Loading story…
Pay Tel, a prison communications provider serving facilities across much of the United States, secured a publicly accessible Microsoft Azure storage server after researchers found it exposed without password protection. The exposed data included at least 300,000 scans of driver’s licenses and other government-issued IDs, as well as profile photos, inmate communications, handwritten notes, text messages, and financial records tied to customers using the service to contact incarcerated people.
Researchers said many uploaded photos also contained precise geolocation metadata that in some cases could reveal users’ home addresses, increasing the sensitivity of the leak. UpGuard reported notifying Pay Tel on May 7 and following up before the server was secured, but the company had not publicly acknowledged the exposure or said whether affected individuals or state attorneys general would be notified under breach disclosure laws. The incident marks Pay Tel’s second known security event in two years, following a ransomware attack in 2025.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
After UpGuard's notification and follow-up, Pay Tel secured the publicly exposed Azure storage server. Reporting said the company had not publicly acknowledged the incident at the time of publication.
Pay Tel experienced a ransomware attack in June 2025, marking the company's earlier known security incident referenced in later reporting about the data exposure.
UpGuard discovered that a Microsoft Azure storage server belonging to Pay Tel was publicly accessible without a password and notified the company on May 7. Researchers said the exposed data included at least 300,000 driver's license scans and other sensitive customer and inmate-related records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Identity-verification provider **IDScan** confirmed that attackers stole data from its cloud systems during a reportedly year-long intrusion. The compromised dataset includes full names, driver’s-license numbers, and identification numbers from other government documents, including passports; IDScan holds more than 150 million driver’s-license records. The records were advertised on a dark-web marketplace and reportedly searchable for more than 150 million people in the United States and Canada, potentially including photographs. The seller and breach method have not been publicly identified, while IDScan continues its investigation and the FBI is investigating; the Pentagon said it was aware of reports that Defense Secretary Pete Hegseth’s information appeared in the database.
Sep 15, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
CareCloud disclosed that hackers breached an AWS environment tied to its CareCloud Health electronic health record platform and accessed a data store between March 10 and March 16, disrupting the environment before the company secured it. Breach notices filed with state attorneys general and subsequent reporting indicate the attackers claimed to have exfiltrated database data, with the incident affecting roughly **345,000 to 350,000** people in the United States. The compromised information included names, addresses, dates of birth, Social Security numbers, driver’s license and other government ID numbers, bank account and payment card details, and medical and health insurance records. CareCloud said it engaged external cybersecurity experts, removed the threat, found no evidence of persistent unauthorized access, and is offering up to **24 months** of identity theft protection and credit monitoring, while no ransomware or extortion group had publicly claimed responsibility at the time of reporting.
Aug 2, 2026