#data-breach

LastPass confirms data breach in Klue supply chain attack

LastPass xác nhận dữ liệu khách hàng trong môi trường Salesforce bị truy cập sau cuộc tấn công chuỗi cung ứng nhằm vào Klue hôm 12/6. Nhóm tống tiền Icarus đã xâm nhập hạ tầng Klue bằng thông tin đăng nhập cũ, đánh cắp token OAuth kết nối Klue với Salesforce của khách hàng. Dữ liệu bị lộ bao gồm tên, số điện thoại, email, địa chỉ, thông tin hỗ trợ và dữ liệu CRM. LastPass cho biết sản phẩm cốt lõi, dịch vụ và kho dữ liệu khách hàng không bị ảnh hưởng.

Lập trình viên nên đọc bài này để hiểu rõ về cách tấn công supply chain attack hoạt động như thế nào, từ đó nâng cao kiến thức bảo mật cho các ứng dụng và hệ thống của mình, đặc biệt là khi sử dụng các dịch vụ cloud như Salesforce.

Klue says the hackers who stole its customer data are deleting it, but a second group has emerged with extortion demands

Klue, the market intelligence firm whose breach exposed customer data at LastPass, HackerOne, and others, says the original hacking group Icarus is now deleting the stolen data. However, a second unnamed hacker group claims to have obtained the data from Icarus and is extorting affected companies directly, demanding payment or threatening to leak everything. Icarus reportedly told Klue the second group only has data samples for a subset of customers, not the full dataset, and instructed Klue to tell customers not to pay the second group. The breach stemmed from a compromised third-party credential from 2022 that was never revoked, granting OAuth access to customers' Salesforce environments. Over a dozen companies including Gong, Jamf, HackerOne, and LastPass have confirmed they were affected.

Hacked Klue says criminals are deleting stolen customer data, but now other hackers are making threats

Market research company Klue, breached on June 12, is communicating with the hacking group Icarus and believes they are deleting stolen customer data. However, a second unnamed hacker group has emerged, claiming to have obtained Klue's customer data from Icarus and threatening to leak it unless a ransom is paid. The second group alleges 195 affected Klue customers and claims Klue paid Icarus. Klue advises customers contacted by this second group to demand a data sample as proof before taking any action. The original breach involved a 2022 third-party credential that was never revoked, which attackers used to steal OAuth tokens and access customer clouds and databases. Affected companies include Gong, Jamf, HackerOne, Huntress, LastPass, Snyk, and others.

Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress

Huntress discloses it was among multiple victims of a supply chain attack targeting Klue, a market intelligence platform. The threat actor, dubbed Icarus, compromised Klue's backend systems on June 11, 2026, injecting code to steal OAuth tokens used by Klue's customers to connect their CRM tools. This allowed the attacker to directly query and exfiltrate Salesforce data from Huntress and other companies including Recorded Future, Tanium, and Jamf. The stolen Huntress data includes business contact info, pricing, subscription details, and sales communications — no product telemetry, passwords, or payment data was affected. Huntress shares IOCs (IP addresses, User-Agent strings), threat actor attribution details linking to the Icarus extortion group, and five recommended investigation steps for other potentially impacted organizations. The post is being updated in real time as the situation evolves, with a secondary unauthorized party also claiming access to breach data as of June 24.

Scattered Spider duo convicted over $38M Transport for London attack

Two members of the Scattered Spider cybercrime collective, Thalha Jubair (20) and Owen Flowers (18), pleaded guilty to hacking Transport for London's network between August 31 and September 3, 2024. The attack disrupted in-station services, online portals, forced 28,000 employees to reset passwords in person, and exposed personal data of an estimated 10 million people. TfL suffered approximately £29 million ($38.2 million) in losses and recovery costs. Forensic evidence found on seized devices also linked Flowers to breaches of US healthcare companies. The convictions are part of a broader wave of prosecutions against Scattered Spider members, whose tactics include social engineering, SIM swapping, and help-desk impersonation to bypass MFA and gain network access.

Tata Electronics confirms cyberattack as hackers leak data

Tata Electronics, the Tata Group division that manufactures and assembles Apple iPhones, has confirmed a cyberattack that impacted parts of its IT infrastructure, while stating operations remained unaffected. The World Leaks threat group — a rebrand of the Hunters International ransomware gang that now operates purely as a data extortion group — leaked data allegedly stolen from Tata, including Apple product manufacturing data such as internal component schematics, PCB designs, material specifications, and SDK files. Apple has not yet responded to inquiries about potential exposure of proprietary data. World Leaks has previously claimed breaches at Dell and Nike.

Healthtech firm Xolis suffers data breach impacting 1.4 million people

Healthcare technology company Xsolis disclosed a data breach affecting nearly 1.4 million individuals following a targeted phishing attack on January 20, 2026. Attackers gained access to sensitive customer data including names, addresses, dates of birth, Social Security numbers, health insurance information, and medical treatment details. Xsolis detected the breach two days later, contained it with help from external cybersecurity experts, and reported it to law enforcement. The company has since reset all user passwords, increased system monitoring, accelerated employee security training, and strengthened credential management. Affected individuals are being notified by mail and offered 12 months of identity monitoring and theft restoration services through Kroll.

Klue says hackers stole credential from 2022 that led to customer data breaches

Market research company Klue confirmed that hackers used a credential from a 2022 limited pilot to breach its systems on June 12, stealing OAuth tokens that granted access to customer data stored in third-party clouds and databases. Affected customers include LastPass and several other cybersecurity firms. The hacking group Icarus claimed responsibility and is threatening to release stolen data unless a ransom is paid. Klue has not explained why the four-year-old credential was never revoked after the pilot ended, raising serious questions about its credential management and vendor-access controls.

LastPass says hackers stole customer data through a supply chain breach at Klue

LastPass is notifying customers that personal data — including names, emails, phone numbers, and support case contents — was stolen via a supply chain breach at Klue, a competitive intelligence vendor. Hackers obtained OAuth tokens Klue held on behalf of enterprise clients, using them to access LastPass's Salesforce environment. The breach did not compromise LastPass's own infrastructure or encrypted password vaults. A hacking and extortion group called Icarus claimed responsibility and is threatening to release the data unless ransoms are paid. Other affected companies include HackerOne, Recorded Future, Snyk, and Huntress. The incident underscores a structural risk: when a single vendor holds OAuth tokens for dozens of enterprise customers, compromising that vendor grants simultaneous access to all of them. LastPass has revoked the tokens and is advising customers to watch for phishing attempts leveraging the stolen data.

Scattered Spider members plead guilty to hacking Transport for London

Two members of the Scattered Spider cybercrime group, Thalha Jubair (20) and Owen Flowers (18), pleaded guilty to hacking Transport for London (TfL) systems in August–September 2024. The attack caused £29 million ($38.3M) in damages, forced all 28,000 TfL employees to reset passwords in person, and resulted in customer data theft from the Oyster refunds system. Evidence seized from Flowers' home included a laptop with screenshots of TfL infrastructure access and videos of Jubair breaching systems. Sentencing is scheduled for July 16. Flowers is also linked to intrusions at two American healthcare organizations.

Password manager maker LastPass says hackers stole customer support case data during Klue breach

LastPass is notifying customers that personal information and customer support case records were stolen via a breach at market research firm Klue, a third-party technology partner. Stolen data includes names, phone numbers, email addresses, physical addresses, and customer support case and sales-related data. LastPass's own infrastructure and password vaults were not affected. The breach is part of a wider incident at Klue that also impacted HackerOne, Recorded Future, and Tanium. A hacking and extortion group called Icarus claimed responsibility and is threatening to release the data unless a ransom is paid. This marks LastPass's second significant breach in recent years, following the 2022 incident in which encrypted password vaults were stolen and later cracked.

Tata Electronics breach claims to expose Apple and Tesla trade secrets

India's Tata Electronics has confirmed a cybersecurity incident after ransomware group World Leaks claimed to have stolen over 630GB of data, including purported Apple and Tesla component design files and trade secrets. A 52-page document with Apple's proprietary markings allegedly detailing iPhone circuit-board quality-inspection standards and Tesla Model Y chargeport controller files were listed on a dark-web index. Tata says operations were unaffected, but Apple is investigating and a ransom demand has been received. The authenticity of the files remains unverified. The incident highlights the growing risk of supply chain attacks, where attackers target contract manufacturers to gain leverage over high-profile customers who never directly touched the breached network.