Data Security

The ShinyHunters extortion gang claimed to have stolen data from over 14 million Panera Bread user accounts in late January.

The cyberattack, detected on January 22, 2026, allowed unauthorized actors to access a system supporting the retail website.

The attacks exploit misconfigured MongoDB instances accessible without restriction.

Cybernews researchers found that 72% of analyzed Android AI apps contained at least one hardcoded secret, with an average of 5.1 secrets leaked per app.

Security researcher Jatin Banga said that certain private Instagram profiles, when accessed from specific mobile devices, embedded links to private photos and their captions within the HTML response.

NTLM, a legacy authentication protocol, has been a persistent vulnerability, susceptible to attacks like NTLM relay, pass-the-hash, PetitPotam, and ShadowCoerce.

TriZetto Provider Solutions (TPS), owned by Cognizant, discovered the intrusion on October 2, 2025, nearly a year after the initial breach.

New research from BlackFog indicates a widespread adoption of shadow AI among employees, with a significant portion admitting to using unapproved or publicly available AI tools for work.