<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>CyberNews.wiki - Cybersecurity News</title>
    <link>https://cybernews.wiki</link>
    <description>Breaking cybersecurity news, data breach reports, ransomware updates, vulnerability disclosures, and threat intelligence from industry experts.</description>
    <language>en-us</language>
    <lastBuildDate>Sun, 24 May 2026 16:05:07 GMT</lastBuildDate>
    <atom:link href="https://cybernews.wiki/rss.xml" rel="self" type="application/rss+xml"/>
    <image>
      <url>https://cybernews.wiki/logo.png</url>
      <title>CyberNews.wiki</title>
      <link>https://cybernews.wiki</link>
    </image>
    <copyright>Copyright 2026 CyberNews.wiki. All rights reserved.</copyright>
    <managingEditor>contact@cybernews.wiki (CyberNews.wiki Editorial)</managingEditor>
    <webMaster>webmaster@cybernews.wiki (CyberNews.wiki)</webMaster>
    <ttl>60</ttl>
    
    <item>
      <title><![CDATA['agath.app' DDoS-for-Hire Service Linked to Cascading Outages at Google, Apple, Reddit, and Cash App]]></title>
      <link>https://cybernews.wiki/article/agath-app-ddos-for-hire-major-outages</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/agath-app-ddos-for-hire-major-outages</guid>
      <description><![CDATA[A previously low-profile stresser service known as agath.app has emerged as the prime suspect in a wave of high-impact DDoS attacks that intermittently knocked Google Docs, accounts.google.com, Google Maps, Apple's website, Reddit, SoundCloud, Cash App, BC.Game, and the Cloudflare Community offline over the past 72 hours.]]></description>
      <pubDate>Sun, 24 May 2026 11:30:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Cybercrime</category>
      <category>DDoS</category>
      <category>agath.app</category>
      <category>booter</category>
      <category>stresser</category>
      <category>Google</category>
      <category>Apple</category>
      <category>Reddit</category>
      <category>Cash App</category>
      <category>Cloudflare</category>
      <category>SoundCloud</category>
      <category>Meris</category>
      <category>Kimwolf</category>
      <category>Aisuru</category>
    </item>
    <item>
      <title><![CDATA[Critical Cisco IOS XE Vulnerability Under Active Exploitation; Thousands of Devices Compromised]]></title>
      <link>https://cybernews.wiki/article/critical-cisco-vulnerability-active-exploitation</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/critical-cisco-vulnerability-active-exploitation</guid>
      <description><![CDATA[A critical zero-day vulnerability in Cisco IOS XE software is being actively exploited, with security researchers identifying over 40,000 compromised devices worldwide.]]></description>
      <pubDate>Sun, 24 May 2026 06:15:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Vulnerabilities</category>
      <category>Cisco</category>
      <category>zero-day</category>
      <category>CVE</category>
      <category>IOS XE</category>
      <category>critical vulnerability</category>
    </item>
    <item>
      <title><![CDATA[Chinese APT Group 'Volt Typhoon' Maintains Persistent Access to U.S. Critical Infrastructure]]></title>
      <link>https://cybernews.wiki/article/chinese-apt-group-targets-us-critical-infrastructure</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/chinese-apt-group-targets-us-critical-infrastructure</guid>
      <description><![CDATA[U.S. intelligence agencies warn that Chinese state-sponsored hackers have maintained undetected access to American critical infrastructure networks for at least five years.]]></description>
      <pubDate>Sat, 23 May 2026 14:00:00 GMT</pubDate>
      <author>David Nakamura</author>
      <category>Nation-State</category>
      <category>China</category>
      <category>APT</category>
      <category>Volt Typhoon</category>
      <category>critical infrastructure</category>
      <category>CISA</category>
    </item>
    <item>
      <title><![CDATA[Ascension Health Confirms Data Breach Affecting 5.6 Million Patients]]></title>
      <link>https://cybernews.wiki/article/healthcare-data-breach-ascension-health</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/healthcare-data-breach-ascension-health</guid>
      <description><![CDATA[One of the nation's largest healthcare systems confirms a massive data breach that exposed personal and medical information of millions of patients across 19 states.]]></description>
      <pubDate>Sat, 23 May 2026 11:30:00 GMT</pubDate>
      <author>Jennifer Martinez</author>
      <category>Data Breaches</category>
      <category>healthcare</category>
      <category>data breach</category>
      <category>HIPAA</category>
      <category>Ascension Health</category>
      <category>medical records</category>
    </item>
    <item>
      <title><![CDATA[Microsoft Patches 78 Vulnerabilities Including Three Actively Exploited Zero-Days]]></title>
      <link>https://cybernews.wiki/article/microsoft-patch-tuesday-may-2026</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/microsoft-patch-tuesday-may-2026</guid>
      <description><![CDATA[Microsoft's May 2026 Patch Tuesday addresses 78 security vulnerabilities, with three zero-days confirmed to be under active exploitation in the wild.]]></description>
      <pubDate>Fri, 22 May 2026 18:00:00 GMT</pubDate>
      <author>Thomas Bradley</author>
      <category>Vulnerabilities</category>
      <category>Microsoft</category>
      <category>Patch Tuesday</category>
      <category>zero-day</category>
      <category>Windows</category>
      <category>CVE</category>
    </item>
    <item>
      <title><![CDATA[AI-Generated Phishing Attacks Surge 900% as Threat Actors Embrace Large Language Models]]></title>
      <link>https://cybernews.wiki/article/ai-powered-phishing-attacks-surge</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/ai-powered-phishing-attacks-surge</guid>
      <description><![CDATA[Security researchers document an unprecedented 900% increase in AI-crafted phishing emails, with attackers using LLMs to create highly convincing, personalized lures.]]></description>
      <pubDate>Fri, 22 May 2026 14:45:00 GMT</pubDate>
      <author>Rachel Wong</author>
      <category>Phishing</category>
      <category>AI</category>
      <category>phishing</category>
      <category>LLM</category>
      <category>business email compromise</category>
      <category>social engineering</category>
    </item>
    <item>
      <title><![CDATA[North Korean Hackers Steal $230 Million in Cryptocurrency Exchange Heist]]></title>
      <link>https://cybernews.wiki/article/north-korea-cryptocurrency-heist-bybit</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/north-korea-cryptocurrency-heist-bybit</guid>
      <description><![CDATA[The Lazarus Group, a notorious North Korean hacking collective, has been linked to a $230 million cryptocurrency theft from a major exchange.]]></description>
      <pubDate>Thu, 21 May 2026 16:30:00 GMT</pubDate>
      <author>Christopher Park</author>
      <category>Cybercrime</category>
      <category>North Korea</category>
      <category>Lazarus Group</category>
      <category>cryptocurrency</category>
      <category>exchange hack</category>
      <category>ByBit</category>
    </item>
    <item>
      <title><![CDATA[Google Rushes Emergency Chrome Patch for Actively Exploited V8 Vulnerability]]></title>
      <link>https://cybernews.wiki/article/google-chrome-emergency-patch-v8-bug</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/google-chrome-emergency-patch-v8-bug</guid>
      <description><![CDATA[Google has released an emergency security update for Chrome after discovering active exploitation of a critical type confusion vulnerability in the V8 JavaScript engine.]]></description>
      <pubDate>Thu, 21 May 2026 10:15:00 GMT</pubDate>
      <author>Alex Kowalski</author>
      <category>Vulnerabilities</category>
      <category>Google Chrome</category>
      <category>V8</category>
      <category>zero-day</category>
      <category>browser security</category>
      <category>CVE</category>
    </item>
    <item>
      <title><![CDATA[Baltimore Water Utility Hit by Ransomware; Operations Shifted to Manual Controls]]></title>
      <link>https://cybernews.wiki/article/ransomware-attack-city-baltimore-water</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/ransomware-attack-city-baltimore-water</guid>
      <description><![CDATA[A ransomware attack on Baltimore's Department of Public Works has forced the city's water treatment facilities to operate under manual controls while systems are restored.]]></description>
      <pubDate>Wed, 20 May 2026 13:00:00 GMT</pubDate>
      <author>Marcus Johnson</author>
      <category>Ransomware</category>
      <category>ransomware</category>
      <category>water utility</category>
      <category>Baltimore</category>
      <category>critical infrastructure</category>
      <category>Play ransomware</category>
    </item>
    <item>
      <title><![CDATA[Apple Issues Spyware Threat Notifications to iPhone Users in 92 Countries]]></title>
      <link>https://cybernews.wiki/article/apple-spyware-threat-notifications</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/apple-spyware-threat-notifications</guid>
      <description><![CDATA[Apple has sent threat notifications to iPhone users across 92 countries, warning them that they may have been targeted by mercenary spyware attacks.]]></description>
      <pubDate>Wed, 20 May 2026 09:45:00 GMT</pubDate>
      <author>Elena Rodriguez</author>
      <category>Mobile Security</category>
      <category>Apple</category>
      <category>iPhone</category>
      <category>spyware</category>
      <category>Pegasus</category>
      <category>mercenary spyware</category>
    </item>
    <item>
      <title><![CDATA[SEC Charges Former SolarWinds CISO with Securities Fraud Over Breach Disclosures]]></title>
      <link>https://cybernews.wiki/article/sec-charges-solarwinds-ciso</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/sec-charges-solarwinds-ciso</guid>
      <description><![CDATA[The SEC has filed securities fraud charges against a former CISO, alleging he misled investors about the company's cybersecurity practices prior to a major breach.]]></description>
      <pubDate>Tue, 19 May 2026 15:30:00 GMT</pubDate>
      <author>Patricia Coleman</author>
      <category>Legal</category>
      <category>SEC</category>
      <category>CISO</category>
      <category>SolarWinds</category>
      <category>securities fraud</category>
      <category>regulation</category>
    </item>
    <item>
      <title><![CDATA[Akira Ransomware Gang Launches Massive Campaign Targeting VMware ESXi Servers]]></title>
      <link>https://cybernews.wiki/article/akira-ransomware-vmware-esxi-campaign</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/akira-ransomware-vmware-esxi-campaign</guid>
      <description><![CDATA[The Akira ransomware group has launched an aggressive campaign targeting VMware ESXi hypervisors, with over 300 organizations compromised in the past month alone.]]></description>
      <pubDate>Tue, 19 May 2026 11:00:00 GMT</pubDate>
      <author>Nathan Wright</author>
      <category>Ransomware</category>
      <category>Akira</category>
      <category>ransomware</category>
      <category>VMware</category>
      <category>ESXi</category>
      <category>virtualization</category>
    </item>
    <item>
      <title><![CDATA[Independent Audit Finds Critical Vulnerabilities in Popular Password Manager Extensions]]></title>
      <link>https://cybernews.wiki/article/password-manager-bitwarden-audit-results</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/password-manager-bitwarden-audit-results</guid>
      <description><![CDATA[A comprehensive security audit of browser extensions for five major password managers has revealed critical vulnerabilities that could expose user credentials.]]></description>
      <pubDate>Mon, 18 May 2026 14:15:00 GMT</pubDate>
      <author>Victoria Shaw</author>
      <category>Security Research</category>
      <category>password managers</category>
      <category>browser extensions</category>
      <category>security audit</category>
      <category>vulnerabilities</category>
      <category>EFF</category>
    </item>
    <item>
      <title><![CDATA[Russian APT Exploits Microsoft Teams to Deliver Malware to Ukrainian Government]]></title>
      <link>https://cybernews.wiki/article/russian-apt-microsoft-teams-attacks</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/russian-apt-microsoft-teams-attacks</guid>
      <description><![CDATA[A Russian state-sponsored hacking group is exploiting Microsoft Teams to deliver malware to Ukrainian government officials through targeted social engineering attacks.]]></description>
      <pubDate>Mon, 18 May 2026 09:30:00 GMT</pubDate>
      <author>Andrew Petrov</author>
      <category>Nation-State</category>
      <category>Russia</category>
      <category>Midnight Blizzard</category>
      <category>Microsoft Teams</category>
      <category>Ukraine</category>
      <category>APT</category>
    </item>
    <item>
      <title><![CDATA[Sophisticated Supply Chain Attack Discovered in Popular Python Packages]]></title>
      <link>https://cybernews.wiki/article/supply-chain-attack-python-packages</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/supply-chain-attack-python-packages</guid>
      <description><![CDATA[Security researchers have discovered a coordinated supply chain attack affecting multiple popular Python packages on PyPI, with backdoored versions downloaded over 500,000 times.]]></description>
      <pubDate>Sun, 17 May 2026 16:00:00 GMT</pubDate>
      <author>Linda Nakashima</author>
      <category>Supply Chain</category>
      <category>Python</category>
      <category>PyPI</category>
      <category>supply chain attack</category>
      <category>malware</category>
      <category>open source</category>
    </item>
    <item>
      <title><![CDATA[FBI-Led Operation Dismantles QakBot Botnet After 15 Years of Operations]]></title>
      <link>https://cybernews.wiki/article/fbi-dismantles-qakbot-botnet</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/fbi-dismantles-qakbot-botnet</guid>
      <description><![CDATA[An international law enforcement operation has dismantled QakBot, one of the longest-running and most destructive botnets, seizing infrastructure and recovering millions in cryptocurrency.]]></description>
      <pubDate>Sun, 17 May 2026 12:30:00 GMT</pubDate>
      <author>Robert Fitzgerald</author>
      <category>Cybercrime</category>
      <category>QakBot</category>
      <category>botnet</category>
      <category>FBI</category>
      <category>law enforcement</category>
      <category>malware</category>
    </item>
    <item>
      <title><![CDATA[Critical Kubernetes Vulnerability Allows Container Escape and Cluster Takeover]]></title>
      <link>https://cybernews.wiki/article/kubernetes-critical-vulnerability</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/kubernetes-critical-vulnerability</guid>
      <description><![CDATA[A critical vulnerability in Kubernetes allows attackers to escape container boundaries and gain control of entire clusters, affecting all versions prior to the latest patches.]]></description>
      <pubDate>Sat, 16 May 2026 15:45:00 GMT</pubDate>
      <author>Daniel Morrison</author>
      <category>Vulnerabilities</category>
      <category>Kubernetes</category>
      <category>container security</category>
      <category>CVE</category>
      <category>cloud security</category>
      <category>critical vulnerability</category>
    </item>
    <item>
      <title><![CDATA[Major Insurance Carrier Refuses $40M Ransomware Payment, Faces Lawsuit from Policyholders]]></title>
      <link>https://cybernews.wiki/article/insurance-giant-ransomware-payout</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/insurance-giant-ransomware-payout</guid>
      <description><![CDATA[A major cyber insurance carrier is facing lawsuits after refusing to pay a $40 million ransomware demand for a client, citing policy exclusions the client disputes.]]></description>
      <pubDate>Sat, 16 May 2026 11:00:00 GMT</pubDate>
      <author>Benjamin Grant</author>
      <category>Insurance</category>
      <category>cyber insurance</category>
      <category>ransomware</category>
      <category>lawsuit</category>
      <category>Hartford</category>
      <category>policy exclusions</category>
    </item>
    <item>
      <title><![CDATA[CISA Issues Emergency Directive Over Critical Microsoft Exchange Vulnerability]]></title>
      <link>https://cybernews.wiki/article/cisa-emergency-directive-exchange-servers</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/cisa-emergency-directive-exchange-servers</guid>
      <description><![CDATA[CISA has issued an emergency directive requiring federal agencies to patch or mitigate a critical Microsoft Exchange vulnerability within 48 hours.]]></description>
      <pubDate>Fri, 15 May 2026 17:30:00 GMT</pubDate>
      <author>Amanda Stevens</author>
      <category>Vulnerabilities</category>
      <category>CISA</category>
      <category>Microsoft Exchange</category>
      <category>emergency directive</category>
      <category>zero-day</category>
      <category>federal agencies</category>
    </item>
    <item>
      <title><![CDATA[SS7 Attacks Continue to Plague Telecom Networks, Enabling Surveillance and Fraud]]></title>
      <link>https://cybernews.wiki/article/telecom-ss7-attacks-persist</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/telecom-ss7-attacks-persist</guid>
      <description><![CDATA[Despite years of warnings, telecommunications networks remain vulnerable to SS7 attacks that enable location tracking, call interception, and SMS hijacking.]]></description>
      <pubDate>Fri, 15 May 2026 10:00:00 GMT</pubDate>
      <author>Gregory Palmer</author>
      <category>Telecommunications</category>
      <category>SS7</category>
      <category>telecommunications</category>
      <category>surveillance</category>
      <category>SMS interception</category>
      <category>mobile security</category>
    </item>
    <item>
      <title><![CDATA[Cloudflare Mitigates Record-Breaking 3.8 Tbps DDoS Attack]]></title>
      <link>https://cybernews.wiki/article/record-ddos-attack-3-8-tbps-cloudflare</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/record-ddos-attack-3-8-tbps-cloudflare</guid>
      <description><![CDATA[Cloudflare disclosed it absorbed a 3.8 Tbps volumetric DDoS attack against a financial services customer, the largest publicly reported flood to date.]]></description>
      <pubDate>Wed, 29 Apr 2026 13:00:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Vulnerabilities</category>
      <category>DDoS</category>
      <category>Cloudflare</category>
      <category>botnet</category>
      <category>MikroTik</category>
      <category>DDoS record</category>
    </item>
    <item>
      <title><![CDATA[Coordinated DDoS Campaign Disrupts Five European Banks]]></title>
      <link>https://cybernews.wiki/article/ddos-attack-european-banks-march-2026</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/ddos-attack-european-banks-march-2026</guid>
      <description><![CDATA[A coordinated DDoS campaign linked to a pro-Kremlin hacktivist group knocked online banking offline for five major European banks across two days in March.]]></description>
      <pubDate>Thu, 19 Mar 2026 09:45:00 GMT</pubDate>
      <author>Marcus Reilly</author>
      <category>Cybercrime</category>
      <category>DDoS</category>
      <category>hacktivism</category>
      <category>NoName057</category>
      <category>banking</category>
      <category>Europe</category>
    </item>
    <item>
      <title><![CDATA[FBI Dismantles 27 'Stresser' Sites in Largest DDoS-for-Hire Takedown]]></title>
      <link>https://cybernews.wiki/article/ddos-as-a-service-takedown-2026</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/ddos-as-a-service-takedown-2026</guid>
      <description><![CDATA[Operation PowerOff III seized 27 booter-service domains and indicted nine operators across four countries, the FBI's largest DDoS-for-hire crackdown to date.]]></description>
      <pubDate>Wed, 11 Feb 2026 15:20:00 GMT</pubDate>
      <author>David Nakamura</author>
      <category>Cybercrime</category>
      <category>DDoS</category>
      <category>FBI</category>
      <category>booter</category>
      <category>stresser</category>
      <category>Operation PowerOff</category>
    </item>
    <item>
      <title><![CDATA[RapperBot Mirai Variant Behind Surge in Layer-7 DDoS Against Gaming Industry]]></title>
      <link>https://cybernews.wiki/article/ddos-attack-rapper-bot-mirai-variant-2026</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/ddos-attack-rapper-bot-mirai-variant-2026</guid>
      <description><![CDATA[Akamai researchers attribute a new wave of Layer-7 DDoS attacks against game publishers to RapperBot, a Mirai variant targeting outdated IoT devices and weakly secured Linux servers.]]></description>
      <pubDate>Fri, 23 Jan 2026 12:00:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Cybercrime</category>
      <category>DDoS</category>
      <category>RapperBot</category>
      <category>Mirai</category>
      <category>gaming</category>
      <category>botnet</category>
      <category>Akamai</category>
    </item>
    <item>
      <title><![CDATA[CrowdStrike Falcon Update Triggers Global Windows Outage Affecting 8.5 Million Machines]]></title>
      <link>https://cybernews.wiki/article/crowdstrike-falcon-outage-2024</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/crowdstrike-falcon-outage-2024</guid>
      <description><![CDATA[A defective channel-file update from CrowdStrike's Falcon endpoint sensor crashed Windows systems worldwide, grounding airlines, halting hospitals, and taking down television broadcasts in what Microsoft estimates affected 8.5 million machines.]]></description>
      <pubDate>Fri, 19 Jul 2024 15:30:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Security Research</category>
      <category>CrowdStrike</category>
      <category>Falcon</category>
      <category>Windows</category>
      <category>outage</category>
      <category>BSOD</category>
    </item>
    <item>
      <title><![CDATA[AT&T Discloses Breach Exposing Call and Text Records of 'Nearly All' Customers]]></title>
      <link>https://cybernews.wiki/article/att-data-breach-disclosure-2024</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/att-data-breach-disclosure-2024</guid>
      <description><![CDATA[AT&T confirmed attackers accessed call and text-message metadata for nearly all of its cellular customers between May and October 2022, downloaded from a third-party cloud workspace.]]></description>
      <pubDate>Fri, 12 Jul 2024 11:00:00 GMT</pubDate>
      <author>Amanda Stevens</author>
      <category>Data Breaches</category>
      <category>AT&T</category>
      <category>Snowflake</category>
      <category>data breach</category>
      <category>metadata</category>
      <category>telecom</category>
    </item>
    <item>
      <title><![CDATA[Snowflake-Linked Data Thefts Hit Ticketmaster, Santander, Advance Auto Parts]]></title>
      <link>https://cybernews.wiki/article/snowflake-mass-data-theft-2024</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/snowflake-mass-data-theft-2024</guid>
      <description><![CDATA[A threat actor identified as UNC5537 is monetizing data stolen from at least 165 Snowflake customer tenants by abusing valid credentials harvested by infostealer malware against accounts lacking multi-factor authentication.]]></description>
      <pubDate>Mon, 10 Jun 2024 13:00:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Data Breaches</category>
      <category>Snowflake</category>
      <category>UNC5537</category>
      <category>infostealer</category>
      <category>MFA</category>
      <category>data theft</category>
    </item>
    <item>
      <title><![CDATA[UnitedHealth Says Change Healthcare Ransomware Attack Cost $872 Million]]></title>
      <link>https://cybernews.wiki/article/change-healthcare-ransomware-2024</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/change-healthcare-ransomware-2024</guid>
      <description><![CDATA[UnitedHealth Group disclosed that the ALPHV/BlackCat ransomware attack against subsidiary Change Healthcare cost the company $872 million in Q1 and disrupted U.S. pharmacy operations nationwide.]]></description>
      <pubDate>Tue, 16 Apr 2024 14:30:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Ransomware</category>
      <category>Change Healthcare</category>
      <category>UnitedHealth</category>
      <category>ALPHV</category>
      <category>BlackCat</category>
      <category>healthcare</category>
    </item>
    <item>
      <title><![CDATA[23andMe Confirms Credential-Stuffing Attack Exposed 6.9 Million Users]]></title>
      <link>https://cybernews.wiki/article/23andme-credential-stuffing-2023</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/23andme-credential-stuffing-2023</guid>
      <description><![CDATA[Genetic testing company 23andMe confirmed that attackers used credential stuffing to access roughly 14,000 accounts and scraped ancestry data on approximately 6.9 million additional users via the DNA Relatives feature.]]></description>
      <pubDate>Mon, 04 Dec 2023 16:00:00 GMT</pubDate>
      <author>Jennifer Park</author>
      <category>Data Breaches</category>
      <category>23andMe</category>
      <category>credential stuffing</category>
      <category>genetic data</category>
      <category>DNA</category>
      <category>privacy</category>
    </item>
    <item>
      <title><![CDATA[Okta Discloses Second Customer-Support Breach in Two Years]]></title>
      <link>https://cybernews.wiki/article/okta-customer-support-breach-2023</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/okta-customer-support-breach-2023</guid>
      <description><![CDATA[Identity provider Okta confirmed an attacker accessed support-case files belonging to all customers of its main support system, escalating disclosures originally limited to 1 percent of customers.]]></description>
      <pubDate>Wed, 29 Nov 2023 14:00:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Data Breaches</category>
      <category>Okta</category>
      <category>support breach</category>
      <category>HAR file</category>
      <category>session tokens</category>
      <category>identity</category>
    </item>
    <item>
      <title><![CDATA[Clop Mass-Exploits MOVEit Transfer Zero-Day; Hundreds of Organizations Affected]]></title>
      <link>https://cybernews.wiki/article/moveit-clop-mass-exploitation-2023</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/moveit-clop-mass-exploitation-2023</guid>
      <description><![CDATA[The Clop ransomware crew is mass-exploiting a SQL injection zero-day in Progress Software's MOVEit Transfer to steal data from hundreds of organizations including the BBC, British Airways, and U.S. federal agencies.]]></description>
      <pubDate>Wed, 14 Jun 2023 10:00:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Vulnerabilities</category>
      <category>MOVEit</category>
      <category>Clop</category>
      <category>CVE-2023-34362</category>
      <category>zero-day</category>
      <category>data theft</category>
    </item>
    <item>
      <title><![CDATA[LastPass Confirms Encrypted Vault Backups Stolen in Second Breach]]></title>
      <link>https://cybernews.wiki/article/lastpass-vault-breach-2022</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/lastpass-vault-breach-2022</guid>
      <description><![CDATA[Password manager LastPass disclosed that the attacker behind its August breach returned in November and exfiltrated encrypted customer vault backups along with billing data, URLs, and unencrypted metadata.]]></description>
      <pubDate>Thu, 22 Dec 2022 17:00:00 GMT</pubDate>
      <author>Jennifer Park</author>
      <category>Data Breaches</category>
      <category>LastPass</category>
      <category>password manager</category>
      <category>data breach</category>
      <category>encryption</category>
    </item>
    <item>
      <title><![CDATA[LockBit 3.0 Source Code and Builder Leaked by Disgruntled Developer]]></title>
      <link>https://cybernews.wiki/article/lockbit-3-0-leak-2022</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/lockbit-3-0-leak-2022</guid>
      <description><![CDATA[The LockBit ransomware crew's 3.0 builder and source code were leaked on Twitter by a disgruntled developer, allowing security researchers and copycats alike to study and reuse the toolkit.]]></description>
      <pubDate>Wed, 21 Sep 2022 11:30:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Ransomware</category>
      <category>LockBit</category>
      <category>ransomware</category>
      <category>source code leak</category>
      <category>RaaS</category>
    </item>
    <item>
      <title><![CDATA[Uber Breached via MFA Fatigue Attack on Contractor Account]]></title>
      <link>https://cybernews.wiki/article/uber-data-breach-mfa-fatigue-2022</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/uber-data-breach-mfa-fatigue-2022</guid>
      <description><![CDATA[Uber confirmed an attacker linked to the Lapsus$ crew compromised an external contractor and used an MFA-fatigue 'push spam' attack to bypass multi-factor authentication, gaining access to internal Slack, GCP, AWS, and SentinelOne consoles.]]></description>
      <pubDate>Mon, 19 Sep 2022 10:00:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Data Breaches</category>
      <category>Uber</category>
      <category>Lapsus$</category>
      <category>MFA fatigue</category>
      <category>push bombing</category>
      <category>infostealer</category>
    </item>
    <item>
      <title><![CDATA[Lapsus$ Claims Okta Breach via Third-Party Support Contractor]]></title>
      <link>https://cybernews.wiki/article/lapsus-okta-breach-2022</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/lapsus-okta-breach-2022</guid>
      <description><![CDATA[The Lapsus$ extortion crew posted screenshots showing what it claims is access to identity provider Okta's internal systems, obtained through a compromised third-party support contractor.]]></description>
      <pubDate>Tue, 22 Mar 2022 08:00:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Data Breaches</category>
      <category>Lapsus$</category>
      <category>Okta</category>
      <category>Sitel</category>
      <category>supply chain</category>
      <category>identity</category>
    </item>
    <item>
      <title><![CDATA[Log4Shell: Critical Log4j Vulnerability Triggers Internet-Wide Patching Race]]></title>
      <link>https://cybernews.wiki/article/log4shell-vulnerability-disclosed</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/log4shell-vulnerability-disclosed</guid>
      <description><![CDATA[A critical remote-code-execution flaw in the widely used Log4j Java logging library is being mass-exploited within hours of public disclosure, prompting CISA to call it 'one of the most serious' vulnerabilities in its career.]]></description>
      <pubDate>Mon, 13 Dec 2021 22:00:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Vulnerabilities</category>
      <category>Log4j</category>
      <category>Log4Shell</category>
      <category>CVE-2021-44228</category>
      <category>zero-day</category>
      <category>Apache</category>
    </item>
    <item>
      <title><![CDATA[Robinhood Says Five Million Email Addresses Exposed in Customer-Support Breach]]></title>
      <link>https://cybernews.wiki/article/robinhood-data-breach-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/robinhood-data-breach-2021</guid>
      <description><![CDATA[Trading app Robinhood disclosed that a social-engineering attack against a customer-support employee exposed email addresses for five million users and full names for two million more.]]></description>
      <pubDate>Mon, 08 Nov 2021 20:00:00 GMT</pubDate>
      <author>Jennifer Park</author>
      <category>Data Breaches</category>
      <category>Robinhood</category>
      <category>social engineering</category>
      <category>data breach</category>
      <category>fintech</category>
    </item>
    <item>
      <title><![CDATA[Anonymous Leaker Dumps 125GB of Twitch Source Code and Creator Payouts]]></title>
      <link>https://cybernews.wiki/article/twitch-source-code-leak-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/twitch-source-code-leak-2021</guid>
      <description><![CDATA[An anonymous 4chan user posted a 125GB torrent containing Twitch's source code, internal red-team tools, and three years of creator payout records following what Amazon-owned Twitch describes as a server configuration error.]]></description>
      <pubDate>Wed, 06 Oct 2021 11:30:00 GMT</pubDate>
      <author>Tom Bradford</author>
      <category>Data Breaches</category>
      <category>Twitch</category>
      <category>Amazon</category>
      <category>source code</category>
      <category>leak</category>
      <category>streaming</category>
    </item>
    <item>
      <title><![CDATA[T-Mobile Confirms Breach Exposing Personal Data of 54 Million Customers]]></title>
      <link>https://cybernews.wiki/article/t-mobile-data-breach-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/t-mobile-data-breach-2021</guid>
      <description><![CDATA[T-Mobile USA confirmed a hacker accessed personal data — including Social Security numbers and driver's license information — for at least 54 million current, former, and prospective customers.]]></description>
      <pubDate>Wed, 18 Aug 2021 19:00:00 GMT</pubDate>
      <author>Gregory Palmer</author>
      <category>Data Breaches</category>
      <category>T-Mobile</category>
      <category>data breach</category>
      <category>telecom</category>
      <category>SSN</category>
      <category>John Binns</category>
    </item>
    <item>
      <title><![CDATA[REvil Ransomware Hits Kaseya VSA in Massive Supply-Chain Attack]]></title>
      <link>https://cybernews.wiki/article/kaseya-vsa-supply-chain-attack</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/kaseya-vsa-supply-chain-attack</guid>
      <description><![CDATA[The REvil ransomware crew exploited a zero-day in Kaseya's VSA remote-management software to encrypt systems at an estimated 1,500 downstream businesses through approximately 60 managed service providers.]]></description>
      <pubDate>Sat, 03 Jul 2021 22:30:00 GMT</pubDate>
      <author>Michael Thornton</author>
      <category>Supply Chain</category>
      <category>Kaseya</category>
      <category>REvil</category>
      <category>ransomware</category>
      <category>MSP</category>
      <category>supply chain</category>
      <category>CVE-2021-30116</category>
    </item>
    <item>
      <title><![CDATA[JBS Foods Confirms $11 Million Ransom Payment After Ransomware Attack]]></title>
      <link>https://cybernews.wiki/article/jbs-foods-ransomware-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/jbs-foods-ransomware-2021</guid>
      <description><![CDATA[Meatpacker JBS, the world's largest, confirmed it paid $11 million in bitcoin to ransomware operators after an attack disrupted operations at facilities across the United States, Canada, and Australia.]]></description>
      <pubDate>Wed, 09 Jun 2021 14:00:00 GMT</pubDate>
      <author>Amanda Stevens</author>
      <category>Ransomware</category>
      <category>JBS</category>
      <category>REvil</category>
      <category>ransomware</category>
      <category>critical infrastructure</category>
      <category>food supply</category>
    </item>
    <item>
      <title><![CDATA[Colonial Pipeline Pays $4.4M Ransom After DarkSide Attack Shuts U.S. Fuel Pipeline]]></title>
      <link>https://cybernews.wiki/article/colonial-pipeline-ransomware-attack</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/colonial-pipeline-ransomware-attack</guid>
      <description><![CDATA[Colonial Pipeline, which supplies approximately 45 percent of fuel to the U.S. East Coast, paid a $4.4 million ransom to the DarkSide ransomware crew after an attack forced a six-day operational shutdown.]]></description>
      <pubDate>Wed, 19 May 2021 16:00:00 GMT</pubDate>
      <author>David Nakamura</author>
      <category>Ransomware</category>
      <category>Colonial Pipeline</category>
      <category>DarkSide</category>
      <category>ransomware</category>
      <category>critical infrastructure</category>
      <category>fuel</category>
    </item>
    <item>
      <title><![CDATA[Personal Data of 533 Million Facebook Users Posted on Low-Tier Hacker Forum]]></title>
      <link>https://cybernews.wiki/article/facebook-533-million-leak-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/facebook-533-million-leak-2021</guid>
      <description><![CDATA[A trove containing phone numbers, email addresses, and biographical data for 533 million Facebook users from 106 countries has been posted for free on a low-tier hacking forum after circulating in private channels for years.]]></description>
      <pubDate>Sat, 03 Apr 2021 18:30:00 GMT</pubDate>
      <author>Jennifer Park</author>
      <category>Data Breaches</category>
      <category>Facebook</category>
      <category>Meta</category>
      <category>data leak</category>
      <category>scraping</category>
      <category>GDPR</category>
    </item>
    <item>
      <title><![CDATA[China-Linked HAFNIUM Group Exploits Four Microsoft Exchange Zero-Days]]></title>
      <link>https://cybernews.wiki/article/microsoft-exchange-proxylogon-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/microsoft-exchange-proxylogon-2021</guid>
      <description><![CDATA[Microsoft attributed mass exploitation of four chained zero-day vulnerabilities in Exchange Server — dubbed ProxyLogon — to a state-sponsored Chinese threat actor it tracks as HAFNIUM.]]></description>
      <pubDate>Tue, 02 Mar 2021 17:00:00 GMT</pubDate>
      <author>Sarah Chen</author>
      <category>Nation-State</category>
      <category>Microsoft Exchange</category>
      <category>ProxyLogon</category>
      <category>HAFNIUM</category>
      <category>China</category>
      <category>zero-day</category>
    </item>
    <item>
      <title><![CDATA[U.S. Government Formally Attributes SolarWinds Compromise to Russian SVR]]></title>
      <link>https://cybernews.wiki/article/solarwinds-sunburst-attribution-january-2021</link>
      <guid isPermaLink="true">https://cybernews.wiki/article/solarwinds-sunburst-attribution-january-2021</guid>
      <description><![CDATA[The Cyber Unified Coordination Group formally attributed the SolarWinds Orion supply-chain compromise to Russia's Foreign Intelligence Service (SVR), describing it as a likely intelligence-gathering operation.]]></description>
      <pubDate>Tue, 05 Jan 2021 19:00:00 GMT</pubDate>
      <author>David Nakamura</author>
      <category>Nation-State</category>
      <category>SolarWinds</category>
      <category>SVR</category>
      <category>Russia</category>
      <category>APT29</category>
      <category>supply chain</category>
    </item>
  </channel>
</rss>