Gap International, Inc. experienced a network disruption on July 22, 2025, which led to unauthorized access to certain files containing personal information. The affected data included names, Social Security numbers, driver's license or state ID numbers, medical information, and health insurance inf...
HealthcareInteractive, Inc. suffered a security incident where an unauthorized actor copied certain files from their computer network between July 8, 2025, and July 12, 2025. The incident was discovered on or about July 22, 2025. The company is offering complimentary access to credit monitoring serv...
Posted by Matthew Suozzo, Google Open Source Security Team (GOSST)Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives...
Nova Biomedical Corp. experienced a sophisticated cybersecurity attack on July 22, 2025, which may have impacted personally identifiable information. The company is offering complimentary access to Experian IdentityWorks for 24 months to help protect affected individuals. Nova is also providing info...
Bellflower Unified School District suffered a data breach where an unauthorized third party may have accessed personal information, including names and other breached elements, due to unauthorized activity within its computer systems. The incident was discovered on April 15, 2026, and the district h...
New samples of DCHSpy, a spyware implant linked to Iranian APT group MuddyWater, were detected by Lookout one week after the start of the Israel-Iran conflict
An investigation has revealed novel scams using tools like MaisonReceipts, creating realistic fake receipts to resell stolen or counterfeit good
Vendetect is our new open-source tool for detecting copied and vendored code between repositories. It uses semantic fingerprinting to identify similar code even when variable names change or comments disappear. More importantly, unlike academic plagiarism detectors, it understands version control hi...
An attack on a US accounting firm delivered PureRAT via Ghost Crypt, involving social engineering and advanced obfuscation techniques
CVE-2025-54309 could allow remote attackers to obtain admin access via HTTPS
**[Mise à jour du 23 juillet 2025]** Le 20 juillet 2025, Microsoft a publié des correctifs pour une vulnérabilité de type limitation insuffisante d'un chemin d'accès à un répertoire restreint, aussi appelé *path traversal*, affectant SharePoint Enterprise Server 2016, SharePoint Server 2019 et...
On-prem SharePoint customers have been told to assume compromise, with attackers observed to be exfiltrating data from victim servers across critical sectors
This post reports on activity from the 'Mimo' threat actor.
Le SAAEB a subi une tentative d'attaque cybernétique, les systèmes internes sont temporairement hors service, mais les données ont été sauvegardées grâce à la politique de sécurité de l'information. L'équipe technique travaille à la restauration des systèmes. Les services présentiels sont actuelleme...
Le district scolaire public de Fort Smith est victime d'une attaque informatique qui a perturbé les systèmes téléphoniques et internet. Le district travaille avec une entreprise tierce pour résoudre le problème et ne prévoit pas de perturbation pour le début de l'année scolaire. L'attaque a été sign...
Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'analyse de l'ensemble des avis et alertes publiés par le CERT-FR dans le cadre d'une analyse de risques pour prioriser l'application des...
On July 21, 2025, ModMed became aware of potential unauthorized activity in certain computer servers, which ModMed subsequently determined involved servers containing limited data from some of our podiatry customers. We immediately took steps to prevent any further unauthorized activity and began an...
Opus Card Systems, Inc. has experienced a data incident, resulting in potential unauthorized access to personal information. The company is offering monitoring services to affected individuals. The incident is not currently known to have resulted in any fraud.
**[Mise à jour du 23 juillet 2025]** Le 20 juillet 2025, Microsoft a publié des correctifs pour une vulnérabilité de type limitation insuffisante d'un chemin d'accès à un répertoire restreint, aussi appelé *path traversal*, affectant SharePoint Enterprise Server 2016, SharePoint Server 2019 et...
JASCO Applied Sciences suffered a data breach after an unauthorized party gained access to their network, resulting in the acquisition of personal information. The breach was discovered on July 21, 2025, and around October 20, it was established that that some personal information had been acquired....