Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 220 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2629–2640 / 3797 reports
Washington Hotel Japan Ransomware Attack: A 2026 Case Study
Hospitality8 months ago

Washington Hotel Japan Ransomware Attack: A 2026 Case Study

In February 2026, Washington Hotel, a prominent hospitality chain in Japan, experienced a ransomware attack that compromised its servers and exposed various business data. The breach occurred on February 13, 2026, at 22:00 local time. Upon detection, the IT staff promptly disconnected the affected servers from the internet to prevent further spread. An internal task force, along with external cybersecurity experts, was established to assess the impact and coordinate recovery efforts. While customer data is believed to be secure, as it is stored on separate servers managed by a different company, some operational disruptions, including temporary unavailability of credit card terminals, were reported. The financial impact is under review, and the company is collaborating with law enforcement and cybersecurity professionals to investigate the incident. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/washington-hotel-in-japan-discloses-ransomware-infection-incident/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting the hospitality industry, particularly in Japan. Recent data indicates a significant increase in such attacks, with small and medium-sized enterprises being primary targets. The Washington Hotel breach highlights the urgent need for robust cybersecurity measures and proactive strategies to mitigate the risks associated with ransomware and other cyber threats. ([linkedin.com](https://www.linkedin.com/pulse/ransomware-attacks-targeting-japanese-companies-increase-baek-glpcc?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Eurail 2026 Data Breach: What You Need to Know
Transportation8 months ago

Eurail 2026 Data Breach: What You Need to Know

In January 2026, Eurail B.V., the operator of the Interrail ticketing platform, experienced a security breach resulting in unauthorized access to customer data. The compromised information includes names, contact details, passport information, and, for some DiscoverEU participants, bank account references and health data. Upon discovery, Eurail secured its systems, initiated an investigation with external cybersecurity specialists, and began notifying affected customers and regulatory authorities. As of mid-January 2026, there is no evidence of data misuse or public disclosure. This incident underscores the critical importance of robust cybersecurity measures in the travel industry, especially given the sensitive nature of the data involved. Organizations must remain vigilant against evolving cyber threats and ensure compliance with data protection regulations to safeguard customer information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Lithuania's Digital Infrastructure Compromised by AI-Driven Social Engineering Attacks in 2026

Lithuania's Digital Infrastructure Compromised by AI-Driven Social Engineering Attacks in 2026

In early 2026, Lithuania faced a surge in AI-driven social engineering attacks targeting its digital infrastructure. Cybercriminals utilized advanced AI tools to craft highly personalized phishing campaigns, deepfake videos, and voice-cloned calls, deceiving individuals into divulging sensitive information. These sophisticated attacks led to significant data breaches across various sectors, including finance and public services, compromising personal data and undermining trust in digital platforms. This incident underscores the escalating threat of AI-enhanced cyber fraud, highlighting the need for robust cybersecurity measures and public awareness. As AI technologies become more accessible, the potential for their misuse in cyberattacks grows, necessitating proactive defense strategies and continuous monitoring to safeguard digital ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Outlook Add-In Hijack Exposes 4,000 Microsoft Accounts
Financial Services8 months ago

Outlook Add-In Hijack Exposes 4,000 Microsoft Accounts

In early February 2026, a threat actor exploited an abandoned Microsoft Outlook add-in named AgreeTo, originally a meeting scheduling tool, to conduct a phishing campaign. By claiming the add-in's orphaned URL, the attacker replaced its content with a phishing kit that mimicked Microsoft's sign-in page, leading to the compromise of over 4,000 Microsoft account credentials. This incident underscores the risks associated with unmaintained third-party applications and highlights the need for rigorous oversight of software supply chains. The attack also demonstrates how adversaries can leverage trusted platforms to distribute malicious content, emphasizing the importance of continuous monitoring and validation of third-party integrations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
OpenClaw 2026 Infostealer Vidar Breach: A Wake-Up Call for AI Security

OpenClaw 2026 Infostealer Vidar Breach: A Wake-Up Call for AI Security

In February 2026, cybersecurity researchers identified a significant security breach involving OpenClaw, an open-source AI agent platform. An infostealer malware, likely a variant of Vidar, infiltrated a user's system and exfiltrated sensitive OpenClaw configuration files. These files contained critical data, including API keys for AI services, OAuth tokens for platforms like Gmail and Slack, and detailed operational guidelines of the AI agent. The theft of these credentials enabled attackers to remotely access and control the victim's OpenClaw instance, potentially leading to unauthorized actions and data exfiltration. This incident underscores the evolving threat landscape where infostealer malware targets AI agent configurations, highlighting the urgent need for enhanced security measures in AI integrations. As AI agents become more embedded in professional workflows, they present attractive targets for cybercriminals aiming to exploit their access to sensitive data and systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Major Password Managers Exposed: Critical Vulnerabilities Affect Millions
Financial Services8 months ago

Major Password Managers Exposed: Critical Vulnerabilities Affect Millions

In February 2026, researchers from ETH Zurich and Università della Svizzera italiana identified critical vulnerabilities in three major cloud-based password managers: Bitwarden, LastPass, and Dashlane. The study revealed 25 distinct attacks that could compromise user vaults, ranging from integrity violations to complete access to all stored passwords. These vulnerabilities exploit flaws in key escrow mechanisms, item-level encryption, sharing features, and backward compatibility with legacy code. Collectively, these password managers serve over 60 million users and nearly 125,000 businesses. ([thehackernews.com](https://thehackernews.com/2026/02/study-uncovers-25-password-recovery.html?utm_source=openai)) This incident underscores the importance of scrutinizing the security claims of widely-used password management solutions. As cyber threats evolve, organizations must ensure that their security tools are resilient against sophisticated attacks, especially those targeting foundational security mechanisms like zero-knowledge encryption.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Flickr's 2026 Data Breach: A Wake-Up Call for Third-Party Security
Internet9 months ago

Flickr's 2026 Data Breach: A Wake-Up Call for Third-Party Security

In early February 2026, Flickr, a prominent photo-sharing platform, identified a security vulnerability within a third-party email service provider's system. This flaw potentially exposed user data, including names, email addresses, usernames, account types, IP addresses, general locations, and Flickr activity. Importantly, passwords and payment card information remained secure. Upon discovery on February 5, Flickr promptly disabled access to the compromised system and initiated a comprehensive investigation to assess the breach's scope and impact. ([forbes.com](https://www.forbes.com/sites/daveywinder/2026/02/06/photo-sharing-platform-flickr-issues-data-breach-warning/?utm_source=openai)) This incident underscores the critical importance of robust security measures and vigilant monitoring of third-party service providers. As organizations increasingly rely on external vendors, ensuring these partners adhere to stringent security protocols is essential to safeguard sensitive user information and maintain trust.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
SmarterMail 2026 Ransomware Attack via RCE Vulnerability

SmarterMail 2026 Ransomware Attack via RCE Vulnerability

In early 2026, a critical vulnerability (CVE-2026-24423) was discovered in SmarterTools' SmarterMail email server, allowing unauthenticated remote code execution via the ConnectToHub API. This flaw was actively exploited by ransomware actors, leading to unauthorized access and potential data breaches. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching by February 26, 2026. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-warns-of-smartermail-rce-flaw-used-in-ransomware-attacks/?utm_source=openai)) The exploitation of this vulnerability underscores the increasing targeting of email servers by cybercriminals, emphasizing the need for organizations to promptly apply security updates and monitor for unusual activities to mitigate potential threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
dYdX Supply Chain Attack Exposes Cryptocurrency Wallets to Theft
Financial Services9 months ago

dYdX Supply Chain Attack Exposes Cryptocurrency Wallets to Theft

In early February 2026, dYdX, a decentralized cryptocurrency exchange, experienced a significant supply chain attack. Malicious actors compromised legitimate npm and PyPI packages—@dydxprotocol/v4-client-js and dydx-v4-client, respectively—by publishing infected versions using legitimate developer credentials. These compromised packages were designed to steal wallet credentials and, in the case of the PyPI package, deploy a remote access trojan (RAT) for executing arbitrary commands on affected systems. The attack underscores the vulnerabilities inherent in software supply chains and the potential for widespread impact when trusted distribution channels are exploited. This incident highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels, following similar attacks in 2022 and 2024. The coordinated cross-ecosystem deployment and sophisticated obfuscation techniques suggest that threat actors had direct access to publishing infrastructure, emphasizing the need for enhanced security measures in software development and distribution processes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Moltbook's 2026 Security Breach: A Cautionary Tale of Cloud Misconfiguration

Moltbook's 2026 Security Breach: A Cautionary Tale of Cloud Misconfiguration

In late January 2026, Moltbook, an AI-exclusive social platform, suffered a significant security breach due to a misconfigured Supabase database. This vulnerability exposed sensitive data, including 1.5 million AI agent API tokens, 35,000 email addresses, and private messages. The misconfiguration allowed unauthorized access and modification of agent records, leading to potential impersonation and data manipulation. Promptly addressing the issue, Moltbook resolved the vulnerability within hours of disclosure. ([techradar.com](https://www.techradar.com/pro/security/ai-agent-social-media-network-moltbook-is-a-security-disaster-millions-of-credentials-and-other-details-left-unsecured?utm_source=openai)) This incident underscores the critical importance of robust security configurations in cloud-based platforms, especially those handling sensitive user data. It highlights the risks associated with rapid deployment of AI-driven services without comprehensive security assessments, emphasizing the need for stringent access controls and regular security audits to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical OS Command Injection Vulnerability in React Native CLI's Metro Development Server

Critical OS Command Injection Vulnerability in React Native CLI's Metro Development Server

In November 2025, a critical vulnerability (CVE-2025-11953) was identified in the React Native Community CLI's Metro Development Server. This flaw allowed unauthenticated attackers to execute arbitrary commands on the host system by sending specially crafted POST requests to the server's '/open-url' endpoint. The vulnerability affected versions 4.8.0 through 20.0.0-alpha.2 and was patched in version 20.0.0. Developers were advised to update their installations promptly or restrict the server's network exposure to mitigate the risk. ([research.jfrog.com](https://research.jfrog.com/vulnerabilities/react-native-cli-command-injection-jfsa-2025-001495618/?utm_source=openai)) The incident underscores the importance of securing development tools and environments, as vulnerabilities in such tools can serve as entry points for attackers. It also highlights the need for developers to stay vigilant about applying security patches and configuring development servers securely to prevent unauthorized access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zendesk 2026 Spam Campaign: A Wake-Up Call for Securing Support Systems

Zendesk 2026 Spam Campaign: A Wake-Up Call for Securing Support Systems

In January 2026, a massive global spam campaign exploited unsecured Zendesk support systems, allowing attackers to flood users' inboxes with automated 'ticket received' emails. By abusing Zendesk instances that permitted unverified users to submit support tickets, attackers generated numerous fake tickets using large email lists. This resulted in victims receiving confirmation emails from legitimate Zendesk domains, enabling the messages to bypass spam filters and inundate users' inboxes. Affected organizations included major companies such as Discord, Tinder, Riot Games, Dropbox, CD Projekt, NordVPN, and various Tennessee state departments. Notably, the spam emails did not contain malware or phishing links but featured bizarre and seemingly pointless messages, such as fake law enforcement takedown requests and promotional offers. Zendesk acknowledged the issue and responded by implementing new safety measures, including enhanced monitoring and stricter activity limits to detect and halt spam efforts more effectively. The campaign began on January 18, 2026, but its current status remains unclear. ([techradar.com](https://www.techradar.com/pro/security/zendesk-tickets-hijacked-in-massive-spam-campaign?utm_source=openai)) This incident underscores the critical importance of securing customer support platforms against abuse. The exploitation of Zendesk's ticketing system highlights a broader trend where attackers leverage legitimate services to conduct spam campaigns, thereby evading traditional security measures. Organizations must proactively assess and fortify their support systems to prevent similar abuses, ensuring that such platforms do not become vectors for large-scale spam or other malicious activities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Looking for threats in a different sector?

Browse All Threat Reports