The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Legal Services
Breach intelligence, attack campaigns, and threat reports targeting the Legal Services sector.
Explore Other Sectors
Legal Services Threat Reports
Ernst & Young's 2026 Data Breach: A Supply Chain Attack by ShinyHunters
In April 2026, Ernst & Young (EY) detected unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded multiple documents containing personal and financial information related to client tax filings. EY secured its systems, removed unauthorized access, and notified federal law enforcement. Affected clients were offered 24 months of identity monitoring and restoration services through Experian. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/?utm_source=openai)) On July 27, 2026, the ShinyHunters extortion gang claimed responsibility for the breach, alleging they obtained EY credentials via a supply-chain attack. They threatened to release the stolen data if EY did not contact them by July 31, 2026. EY has not confirmed ShinyHunters' involvement. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/?utm_source=openai))
1 month ago
Kill Chain
ESAFENET CDG 3 Default Password Exploitation in 2026
In July 2026, security researchers observed increased scanning activity targeting ESAFENET's CDG 3 Document Management System, specifically exploiting default administrative credentials. ESAFENET, a company specializing in secure document management and data leakage prevention, has previously faced vulnerabilities such as SQL Injection and Cross-Site Scripting. The current scans focus on the 'secadmin' account with the default password 'Est@Spc820', which, despite meeting complexity requirements, is widely known and documented in exploit scripts. This exploitation could grant unauthorized access to sensitive documents and administrative functions, posing significant security risks. The resurgence of attacks leveraging default credentials underscores the critical need for organizations to change default passwords upon deployment. This incident highlights the ongoing threat posed by default credentials and the importance of proactive security measures to prevent unauthorized access.
2 months ago
Kill Chain
Illinois Man Sentenced for Hacking 750 Women's Snapchat Accounts
Between May 2020 and February 2021, Kyle Svara, a 26-year-old from Illinois, orchestrated a phishing campaign targeting over 4,500 women by impersonating a Snap Inc. representative. Utilizing anonymized phone numbers, he deceived victims into providing their Snapchat access codes, successfully compromising approximately 517 accounts to steal nude or semi-nude photos. Svara further secured these accounts by activating two-factor authentication, effectively locking out the rightful owners. The stolen images were subsequently traded or sold online. In July 2026, Svara was sentenced to 76 months in prison and three years of supervised release for his actions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/man-gets-six-years-for-hacking-750-womens-snapchat-accounts/?utm_source=openai)) This incident underscores the persistent threat of social engineering attacks and the critical importance of user education on recognizing and resisting phishing attempts. The case also highlights the necessity for robust security measures and vigilant monitoring to protect personal data from unauthorized access and exploitation.
2 months ago
Kill Chain
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
In July 2026, cybersecurity firm ReliaQuest identified a campaign where attackers compromised Wi-Fi devices in hotels and conference centers to hijack DNS settings. This manipulation redirected users attempting to access legitimate Microsoft 365 login pages to attacker-controlled phishing sites, leading to credential theft. The campaign, active since at least June 2026, affected various sectors, including financial services, healthcare, and retail, across multiple countries such as the U.S., India, and Saudi Arabia. The attackers exploited weakly protected management interfaces or unpatched vulnerabilities in Wi-Fi gateways to gain administrative access and alter DNS configurations. This method allowed them to intercept sensitive business information and communications without direct access to the victims' devices. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai)) This incident underscores the evolving tactics of threat actors, who are increasingly targeting network infrastructure to bypass traditional endpoint security measures. The use of DNS hijacking to facilitate adversary-in-the-middle attacks highlights the need for organizations to secure all network devices, including those in transient environments like hotels and conference centers. Implementing robust security practices, such as using always-on, full-tunnel VPNs and encrypted DNS, is crucial to mitigate such threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai))
2 months ago
Kill Chain
Critical Vulnerability in Adobe Chrome Extension: CVE-2026-48294
In June 2026, a critical vulnerability (CVE-2026-48294) was discovered in the Adobe Acrobat PDF Extension for Chrome, affecting versions up to 26.5.2.2. This Universal Cross-Site Scripting (UXSS) flaw allowed attackers to bypass the browser's same-origin policy, enabling unauthorized access to users' session data across different web origins. Exploitation required user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page. The vulnerability posed a significant risk to user confidentiality, as it could expose sensitive information from authenticated sessions. The discovery of this vulnerability underscores the ongoing challenges in securing browser extensions, which often have elevated privileges and can interact with various web pages. It highlights the importance of rigorous security assessments and prompt patching of extensions to prevent potential data breaches and maintain user trust.
2 months ago
Kill Chain
Critical Vulnerability in Adobe Acrobat Chrome Extension Exposes User Data
In June 2026, a critical vulnerability (CVE-2026-48294) was identified in the Adobe Acrobat PDF Extension for Chrome, affecting versions up to 26.5.2.2. This Universal Cross-Site Scripting (UXSS) flaw allowed attackers to bypass the browser's same-origin policy, enabling unauthorized access to users' session data across different web origins. Exploitation required user interaction, such as visiting a maliciously crafted URL or interacting with a compromised webpage. The vulnerability was promptly patched by Adobe following its disclosure. The incident underscores the persistent risks associated with browser extensions, especially those with extensive user bases like Adobe Acrobat's, which boasts over 314 million users. It highlights the importance of regular security assessments and prompt patching to mitigate potential data breaches stemming from such vulnerabilities.
2 months ago
Kill Chain
Unveiling Project CAV3RN: APT34's Covert Cyberespionage Tactics
In June 2026, Kaspersky's Threat Intelligence Reporting service detailed Project CAV3RN, a sophisticated modular cyberespionage framework targeting Israeli entities. Active since December 2025, the framework underwent a significant architectural shift in April 2026, transitioning from a three-component system to a controller-based architecture with a WebSocket-enabled C2 communication component and an extensible plugin system. Subsequently, a new .NET Native AOT communication module was identified, utilizing Outlook calendar events accessed via Microsoft Graph for command and control (C2) communications. This module also employs a DNS AAAA-based recovery mechanism to retrieve configuration settings if Microsoft Graph authentication fails. ([securelist.com](https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/?utm_source=openai)) The emergence of Project CAV3RN underscores the evolving tactics of state-sponsored threat actors, particularly the Iranian-linked group APT34 (OilRig). Their innovative use of legitimate services like Microsoft Graph and DNS for covert communications highlights the need for organizations to enhance monitoring of cloud services and implement robust detection mechanisms to identify and mitigate such sophisticated threats.
2 months ago
Kill Chain
Apple's Hide My Email Vulnerability: A Year-Long Privacy Breach
In July 2026, a significant vulnerability was discovered in Apple's 'Hide My Email' feature, which is designed to protect users' real email addresses by generating random aliases. Security researcher Tyler Murphy identified that this flaw allowed attackers to unmask users' actual email addresses, thereby compromising their privacy. Despite being reported to Apple in June 2025, the issue remained unresolved for over a year, with Apple deploying a fix only on July 3, 2026. This delay has raised concerns about the effectiveness of Apple's privacy safeguards and its responsiveness to security vulnerabilities. The incident underscores the critical importance of timely vulnerability management and transparent communication in maintaining user trust. It also highlights the need for organizations to regularly audit and test their privacy features to ensure they function as intended, especially when user data protection is a key selling point.
2 months ago
Kill Chain
Ernst & Young Data Breach Exposes Client Tax Information in 2026
In April 2026, Ernst & Young (EY) identified unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded documents containing personal and financial information used in tax filings. EY promptly secured the affected systems, notified federal law enforcement, and offered 24 months of identity monitoring services to impacted clients. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/?utm_source=openai)) This incident underscores the critical need for robust third-party risk management, especially as organizations increasingly rely on external platforms for sensitive operations. The breach highlights the importance of continuous monitoring and rapid response strategies to mitigate potential damages from such compromises.
2 months ago
Kill Chain
ACR Stealer's ClickFix Campaign: A Wake-Up Call for Cybersecurity
In mid-2026, the ACR Stealer malware exploited ClickFix social engineering tactics to infiltrate enterprise networks. By deceiving users into executing commands via fake verification prompts, attackers deployed two primary infection chains: one utilizing WebDAV and PowerShell scripts, and another employing mshta.exe with obfuscated PowerShell. Both methods aimed to exfiltrate browser-stored credentials, session tokens, and sensitive Microsoft 365 documents, including files from OneDrive and SharePoint. This incident underscores a significant shift towards sophisticated social engineering attacks that bypass traditional security measures. The reliance on user interaction highlights the critical need for enhanced user awareness and robust endpoint protection strategies to mitigate such threats.
2 months ago
Kill Chain
Critical Vulnerability in Claude Chrome Extension Exposes User Data
In July 2026, a critical vulnerability was discovered in Anthropic's Claude for Chrome browser extension. This flaw allowed malicious extensions to simulate user interactions, triggering predefined AI actions without user consent. Exploiting this, attackers could access connected services such as Gmail, Google Docs, Google Calendar, and Salesforce, leading to unauthorized data access and potential data exfiltration. The vulnerability stemmed from the extension's failure to verify the origin of click events, accepting synthetic events generated by other extensions as legitimate user actions. This incident underscores the growing risks associated with browser extensions and their integration with AI-powered services. As organizations increasingly adopt such tools to enhance productivity, ensuring robust security measures and thorough validation of user interactions becomes imperative to prevent unauthorized access and data breaches.
2 months ago
Kill Chain
Zoom Addresses Critical Windows Vulnerability CVE-2026-53412
In July 2026, Zoom addressed a critical vulnerability (CVE-2026-53412) in its Windows clients, including Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK. This flaw, stemming from improper input validation, could allow unauthenticated attackers to take over user accounts via network access. The vulnerability received a CVSS score of 9.8, indicating its severity. Users are urged to update to the latest versions to mitigate this risk. The incident underscores the importance of timely software updates and robust input validation practices. With the increasing reliance on virtual communication platforms, such vulnerabilities pose significant risks to user security and privacy. Organizations must remain vigilant and proactive in applying security patches to prevent potential exploits.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports