DHS data leak, Northflank suffers breach, Russian Poryadok cyberattack - LinkedIn
Over 41,000 homeland security workers' data leaked this week, while cloud platform Northflank warns customers of a breach affecting AI API keys.
The data was released on Wednesday by the non-profit group DDoSecrets, identifying employees and contractors for the U.S. Department of Homeland Security (DHS). The records include operation names, surveillance programs, information on undercover initiatives, as well as names, phone numbers and email addresses of employees from various DHS agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations and Cybersecurity and Infrastructure Security Agency.
Cloud Platform Breach
Cloud application hosting platform Northflank is urging its customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. The incident was disclosed on Saturday and was detected by cloud security company Wiz.
assume their environment variables had been decrypted and that the secrets stored within them were stolen
Retail Disruptions
Russian home goods chain Poryadok, which operates 48 stores in 32 Russian cities, had to cease operations in some stores and suspend online services for five consecutive days due to a cyberattack first detected Sunday October 25. The company confirmed the attack but did not disclose how hackers breached its systems or when normal operations would resume, leaving customers unable to collect orders, access loyalty accounts, or contact customer support.
Online fashion retailer Revolve has announced that cybercriminals gained access to payment card numbers and expiration dates during a recent cyber incident after accessing multiple company systems. The attack used automated means to obtain PII and payment card information from its e-commerce platform.
New Vulnerabilities
Security researcher Mark Blah has released a proof-of-concept exploit for a recently patched Android vulnerability dubbed "SMS of Death." The CVE-2026-58882 vulnerability lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message—a zero-click denial-of-service flaw that processes numeric codes before reaching the SMS inbox.
Researchers at Kaspersky are warning of a highly sophisticated infection chain targeting government organizations in Asia. The attack focuses on a custom Windows 10 build used exclusively by government entities in the region and involves a previously undocumented .NET assembly-loading framework codenamed NetamLoader, potentially involving a supply chain attack using a trusted third-party vendor.
Infrastructure Concerns
GCHQ, the British cyber and signals intelligence agency, reports it cannot account for thousands of USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices, according to its official watchdog, the Investigatory Powers Commissioner's Office (IPCO). The removable media are used extensively in some operating processes and may contain data obtained under the Investigatory Powers Act.
Openreach, a subsidiary of British Telecom, is reminding customers that its legacy phone network will be officially switched off on January 31, impacting those still using landline telephones and systems relying on PSTN connectivity, including point-of-sale terminals, fire and security alarms, and personal care alarms for elderly and vulnerable people.
Related
