Loading story…
A leading North American bank suffered a $250 million breach after attackers exploited a misconfigured web application firewall and chained cloud and identity weaknesses. Over 100 million customer records were exposed due to siloed security teams and overlooked connections between cloud misconfigurations and over-permissioned access. The incident highlights the need for exposure management platforms to proactively identify and remediate complex attack paths across hybrid environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
10 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcethehackernews.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcehelpnetsecurity.com
Open sourcecio.com
Open sourcescworld.com
Open sourcehorizon3.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026
Threat actors are actively exploiting **intentionally vulnerable web applications** used for security training and internal testing (including **DVWA**, **OWASP Juice Shop**, **Hackazon**, and **bWAPP**) when they are mistakenly exposed to the public Internet, using them as an entry point into enterprise cloud environments. Reporting based on a Pentera investigation described evidence of real-world abuse leading to follow-on activity such as **cryptominer deployment**, **webshell placement**, and **pivoting** deeper into sensitive systems—especially when these apps are deployed from **privileged cloud accounts** and paired with weak configurations. Pentera reported finding **1,926** live exposed instances across **AWS, GCP, and Azure**, frequently associated with **over-permissioned IAM roles** and poor hygiene such as **default credentials** and failure to follow least-privilege practices. The exposed environments could enable access to cloud storage (e.g., **S3**, **GCS**, **Azure Blob Storage**), secrets stores (e.g., **AWS Secrets Manager**), container registries, and in some cases **administrative control** of cloud accounts; impacted organizations cited in coverage included major vendors such as **Cloudflare**, **F5**, and **Palo Alto Networks**, which were notified and reportedly remediated affected exposures.
Jun 29, 2026
A massive data exposure incident occurred involving Netcore Cloud, an Indian-based global email marketing and automation company, when a misconfigured server left over 40 billion records and 13.4 terabytes of data publicly accessible. The exposed database contained unencrypted mail logs, which included sensitive information such as email addresses, message subjects, internal delivery details, and technical data like IP addresses and SMTP configurations. Among the leaked records were healthcare notifications, banking activity alerts, and employment-related emails, some of which were marked as confidential. The data was accessible to anyone who knew the server’s IP address, posing a significant risk of unauthorized access and potential misuse. The breach affected Netcore Cloud’s global client base, which spans more than 6,500 brands across 40 countries and includes organizations in sectors such as ecommerce, finance, media, and travel. The exposure was discovered by cybersecurity researcher Jeremiah Fowler, who reported the issue after finding the database unprotected and unencrypted. Upon notification, Netcore Cloud responded promptly by securing the database and restricting public access on the same day. The company also requested additional information from the researcher to support its internal investigation. The incident highlights the risks associated with misconfigured cloud infrastructure, especially for companies handling large volumes of sensitive communication data. The scale of the exposure, both in terms of record count and data volume, makes it one of the more significant data leaks in recent times. The presence of confidential and technical information in the logs could facilitate further attacks, such as phishing or account compromise, if accessed by malicious actors. The incident underscores the importance of robust security controls, regular audits, and prompt response protocols for organizations managing critical customer data. Netcore Cloud’s swift action in securing the database likely mitigated further risk, but the exposure period remains unclear. The breach has raised concerns about data privacy and the security practices of third-party service providers in the email marketing industry. Organizations using Netcore Cloud’s services may need to assess their own exposure and consider additional safeguards. The event serves as a cautionary tale for all companies relying on cloud-based infrastructure to ensure proper configuration and continuous monitoring to prevent similar incidents.
Jul 12, 2026