Naomi Diaz reports: New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study. Weill Cornell learned of the incident Sept. 6 and launched an investigation, which determined that certain patient information from Weill Cornell Imaging...

Zack Whittaker reports: Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for...

Shmulik Cohen and Matan Giladi write: Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories: database passwords, cloud keys, API tokens, SSH root logins. Among them: a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records database. 63 organizations, mostly...

Lawrence Abrams reports: DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and...

Grace Atta reports: The Northern Territory health department has backtracked on its claim that only five patients were affected by a privacy breach that led to pregnant women’s confidential medical information being shared with 28,000 followers on Instagram by a “medical observer”. The admission comes after the ABC earlier this week contacted multiple women it...

Debra Ahmed reports: An unprotected database linked to India-based AI software development and IT services company Vibetech exposed 13.7 million records containing credentials and other sensitive information from previous data breaches. The repository was accessible online without security authentication or a password, according to cybersecurity researcher Jeremiah Fowler, whose findings were published by ExpressVPN and...

Source

UpGuard provides another entry for our “No need to hack when it’s leaking” files. This time, it’s Liberating Research.  On August 31, Greg Pollock from UpGuard contacted DataBreaches.net to report a data leak they discovered containing sensitive medical information on almost 100,000 people. By agreement, we both delayed publication to give the responsible firm time...

Source

When asked about the “Luna Moth Files” that had mysteriously appeared online, Silent Ransom Group called them “fake” and insisted they hadn’t had any leak or breach. But they had. Here’s what we know.   When the “Luna Moth Files” appeared on an onion site without anyone claiming responsibility or explaining their origin, DataBreaches asked a...

Source

DataBreaches has reported on a group known as KillSec for almost two years. This time, we get to report on their arrest.  The European Union Agency for Criminal Justice Cooperation issued this press release today: An international group of authorities from nine countries, coordinated by Eurojust and Europol, has successfully shut down a ransomware group...

Source

Zack Whittaker reports today’s nominee for the “No need to hack when it’s leaking” honors: Thousands of databases hosted by development platform Supabase are exposing people’s sensitive information to the public web, new security research by cybersecurity firm UpGuard has found. UpGuard told TechCrunch that it found around 16,000 databases on which some degree of...

Source

Kudos to WBTV for following up on an astute observer’s vulnerability report. David Hodges reports: North Carolina residents summoned for jury duty received notice through a letter in the mail but to request an exemption from jury duty in North Carolina, a person can go online and fill out a jury excuse form. Zach Duda...

Source

The mistaken cc: breach still happens.  Ann Neo reports: An invitation to an event sent by the National Cancer Centre Singapore (NCCS) has sparked privacy concerns after a mailing list exposed the identities, contact details and, in some instances, workplaces of individuals with a genetic cancer condition. The e-mail, an invitation to a Living with...

Source

Shin Da-eun and Park Kang-su report: Korea was not the only country where victims who sent Google removal requests about illegally obtained sexual images ended up having their private information posted online, the Hankyoreh has confirmed. “Photos of me from when I was a minor were distributed without my consent. They were posted on an...

Source