Data Security

Major European food delivery platform GonnaOrder had real-time order information from thousands of its customers inadvertently exposed by a Kafka Broker instance that has been unsecured since August 2022, reports Cybernews.

An attacker could have sent an email causing Copilot to leak info via a markdown image.

The Office of Personnel Management was found to have violated the law by providing the Department of Government Efficiency with access to its databases containing information on current and former federal workers, as well as job seekers, following the inauguration of President Donald Trump, according to The Hill.

Such a leak stemming from inadequate security configurations is the first to impact a Chroma database, according to a report from UpGuard, which identified the internet-exposed database that has since been secured.

Independent security researcher brutecat was able to create an exploit that facilitated the exposure of targeted accounts' full display names while circumventing Google's anti-bot defense mechanism hindering password reset request spamming.

While data exposed by Arkana Security was initially suspected to be from a new data breach, BleepingComputer discovered that the recently leaked files were the same as those previously identified in the Snowflake attacks.

Attackers who breached the state's CRIS using a compromised account, which has since been taken down, were able to exfiltrate data, including names, driver's license numbers, license plate numbers, car insurance policy numbers, and addresses, as well as details on crash-related injuries and incident narratives.