… In a public update following the incident, Guillermo Rauch reckons the intrusion began with a compromised employee account linked to Context.ai. An attacker used that access to hijack the employee's Vercel Google Workspace account to drill into the company's systems. …
… And in a subsequent letter sent to employees, Starbucks advised impacted staff that their names, Social Security numbers, and dates of birth, along with financial account numbers and routing numbers, may have been snarfed up by "an unauthorized third party." Starbucks became aware of the breach aro… …
… Crypto flows to sanctioned entities Blockchain-watcher Chainalysis last week published research claiming sanctioned entities managed to conduct $154 billion worth of cryptocurrency transactions in 2025, a 694 percent year-over-year increase. $104 billion of that haul went to sanctioned entities, wi…
… "No penalty was imposed on, nor findings of a breach made against, Apple Inc." MORE CONTEXT The drone swarm is coming, and NATO air defenses are too expensive to cope Russians are posing as Signal support to launch phishing attacks Iran's cyberattack against med tech firm is 'just the beginning' Ru… …
… In statements to other outlets , however, it claimed the activity "appears to be part of a broader issue involving a misconfiguration within Salesforce's environment that has impacted multiple organizations." MORE CONTEXT Microsoft announces product it doesn't want you to buy: Extended security upd… …
… Google has also spotted the miscreants using fake security software updates to trick victims into downloading remote access malware. …
Security Vibe coding upstart Lovable denies data leak, cites 'intentional behavior,' then throws HackerOne under the bus A lesson in how not to respond to vulnerability reports UPDATED Vibe-coding platform Lovable is pooh-poohing a researcher’s finding that anyone could open a free account on the s… …
… The attacker used that access to take over the employee's Vercel Google Workspace account, which enabled them to gain access to some Vercel environments and environment variables that were not marked as “sensitive.” Context.ai has also published a security bulletin that reveals a March incident tha… …
… Security firm StepSecurity found that both versions were published via the compromised npm account of "jasonsaayman," the project's primary maintainer, who was reportedly locked out of the account while the packages were being pushed. …
… INFOSEC IN BRIEF Russian intelligence-affiliated parties are posing as customer support services on commercial messaging applications such as Signal to compromise accounts and conduct phishing attacks, the FBI and Cybersecurity and Infrastructure Security Agency CISA warned last Friday. …