The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Human Resources/HR
Breach intelligence, attack campaigns, and threat reports targeting the Human Resources/HR sector.
Explore Other Sectors
Human Resources/HR Threat Reports
North Korean WaterPlum Campaign: How DPRK IT Workers Infiltrated Global Organizations
In 2025, North Korean threat actors operating under the WaterPlum campaign (also known as Contagious Interview) have successfully infiltrated over 100 countries through fraudulent IT worker schemes. The operation infected at least 30,000 devices and compromised over 7,000 cryptocurrency wallets by embedding fake remote workers into technology companies worldwide. These operatives used sophisticated social engineering, AI-enhanced resumes, and laptop farms to maintain persistent access while generating regular income for the North Korean regime. The campaign demonstrates unprecedented scale, with attackers applying for 170,000 positions over 10 months and successfully placing 76 fraudulent workers across various organizations. This incident highlights the growing threat of state-sponsored insider attacks leveraging remote work vulnerabilities and AI-powered deception techniques. As organizations increasingly rely on distributed workforces and face talent shortages in cybersecurity roles, these sophisticated employment fraud schemes represent a critical evolution in nation-state attack vectors that traditional security controls struggle to detect.
4 hours ago
Kill Chain
Sweden Imposes $183K GDPR Fine on Miljödata After Ransomware Breach Affects 2.2M Citizens
In August 2025, Swedish IT systems provider Miljödata suffered a cyberattack that compromised sensitive data of 2.2 million people across over 200 municipalities. The attackers demanded 1.5 Bitcoin ransom but published the stolen data on the dark web under "Datacarry" when payment was not made. The breach exposed personal identity numbers, contact information, sickness absence records, rehabilitation data, and school incidents involving minors. Sweden's data privacy regulator IMY subsequently fined Miljödata $183,000 for GDPR violations, citing inadequate security measures including insufficient software validation and lack of automated real-time monitoring. This incident highlights the escalating regulatory enforcement of GDPR compliance following ransomware attacks, as European authorities increasingly impose substantial penalties for security negligence that enables data breaches affecting millions of citizens.
2 days ago
Kill Chain
SickKids Hospital Data Breach Exposes Critical Third-Party Security Gaps
In December 2024, Toronto's Hospital for Sick Children (SickKids) disclosed a cybersecurity incident that exposed personal information of current and former employees and job applicants through a vulnerability in third-party software. The breach affected human resources data including names, addresses, phone numbers, and employment details, while clinical systems and patient records remained unaffected. SickKids immediately secured the compromised system, launched an investigation with cybersecurity experts, and began notifying affected individuals while implementing additional security measures. This incident highlights the growing trend of healthcare organizations facing data breaches through third-party vendor vulnerabilities, a critical concern as healthcare becomes increasingly digitized and regulatory scrutiny intensifies under frameworks like HIPAA and emerging privacy legislation.
1 month ago
Kill Chain
Protecting Against Deepfake Job Interview Scams in 2026
In 2026, a surge in deepfake job interview scams has been observed, where cybercriminals utilize AI-generated videos to impersonate recruiters during remote interviews. These sophisticated scams involve creating realistic video representations of fake interviewers, often using deepfake technology to mimic real company employees. The primary objective is to deceive job seekers into divulging sensitive personal information or making upfront payments for nonexistent training or equipment. This trend has led to significant financial losses and identity theft among unsuspecting applicants. ([tuteladigitalis.com](https://www.tuteladigitalis.com/blog/deepfake-job-interviews?utm_source=openai)) The increasing prevalence of these scams underscores the urgent need for enhanced verification processes in remote hiring practices. As deepfake technology becomes more accessible and convincing, both job seekers and employers must adopt more rigorous methods to authenticate identities during virtual interactions to prevent fraud and protect sensitive information.
1 month ago
Kill Chain
Estée Lauder's 2025 Data Breach: A Cautionary Tale of Unpatched Vulnerabilities
In August 2025, Estée Lauder experienced a significant data breach when attackers exploited a critical vulnerability (CVE-2025-61882) in Oracle's E-Business Suite, specifically targeting the BI Publisher Integration component. This flaw allowed unauthenticated remote code execution, enabling the Clop ransomware group to access and exfiltrate sensitive personal information of certain individuals, including full names, postal addresses, email addresses, dates of birth, Social Security numbers, passport numbers, financial account information, health information, and employment details. The breach was identified in June 2026, prompting Estée Lauder to notify affected individuals and offer 24 months of complimentary identity monitoring services through Kroll. ([oracle.com](https://www.oracle.com/security-alerts/alert-cve-2025-61882.html?utm_source=openai)) This incident underscores the critical importance of timely patch management and proactive vulnerability assessments. The exploitation of CVE-2025-61882 by the Clop group highlights a broader trend of ransomware actors leveraging zero-day vulnerabilities to infiltrate enterprise systems, emphasizing the need for organizations to enhance their cybersecurity posture to mitigate such threats. ([computerweekly.com](https://www.computerweekly.com/news/366632397/Oracle-patches-E-Business-suite-targeted-by-Cl0p-ransomware?utm_source=openai))
2 months ago
Kill Chain
Major Brands Impersonated in Phishing Scam Targeting Marketing Professionals
In July 2026, a sophisticated phishing campaign targeted marketing professionals by impersonating recruiters from renowned companies such as Netflix, Coca-Cola, and FIFA. Attackers utilized legitimate platforms like PeopleForce and Salesforce's ExactTarget to send personalized emails, leading recipients through nested redirects to a fake Google sign-in page designed to harvest credentials. This method effectively evaded traditional detection mechanisms, posing significant risks to individuals and organizations. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/big-brand-jobs-scam-marketing-pros-google-accounts?utm_source=openai)) The incident underscores a growing trend of cybercriminals exploiting trusted services and personalized lures to deceive professionals. As the job market becomes increasingly competitive and AI-generated content enhances the realism of such scams, organizations must bolster their defenses against these evolving threats. ([malwarebytes.com](https://www.malwarebytes.com/blog/scams/2026/07/fake-netflix-coca-cola-and-fifa-job-scams-target-marketers?utm_source=openai))
2 months ago
Kill Chain
Nintendo's 2026 Data Breach: A Wake-Up Call for Third-Party Security
In June 2026, Nintendo of America experienced a data breach through TinyPulse, a third-party service used for internal employee surveys. The cybercriminal group ShadowByt3$ claimed responsibility, alleging they exfiltrated approximately 859 MB of sensitive data, including employee names, email addresses, bank statements, and W-9 forms. Nintendo confirmed the breach but stated that only internal survey content from a small subset of employees was affected, with most information dating back several years. The company's internal systems, as well as customer and financial data, remained uncompromised. This incident underscores the growing threat posed by emerging ransomware groups like ShadowByt3$, which, despite their relatively recent appearance, are capable of targeting major corporations through third-party service vulnerabilities. Organizations must reassess their third-party risk management strategies to prevent similar breaches.
3 months ago
Kill Chain
Council of Europe Probes ShinyHunters Data Breach Allegations
In June 2026, the Council of Europe, representing 46 member states and over 700 million people, began investigating claims by the cyber extortion group ShinyHunters of a significant data breach. ShinyHunters alleged they had stolen over 429,000 documents containing sensitive HR and payroll data from multiple departments, including payslips, personnel files, and CVs, encompassing personal and financial information such as names, dates of birth, addresses, salaries, and bank account details. The group threatened to leak the data if their demands were not met by June 16, 2026. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been linked to numerous high-profile data breaches targeting organizations worldwide. Their tactics often involve exfiltrating large volumes of sensitive data and leveraging it for ransom, highlighting the critical need for robust cybersecurity measures and proactive threat detection to safeguard organizational data.
3 months ago
Kill Chain
Oxford University CareerConnect Data Breach Exposes User Information
On May 28, 2026, Oxford University's CareerConnect platform, managed by third-party provider Group GTI, was compromised. Attackers accessed users' first names, last names, email addresses, and encrypted passwords for those not using Single Sign-On (SSO). Students using SSO were less affected, with only their names and email addresses exposed. GTI has since addressed the security vulnerability and implemented additional measures. ([careers.ox.ac.uk](https://www.careers.ox.ac.uk/article/careerconnect-secured-and-safe-to-use-following-data-security-incident?utm_source=openai)) This incident underscores the risks associated with third-party service providers in educational institutions. It highlights the importance of robust security measures and vigilant monitoring to protect sensitive user data from unauthorized access.
3 months ago
Kill Chain
Detection Strategies Against Infiltrating IT Workers
In April 2026, Microsoft reported that the North Korean state-sponsored group Jasper Sleet exploited remote work trends by posing as legitimate IT hires using fabricated identities and AI-assisted deception. These operatives infiltrated organizations to gain trusted access, leading to data theft, extortion, and potential follow-on compromises. The attackers systematically surveyed job postings, crafted convincing applications, and, once hired, accessed sensitive company resources. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/21/detection-strategies-cloud-identities-against-infiltrating-it-workers/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors leveraging AI to enhance social engineering attacks, highlighting the urgent need for organizations to strengthen identity verification processes and monitor for anomalous behaviors during recruitment and onboarding phases. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/21/detection-strategies-cloud-identities-against-infiltrating-it-workers/?utm_source=openai))
5 months ago
Kill Chain
Microsoft 2026: Storm-2755's Payroll Pirate Attack Exposes MFA Vulnerabilities
In April 2026, Microsoft identified a financially motivated threat actor, Storm-2755, targeting Canadian employees through sophisticated 'payroll pirate' attacks. The attackers employed adversary-in-the-middle (AiTM) techniques, using malicious Microsoft 365 sign-in pages to intercept authentication tokens and session cookies. This method allowed them to bypass traditional multi-factor authentication (MFA) and gain unauthorized access to employee accounts. Once inside, they created inbox rules to conceal communications from human resources and manipulated payroll systems, such as Workday, to redirect salary payments to accounts under their control. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/?utm_source=openai)) This incident underscores the evolving nature of business email compromise (BEC) schemes, highlighting the need for organizations to implement phishing-resistant MFA solutions and monitor for anomalous activities within their systems. The use of AiTM tactics to circumvent standard security measures signifies a shift in cybercriminal strategies, emphasizing the importance of continuous vigilance and adaptive security protocols. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/?utm_source=openai))
5 months ago
Kill Chain
Storm-2755: Unveiling the 2026 Payroll Pirate AiTM Attack in Canada
In April 2026, a financially motivated threat actor identified as Storm-2755 targeted Canadian employees through a sophisticated 'payroll pirate' campaign. Utilizing adversary-in-the-middle (AiTM) phishing techniques, the attackers intercepted authentication sessions to gain unauthorized access to employee profiles on HR platforms. This access enabled them to divert salary payments to accounts under their control, resulting in direct financial losses for both individuals and organizations. The campaign was notable for its use of malvertising and search engine optimization (SEO) poisoning to lure victims to malicious sites, effectively bypassing traditional multi-factor authentication (MFA) methods. This incident underscores the evolving nature of cyber threats, particularly the increasing prevalence of AiTM attacks that can circumvent standard MFA protections. Organizations must recognize the limitations of traditional security measures and adopt more robust, phishing-resistant authentication methods to safeguard against such sophisticated attacks.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports