BREACH & RANSOMWARE

A Binance DevOps engineer’s laptop was hacked, giving attackers access to privileged cloud credentials that were used to move roughly $6.3 billion in cryptocurrency. The breach highlights the importance of strong identity and access controls for audit readiness.

A tampered Claude Code extension published on the Open VSX marketplace installed a persistent SSH backdoor on developers' machines and exfiltrated host details and potential cloud credentials. The supply‑chain compromise highlights the need for rigorous third‑party software oversight to satisfy audit‑readiness requirements.

Hacktivists published a data set containing names, titles, emails, phone numbers, and tool access for over 41 000 DHS staff, exposing ICE, CBP, and CISA personnel. The incident highlights the importance of robust IAM controls and audit‑ready evidence for identity‑related risks.

A compromised DevOps engineer’s laptop let attackers withdraw $6.3 billion from Binance, the largest crypto theft to date. The breach highlights the importance of privileged‑access controls and continuous monitoring for audit readiness.

Attackers impersonating corporate IT staff used only employee names and email addresses to convince users to open remote‑access sessions, culminating in ransomware deployment and data exfiltration. The episode underscores the importance of security‑awareness training and verified remote‑access procedures for audit readiness.

A hacktivist posted a database with names, titles, work emails and phone numbers for more than 40,000 DHS staff. The breach underscores the importance of robust IAM controls and auditable access‑monitoring for compliance readiness.

Binance reported a security incident that froze nearly $3 billion of assets and put $6.3 billion at risk. The event underscores the importance of strong privileged‑access and transaction‑monitoring controls for audit readiness.

Binance reported a suspected theft of $5.8 billion in cryptocurrency, with $3 billion of assets frozen while investigators trace the funds. The incident highlights the need for robust incident‑response and evidentiary controls for audit readiness.

Binance reports billions of dollars moving from its hot wallets to a new Ethereum address, prompting an investigation into a possible large‑scale theft. The event underscores the importance of strong privileged‑access controls for crypto‑asset custodians.

Attackers accessed Amadeus’s reservation platform used by Japan Airlines, exposing personal and travel details for 92 000 passengers. No payment data were taken, but the breach underscores the importance of continuous vendor oversight for audit readiness.

Polymarket halted its exchange after a compromised performance‑monitoring service delivered malicious JavaScript that siphoned $2.5 M in user tokens. The breach highlights the importance of continuous third‑party oversight for audit readiness.

Researchers confirmed that a Chinese‑linked group leveraged the PHP2Shell vulnerabilities (CVE‑2026‑109618/109619) and a Linux firewall bug (CVE‑2026‑46300) to gain root access on 24 firewalls hosting U.S. government services. The breach demonstrates why rapid vulnerability remediation is a core control for audit readiness.

General Motors settled with 36 states for $220 million after regulators said the automaker sold driver location and behavior data to data brokers without explicit consent. The case underscores the importance of documented consent processes for audit and compliance readiness.

A counterfeit iOS app called Padre Terminal impersonated a legitimate Solana trading platform and stole private keys from 27 wallets, resulting in $23,000 loss. The breach underscores the importance of credential‑protection controls for audit readiness.

CoinDCX confirmed a $16 million theft after attackers accessed an outdated wallet that accumulated funds during an automated transfer service outage. The breach underscores the need for robust asset decommissioning and continuous configuration monitoring to satisfy control‑assurance requirements.

Sony Network Communications confirmed that attackers accessed its subscriber database, leaking personal data and 54 k email passwords. The breach underscores the need for strong authentication controls and audit‑ready evidence of access‑management safeguards.

Hacktivists accessed an Okta SSO tenant used by the Department of Homeland Security and published personal and assignment data for over 41,000 employees. The breach underscores the importance of strong IAM controls and continuous monitoring for audit readiness.

A ransomware gang called BYOD crippled the University of New Mexico Health Sciences Center, forcing ambulance diversions, surgery cancellations, and the exposure of personal data for thousands of students and staff. The breach underscores the need for robust incident‑response and backup controls to meet audit‑readiness expectations.

A cyber intrusion forced the Bankruptcy Noticing Center, the system that distributes federal bankruptcy notices, offline for weeks. No PII was taken, but the outage triggered an emergency declaration and highlighted the need for robust incident‑response and continuity controls.

A cyberattack forced Belgium’s main online tax portal offline just before a filing deadline, prompting an investigation and deadline extension. The incident highlights the need for robust incident‑response and continuity controls to satisfy audit and trust requirements.

A ransomware group called BYOD crippled the University of New Mexico Health Sciences Center, shutting down hospital systems and threatening stolen patient data. The breach highlights the importance of incident‑response controls and security‑awareness training for healthcare organizations.