Loading story…
A misconfigured, publicly accessible development server operated by regional airline CommuteAir exposed an outdated 2019 version of the U.S. no-fly list along with personal information for roughly 900 employees. The exposure was reportedly discovered by Swiss hacker maia arson crimew, who found a file named NoFly.csv containing more than 1.5 million records, including names and birth dates of people identified as having suspected ties to terrorist organizations; reports noted the total was likely inflated by aliases and duplicate-style entries.
CommuteAir confirmed the database was legitimate, took the server offline, and said it reported the incident to the Cybersecurity and Infrastructure Security Agency. The leaked file was described as a subset of the broader U.S. Terrorist Screening Database maintained by the DOJ, FBI, and Terrorist Screening Center, and the disclosure renewed criticism from civil liberties advocates who argue the watchlisting system is opaque, error-prone, and disproportionately affects Muslims and people of Arab, Middle Eastern, or South Asian descent.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
CommuteAir confirmed the legitimacy of the exposed database, said the development server had been taken offline, and reported the incident to the Cybersecurity and Infrastructure Security Agency. This marked the company's official response to the exposure.
Swiss hacker maia arson crimew reportedly found the unprotected CommuteAir development server and identified the leaked no-fly list data on it. The discovery was first reported publicly in media coverage published on January 19, 2023.
A publicly accessible misconfigured development server operated by CommuteAir exposed an outdated 2019 version of the U.S. no-fly list along with personal data belonging to about 900 employees. The exposed file, labeled "NoFly.csv," reportedly contained more than 1.5 million entries, including names and birthdates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iran-linked hacktivist group identified as **Nasir Security**, also known as **Nasir Resistance**, has allegedly leaked data stolen during a months-long breach of **Dubai International Airport**. Reports say the exposed material includes passport images belonging to Americans, Arabs, and Emiratis, along with photos of luggage contents and airport security scanner images. No confirmed evidence has emerged that airport operational systems or intelligence data were exposed, but the leaked personal records could be used for **identity theft**, fraud, and targeting of travelers. The intrusion was reported amid a broader escalation in regional cyber activity following U.S.-Israel strikes against Iran, with researchers linking the campaign to a wider pattern of Iranian cyber operations. Separate reporting also noted activity by the Iranian state-backed group **Seedworm**, which has reportedly compromised multiple organizations, including a U.S. bank and another airport, underscoring concerns that transportation infrastructure and traveler data are becoming focal points in the expanding cyber conflict.
Jun 29, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
A publicly accessible directory tied to U.S. government contractor **CMI Management Inc.** exposed more than **70,000 files** linked to U.S. military installations and personnel. Reports say the contractor, which provides facility management services to the **U.S. Army**, left records openly available for months through an open directory listing, allowing access to sensitive material including personnel records, contractor documents, maintenance forms, emails, schematics, and photographs taken inside military bases. The leak created risks including **phishing, impersonation, and intelligence gathering** against military facilities and staff. Researcher **Arkadeep Roy** reportedly alerted **CISA** in 2024 after the exposure was identified following a tip to Cybernews, but the files remained accessible as recently as March 2026, underscoring how long-lived misconfigurations at defense contractors can leave operationally sensitive government data exposed.
Jun 29, 2026