Fanlore wiki breach exposes 144,520 accounts with email and password hashes
OTW disclosed unauthorized access to its Fanlore wiki, exposing ~145k emails, usernames, and MD5/PBKDF2 password hashes.
Read summary →
Source: Have I Been Pwned
Knowledge Center
Identity threat intelligence
A running digest of identity-related exploit and breach news — new zero-days, exposed credential dumps, and directory-security advisories — each summarized in our own words with a link to the primary source.
-
-
Oz Hair and Beauty Breach Exposes ~2M Customer Records in Extortion Attack
Australian retailer Oz Hair and Beauty had nearly 2M customer records leaked after an xpl0itrs extortion attack in August 2026.
Read summary → Source: Have I Been Pwned -
CISA Flags Actively Exploited SharePoint Auth and macOS Authentication Flaws in KEV
CISA added four exploited vulnerabilities to its KEV Catalog, including a SharePoint weak authentication bug and a macOS improper authentication flaw.
Read summary → Source: CISA Cybersecurity Advisories -
ANDRITZ HIPASE-250 SCADA flaws expose credentials via recoverable passwords and hard-coded creds
CISA advisory flags multiple auth-related flaws in ANDRITZ HIPASE-250/250 SCALA energy devices, including reversible password storage and hard-coded credentials.
Read summary → Source: CISA Cybersecurity Advisories -
Hard-Coded Credential in Flow Neuroscience FL-100 Allows Auth Bypass via Bluetooth
A shared hard-coded credential in the FL-100 brain stimulation device lets nearby attackers bypass authentication and alter stimulation parameters.
Read summary → Source: CISA Cybersecurity Advisories -
Johnson Controls Airwall Flaws Allow Auth Bypass via Hardcoded Crypto Key
CISA advisory warns Airwall <=4.0.4 contains a hardcoded cryptographic key and path traversal flaw enabling authentication bypass and data decryption.
Read summary → Source: CISA Cybersecurity Advisories -
Siemens License Server Flaws Enable Local Privilege Escalation to Root
Two vulnerabilities in Siemens License Server allow local privilege escalation and arbitrary file reads, with one leading to full root compromise.
Read summary → Source: CISA Cybersecurity Advisories -
Siemens LOGO! Soft Comfort flaws expose master key and unsalted password hashes
Hardcoded AES key and unsalted hashing in Siemens LOGO! Soft Comfort let local attackers decrypt project data and crack passwords.
Read summary → Source: CISA Cybersecurity Advisories -
RingCentral breach exposes 1.6M accounts in ShinyHunters extortion campaign
ShinyHunters leaked data on ~1.6M RingCentral users including emails, names, addresses and phone numbers after a July 2026 extortion attempt.
Read summary → Source: Have I Been Pwned -
CISA Flags Critical Auth Flaws in Mira Hormone Monitor and Android App
CISA advisory details multiple authentication and credential vulnerabilities in Mira's health monitor and app that could enable full account takeover.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Advisory: Gunra RaaS Exploits VPN/RDP Access for Double Extortion
CISA details Gunra ransomware-as-a-service, which abuses exposed VPN and RDP infrastructure and lateral movement to encrypt and exfiltrate data.
Read summary → Source: CISA Cybersecurity Advisories -
Alcon Breach Exposes 218K Accounts in ShinyHunters Extortion Campaign
Eye care firm Alcon named in a ShinyHunters 'pay or leak' extortion; leaked data includes 218k emails, names, phone numbers and addresses.
Read summary → Source: Have I Been Pwned -
Brinks Home breach exposes 732K accounts in ShinyHunters extortion leak
ShinyHunters published data allegedly stolen from Brinks Home, exposing 732K email addresses plus personal and partial payment details of leads, customers and staff.
Read summary → Source: Have I Been Pwned -
Exact Sciences breach exposes 10.9M records in ShinyHunters extortion
ShinyHunters published stolen Exact Sciences data affecting 10.9M people, including emails, contact details and health records.
Read summary → Source: Have I Been Pwned -
Johnson Controls TL280 Ships With Hardcoded Credentials (CVE-2026-27871)
CISA advisory warns Johnson Controls TL280 devices below v5.63 contain embedded credentials and a weak cryptographic algorithm exposing sensitive data.
Read summary → Source: CISA Cybersecurity Advisories -
Inter-Con Security breach exposes 276K accounts in ShinyHunters extortion leak
ShinyHunters published data allegedly stolen from Inter-Con Security, exposing 276K email addresses plus names, addresses, job titles and phone numbers.
Read summary → Source: Have I Been Pwned -
CISA Adds N-able N-central Auth Bypass to KEV Amid Active Exploitation
Three vulnerabilities added to CISA's KEV Catalog, including an actively exploited authentication bypass in N-able N-central RMM.
Read summary → Source: CISA Cybersecurity Advisories -
Hard-coded Bluetooth key in Acrisure KARR car alarms enables unauthorized vehicle control
A shared, hard-coded Bluetooth authentication key in KARR BT and DR-100 anti-theft systems lets nearby attackers unlock doors and bypass immobilizers.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Flags Actively Exploited N-able N-central Auth Bypass in KEV Catalog
CVE-2026-18577, an authentication bypass in N-able N-central, is under active exploitation and added to CISA's KEV Catalog.
Read summary → Source: CISA Cybersecurity Advisories -
SplitVPN breach exposes 865K accounts including emails and partial card data
Russian VPN service SplitVPN (formerly NotVPN) suffered a July 2026 breach exposing 865K email addresses, IPs, and partial payment card details.
Read summary → Source: Have I Been Pwned -
Toptech RCU II+/Multiload II+ Expose Unauthenticated Root Debug Interface
CISA warns of a missing-authentication flaw (CVE-2026-12562) giving unauthenticated attackers full root access to Toptech energy-sector devices.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Flags Actively-Exploited Hard-Coded Password in Cisco Secure Firewall Management Center
CVE-2026-20316, a hard-coded password flaw in Cisco Secure FMC, is under active exploitation and added to CISA's KEV Catalog.
Read summary → Source: CISA Cybersecurity Advisories -
Houston City College breach exposes 831,642 accounts in ShinyHunters extortion
A ShinyHunters extortion campaign leaked 832k email addresses plus names, addresses, phone numbers, and academic records from Houston City College.
Read summary → Source: Have I Been Pwned -
igloohome Smart Lock App Exposed Backend Secrets Allowing Unauthenticated Access
A CISA advisory flags CVE-2026-16581 in the igloohome Smart Lock Android app, where hardcoded sensitive data let attackers reach insufficiently protected backend services.
Read summary → Source: CISA Cybersecurity Advisories -
MikroTik RouterOS API Flaw Allows Unlimited Password Guessing (CVE-2026-16347)
CISA warns MikroTik RouterOS and Cloud Hosted Router lack effective brute-force protections, letting attackers rapidly guess credentials for unauthorized access.
Read summary → Source: CISA Cybersecurity Advisories -
Siemens Mendix Runtime Access-Rule Flaw Enables Privilege Escalation (CVE-2026-7891)
A documentation gap around the System.User entity in Siemens Mendix leads to overly permissive access rules, risking data exposure and privilege escalation.
Read summary → Source: CISA Cybersecurity Advisories -
Panduit IntraVUE Flaws Expose Plaintext Credentials via API
CISA advisory flags multiple IntraVUE vulnerabilities, including plaintext password storage that leaks cleartext credentials through the API.
Read summary → Source: CISA Cybersecurity Advisories -
Russian APT LAUNDRY BEAR Exploits Zimbra Zero-Day in Phishing Campaign
CISA warns that Russian state-backed actors are targeting Zimbra Collaboration Suite users via phishing and a novel zero-day to steal email data.
Read summary → Source: CISA Cybersecurity Advisories -
Weintek cMT3092X HMI Flaws Allow Privilege Escalation and Credential Exposure
CISA advisory details vulnerabilities in Weintek cMT3092X HMI that let low-privileged users escalate privileges and view other users' credentials.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Flags Actively Exploited Check Point SmartConsole Auth Bypass in KEV Catalog
CISA added two actively exploited flaws to its KEV Catalog, including a Check Point SmartConsole improper authentication bug directly relevant to identity security.
Read summary → Source: CISA Cybersecurity Advisories -
Auth Bypass in Tycon TPDIN-Monitor-WEB2 Grants Full Admin Access
CISA advisory warns a CVSS 9.8 auth bypass lets unauthenticated attackers gain admin sessions and access stored credentials on Tycon monitoring devices.
Read summary → Source: CISA Cybersecurity Advisories -
Rockwell FactoryTalk Flaw Lets Attackers Forge JWTs to Impersonate Users
CVE-2026-10714 in FactoryTalk Services Platform allows JWT signature bypass, enabling low-privilege users to impersonate authorized accounts.
Read summary → Source: CISA Cybersecurity Advisories -
Siemens IAM Client Unquoted Search Path Flaw Enables Local Privilege Escalation
An unquoted search path vulnerability in Siemens IAM Client lets an authenticated local attacker escalate privileges across many Siemens engineering products.
Read summary → Source: CISA Cybersecurity Advisories -
Siemens Opcenter X Auth Bypass via JWT Algorithm Confusion (CVSS 10)
A critical flaw in Siemens Opcenter X before V2604 lets unauthenticated attackers forge JWTs and impersonate any user, including admins.
Read summary → Source: CISA Cybersecurity Advisories -
Suno AI music platform breach exposes 55M email addresses
A November 2025 breach at AI music tool Suno leaked over 55M unique emails, phone numbers, and tens of thousands of partial Stripe payment records.
Read summary → Source: Have I Been Pwned -
Paidwork Breach Exposes 23M Accounts Including bcrypt Password Hashes
A gig economy platform breach leaked over 23M email addresses along with bcrypt password hashes, banking data, and payout history.
Read summary → Source: Have I Been Pwned -
SALTO ProAccess Space Flaw Lets Authenticated Operators Escalate Privileges Across Partitions
CVE-2026-11889 allows an authenticated operator to bypass partition boundaries and access spaces outside their assigned tenancy in SALTO ProAccess Space <6.13.
Read summary → Source: CISA Cybersecurity Advisories -
Siemens SICAM 8 flaws include unverified password change and insecure defaults
CISA advisory covers multiple SICAM 8 vulnerabilities, including an unverified password change weakness and insecure default initialization affecting ICS devices.
Read summary → Source: CISA Cybersecurity Advisories -
Stored XSS in Rockwell FactoryTalk DataMosaix Enables Account Takeover
CISA advisory warns of a stored XSS flaw (CVE-2026-9292) in FactoryTalk DataMosaix that can lead to credential theft and account takeover.
Read summary → Source: CISA Cybersecurity Advisories -
Fluke breach exposes 821,100 accounts in ShinyHunters extortion leak
ShinyHunters published 100GB+ of data from test equipment maker Fluke, exposing 800k+ email addresses, names, phone numbers and addresses.
Read summary → Source: Have I Been Pwned -
Goose Creek Candle Company breach exposes 6.6M customer records
A breach of Goose Creek's Shopify instance leaked 6.6M email addresses along with names, phone numbers, addresses, and order details.
Read summary → Source: Have I Been Pwned -
CISA Adds AD FS and SharePoint Auth Flaws to KEV Amid Active Exploitation
CISA flagged four actively exploited CVEs, including a Microsoft AD FS access-control flaw and SonicWall SMA1000 gateway bugs, mandating federal remediation.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Warns of Active SharePoint Exploits Enabling RCE and Machine Key Theft
Three actively exploited SharePoint Server flaws allow unauthorized access, RCE, and IIS machine key theft for persistence across all supported on-prem versions.
Read summary → Source: CISA Cybersecurity Advisories -
Rockwell 1715-AENTR EtherNet/IP Adapter Exposes Unauthenticated Debug Port (CVSS 10)
A missing-authentication flaw in Rockwell's 1715-AENTR adapter lets unauthenticated remote attackers run intrusive CLI commands via an exposed debug port.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Warns of Russian FSB Center 16 Exploiting Weak Router Configs and Credentials
Joint advisory details FSB Center 16 opportunistically compromising poorly configured networking devices, including via weak SNMP and default credentials, across critical sectors.
Read summary → Source: CISA Cybersecurity Advisories -
Glendale Community College breach exposes ~794k accounts in ShinyHunters extortion
A ShinyHunters 'pay or leak' campaign hit Glendale Community College, leaking nearly 800k emails plus SSNs, names and enrollment data.
Read summary → Source: Have I Been Pwned -
Schneider Electric PowerChute Serial Shutdown flaws enable credential resets and account access
CISA advisory flags multiple vulnerabilities in Schneider PowerChute Serial Shutdown <=1.4 that could allow unauthorized account access and credential resets.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Advisory: Hydro-Québec EV Charging Backend Has Critical Auth Flaws
CVSS 9.8 access control and session flaws in Hydro-Québec's Le Circuit Electrique charging backend could enable privilege escalation and DoS.
Read summary → Source: CISA Cybersecurity Advisories -
Digi PortServer TS and Digi One SP IA Flaws Allow Auth Bypass, Credential Theft
CISA advisory warns of authentication bypass and XSS flaws in Digi International serial device servers that could expose credentials.
Read summary → Source: CISA Cybersecurity Advisories -
Hitachi Energy PROMOD V Uses Insecure HTTP, Enabling Credential Theft
A cleartext HTTP transmission flaw (CVE-2026-10763) in PROMOD V could let attackers intercept credentials, hijack sessions, or gain unauthorized access.
Read summary → Source: CISA Cybersecurity Advisories -
Moody Bible Institute breach exposes 2.3M records in ShinyHunters extortion
A ShinyHunters 'pay or leak' campaign led to 2.3M email addresses and personal details of donors, students and alumni being published publicly.
Read summary → Source: Have I Been Pwned -
CISA: ST Engineering iDirect iQ-Series Terminals Expose Unauthenticated API Endpoints
Satellite terminals expose REST API endpoints without authentication, letting remote attackers pull sensitive device identity data or trigger DoS.
Read summary → Source: CISA Cybersecurity Advisories -
Gardyn IoT Hub Flaws Expose Hard-Coded Credentials Enabling Unauthenticated Device Takeover
CISA advisory details critical Gardyn IoT Hub vulnerabilities, including a hard-coded privileged key allowing unauthenticated attackers to control managed devices.
Read summary → Source: CISA Cybersecurity Advisories -
Delta DVP12SE PLC Exposes Unauthenticated Modbus Access (CVSS 9.8)
CISA warns Delta Electronics DVP12SE PLCs allow unauthenticated Modbus TCP commands, letting remote attackers control device logic without credentials.
Read summary → Source: CISA Cybersecurity Advisories -
FUXA SCADA/HMI Auth Bypass Exposes User Accounts and Roles to Unauthenticated Attackers
CVE-2026-13207 lets remote attackers bypass authentication via dot-segment path tricks to enumerate all users and role assignments in FUXA SCADA/HMI.
Read summary → Source: CISA Cybersecurity Advisories -
Schneider Electric EasyLogic T150 & Saitel DP RTU expose stored credentials
CISA advisory warns unauthenticated attackers can access credentials stored in firmware or system files of Schneider Electric RTUs.
Read summary → Source: CISA Cybersecurity Advisories -
StoneFly Storage Concentrator flaws include hard-coded credentials, CVSS 10
CISA warns of critical StoneFly Storage Concentrator vulnerabilities, including hard-coded credentials enabling root-level unauthorized access.
Read summary → Source: CISA Cybersecurity Advisories -
CISA Flags Actively Exploited SimpleHelp Authentication Bypass (CVE-2026-48558)
CISA added a SimpleHelp authentication bypass flaw to its KEV Catalog citing active exploitation, requiring rapid federal remediation.
Read summary → Source: CISA Cybersecurity Advisories -
Sysco Breach Exposes 2.7M Accounts in ShinyHunters Extortion Campaign
A ShinyHunters extortion attack on Sysco leaked 2.7M email addresses plus names, phone numbers, addresses, and internal job titles.
Read summary → Source: Have I Been Pwned -
American Tower breach exposes 216,601 accounts in ShinyHunters extortion campaign
ShinyHunters published data on 200k+ individuals tied to American Tower after a pay-or-leak extortion attempt, exposing emails, names, addresses, and phone numbers.
Read summary → Source: Have I Been Pwned -
Daktronics Controller Firmware Flaws Allow Unauthenticated Root via Hard-coded Credentials
CISA warns of path traversal, unrestricted file upload, and hard-coded credential flaws in Daktronics Controller Firmware enabling unauthenticated root-level takeover.
Read summary → Source: CISA Cybersecurity Advisories -
EVoke EV Charging Management System Flaws Allow Auth Bypass, Admin Takeover
CISA advisory details missing authentication, weak session handling, and exposed credentials in EVoke CSMS, enabling unauthorized admin control of charging stations.
Read summary → Source: CISA Cybersecurity Advisories -
OHIF DICOM Viewer SSRF Leaks Clinician OIDC Bearer Tokens via Crafted Links
A SSRF flaw in OHIF DICOM Web Viewer (<=v3.12.0) can leak an authenticated clinician's OIDC Bearer token to an attacker-controlled server.
Read summary → Source: CISA Cybersecurity Advisories -
Stolen Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data
UNC6395 stole OAuth tokens tied to the Salesloft Drift integration and used them to export data — and hunt for cloud credentials — from over 700 organizations' Salesforce instances.
Read summary → Source: Google Threat Intelligence Group -
Snowflake customer breaches: infostealer-stolen passwords, no MFA, ~165 victims
UNC5537 used credentials harvested by infostealer malware — some years old and never rotated — to loot 100+ Snowflake customer databases, including AT&T and Ticketmaster.
Read summary → Source: Mandiant / Google Threat Intelligence -
Change Healthcare: one stolen Citrix login with no MFA, 190 million people exposed
BlackCat ransomware actors logged into Change Healthcare's Citrix remote-access portal with stolen credentials and no MFA — the largest healthcare data breach in U.S. history.
Read summary → Source: UnitedHealth Group -
'Midnight Blizzard' breached Microsoft via password spray on a legacy account
A legacy, non-production tenant account with no MFA was compromised by password spray, then abused through OAuth to read senior Microsoft executives' email.
Read summary → Source: Microsoft Security Response Center -
23andMe credential-stuffing breach exposed 6.9 million users' data
Attackers reused passwords leaked on other sites to break into ~14,000 23andMe accounts, then scraped the DNA Relatives feature to reach 6.9 million users.
Read summary → Source: 23andMe -
Okta support-system breach exposed customer session tokens
Attackers accessed Okta's customer support case-management system and obtained HAR files containing session tokens, which were then used against several downstream customers.
Read summary → Source: Okta Security -
Outlook elevation-of-privilege flaw leaks NTLM credentials with no user interaction
A zero-click Outlook vulnerability (CVE-2023-23397) let attackers capture Net-NTLMv2 authentication hashes simply by sending a crafted email — exploited in the wild before patch.
Read summary → Source: Microsoft Security Response Center -
Zerologon: domain takeover through a flaw in Netlogon's cryptography
CVE-2020-1472 let an unauthenticated attacker with network access to a domain controller reset its machine-account password and seize the entire Active Directory domain.
Read summary → Source: Microsoft Security Response Center