Loading story…
Avnet, a global leader in electronic component distribution and supply chain solutions, experienced a significant data breach in late September 2025, impacting its EMEA (Europe, Middle East, and Africa) operations. The breach was detected on September 26, 2025, when unauthorized access was discovered in an externally hosted cloud storage environment supporting an internal sales tool. Attackers managed to steal approximately 1.3 terabytes of compressed data, which could expand to between 7 and 12 terabytes when uncompressed. The compromised data included historical sales records, employee emails, customer contact lists, and other operational information. Avnet responded by rotating all credentials across its Azure and Databricks cloud environments to contain the breach and prevent further unauthorized activity. The company asserted that the majority of the stolen data was unreadable without access to its proprietary sales tool, which remained secure and unaffected by the incident. Despite these claims, both cybersecurity researchers and the threat actor released plaintext samples of the stolen data on dark web leak sites, revealing that some personally identifiable information (PII) such as employee emails and customer contact details were accessible. The threat actor behind the breach stated their motivation was financial, setting up a leak site to pressure Avnet into paying a ransom by publishing data samples. Avnet confirmed that the breach was limited to a single system in the EMEA region and did not disrupt its global operations. The company also stated that it had informed authorities and would be contacting impacted customers and suppliers. The incident has raised concerns about the security of technology supply chains, especially given Avnet's role as a Fortune 500 company with operations in 125 countries and annual revenues of $27 billion. The exposure of PII increases the risk of phishing, identity theft, and other malicious activities targeting both employees and customers. Avnet's prompt response in rotating credentials and securing its cloud environments was aimed at containing the breach, but questions remain about the extent of data exposure. The company has not publicly confirmed the authenticity of the leaked data samples, but the presence of plaintext information on dark web forums suggests that at least some sensitive data is accessible. The breach highlights the ongoing challenges organizations face in securing cloud-based environments and the potential impact of such incidents on global supply chains. Avnet's communication with authorities and affected parties is part of its incident response, but the long-term consequences for its reputation and customer trust are yet to be determined. The event underscores the importance of robust security controls and rapid response measures in mitigating the fallout from large-scale data breaches.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
In its public response, Avnet said the data taken in the breach was unreadable, indicating protections such as encryption or similar safeguards limited the usefulness of the stolen information. This clarification accompanied the company's breach confirmation.
Avnet disclosed that an internal sales tool was compromised in a data breach affecting company information. The incident was publicly reported in early October 2025 across multiple outlets.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026
A massive data exposure incident occurred involving Netcore Cloud, an Indian-based global email marketing and automation company, when a misconfigured server left over 40 billion records and 13.4 terabytes of data publicly accessible. The exposed database contained unencrypted mail logs, which included sensitive information such as email addresses, message subjects, internal delivery details, and technical data like IP addresses and SMTP configurations. Among the leaked records were healthcare notifications, banking activity alerts, and employment-related emails, some of which were marked as confidential. The data was accessible to anyone who knew the server’s IP address, posing a significant risk of unauthorized access and potential misuse. The breach affected Netcore Cloud’s global client base, which spans more than 6,500 brands across 40 countries and includes organizations in sectors such as ecommerce, finance, media, and travel. The exposure was discovered by cybersecurity researcher Jeremiah Fowler, who reported the issue after finding the database unprotected and unencrypted. Upon notification, Netcore Cloud responded promptly by securing the database and restricting public access on the same day. The company also requested additional information from the researcher to support its internal investigation. The incident highlights the risks associated with misconfigured cloud infrastructure, especially for companies handling large volumes of sensitive communication data. The scale of the exposure, both in terms of record count and data volume, makes it one of the more significant data leaks in recent times. The presence of confidential and technical information in the logs could facilitate further attacks, such as phishing or account compromise, if accessed by malicious actors. The incident underscores the importance of robust security controls, regular audits, and prompt response protocols for organizations managing critical customer data. Netcore Cloud’s swift action in securing the database likely mitigated further risk, but the exposure period remains unclear. The breach has raised concerns about data privacy and the security practices of third-party service providers in the email marketing industry. Organizations using Netcore Cloud’s services may need to assess their own exposure and consider additional safeguards. The event serves as a cautionary tale for all companies relying on cloud-based infrastructure to ensure proper configuration and continuous monitoring to prevent similar incidents.
Jul 12, 2026
The European Commission is investigating a breach after a threat actor gained unauthorized access to its Amazon cloud infrastructure and at least one account used to manage that environment. According to reports, the intrusion was detected quickly by the Commission’s cybersecurity incident response team, but the actor claims to have exfiltrated more than **350 GB** of data, including multiple databases. Screenshots shared with reporters allegedly show access to European Commission employee information and an email server used by staff. The actor reportedly said they do not intend to extort the Commission and instead plan to leak the stolen data later. The incident adds to a recent string of security problems at European institutions: the Commission had already disclosed a separate breach tied to a compromised mobile device management platform, apparently linked to exploitation of **Ivanti Endpoint Manager Mobile** code-injection vulnerabilities that affected other organizations in the region as well.
Jun 29, 2026