Breach Watch
Written for risk decisions, not headlines.
Breach, ransomware, vulnerability, advisory and threat intelligence, classified by LiveThreat and analysed in an ADTP brief for every item.
Showing 20 of 2,564
BREACH WATCH BRIEF
GMO Internet's Onamae Desktop Cloud Hit by Intrusion; Data Stolen and Ransomware Threat Prompts Shutdown Advice
GMO Internet disclosed a breach of its Onamae Desktop Cloud VPS service that exposed company and customer data and included a ransomware demand. The event highlights the importance of auditable incident‑response controls for compliance and audit readiness.
BREACH WATCH BRIEF
Hackers Hijack Convertr Analytics Script to Skim Payment Card Data from Brazilian E‑commerce Stores
A Brazilian skimming gang compromised Convertr’s Plausible analytics script, injecting malicious code that stole full payment‑card details from checkout pages. The breach underscores the importance of continuous third‑party component monitoring and integrity controls for audit readiness.
BREACH WATCH BRIEF
Email Accounts of Italy’s Prime Minister and Deputies Compromised in Parliamentary Cyberattack
Three parliamentary email accounts—including one assigned to Prime Minister Giorgia Meloni—were accessed by an unknown actor on 27 Oct 2026. The incident, investigated with Italy’s National Cybersecurity Agency, underscores the strategic risk of privileged‑account compromise in government. It highlights the importance of strong access‑control policies and continuous monitoring for audit readiness.
BREACH WATCH BRIEF
Warp Discloses Third‑Party Vendor Breach Exposing AI Agent Logs and User Telemetry
Warp reported that a breach of a third‑party vendor exposed AI agent decision logs and telemetry for roughly 1 % of its 800 k users. The incident demonstrates the importance of robust vendor risk management and continuous assurance evidence for audit readiness.
BREACH WATCH BRIEF
University of New Mexico Hospital Diverts Ambulances After Cyberattack
A cyberattack forced UNM Health System to shut down desktops, reroute ambulances and suspend surgeries. A ransomware gang claims to have stolen patient and staff data, highlighting the need for auditable incident‑response controls.
BREACH WATCH BRIEF
Ransomware Attack Disrupts UNM Health Hospitals, Threat Group Claims Theft of Student and Employee Data
The University of New Mexico Health Sciences Center suffered a ransomware‑style cyberattack that forced hospital shutdowns and ambulance diversions. Attackers claim to have stolen student and employee PII, prompting a ransom demand. The event highlights the need for auditable incident‑response controls to maintain trust and compliance.
BREACH WATCH BRIEF
Keystone Exposes Device Verification Key, Threatening 18,835 Hardware Wallets
Keystone’s website was compromised and the secret key used to verify hardware wallets was stolen, allowing attackers to create counterfeit devices. This underscores the importance of robust access‑control and key‑management for audit readiness.
BREACH WATCH BRIEF
University of Copenhagen Breach Exposes Personal Data of 525,000 Individuals
The University of Copenhagen disclosed that attackers accessed a test environment and exfiltrated personal data for roughly 525 000 individuals, including national ID numbers. The breach underscores the importance of GDPR‑aligned consent and data‑subject request controls for audit readiness.
BREACH WATCH BRIEF
Lazarus Group Hijacks South Korean Security Software to Deploy Post‑Quantum Encrypted Malware in Supply‑Chain Attack
Lazarus Group leveraged a compromised South Korean security‑software suite to deliver post‑quantum encrypted malware to at least three organizations in construction, software, and wire‑communication equipment manufacturing. The campaign highlights the importance of continuous third‑party risk monitoring for audit readiness.
BREACH WATCH BRIEF
Stolen GitHub Tokens Enable Gheist Campaign to Exfiltrate Secrets from Private Repositories
Gheist leveraged compromised GitHub personal access tokens to create hidden workflow branches in private repositories, printing and downloading production credentials. The breach underscores the importance of strict token governance and CI/CD approval controls for audit readiness.
BREACH WATCH BRIEF
ENGIE Energy Giant Breach Exposes French Customer Contact and Contract Data via Partner Marketing Platform
ENGIE disclosed that attackers stole French customer names, addresses, meter IDs and contract numbers by compromising a partner‑hosted marketing platform. The breach underscores the importance of third‑party risk controls and audit‑ready evidence for data protection.
BREACH WATCH BRIEF
AfD Political Party Breach Exposes 345,439 Email Addresses via Hosting Provider Compromise
In September 2026 the German party AfD disclosed that a breach of its hosting provider leaked 345k email addresses and attachments. The incident underscores the importance of third‑party risk oversight for audit readiness.
BREACH WATCH BRIEF
Attackers Hijack Dahua IP Cameras in Ukraine via P2P Access and Authentication Weaknesses
CERT‑UA reported that threat actors compromised Dahua video‑surveillance devices in Ukraine by abusing weak authentication and P2P access, allowing them to view streams, change settings, and add rogue accounts. The incident underscores the importance of strong access‑control controls for audit readiness.
BREACH WATCH BRIEF
University of Copenhagen Test‑Environment Breach Exposes Personal Data of 525,000 Individuals
Hackers accessed a University of Copenhagen test environment, stealing names, CPR numbers, phone and email data for 525,000 people and PIN codes for 20,000 staff and students. The incident underscores the importance of robust access‑control and monitoring to satisfy GDPR and other compliance regimes.
BREACH WATCH BRIEF
Cross‑tenant KV Cache Exposure in Cloudflare Workers AI GLM‑5.3 Model Leads to 155 Mixed Responses
Between Aug 27 and Sep 9 2026 Cloudflare’s GLM‑5.3 Workers AI model returned 155 responses that mixed data from different customers due to a KV‑cache overflow bug. The breach underscores the need for verifiable tenant‑isolation controls in multi‑tenant AI services.
BREACH WATCH BRIEF
Former Pentester Leveraged ARTEX AI Framework to Steal 8.2 Million Records from 90 South Korean Organizations
A gang led by a former pentester used the ARTEX AI framework to breach 90+ South Korean entities, exfiltrating 8.2 million records. The incident underscores the need for strong identity‑and‑access‑control and continuous monitoring to meet audit‑readiness requirements.
BREACH WATCH BRIEF
DreamHost Forces Password Resets After Potential Credential Compromise Affects Email and FTP/SFTP Users
DreamHost blocked access and required password resets for email, FTP and SFTP accounts after an incident that began with File‑Manager outages. The move hints at credential compromise, highlighting the importance of strong access‑control practices and audit‑ready evidence of remediation.
BREACH WATCH BRIEF
Hackers Infect 953 Magento Stores with Scanner‑Evading JavaScript Loader
An unknown actor has injected malicious JavaScript into 953 Magento‑based e‑commerce sites by abusing CMS block permissions. The breach underscores the importance of continuous control‑mapping and auditable monitoring of web‑application integrity for compliance readiness.
BREACH WATCH BRIEF
12,976 Refrigeration Control Systems Exposed Online Across 99 Countries
Researchers found nearly 13 k internet‑exposed refrigeration controllers in 99 countries, revealing firmware and live telemetry. The breach underscores the need for hardened IoT configurations and audit‑ready evidence.
BREACH WATCH BRIEF
eMudhra Exits SSL/TLS Market After Eight Intermediate CA Private Keys Were Found Guessable
eMudhra disclosed that eight intermediate‑CA private keys were easily guessable, prompting browsers to distrust its certificates and forcing the CA to leave the market. The breach underscores the need for strong key‑generation controls to satisfy audit‑readiness across multiple frameworks.
Breach Watch intelligence is provided by LiveThreat, a product of a founding sponsor of the association. Every ADTP brief carries LiveThreat's analysis and links the original source.
Practitioner briefings
Written by the association: what the week's intelligence means for the controls you run.
Reading a vendor's breach notice for what it does not say
A practitioner checklist for turning a supplier notification into an evidence request and a monitoring change.
Where AI inventory efforts stall, and the control that unblocks them
Findings from practitioner roundtables on AI governance programs in their first year.
Evidence reuse across customer diligence and audit
How practitioners are organizing one evidence base to serve buyers and auditors at the same time.
Global Privacy Control signals and state opt-out obligations
What a site must do when it sees a GPC signal, and how to evidence it.
Get the digest
No membership required. Confirm by email; unsubscribe in one click.