DigiCert Breached via Weaponized Screensaver: Threat Actor Steals EV Code Signing Certificates to Spread Zhong Stealer
A sophisticated threat actor breached DigiCert's internal support environment in early April 2026 by tricking analysts into executing a disguised .scr malware file, ultimately obtaining EV Code Signing...
Trellix Source Code Breach: Hackers Gain Unauthorized Access to Internal Repository of Major XDR Vendor
Cybersecurity vendor Trellix has confirmed unauthorized access to part of its internal source code repository. The company says no evidence of product tampering or active exploitation has been...
ClickUp’s Hardcoded API Key Has Silently Leaked 959 Corporate and Government Emails for 15 Months
A hardcoded API key in ClickUp's public JavaScript file exposed 959 corporate and government email addresses for over 15 months after responsible disclosure in January 2025. Affected organizations...
ShinyHunters Claims Udemy Data Breach: 1.4 Million User Records at Risk as Ransom Deadline Expires
ShinyHunters has claimed a breach of Udemy affecting 1.4 million user records, setting a "Pay or Leak" ransom deadline of April 27, 2026. Udemy has not yet issued...
ADT Confirms Data Breach: ShinyHunters Claims 10 Million Records Stolen via Vishing Attack
Home security giant ADT Inc. has confirmed a data breach following a ShinyHunters claim of stealing over 10 million records. The group used a vishing attack to compromise...
Vercel Confirms OAuth Supply Chain Breach Linked to Context.ai Compromise; ShinyHunters Claims Responsibility
Vercel has disclosed an internal breach caused by a compromised Context.ai OAuth token harvested via Lumma Stealer. A limited set of customer accounts had non-sensitive environment variables exposed,...
Booking.com Notifies Customers of Data Breach Exposing Reservation Details and Personal Information
Booking.com has notified customers of a data breach that exposed personal information including full names, addresses, phone numbers, email addresses, and detailed reservation data. The breach originated from...
Inditex (Zara) Confirms Third-Party Data Breach: Transaction Records Exposed via Analytics Platform with April 21 Leak Deadline
Inditex, owner of Zara and Bershka, has confirmed a data breach affecting transaction records accessed via a third-party analytics platform, Anodot. Hackers set an April 21 deadline, threatening...