Loading story…
Unity Technologies, a prominent video game software development company, experienced a significant data breach involving its SpeedTree 3D vegetation modeling software website. The breach was the result of malicious code injected into the checkout page, which remained undetected from March 13 to August 26, 2025. This unauthorized code was capable of skimming sensitive customer information during the purchase process. As a result, data belonging to 428 customers was compromised, including names, addresses, email addresses, access codes, and payment card details. Unity Technologies discovered the breach on August 26, 2025, and immediately took action by disabling the website and removing the malicious code. The company launched a thorough investigation to determine the scope and impact of the incident. Following the investigation, Unity notified affected customers and relevant authorities, including the Office of the Maine Attorney General. To mitigate the potential impact on victims, Unity is providing 12 months of complimentary credit monitoring and identity protection services through Equifax. The breach notification letter detailed the timeline of the compromise and the specific data elements exposed. Unity also reviewed affected files and implemented additional security measures to prevent similar incidents in the future. The company’s response included transparent communication with customers and regulatory bodies. The incident highlights the risks associated with e-commerce platforms and the importance of monitoring for unauthorized code injections. In parallel, Unity disclosed a separate high-severity vulnerability in the Unity Editor, tracked as CVE-2025-59489, which could allow arbitrary library loading and malicious code execution, though this was not directly related to the SpeedTree breach. Customers who made purchases on the SpeedTree website during the affected period are advised to monitor their financial accounts for suspicious activity. The breach underscores the need for robust web application security and timely detection of malicious activity. Unity’s swift response and offer of identity protection aim to reduce the risk of further harm to affected individuals. The incident serves as a reminder for organizations to regularly audit their web infrastructure for vulnerabilities and unauthorized changes.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Unity Technologies disclosed that its SpeedTree website was compromised, resulting in the theft of customer payment card information. Reporting indicates the incident affected more than 400 individuals.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
Ultrahuman disclosed that attackers accessed customer wellness data after using credentials stolen from an employee whose laptop was infected with malware. The intrusion targeted an internal analytics system on March 27, and the company said it detected the activity within hours, took the affected system offline, and revoked access. Ultrahuman said the attackers had **read-only** access and that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised. The company said about **0.1%** of users were affected, which based on its previously reported user base could amount to at least **700 customers**. Ultrahuman has begun notifying impacted users and regulators after completing an audit of the incident’s scope, but it has not confirmed whether any data was exfiltrated or specified exactly which wellness data was accessed.
Jun 29, 2026
Unlimited Technology Systems, a Montgomery, Ohio-based provider of revenue cycle management services, disclosed a data breach affecting **3,803,750 individuals** after hackers stole information from one of its commercial data centers. The intrusion occurred between **October 10 and October 15, 2025**, and was discovered on **October 19, 2025**. The company later reported the incident to the US Department of Health and Human Services in late July 2026, and HHS added it to its breach portal. The stolen data included personal, medical, and health insurance information such as **Social Security numbers**, medical record numbers, diagnoses, dates of service, insurance details, and scanned identity documents. Unlimited Technology Systems said full patient medical records, medical imaging, and financial account or payment card data were not exposed, and it has not identified attempted or actual misuse of the stolen information. The company is offering affected individuals two years of credit monitoring, fraud consultation, and identity theft restoration services.
Aug 10, 2026