Ernst & Young is notifying clients of a breach at a third-party IT service management platform used by staff supporting its tax practice. Support tickets submitted through the platform could include attached documents containing client tax information, and the firm says an unauthorized third party accessed the platform between March 28 and April 12 and downloaded documents belonging to a number of clients. EY detected the activity on April 23, roughly two weeks after it stopped, and filed breach notifications with the California Attorney General in July. The exposed data includes personal and financial information used to prepare tax filings.
Coca-Cola disclosed in a securities filing that a ransomware attack on its Fairlife dairy subsidiary has disrupted operations and temporarily suspended production across the United States. The company said Fairlife detected unauthorized access to some systems, including production-related systems, and that it activated incident response and business continuity plans, brought in outside experts, and notified law enforcement. It says product quality and safety were not affected, and Canadian operations continue. The full impact is still being investigated, and no ransomware group has been named. Ransomware at food and beverage producers has caused weeks-long shutdowns and empty shelves in past incidents.
Discount supermarket chain Lidl has notified online shop customers in Germany, Belgium, and the Netherlands of a data breach that stemmed from a hack at one of its service providers rather than Lidl's own systems. According to the company, the exposed information involves customer contact and order-related details, while payment card data was not affected. The incident is another example of third-party or supply-chain risk, where attackers compromise a vendor to reach a larger brand's customer data. Even without financial data, the exposed details can fuel convincing phishing and scams that impersonate Lidl, especially messages referencing real orders to make fraudulent requests look legitimate to shoppers who recently used the online shop.
Glendale Community College has had data on roughly 793,000 people exposed after the extortion group ShinyHunters stole files from its student information systems. Have I Been Pwned indexed 793,925 accounts, and the attackers claim to have taken more than 62GB across roughly 304,000 files, including student records with personal identifiers, financial aid exports, immunization logs, admission checklists, and transcripts dating back to 2020. The theft came from the college's PeopleSoft Campus Solutions environment, tying it to the wider ShinyHunters campaign against Oracle PeopleSoft that has hit numerous universities and companies. The breadth of academic and personal data raises the risk of identity theft and targeted phishing against students, applicants, and staff.
US auto insurer AssuranceAmerica has confirmed a breach affecting nearly 6.9 million people, the largest known exposure of Americans' driver's license data this year. The company detected the intrusion on March 17 after attackers compromised a single employee's credentials the day before and copied data files, but a lengthy review of the files was not finished until June 15, delaying notifications until now. The stolen data includes names, contact details, driver's license numbers, auto insurance policy and claims information, and, for some people, Social Security numbers. AssuranceAmerica has not detailed how the employee's credentials were taken, though such incidents are often tied to phishing or credential-stealing malware.
Mount Royal University in Calgary has confirmed that attackers breached its network in June, stole data from its file storage systems, and then deleted the files to hinder recovery, as the hackers now publicly claim the attack. The intrusion, detected around June 18, disrupted phones, the university website, and other systems. The affected storage held academic material such as assignments and research, but the university acknowledges some students and staff may have kept personal information there, and a separate departmental drive was also wiped. Mount Royal is notifying affected individuals and offering credit monitoring to current and recent employees, though not to students.
Accenture, one of the world's largest IT consulting firms, has confirmed a data breach after a threat actor advertised stolen data for sale on a hacking forum. The seller claims to have taken about 35GB of source code along with RSA keys, SSH keys, Azure access tokens and storage keys, and configuration files, and shared a screenshot appearing to show them cloning an internal Azure DevOps repository. Accenture confirmed the breach but did not comment on the amount or type of data involved. If the stolen keys and tokens are valid, they could give attackers a path into Accenture's development systems or cloud infrastructure.
Medtronic has begun notifying about 3.8 million people that their data was exposed in the breach of its corporate IT systems earlier this year, giving a concrete scale to the ShinyHunters attack it first disclosed in April. The exposed information includes names, contact details, dates of birth, Social Security numbers, and health-related data, a more sensitive set than the company initially detailed. The intrusion, which the extortion group claimed involved around nine million records, was limited to corporate systems, with Medtronic saying its products, patient safety, and device networks were not affected. Affected individuals are being offered credit monitoring, and several class-action lawsuits have followed.
A Ransom-ISAC case study, built from a leaked negotiation chat and the blockchain trail, reconstructs how a US government entity quietly paid about $1 million to an extortion group called Kairos to keep stolen files from being published. Notably, Kairos never encrypted anything: there was no locker and no decryption key, just theft and the threat to leak, with special pressure applied to a folder of prosecutors' records. The month-long negotiation fell from a $3 million demand to a $1 million payment. The case reflects a broader shift, with roughly half of recent extortion now skipping encryption entirely, since data theft alone provides enough leverage.
The extortion group ShinyHunters has published data stolen from Moody Bible Institute, a Chicago-based Christian college, after a "pay or leak" campaign. Have I Been Pwned indexed more than 2.3 million unique email addresses along with names, physical addresses, phone numbers, and dates of birth belonging to students, alumni, donors, and supporters. ShinyHunters claimed a much larger haul spanning enrollment, donor, payroll, and communications systems, and some reporting ties the intrusion to the same ShinyHunters campaign that exploited an Oracle PeopleSoft flaw. Most of the leaked email addresses had already appeared in earlier breaches, raising the risk of credential stuffing and targeted phishing.
TrustStrike Labs