Tata Electronics, the Tata Group division that manufactures and assembles Apple iPhones, has confirmed a cyberattack that impacted parts of its IT infrastructure, while stating operations remained unaffected. The World Leaks threat group — a rebrand of the Hunters International ransomware gang that now operates purely as a data extortion group — leaked data allegedly stolen from Tata, including Apple product manufacturing data such as internal component schematics, PCB designs, material specifications, and SDK files. Apple has not yet responded to inquiries about potential exposure of proprietary data. World Leaks has previously claimed breaches at Dell and Nike.
Nguồn: https://www.bleepingcomputer.com/news/security/tata-electronics-confirms-cyberattack-as-hackers-leak-data. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
LastPass xác nhận dữ liệu khách hàng trong môi trường Salesforce bị truy cập sau cuộc tấn công chuỗi cung ứng nhằm vào Klue hôm 12/6. Nhóm tống tiền Icarus đã xâm nhập hạ tầng Klue bằng thông tin đăng nhập cũ, đánh cắp token OAuth kết nối Klue với Salesforce của khách hàng. Dữ liệu bị lộ bao gồm tên, số điện thoại, email, địa chỉ, thông tin hỗ trợ và dữ liệu CRM. LastPass cho biết sản phẩm cốt lõi, dịch vụ và kho dữ liệu khách hàng không bị ảnh hưởng.
Lập trình viên nên đọc bài này để hiểu rõ về cách tấn công supply chain attack hoạt động như thế nào, từ đó nâng cao kiến thức bảo mật cho các ứng dụng và hệ thống của mình, đặc biệt là khi sử dụng các dịch vụ cloud như Salesforce.
Huntress discloses it was among multiple victims of a supply chain attack targeting Klue, a market intelligence platform. The threat actor, dubbed Icarus, compromised Klue's backend systems on June 11, 2026, injecting code to steal OAuth tokens used by Klue's customers to connect their CRM tools. This allowed the attacker to directly query and exfiltrate Salesforce data from Huntress and other companies including Recorded Future, Tanium, and Jamf. The stolen Huntress data includes business contact info, pricing, subscription details, and sales communications — no product telemetry, passwords, or payment data was affected. Huntress shares IOCs (IP addresses, User-Agent strings), threat actor attribution details linking to the Icarus extortion group, and five recommended investigation steps for other potentially impacted organizations. The post is being updated in real time as the situation evolves, with a secondary unauthorized party also claiming access to breach data as of June 24.
India's Tata Electronics has confirmed a cybersecurity incident after ransomware group World Leaks claimed to have stolen over 630GB of data, including purported Apple and Tesla component design files and trade secrets. A 52-page document with Apple's proprietary markings allegedly detailing iPhone circuit-board quality-inspection standards and Tesla Model Y chargeport controller files were listed on a dark-web index. Tata says operations were unaffected, but Apple is investigating and a ransom demand has been received. The authenticity of the files remains unverified. The incident highlights the growing risk of supply chain attacks, where attackers target contract manufacturers to gain leverage over high-profile customers who never directly touched the breached network.
Mexico's 2025–2030 National Cybersecurity Plan, published by the ATDT in December 2025, outlines a six-phase roadmap to modernize the country's cyber posture. The plan addresses top threats including ransomware, financial malware, hacktivism, state-sponsored attacks, and organized crime. Key milestones include passing a General Cybersecurity Law in 2026, establishing a National Center for Cybersecurity Operations, creating a National Cyber Range by 2027, and integrating AI for cyber defense by 2028. Mexico ranks as a Tier 2 nation in the ITU Global Cybersecurity Index but lags in institutional capacity. The 2026 FIFA World Cup co-hosted by Mexico serves as an immediate stress test for its digital infrastructure. Insikt Group recommends organizations in Mexico adopt international standards like NIST CSF or ISO/IEC 27001, conduct scenario-planning exercises, leverage threat intelligence platforms, and invest in public cyber hygiene education.
Market research company Klue, breached on June 12, is communicating with the hacking group Icarus and believes they are deleting stolen customer data. However, a second unnamed hacker group has emerged, claiming to have obtained Klue's customer data from Icarus and threatening to leak it unless a ransom is paid. The second group alleges 195 affected Klue customers and claims Klue paid Icarus. Klue advises customers contacted by this second group to demand a data sample as proof before taking any action. The original breach involved a 2022 third-party credential that was never revoked, which attackers used to steal OAuth tokens and access customer clouds and databases. Affected companies include Gong, Jamf, HackerOne, Huntress, LastPass, Snyk, and others.
Two members of the Scattered Spider cybercrime group, Thalha Jubair (20) and Owen Flowers (18), pleaded guilty to hacking Transport for London (TfL) systems in August–September 2024. The attack caused £29 million ($38.3M) in damages, forced all 28,000 TfL employees to reset passwords in person, and resulted in customer data theft from the Oyster refunds system. Evidence seized from Flowers' home included a laptop with screenshots of TfL infrastructure access and videos of Jubair breaching systems. Sentencing is scheduled for July 16. Flowers is also linked to intrusions at two American healthcare organizations.
A Huntress SOC investigation uncovered an Akira ransomware affiliate using an unusual attack chain: the threat actor accessed a hypervisor, spun up a new virtual machine (bypassing installed security tooling), disabled Microsoft Defender, archived target data with WinRAR, and exfiltrated it via Easyupload.io — a file-sharing site now owned by the rebranded LimeWire platform. The VHDX image of the VM provided forensic analysts a clear timeline of attacker activity, including Active Directory enumeration, lateral movement to file servers, and rapid ransomware deployment. The incident highlights how RaaS affiliates adapt TTPs, including creating new VMs to evade endpoint security stacks, and underscores the need to monitor for new endpoint creation within environments.
Ransomware attacks in Europe surged 55% in the first four months of 2026 compared to the same period in 2025, with France seeing a 119% increase and Italy 92%. Researchers from Black Kite attribute the shift to US market oversaturation and AI-assisted target research pointing attackers toward European organizations. The number of active ransomware groups has grown from 60 in 2023 to 150 today, filling the vacuum left by law enforcement takedowns of major RaaS operations. Manufacturing and digital services sectors are primary targets, largely because attackers exploit supply chain leverage — breaching one vendor to access hundreds of downstream clients, as demonstrated by the Miljödata attack that exposed data from ~200 Swedish municipalities. Experts recommend organizations map fourth- and fifth-party vendor dependencies and rank vendors by risk proactively rather than reactively.