#hackandleak — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #hackandleak, aggregated by home.social.
-
New by Me:
EXCLUSIVE: Top-100 Law Firm Fox Rothschild Suffers Data Breach and Leak by Silent Ransom Group
Includes a section on the roots of Silent Ransom Group and its methods as well as advice to law firms or victims of attacks by SRG, based on the patterns I've observed with them over multiple incidents:
#databreach #hackandleak #extortion #SRG #SilentRansomGroup #cybersecurity #lawsec #lawfirm
Great thanks to Yelisey Bohuslavskiy for sharing AdvIntel's findings and observations.
-
NEW by me:
Two Data Breaches Didn't Sink Novo Nordisk's Stock. Why Not?
So often, we see stock prices take a dip after a breach is disclosed. In this case, there were TWO breaches, yet the stock price didn't take any real dip, however short-lived. Either that's really unusual or breaches are starting to have less impact on stock prices, even in the short-term.
If the latter, threat actors may stop trying to threaten targets that their investors will care.
https://databreaches.net/2026/06/21/two-data-breaches-didnt-sink-novo-nordisks-stock-why-not/
#databreach #novoNordisk #infosec #hackandleak #intellectualproperty
-
NEW by me:
While digging into the High Court of Bombay injunction sought by Global Schools Group (GSG) against FulcrumSec that I reported yesterday, I discovered a second injunction filed by a Singapore court.
Two injunctions in two countries in 24 hours.
Each one was worded somewhat differently and listed different defendants or respondents.
As an odd note: it appears that GSG's law firm may have forgotten to send FulcrumSec the Bombay court injunction of June 12 until after I reported on it yesterday. FulcrumSec had received the Singapore injunction on June 13, but knew nothing about any other injunction until I asked them about it yesterday. Less than 24 hours after I published about the Bombay injunction, the law firm sent it to FulcrumSec along with the attached files that the threat actors have now shared with me.
But what did these injunctions actually accomplish? Read my new post:
Global Schools Group Obtained Two Court Injunctions That Didn’t Seem to Change Much—and Might Backfire
@zackwhittaker @campuscodi @amvinfe
#FulcrumSec #GlobalSchoolsGroup #GIIS #injunction #databreach #hackandleak #extortion #chillingeffects #pressfrredom #legalthreats #censorship
-
NEW by me:
Bombay High Court Blocks FulcrumSec Data Leak
https://databreaches.net/2026/06/19/bombay-high-court-blocks-fulcrumsec-data-leak/
-
I asked FulcrumSec if they would give me a breakdown of the Global Schools Group (GSG) data breach by school brand and campus. They did. The breakdown also includes by country, as GSG has schools in 10 countries.
I've published the aggregate totals and individual school brand data in a two-part article:
https://databreaches.net/2026/06/18/data-analysis-of-the-global-schools-group-breach-part-1/
https://databreaches.net/2026/06/18/data-analysis-of-the-global-schools-group-breach-part-2/
#FulcrumSec #databreach #hackandleak #extortion #GlobalSchoolsGroup #GSG #GIIS
-
NEW by me:
One threat actor demanded $50 million from Novo Nordisk. Another one demanded $25 million. Neither got paid.
Two different groups tried to extort Novo Nordisk at around the same time. Novo Nordisk strung them both along, and then went dark.
Data leaks followed.
#NovoNordisk #FulcrumSec #TheUSERS007 #hackandleak #extortion #AI #databreach #infosec #cybersecurity
@campuscodi @euroinfosec @jgreig @lorenzofb @ajvicens @amvinfe
-
New by me:
Scoop: FulcrumSec Leaks Novo Nordisk Data After $25M Demand Goes Unpaid
#novonordisk #FulcrumSec #hackandleak #infosec #cybersecurity #databreach #intellectualproperty
@campuscodi @dangoodin @zackwhittaker @euroinfosec @amvinfe @briankrebs @lawrenceabrams
-
NEW by me:
Another detail emerges about Instructure's agreement with ShinyHunters; Debate continues about whether to pay:
Cybersecurity experts make claims about ShinyHunters to journalists, but where is the evidence to support their claims? Journalists shouldn't just quote experts -- ask them the basis for their claims. How much evidence do they actually have to support their assertions?
#hackandleak #databreach #Instructure #ShinyHunters #ransom #journalism
-
@brianhonan There doesn't seem to have been any 2025 report for U.S., but in the 2026 U.S. focus based on a survey of 1000 small U.S. businesses, they have data on encryption incidents and report that of those that paid the extortion demand:
-- only 50% recovered all their data;
-- 27% were attacked again; and
-- ransomware victims paid a ransom an average of 2.24 times to recover.Unfortunately, they don't report what percent have data leaked anyway in U.S. encryption incidents where victims pay, and they don't have any data on non-encryption #hackandleak incidents in the U.S. when small businesses are paying just to not leak data. The outcome may be the same as IE, but I wouldn't assume that.
I'll email them to inquire, but I suspect if they had that data, they would have reported it.
Thanks again for sharing that helpful resource.
https://www.hiscox.com/documents/Hiscox-Cyber-Readiness-Report-2026.pdf
-
@masek If the sole reason for paying is to reduce harm to the company or entity, then I tend to agree with you.
But let's look at the Instructure situation. It was a #hackandleak situation with data that is not particularly valuable, so why pay, right?
But then the attackers escalated and disrupted Finals week for tens of thousands of schools and millions of students.
And if Instructure hadn't paid, would ShinyHunters keep attacking them and disrupting their ability to provide the software schools rely on? My bet is that they would have.
When Instructure paid, I viewed it as them paying to stop the attacks more than to (just) allegedly delete data.
And that was not to reduce harm to the business, although Lord knows, their reputation was taking quite a hit, but paying reduced the disruption and harm to the students and teachers and schools.
And I'm okay with that. Does the payment reward criminals and make more crime more likely? Maybe. But even if the answer is "definitely," the company had a duty to mitigate harm to those who entrusted them with their data. And if that means paying, then their first duty is still to the ultimate victims and not to other companies.
I feel even more strongly when the target is a healthcare entity and patient services are delayed, or emergency services are diverted elsewhere.
I know, I know.... some people probably hate me for this opinion. To those who disagree with me strongly:
Change my mind. And show me some actual data about how often some gangs do or do not keep their word.
-
RE: https://infosec.exchange/@amvinfe/116567370386921171
I realize my view on whether it is ever okay to pay #ransom in a #hackandleak situation is contentious. Great thanks to @amvinfe for asking me to articulate my views. #incidentresponse #mitigation #responsibility #ethics
-
I'm not sure I understand why people are trying to research what schools use Canvas. ShinyHunters provided a list of all of the schools that were caught up in this attack:
https://databreaches.net/wp-content/uploads/Claimed-Victims-of-Canvas-Cyber-Incident.txt That list has 8,809 entities listed.
It's not the entire universe of schools that use Canvas, but it's probably an accurate list of the schools that may be affected. A sample list ShinyHunters provided for my earlier report on this incident showed filesizes for: communication_channels.csv.gz, conversation_messages.csv.gz, conversations.csv.gz, and users.csv.gz. There were about 7,780 schools in that sample.
And yeah, hang on to your Tox because Session is closing in July, it seems.
#Instructure #Canvas #ShinyHunters #hackandleak #EduSec #databreach
-
OK, so it seems that #ShinyHunters breached #Instructure again and replaced login pages with their own message to schools about how to contact them directly.
The Canvas login page were replaced with the message in the screenshot below.
Canvas subsequently replaced the login with "under maintenance" pages.
-
@funnymonkey Thanks for the kind words.
Someone commented on my Instructure post with a comment as "Sysadmin." They wrote:
"Are you effin kidding me! We got an Email from Instructure saying we were impacted and now we have to inform all the students and families in our district.
Why do these ShinyHunters keep attacking the edtech sector?? PowerSchool, infinite campus and now this.
It’s only a Sunday night and law enforcement has still done nothing about these hackers. Regulators really need to hold these companies accountable for poor security practices."
They raise valid points.
#edtech #EduSec #cybersecurity #vendor #supplychain #databreach #hackandleak
-
The NYS Department of Financial Services announced that they settled charges against Delta Dental Insurance Co. and Delta Dental of New York stemming from the 2023 Clop/MOVEit data breach.
The state's investigation found that Delta had violated NYS cybersecurity regs in a number of ways.
Delta has agreed to pay $2.25 million, none of which can be paid by their insurers and they can accept any reimbursement for the payment from any source.
I wonder how many other MOVEit customers who do business in New York are also dealing with NYSDFS.
#databreach #hackandleak #supplychain #0day #DeltaDental #MOVEit #Clop #NYSDFS
-
This won't be the end of this controversy, but a California court did not dismiss claims against Bain Capital over the PowerSchool data breach. In considering the timeline and the private equity firm's actions before and after its acquisition of PowerSchool in 2024, the court noted, in part:
"Post-closing, Bain directed PowerSchool to offshore cybersecurity, engineering, and IT functions to contractors, including offshoring required data-management tools that enabled vendors to bypass consent protocols and access protected school district computers directly.
Bain failed to assess data-breach risks from the offshoring it directed.
Post-closing, Bain directed layoffs of at least 5% of PowerSchool’s workforce, including critical domestic IT staff."
Read more from Womble Bond Dickinson at https://www.womblebonddickinson.com/us/insights/alerts/unprecedented-private-equity-firm-potentially-hook-portfolio-companys-data-breach
h/t, JDSupra, The National Law Review
#EdTech #Liability #negligence #PowerSchool #BainCapital #hackandleak
-
Another #EdTech vendor has allegedly fallen prey to #ShinyHunters in yet another Salesforce-related hack-and-leak incident.
Follett Software markets Aspen, Destiny, and Classroom Library Manager software to schools.
The threat actors claim to have acquired 4 million records with PII and other corporate files, and have given Follett until May 4 to contact them.
Because this is Salesforce related, there may actually be very little identifiable information about students or personnel in the customer support data, unless district or school personnel gave students' names or details in seeking help with the software or specific problems.
I guess we'll find out soon.
-
ABC's recent piece on Matthew Lane seems to have confused some people.
ABC had interviewed and recorded Lane, who was convicted for hacking and extorting a telecom and his role in the PowerSchool incident, before he went to prison.
They just first aired the piece this week at https://abcnews.com/US/addicted-hacking-young-hacker-historic-breach-speaks-1st/story?id=131855776, but Lane has actually been in prison since January.
I hear from him fairly regularly.Much of the media seems to misreport what Lane was charged with and convicted for, as I have reported on my site in a few posts. Read the court records carefully. He was neither charged nor convicted for exfiltrating all the PowerSchool data, yet everyone seems to refer to him as the PowerSchool hacker. As to the ransom that PowerSchool paid, the payment was never found in any wallet or account that Lane owned or had access to. Lane claims that his role was not what the media seems to think it was, but that's why he wasn't charged with some things.
Lane was sentenced to 4 years, but informs me that he will be out in 2027. His sentence has been reduced by his involvement in a program.
And oh --- little note -- both Lane and Conor Brian Fitzpatric ("Pompompurin") are both in Danbury FCI.
-
NEW: A Silent Threat, Loud Consequences: Ransom Group Hits Law Firms Hard
#SilentRansomGroup has leaked data from 38 law firms so far -- and they tell me most law firms do pay them. That means.... (counting on fingers and toes...) they've hit a heckuva lot of law firms.
And I'm beginning to get a feel for how their negotiations go when they fail.
Read about their attack on Wood Smith Henning & Berman at:
-
Note to ALL:
I am starting to use another hashtag called #HackAndLeak that I hope others will also use to describe incidents where there has been no indication that any #ransomware or #malware was deployed.
It's time we stopped calling most attacks "ransomware" when they are really hack and leak incidents.
If you agree, how about sharing/boosting this idea and hashtag shift?
If you don't agree, tell me why so I can argue with you. :))
-
NEW by me:
Silent Ransom Group leaked another big law firm: Orrick, Herrington & Sutcliffe
Silent Ransom Group shared the chat logs of the negotiations with me and also provided some additional details:
@campuscodi @jgreig @aj_vicens
#databreach #HackAndLeak #cybersec
#SilentRansomGroup #SRG #dataleak #Orrick #LawFirmSec -
〝On Breitbart, commenters used the allegations made within the document to discuss polarizing issues in the US such as immigration. One user wrote: “Identify as many non-citizen immigrants as possible in these protests and deport them forthwith. Sign the deportation order, put them in buses and haul their asses to the airport.”〞
#hackAndLeak #fakeNews #disinfo #socialMedia #viral #Iran #protests
-
Im Vorfeld der Europawahl ist Achtsamkeit gefragt – denn Cyberkriminelle versuchen, euch als Wählende zu beeinflussen. Aber können sie das Wahlergebnis auch direkt manipulieren?
#HackAndLeak #Fakenews #SocialMedia #Accountschutz #DeutschlandDigitalSicherBSI
-
Im Vorfeld der Europawahl ist Achtsamkeit gefragt – denn Cyberkriminelle versuchen, euch als Wählende zu beeinflussen. Wir verraten euch, wie sie dabei vorgehen.
#HackAndLeak #Fakenews #SocialMedia #Accountschutz #DeutschlandDigitalSicherBSI