news

Flickr said a vulnerability in a third-party email service provider’s system on February 5, 2026 may have allowed unauthorized access to certain Flickr user data fields, including names, email addresses, IP addresses, general location, and account activity, while passwords and payment card numbers were not affected.What Happened in the BreachFlickr told users it learned on…

What Happened in the BreachJapan Airlines JAL disclosed that its reservation system for the Same Day Luggage Delivery Service, which allows passengers to send bags from airports to hotels, was infiltrated by a third party and may have leaked personal data of up to 28,000 customers. The unauthorized access targeted the baggage delivery system and…

What Happened in the BreachCybersecurity researchers from the Cybernews investigative team uncovered an unprotected MongoDB instance on November 11, 2025 that they traced to US based identity verification firm IDMerit. The exposed server, used to store know your customer KYC data, held multiple databases totaling more than 3 billion records and nearly 1 terabyte of…

What Happened in the BreachA threat actor using the Lapsus$ name claimed on February 16, 2026 that it had breached the Adidas Extranet and stolen 815,000 rows of data, listing first and last names, email addresses, passwords, birthdays, company names and technical data. Adidas traced the incident to an independent licensing partner that distributes its…

What Happened in the BreachPanera Bread told Reuters that an incident occurred and that authorities were notified, and it described the exposed data as customer “contact information.”The extortion group ShinyHunters claimed it stole a much larger dataset and threatened publication, then released data after the extortion attempt failed, according to multiple security and tech outlets…

What Happened in the BreachPayPal confirmed that a software error in its PayPal Working Capital (PPWC) loan application led to a data exposure that lasted nearly six months. According to PayPal’s breach notice filed with Massachusetts authorities, the error in the PPWC application exposed personal data to unauthorized individuals between July 1 2025 and December 13…

Under Armour is investigating claims that a dataset tied to roughly 72 million customer records was posted online after an extortion attempt linked to the Everest ransomware group, raising risks of targeted phishing and account takeover attempts even as the company says it has found no evidence that passwords or payment systems were affected.What Happened…

AT&T’s $177,000,000 data breach settlement received final court approval on October 2, 2026. As of October 19, 2026, no payment date has been announced. The combined class action covers two data incidents announced in 2024 involving personal information and customer call and text metadata.AT&T Settlement Status — October 19, 2026Eligible class members who submitted claims…

What Happened in the BreachMatch Group said it is investigating a security incident after the ShinyHunters extortion group claimed it obtained more than 10 million records tied to Match Group dating services, including Hinge, OkCupid, and Match.com. Match Group told media outlets it moved quickly to terminate unauthorized access and said it has not seen…

Nike is investigating a potential cybersecurity incident after the extortion group WorldLeaks claimed it stole and leaked about 1.4TB of internal files tied to the sportswear giant, a case that could expose sensitive product and factory documentation even if customer records remain unaffected.What Happened in the BreachWorldLeaks, an extortion crew that posts victims on a…