Loading story…
HDFC Asset Management Company disclosed a cyber incident after its IT administrator detected unusual activity on 16 May and found parts of its on-premises VMware environment inaccessible, including VPN, SFTP, and antivirus management servers. The company told the Bombay High Court that it later received an email from a threat actor calling itself Morpheus, which claimed to have exfiltrated more than 680 GB of critical data; the group subsequently listed the firm as HDFC FUND on its Tor leak site, indicating an active extortion campaign. HDFC AMC said it activated incident-response measures and notified SEBI and stock exchanges after the breach.
Court filings and reporting indicate the stolen material may include customer PII, PAN details, bank account information, investment records, employee records, and proprietary investment analysis, raising risks of identity theft, fraud, and strategic business exposure. HDFC AMC warned investors about possible SIM-swap attacks that could enable OTP interception and account takeover. On 29 May, the Bombay High Court issued an ex parte interim injunction restraining Morpheus from publishing or sharing the data and directed the Union government to seek removal or blocking of related online accounts, although the practical impact may be limited against Tor-hosted infrastructure.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
The matter was scheduled for further hearing before the Bombay High Court on June 16. This followed the interim injunction issued against Morpheus over the alleged theft and threatened disclosure of HDFC AMC data.
On June 10, Morpheus listed HDFC AMC as 'HDFC FUND' on its Tor-based leak site. The posting indicated the extortion attempt had progressed beyond a private claim to public leak-site exposure.
On May 29, the Bombay High Court issued an ex parte interim injunction restraining the Morpheus ransomware group from publishing or disclosing HDFC AMC's allegedly stolen data. The court also directed the Union government to take steps to remove, block, disable, and delete online accounts associated with the stolen information.
On May 16, HDFC AMC notified the Securities and Exchange Board of India and stock exchanges about the cybersecurity incident. This was part of the company's formal response following detection of the compromise.
Also on May 16, HDFC AMC found an email from a threat actor calling itself Morpheus claiming it had exfiltrated more than 680 GB of critical company data. The claim marked the start of an apparent data-extortion campaign tied to the intrusion.
On May 16, HDFC AMC's IT administrator detected unusual activity and found parts of the company's on-premises VMware environment inaccessible, including VPN, SFTP, and antivirus management servers. The company activated its cybersecurity response protocols after discovering the disruption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bank of Baroda has confirmed a cybersecurity incident after threat actors claimed to have stolen and published sensitive bank data online. The bank said a compromised employee email account enabled unauthorized access to certain data, but added that its core banking systems were not accessed and that the incident was detected and contained quickly. Public reporting said leaked samples and directory listings appeared to include internal documents, customer onboarding records, audit materials, internal emails, loan documents, and corporate banking files, although the authenticity and full scope of the exposed data have not been independently verified. Researchers tracking darknet activity said the stolen material was advertised for sale on underground forums and a Telegram channel by an actor identified in separate reports as **"leak-king-F"** and publicly linked elsewhere to **Triple X**. One report described the cache as roughly **1 TB** of data spanning retail, corporate, and digital banking operations, while also noting an unverified claim that the breach stemmed from a weak password. Bank of Baroda had not confirmed customer-data exfiltration, and the incident raised concerns over fraud, phishing, and follow-on attacks if internal security and audit documents were exposed.
Jul 30, 2026
Cybersecurity agencies from the United States, United Kingdom, Australia, New Zealand, and Singapore warned that threat actors were actively exploiting multiple **Accellion File Transfer Appliance (FTA)** vulnerabilities to compromise organizations worldwide. The campaign abused `CVE-2021-27101`, `CVE-2021-27102`, `CVE-2021-27103`, and `CVE-2021-27104` to deploy a web shell, execute commands, steal data, and erase logs, affecting government and private-sector victims across medical, legal, telecommunications, finance, and energy sectors. Authorities said some intrusions led to data theft and extortion, identified suspicious outbound traffic to `194.88.104[.]24` and `45.135.229[.]179`, and urged organizations to isolate affected systems, collect forensic images, reset credentials and tokens, upgrade to version `9_12_432` or later, and migrate away from the end-of-life platform. One disclosed victim was **Morgan Stanley**, which said attackers breached the Accellion FTA server of third-party vendor **Guidehouse** and stole encrypted files tied to stock plan participants. The attackers also obtained the decryption key, exposing sensitive data including names, addresses, dates of birth, Social Security numbers, and corporate company names, while Morgan Stanley said its own internal applications were not compromised. Reporting linked the broader Accellion intrusion wave to **FIN11** and the **Clop** ransomware operation, underscoring how exploitation of a legacy file-transfer appliance cascaded into downstream third-party data breaches and extortion risk.
Aug 15, 2026
Amgen disclosed a material data breach involving cloud environments operated by third-party service providers, saying attackers gained unauthorized access and exfiltrated patient protected health information, proprietary company data, and other records. The company detected the activity in July 2026, activated its incident response plan, contained the intrusion, and brought in independent forensic experts to investigate. Amgen said it has not yet identified the affected cloud providers, the intrusion method, the number of impacted individuals, or any threat actor tied to the breach. The company determined the incident was material on July 29 based on the volume of affected files and the possibility that highly sensitive information was included. Amgen is still assessing whether confidential business information, intellectual property, research and development data, or additional patient data were accessed, while also evaluating notification obligations tied to the theft of PHI. Reporting on the incident indicates the breach could trigger both **HIPAA** compliance requirements and **SEC** disclosure scrutiny, although Amgen said it does not currently expect a material impact on its financial condition or operations.
Aug 18, 2026