cyber Threats.

A total of 28 breach events were found and analysed resulting in 13,014,568 exposed accounts containing a total of 34 different data types of personal datum. The breaches found publicly and freely available included ACC Limited, Los Angeles Unified School District, Rhithm, Tracelo and Quantum Information Port (QIP). Sign in to view the full library of breach events which includes, where available, reference articles relating to each breach.

Data Breach Impact

Affected parties face heightened risks of identity theft, financial fraud, and reputational damage due to the wide variety of sensitive information compromised. The inclusion of entities such as ACC Limited, Los Angeles Unified School District, and others indicates a broad spectrum of sectors being targeted, suggesting systemic vulnerabilities. For organisations, this highlights the urgent need to strengthen data protection measures and response protocols to mitigate legal, operational, and trust-related consequences.

Cyber Spotlight

A former DigitalMint employee, a company specialising in ransomware negotiations and crypto facilitation, is under criminal investigation by the U.S. Department of Justice for allegedly collaborating with ransomware gangs for personal profit.
- DigitalMint, based in Chicago, terminated the individual as soon as the probe was announced.
- The firm has negotiated over 2,000 ransomware cases since 2017.
- Industry insiders have long speculated that incident response companies lack transparency and may even inflate demands to profit from larger cryptocurrency payouts.

The incident raises difficult questions: when you normalise negotiating with criminals, where do the ethics end and exploitation begin?

Authorities in the United Arab Emirates have arrested the founder of WhiteRock Finance, a decentralised platform aiming to tokenise real-world financial assets.
- The arrest is tied to the Zkasino rug pull, a now-defunct crypto gambling protocol accused of vanishing with $30 million in investor funds.
- WhiteRock and Zkasino shared infrastructure and founders, as identified by blockchain sleuth ZachXBT, who flagged the connections to UAE law enforcement.
- Investors were promised airdrops and staking rewards, which never materialised.

ZachXBT continues to act as a thorn in the side of crypto scammers, but his investigative reports may make him a high-value target.

New insights have surfaced about IntelBroker, one of the most prolific and dangerous threat actors of the past three years:
- He began his digital mischief in the UK with swatting and bomb threats before being raided by the National Crime Agency (NCA).
- Attempted reform followed: his criminal record was scrubbed, and he was even placed in a cybersecurity trainee program.
- That redemption arc was short-lived. He re-emerged as IntelBroker, responsible for breaching US federal agencies, defense contractors, and critical infrastructure, causing over $25 million in damage.
- The U.S. is now seeking extradition, and he faces 20+ years in federal prison.

This is one of the clearest cases of a second chance violently misused, and the justice system is coming full circle.

Vulnerability Chat

France's cybersecurity agency has disclosed a sweeping cyber campaign that targeted a range of sectors across the country, including government, telecom, media, finance, and transport. Codenamed "Houken," the campaign is attributed to a Chinese hacking group that exploited several zero-day vulnerabilities in Ivanti Cloud Services Appliance (CSA) devices to breach these entities.

Meanwhile, researchers at Stratascale’s Cyber Research Unit (CRU) have uncovered a long-hidden vulnerability in the widely used Sudo utility, a core part of Unix and Linux systems. Shockingly, this flaw has gone unnoticed for over 12 years, potentially leaving millions of systems open to privilege escalation attacks.

Andrew Howe has reported a vulnerability in ModSecurity, which could be exploited to launch denial-of-service (DoS) attacks. The issue lies in how the software parses empty XML elements. Security teams are being urged to disable the SecParseXmlIntoArgs feature immediately or upgrade to the patched version 2.9.11 once it’s available.

Despite widespread reliance on Secure Boot, full-disk encryption, and bootloader passwords, new findings suggest attackers can still circumvent these defences. A vulnerability in the Initial RAM Filesystem debug shell, an area often missed in system hardening guides, can be exploited, according to a report by Insinuator.

A newly identified flaw in the openid-connect plugin of Apache APISIX, disclosed by JunXu Chen and credited to researcher Tiernan Messmer, also made headlines. The open-source API gateway was found to lack proper issuer validation. The Apache APISIX team has since resolved the issue, shoring up the plugin's security.

Security concerns have also hit the wearable tech space. Initially discovered by Moritz Abrell, a German IT security firm has detailed eight separate vulnerabilities affecting all COROS smartwatches. These flaws give attackers nearly full control, letting them interrupt workouts in real time, remotely reset devices, and access or download personal data from COROS.com accounts.

Cisco is tackling its own set of vulnerabilities. The company has rolled out patches for a critical flaw in its Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) software that could let attackers log in using the root account. Alongside that, it has addressed three medium-severity issues in its Spaces Connector, Enterprise Chat and Email (ECE), and BroadWorks Application Delivery Platform, vulnerabilities that could lead to privilege escalation and cross-site scripting attacks.

4 Common Vulnerability and Exposures (CVEs) were added to the CyberSecurity & Infrastructure Security Agency's (CISA) 'Known Exploited Vulnerabilities Catalog' last week including:
- Citrix; NetScaler ADC and Gateway
- TeleMessage; TM SGNL
- Google; Chromium V8

See the full catalog here: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

NIST's National Vulnerability Database (NVD), the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP), has published 658 vulnerabilities during the last week, making the 2025 total 24,260. For more information visit https://nvd.nist.gov/vuln/search/

View the latest critical vulnerabilities, exploited vulnerabilities and EU CSIRT coordinated vulnerabilities from the European Union Agency for Cybersecurity (ENISA) "Vulnerability Database" here: https://euvd.enisa.europa.eu/homepage

Information Privacy Headlines

Security researcher Eric Daigle has uncovered a significant vulnerability tied to the Android spyware operation known as Catwatchful. His investigation revealed that the group had left its entire database, containing data from more than 62,000 customer accounts, wide open. Among the exposed information were plaintext passwords and email addresses. The breach, discovered in June 2025, also shed light on the scale of the operation, which has reportedly been active since at least 2018. Victims were primarily located in countries including Mexico, Colombia, India, Peru, Argentina, Ecuador, and Bolivia.

In response to a cyber-attack that may have impacted up to six million customers, Qantas has announced plans to strengthen its security infrastructure and improve threat detection. The airline’s move comes amid growing concern from Australia’s privacy watchdog, which has warned that social engineering attacks designed to gain unauthorised access to personal data are becoming increasingly common.

Meanwhile, in Germany, a court has ruled that Meta must pay €5,000 to a Facebook user for violating European data protection laws. The court found that Meta’s data practices amounted to near-constant surveillance of users’ private lives, even when they weren’t actively engaging with Facebook or Instagram, a clear breach of EU privacy regulations.

In Nigeria, the Data Protection Commission (NDPC) has hit MultiChoice Nigeria, parent company of DStv and GOtv, with a fine of N766.24 million. The penalty follows an investigation into alleged violations of the Nigeria Data Protection (NDP) Act, which found that MultiChoice had breached the privacy rights of its subscribers and illegally transferred the personal data of Nigerians across borders.

Smarter Protection Starts with Awareness
Data Breach Scan, Check Any Domain for Free https://breachaware.com/scan