— Threat watch
Where the threats are this week
143 tracked 19 critical open Last update 15 Nov 2026
Every incident in the Watch, placed by threat group and by how recent it is. The center is today; a ringed dot involves AI. Click a dot to open the incident.
61new in the last 7 days
14critical, last 30 days
Breaches & extortionbusiest group this week
Your setup: Saved on this device only. Nothing is sent.
CriticalHighMedium AI-related Center = today
How they got in, and at whom
How the attackers got in, crossed with the sector they hit. Pick a cell to see its incidents.
| Many sectors | Tech & SaaS | Government & politics | Retail | Finance | Health | Education | Consumer apps & devices | Transport | Energy | Associations & sport | Media | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Stolen credentials | ||||||||||||
| Phishing, social engineering | ||||||||||||
| Software flaw | ||||||||||||
| Supplier | ||||||||||||
| Exposed or misconfigured | ||||||||||||
| Not public yet |
Has a critical incident · Darker = more incidents
Stolen credentials × Many sectors
- GitHub: 4,837 hijacked accounts plant a CI secret stealer in thousands of repositories Identity · 3 days ago
- Stolen Entra app secrets used against 27 organizations, many through MSP apps Identity · 12 days ago
Stolen credentials × Tech & SaaS
- Apify: a compromised credential let an intruder into internal systems and related customer accounts Identity · 3 days ago
- LiteLLM: poisoned 1.107.0 release published through its own pipeline Supply chain · 25 days ago
- Fireworks AI: attackers seeking to resell LLM access reached API keys, billing data and some customer models Identity · 37 days ago
Stolen credentials × Government & politics
- French Education Ministry: intrusions hit 25 of its 30 académies Identity · 3 days ago
- French Foreign Ministry: library portal entered with stolen technical accounts Identity · 3 days ago
- CAF (France): data of 1.6 million families taken from the Vacaf holiday-aid platform Identity · 37 days ago
- France Travail: data of 60,000 agents and professionals taken through one agent's account Identity · 38 days ago
Stolen credentials × Consumer apps & devices
- Effy: a partner craftsman's login used to read customers' renovation projects Identity · 4 days ago
- Wyndham: a password left in the Android app opened an internal customer database Identity · 6 days ago
Stolen credentials × Associations & sport
- French Shooting Federation (FFTir): second intrusion in a year, 64,000 ID photos copied Identity · 34 days ago
Phishing, social engineering × Many sectors
- FaceStealer: North Korean fake video calls with deepfakes stole more than $400M Identity · 3 days ago
- TypoPrompting: 186 lookalike AI tool domains lead to ClickFix lures and hijacking extensions Identity · 3 days ago
- Three charged in AI impersonation scheme that stole more than $129 million Identity · 10 days ago
- Fake IT help desk calls on Teams led to certificates for privileged accounts Identity · 16 days ago
- Fake IT support on Teams: email bombing, then a chat, then remote access in under 15 minutes Identity · 20 days ago
- Fake OpenAI, SpaceX and Anthropic events phish work accounts Identity · 39 days ago
- Calendar-invite phishing campaign steals live Google Workspace sessions Identity · 45 days ago
Phishing, social engineering × Government & politics
- Cholet: city and agglomeration services disrupted after a phishing attack on staff accounts Identity · 16 days ago
Phishing, social engineering × Finance
- SignalPlus: fake Teams invite compromises an engineer, Binance and Deribit revoke API keys Identity · 10 days ago
- Binance: about $6.3 billion taken from hot wallets Identity · 17 days ago
Phishing, social engineering × Health
- Marathon Health: a fake IT worker got an employee's credentials Identity · 17 days ago
Software flaw × Many sectors
- Check Point gateways: PHP2Shell used to break in, root, then a wiper at some Israeli organizations Vulnerabilities · 2 days ago
- GSocket: attackers keep a hidden way back into hacked Linux web servers Vulnerabilities · 4 days ago
- Xen Orchestra: an empty login token gives attackers admin over virtualization servers Vulnerabilities · 5 days ago
- Outlook: Microsoft patches a zero-day that leaks Windows login hashes through a crafted message file Vulnerabilities · 5 days ago
- Chrome: Google patches an XML zero-day exploited in the wild, the eighth of 2026 Vulnerabilities · 6 days ago
- FreeSWITCH: a crafted SIP message runs API commands on phone servers, exploited in the wild Vulnerabilities · 6 days ago
- GPUStack: a forged header gives attackers admin over AI model servers, exploited in the wild Vulnerabilities · 6 days ago
- IBM Aspera Faspex: an authorization bypass that grants full admin rights, listed as exploited by CISA Vulnerabilities · 6 days ago
- UnrealIRCd: any chat user can send commands with server authority, and attackers are using it Vulnerabilities · 8 days ago
- SonicWall SSLVPN: a flaw lets other credentials skip SAML and its MFA Vulnerabilities · 9 days ago
- "sshole": OpenSSH on Alpine Linux accepts any long password for locked accounts Vulnerabilities · 10 days ago
- Barracuda: attackers exploit two flaws that give root on Email Security Gateway appliances Vulnerabilities · 13 days ago
- Node-RED: unauthenticated admin API flaw (CVE-2026-58115) exploited to drop a Linux bot and webshells Vulnerabilities · 13 days ago
- BTCPay Server: attackers drain hot wallets on outdated self-hosted payment servers Vulnerabilities · 14 days ago
- Synology NAS: ransomware hits devices on outdated DSM Breaches & extortion · 17 days ago
- Plex2Shell: four chained Plex flaws used to take over media servers and NAS Vulnerabilities · 30 days ago
- AhsayCBS: two chained flaws used to plant web shells, crypto miners and a backdoor on backup servers Vulnerabilities · 38 days ago
Software flaw × Tech & SaaS
- N-able N-central: 33 flaws published, then cryptominers on 21 servers despite the hotfix Vulnerabilities · 6 days ago
- Operation Snowball: an AI agent spends two weeks inside a European telecom provider Vulnerabilities · 7 days ago
- NEAR AI: an SGLang flaw on an inference server exposes about 100 users and 18 agents Vulnerabilities · 7 days ago
- Mittwald: an attacker used a flaw in the web host's AI assistant server to compromise 56 customer projects Vulnerabilities · 8 days ago
- Arara Message: an email delivery service leaks 81 million addresses from up to 380 client companies Vulnerabilities · 17 days ago
- DreamHost: File Manager breach exposes FTP/SFTP passwords and some webmail logins Vulnerabilities · 23 days ago
- Railway: a build flaw let an attacker decrypt customer secrets and run up about $740,000 on stolen AI keys Vulnerabilities · 25 days ago
- Maileva (Docaposte, La Poste group): mail-tracking data of about 22 million people accessed Vulnerabilities · 52 days ago
Software flaw × Government & politics
- OFB (France): hunting licence exam portal flaw exposes data of 1,000+ people Vulnerabilities · 3 days ago
- Turla turned government Exchange servers in Kazakhstan and Romania into spy hubs Vulnerabilities · 5 days ago
- BOSSAI: a lone operator's AI agents take data from Taiwan's emergency services Vulnerabilities · 11 days ago
Software flaw × Retail
- Worten: attackers exploit a flaw to reach customer and service-provider data Vulnerabilities · 4 days ago
Software flaw × Finance
- South Korea's Financial Security Institute hacked: files from 48 financial firms leaked from its evaluation site Vulnerabilities · 6 days ago
- Gnosis Pay: customer data exposed in its legacy card system Vulnerabilities · 9 days ago
Software flaw × Education
- Frontline Education: a flaw in third-party software exposes data of 3 million school staff and students Vulnerabilities · 44 days ago
Software flaw × Consumer apps & devices
- Keystone: an attacker takes buyer data and the key that proves its hardware wallets are genuine Vulnerabilities · 22 days ago
Software flaw × Transport
Supplier × Many sectors
- Plerdy analytics script hijacked to serve phone exploits Supply chain · 80 days ago
Supplier × Tech & SaaS
- TSMC: current and former employee data posted online, matching data held by a cloud provider Supply chain · 3 days ago
- Qubole: an attacker used the data platform's trusted AWS access to read customer secrets and data Supply chain · 6 days ago
- Ethersphere: poisoned bee-js and Swarm Desktop releases steal Swarm wallet keys Supply chain · 6 days ago
- Fake security tools on GitHub infect more than 2,000 PCs of the people building them Supply chain · 10 days ago
- ARTEX: a copycat Docker image adds a root backdoor to the AI pentest console Supply chain · 11 days ago
- cPGuard: a fake security update, signed in with a stolen key, ran as root on about 2,950 servers Supply chain · 12 days ago
- Cursor: a key held by Fireworks AI led to stolen agent traces and a tampered Claude Code extension in its marketplace Supply chain · 17 days ago
- ConnectWise Cloud Backup: a stolen app credential used to sign in to Microsoft 365 customer tenants Supply chain · 31 days ago
Supplier × Retail
- Monceau Fleurs: customer data of four Emova florist brands taken through a checkout software supplier Supply chain · 4 days ago
- Who Gives A Crap: customer data accessed through a marketing software provider Supply chain · 8 days ago
Supplier × Finance
- Baker Tilly: client data, Social Security numbers included, taken from a service provider's platform Supply chain · 2 days ago
- Macif Avantages: customer data exposed after an attack on voucher partner Qwertys Supply chain · 3 days ago
- Keplr: a flaw at login provider Web3Auth exposes the keys of Google and Apple sign-in wallets Supply chain · 9 days ago
- Crédit Mutuel Arkéa: a cyberattack enables fraudulent transfers Supply chain · 14 days ago
- Polymarket: traders drained through a hijacked DebugBear monitoring script Supply chain · 17 days ago
Supplier × Health
- French blood service (EFS): plasma cold rooms tampered with through a supplier Supply chain · 10 days ago
Supplier × Consumer apps & devices
- Trezor: spy implants found in Safe 5 hardware wallets sold by a former reseller Supply chain · 2 days ago
- XCPE: Google says a TV box maker built a backdoor into 1.3 million devices Supply chain · 13 days ago
Supplier × Transport
- Expedia: attackers reached its systems through a compromised third-party data platform provider Supply chain · 3 days ago
Supplier × Energy
- ENGIE: customer data taken from a tool used by its sales partners in France Supply chain · 19 days ago
Exposed or misconfigured × Many sectors
- Grok Build: most apps made with the AI builder opened to anyone, some with staff and patient data Vulnerabilities · 5 days ago
- Claude Code: "don't ask again" saved typed secrets in a settings file found in public GitHub repos Vulnerabilities · 8 days ago
Exposed or misconfigured × Tech & SaaS
- CSCTelecom: four years of bank and airline text messages left in an open database Vulnerabilities · 4 days ago
- WorkOS: a researcher's AI pentest agent left its sandbox and pulled sales and support data Vulnerabilities · 13 days ago
- DigiCert: self-registered accounts read archived customer data Vulnerabilities · 26 days ago
Exposed or misconfigured × Retail
- Supermarket refrigeration controllers attacked in France, then across Europe Vulnerabilities · 34 days ago
Not public yet × Many sectors
- Cairn: an AI pentest framework turned against 19 organizations, 10 of them breached Breaches & extortion · 3 days ago
- ScreenConnect: rogue clients pushed from cloud panels to 288 machines in 48 organizations Supply chain · 4 days ago
- AntiFox: an AI pentest agent used to pull production secrets from AWS accounts Identity · 4 days ago
- GhostFrame: an ESXi implant that steals Windows credentials from virtual machine snapshots, linked to Settra ransomware Breaches & extortion · 5 days ago
- LNbits: Lightning wallet servers told to shut down during a wave of attacks, then patched in 1.7.0 Breaches & extortion · 7 days ago
Not public yet × Tech & SaaS
- Quantum Systems: malware disguised as a drone software update, Bundeswehr grounds its drones Supply chain · 2 days ago
- SilentAir: hacked mobile operators used to divert texts and catch 2FA codes, Taiwan the main target Breaches & extortion · 4 days ago
- ActiveCloud (Belarus): ransomware encrypts part of a cloud provider's infrastructure Supply chain · 5 days ago
- MSP Process: app credentials and tokens for Microsoft partner tenants taken from the MSP software vendor Supply chain · 6 days ago
- mSecure: password manager warns of "suspicious activity" without saying what happened Breaches & extortion · 12 days ago
- Beget (Russia): hosting provider's cloud data wiped after attackers reach its management layer Supply chain · 13 days ago
- Trigger.dev: attacker obtained customer root API keys Supply chain · 14 days ago
- Name.com support account used to hijack 15 DeFi domains Supply chain · 15 days ago
- Chainalysis: password hashes and live tokens of all users exposed Breaches & extortion · 16 days ago
- Northflank: customers told to assume every environment variable was decrypted Supply chain · 16 days ago
- GMO Internet: attackers plant malware in an FX trading VPS service and demand about ¥8 billion Breaches & extortion · 25 days ago
Not public yet × Government & politics
- Seminole County Clerk: intrusion shuts the Florida court clerk's systems, records viewed Breaches & extortion · 2 days ago
- ASP (France): trainee pay portal breached, data of 30,500 users taken Breaches & extortion · 3 days ago
- Silent Lynx: an AI agent helped spy on Tajik and Uzbek government systems Breaches & extortion · 4 days ago
- Poland: ePUAP government services platform shut down after a cyberattack Breaches & extortion · 5 days ago
- Philippines SEC: personal data of online platform users exposed, tax IDs included Breaches & extortion · 6 days ago
- Chambourcy: town hall network shut down after a weekend cyberattack Breaches & extortion · 7 days ago
- Italy: Foreign Minister Tajani's personal data spread on the dark web Breaches & extortion · 8 days ago
- Rosstat: destructive cyberattack on Russia's statistics service Breaches & extortion · 14 days ago
- Ukraine and Russia: emergency alert apps hijacked to send fake nuclear warnings Breaches & extortion · 14 days ago
- Rassemblement national: member data leaked from its membership tool Breaches & extortion · 15 days ago
- Australia: an OpenAI agent reached non-public files on the Medicare statistics portal Breaches & extortion · 52 days ago
Not public yet × Retail
- Ninkasi: unauthorized access to the online shop exposes customer data and old-format passwords Breaches & extortion · 3 days ago
- Kinnarps: an IT attack stops production at three Swedish furniture factories Breaches & extortion · 5 days ago
- Smartbox: unauthorised access to one of its platforms Breaches & extortion · 8 days ago
- Nitori: up to 37.62 million customer records may have leaked after unauthorised access Breaches & extortion · 9 days ago
- Delcampe: collectors' addresses and purchases downloaded Breaches & extortion · 9 days ago
- Illicado: copies of 15,000 company e-gift cards taken in an automated attack Breaches & extortion · 10 days ago
- Nojima: about 7 million member records leaked from its online shop Breaches & extortion · 13 days ago
- Revolve: saved payment cards stolen from the online fashion retailer Breaches & extortion · 17 days ago
- Iris Ohyama: data of about 7.7 million online store customers may have leaked Breaches & extortion · 18 days ago
- Ahold Delhaize: a cyberattack takes grocery websites and apps offline Breaches & extortion · 35 days ago
Not public yet × Finance
- Unocoin: Indian crypto exchange suspends all services after its infrastructure was compromised Breaches & extortion · 3 days ago
- Mercado Bitcoin: about $38 to $46 million drained from Brazil's largest crypto exchange Breaches & extortion · 13 days ago
- Abrigo: Sageworks lending platform for banks shut down after unauthorized access Supply chain · 16 days ago
- Monex Securities: up to 1.13 million email addresses may have leaked from a vendor-run account-opening system Breaches & extortion · 26 days ago
- MetaMask Staking: attacker redirects validator rewards after reaching part of its infrastructure Supply chain · 46 days ago
Not public yet × Health
- Qare: French telemedicine platform tells users account data was accessed Breaches & extortion · 3 days ago
- Visionix: cyberattack on the French eye-care equipment maker's IT systems Breaches & extortion · 6 days ago
- Softway Medical: data breach on One Manager, its radiology information system Supply chain · 7 days ago
- Amplifon Americas: hearing care files copied over three weeks, 1.3 million people affected Breaches & extortion · 9 days ago
- Myriad Genetics: network intrusion suspends genetic testing and order systems Breaches & extortion · 13 days ago
- WS Audiology: unauthorised access takes hearing aid apps offline Breaches & extortion · 16 days ago
Not public yet × Education
- University of Texas at Arlington: personal data stolen in an October intrusion, forms portal still offline Breaches & extortion · 1 days ago
- Charles University: attacker downloads data from the central student information system Breaches & extortion · 2 days ago
- Vanderbilt University: a cybersecurity incident cuts access to campus systems Breaches & extortion · 6 days ago
- Technical University of Munich: myTUM portal attack exposes central login passwords Breaches & extortion · 6 days ago
- York University: personal data stolen from department web forms dating back to 2007 Breaches & extortion · 6 days ago
- ISAE-Supméca: ransomware hits the engineering school's whole IT Breaches & extortion · 15 days ago
Not public yet × Consumer apps & devices
- Garanka: customer data exfiltrated in a cyberattack Breaches & extortion · 6 days ago
- Maru-Jan: email addresses and passwords of 1.85 million players leaked Breaches & extortion · 8 days ago
Not public yet × Transport
- Maersk: unauthorised access and data extraction from a local legacy system Breaches & extortion · 4 days ago
- Auto-Planning: hack of a booking provider for French vehicle inspection centres Supply chain · 18 days ago
Not public yet × Media
- Kyiv Independent: CMS and newsletter service used to send fake news Identity · 11 days ago
59 of the 143 incidents do not say yet how the attackers got in. The row shrinks as entries are re-checked.