Clop Exploits Oracle E-Business Suite Zero-Days in Massive Extortion Campaign
The Clop ransomware group weaponized CVE-2025-61882 and CVE-2025-61884 to breach nearly 100 organizations including Allianz UK, GlobalLogic, Envoy Air, Harvard, and Washington Post, with ransom demands reaching $50 million.
Panera Bread Data Breach
ShinyHunters breached Panera Bread via Microsoft Entra SSO vishing attack, leaking 5.1 million customer records including names, emails, phone numbers, and addresses after the company refused extortion demands.
Automated Extortion Campaign Wipes 1,400 MongoDB Servers, Demands Bitcoin Ransom
A single threat actor is conducting automated attacks against exposed MongoDB instances, wiping databases and demanding 0.005 BTC per server, with 208,500 instances publicly exposed worldwide.
SoundCloud Data Breach
ShinyHunters breached SoundCloud's internal systems and leaked 29.8 million user records after the company refused extortion demands, exposing email addresses linked to public profile data.
WorldLeaks Publishes 1.4TB of Nike Internal Data
The WorldLeaks extortion group published 1.4TB of Nike intellectual property including product designs, tech packs, and manufacturing documents spanning 2020-2026 after the company didn't pay.
Brightspeed Investigating Breach Claims After Crimson Collective Posts Customer Data
Extortion group Crimson Collective claims to have stolen data on over 1 million Brightspeed customers, including PII, billing details, and payment information. A class-action lawsuit has been filed.