Loading story…
Researchers disclosed a chain of severe flaws in RA-MICRO's cloud-based legal software that exposed highly sensitive law-firm and client data, including downloadable backups, weakly encrypted archives, embedded credentials, broken authentication, and multiple paths to account takeover. According to the Chaos Computer Club (CCC), some backups were protected only with obsolete ZipCrypto, enabling decryption through a known-plaintext attack and revealing court files, internal notes, correspondence, contact data, and credentials for IMAP mailboxes and Germany's beA legal communications system.
The reported issues extended beyond backup exposure to include credentials in public JavaScript, installation scripts, and backend source code, reconstruction of the JWT signing secret, plaintext password storage, creation of administrator accounts via an apparent test-account mechanism, subdomain takeover, and exposure of private TLS keys through an API. CCC said researchers had reported initial vulnerabilities in 2025 and later uncovered broader weaknesses, while a separate report indicated police were called out overnight in connection with a zero-day incident tied to the case, underscoring the seriousness of the vendor's security failures and the legal risks faced by independent researchers in Germany.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Chaos Computer Club published details of multiple severe security failures affecting RA-MICRO, describing exposure of sensitive legal and client data, credential leaks, and several paths to administrative compromise. The disclosure highlighted negligent security practices and the legal risks faced by independent researchers in Germany.
In August 2025, researchers reported a wider range of RA-MICRO flaws, including exposed backups, weak encryption, embedded credentials, broken authentication, account takeover paths, and other severe weaknesses. The CCC handled communication with the vendor because the researchers feared legal risks under German anti-hacking laws.
According to the CCC, the first vulnerabilities affecting RA-MICRO were reported in May 2025. These issues were part of a broader set of severe security failures in the legal-tech platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant data breach at RemoteCOM, a provider of surveillance and monitoring software for the US criminal justice system, has resulted in the exposure of highly sensitive personal information belonging to nearly 14,000 individuals under court supervision. The breach, attributed to a hacker known as "wikkid," targeted RemoteCOM's proprietary SCOUT software, which is widely used by law enforcement agencies across 49 US states to monitor pretrial, probation, and parole clients. SCOUT operates as a comprehensive surveillance tool, recording keystrokes, capturing screenshots, tracking locations, and sending alerts based on specific keywords typed by monitored individuals. The leaked data was split into two main files: one containing detailed records of monitored clients, and another listing thousands of criminal justice employees who used RemoteCOM's services. The "clients" file included names, home addresses, phone numbers, email addresses, IP addresses, and specific charges or offenses, ranging from sex offenses and narcotics to terrorism, stalking, and hacking. The "officers" file exposed the names, work addresses, phone numbers, email addresses, unique IDs, and job titles of nearly 7,000 criminal justice professionals. The breach has raised concerns about the security of surveillance data, especially given the sensitive nature of the information and the potential risks to both monitored individuals and law enforcement personnel. Some records labeled clients as "tech savvy," and the data also revealed the financial burden placed on offenders, with installation and recurring monitoring fees for each device. The exposure of such detailed information could lead to threats, harassment, or violence against both clients and officers, particularly as some clients may not have been convicted but were merely under investigation or awaiting trial. The hacker described the breach as "one of the easiest" they had ever carried out, highlighting possible weaknesses in RemoteCOM's security posture. The incident has prompted calls for greater scrutiny of surveillance technology vendors and the protection of sensitive data managed by third-party providers. The leak also underscores the broader risks associated with the use of aggressive spyware-like tools in the criminal justice system. Law enforcement agencies and affected individuals now face heightened risks of doxxing, identity theft, and targeted attacks. The breach has sparked debate about the ethics and oversight of digital monitoring in the justice system, as well as the responsibilities of vendors handling such critical data. Security experts warn that the fallout from this breach could be long-lasting, with the potential for further exploitation of the leaked information by malicious actors. The incident serves as a stark reminder of the need for robust cybersecurity measures in organizations handling sensitive personal and law enforcement data.
Jun 29, 2026
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026
Researchers detailed how **CVE-2022-35405**, a pre-authentication remote code execution flaw in **Zoho/ManageEngine Password Manager Pro**, could let an internet-based attacker take over the password vault server through its XML-RPC functionality. The issue was tied to insecure deserialization behavior, aligning with broader OWASP guidance that deserialization flaws can allow untrusted data to trigger arbitrary code execution when applications process attacker-controlled objects. After gaining code execution on a vulnerable Password Manager Pro instance, red-team researchers showed they could reverse engineer the product’s server-side cryptography and recover sensitive secrets, including the stored database password, the master key, and plaintext managed credentials. Their analysis of the default PostgreSQL deployment found that the server’s ability to decrypt secrets on behalf of users created a **single point of failure**: once the PMP server was compromised, attackers could extract vaulted credentials and use them to escalate access, potentially reaching **Domain Admin** in enterprise environments.
Jul 24, 2026