Tag: hackers

Danish Population Register Breached, Leaking Data of Nearly Nine Million People

Hackers are suspected of having cracked the Danish government’s national database containing the personal information of nearly nine million people, potentially exposing them to fraud or identity theft.

Copenhagen’s Ministry of Research, Education and Digitalisation said on Monday that the Central Register of Persons (CPR), the national civil registration database containing personal information for millions of citizens, has been compromised.

In Denmark, all legal residents have a unique 10-digit civil registration number, used to access public services, healthcare, banking, and taxes, and to store information on each citizen, including name, date of birth, address, marital status, citizenship, religious affiliation, and parentage.

The government said on Monday that unidentified people used a Danish business’s access to the system to wrongfully obtain the CPR numbers, names, and addresses of around 8.8 million people, the public Danish Broadcasting Corporation (DR) reported.

In a briefing on Monday, government minister Christina Egelund said that it was too early to tell whether it was a cyber attack or whether foreign state actors were involved in the leak.

“We are not ruling out any clues in the ongoing investigation. Nor that it may have an international character,” she said.

Egelund added that the government will review the entire CPR system and implement “adjustments and transformations” to re-establish security.

Keep reading

‘Session Keys Stolen’ – Hackers Steal Claude Tokens From Paying Subscribers

Hackers have been ‘draining’ usage tokens from the accounts of Paying Subscribers of Anthropic’s Claude AI large language model by hijacking their login sessions to the platform, reports TechCrunch.

The phenomenon came to light when independent AI consultant, Grant De Swardt, noticed that although he had not been using Claude (on a paid-for ‘Claude Max 20x’ plan) on a particular day, his token usage had increased on that day. He notified Anthropic of the issue the following day and, after the company had suspending his paid-for account and, in the words of De Swardt, ‘invalidated all sessions and server-side Claude Code tokens’, issued a partial refund of £44.49 (half of the remaining portion of the subscription cost of $200 per month for Claude Max 20x).

De Swardt was advised by the company that, after investigating the unusual activity, that a compromised Claude session key had been used to generate ‘unauthorized Claude Code OAuth tokens’. In essence, his Claude account had been used by an ‘unauthorized third-party service’ that happened to have been processing activity for other people as well. De Swardt, who raised the issue on Reddit, was unable to establish how the ‘hacking’ had taken place although the evidence was consistent with either ‘stolen credentials or session data’ or ‘connection to an external service’. In the interim, other users came forward on the same Reddit thread to report similar issues with Claude.

One reported that his account had been ‘auto-upgrade[d] without consent’ and ‘charge[d]’ in the process – with the resulting usage suddenly jumping from 0% to 100%. Another reported that, within 12 minutes of using Claude to enter a few prompts and then conducting a simple web search, his account’s usage had suddenly shot up from 0% to 49%. And a third – who had found that his account had ‘exhausted its maximum daily tokens for three consecutive days with no activity’ – raised the matter via a GitHub issue.Anthropic eventually sent an email to some of the affected users – including the party who had discovered that his account had ‘sprinted’ through its maximum daily allowance of tokens over three consecutive days while he was doing nothing with the service – warning that a ‘bad actor’ was using ‘infostealer malware’ to ‘steal logged in Claude sessions from user computers and then drain tokens from their accounts’.

The company emphasized that the malware in question does not come from Claude itself and can be contracted from a variety of online sources including, by way of example, via ‘downloader[ies] infected with the malware’ and ‘ads infected with the malware’. In those circumstances, Anthropic explained that, in order to protect the affected users, it had signed them out of Claude, ‘Rejected all Authorizations for those sessions’, and issued refunds to those users deemed to have been affected.

Keep reading

Chinese Hacking Groups Used Shared Attack Tool Against US Aerospace Firms, NGOs

Chinese cyber-espionage groups used the same sophisticated hacking tool in campaigns targeting U.S. aerospace companies, nongovernmental organizations, mining companies, and commodity traders, according to two cybersecurity firms that separately investigated the activity.

Volexity, a Virginia-based cybersecurity firm, said on Sept. 21 its discovery of another Chinese hacking group using the same tool added to evidence of coordinated sharing within China’s cyber-espionage community.

The company said the widespread adoption “suggests a coordinated effort within the Chinese CNE community,” referring to computer network exploitation, and assessed that the core tool was likely shared, customized, and used by multiple groups.

Proofpoint, a U.S. cybersecurity company, separately documented on Sept. 9 the same capability in campaigns against a small number of U.S. NGOs, mining companies, commodity-trading firms, and multiple U.S. aerospace companies. It found several espionage groups adopting the tool within days of one another, with most of the observed clusters having a suspected China nexus.

Neither company has publicly identified who developed the tool or how it reached the different hacking groups.

The Epoch Times asked both companies whether they had identified its developer or distributor and whether they had found additional U.S. targets. Neither responded by publication time.

Same Tool, Different Targets

The hacking groups pursued different victims and installed different spying software after gaining access, but researchers found that they relied on the same underlying break-in capability.

The attacks took advantage of previously unknown weaknesses in Google Chrome and Microsoft Windows. If successful, they could allow hackers to install spying software and maintain access to a victim’s computer.

Volexity said the additional Chinese operator it identified used the same attack chain on Sept. 3 and 4, when the vulnerabilities were still unpatched.

The company cautioned that what Volexity and Proofpoint have observed may represent only part of the activity.

“The full scope and impact are likely far broader,” Volexity said.

Keep reading

Hackers claim to have stolen data on ‘almost all FBI agents’

The cybercriminal group ShinyHunters has claimed it breached the FBI and stole terabytes of sensitive personal information about nearly all of the agency’s agents and their spouses, as well as people who had applied for jobs there.

ShinyHunters is a prolific hacking and extortion group linked to large-scale data thefts targeting major companies and government organizations. The FBI itself warned about the group in May.

“We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI,” the group announced on its dark-web leak site on Tuesday. It reportedly released a sample of the purportedly stolen data and a screenshot of a defaced FBI recruitment website.

The group claimed to have taken terabytes of information, including names, home addresses and phone numbers. Reuters reported that it was able to find apparent matches for some individuals contained in a sample of the data, but could not establish that the information had actually been taken from FBI systems.

Keep reading

Revolut Leak Shows the Cost of Constant ID Collection

Online bank Revolut has revealed that it gave out sensitive personal and financial information of an undisclosed number of its customers in response to a fake government request.

The information that was handed over to an “unauthorized third party” reportedly includes names, dates of birth, occupations, addresses, phone numbers, account numbers, transaction histories (including Bitcoin), and even copies of government-issued IDs and onboarding verification selfies.

Revolut claims that derived biometric face data was not.

The company said that the data was handed over in response to an email that came from a real government agency’s domain, but was not actually sent or authorized by that agency.

The email passed several authentication checks (SPF, DKIM, and DMARC) that are designed to establish the authenticity of a message’s origin and integrity, but do not verify the legitimacy of the legal request itself.

Revolut said that it complied with the request “under the reasonable belief that it was an authentic government agency request” – and only later found out that it was not.

Revolut said it later realized its mistake, blocked the email address, and reported the incident to the relevant authorities.

Revolut said that only a “limited” number of its customers were affected by the data leak, and that the company’s systems were not hacked, nor was any money stolen.

The story broke on September 11 when Revolut customers started receiving an email notice about a data leak, and the news was picked up by media outlets the following day.

Keep reading

A Single Firm is Behind OpenAI, Anthropic, and Meta Hacking Scandals

OpenAI, Anthropic, and Meta models hacked into several real world systems over the past three months. These models gained unauthorized access to web systems, published malicious packages, and exploited unnamed vulnerabilities.

A single firm, Irregular, is responsible for hacking done by all three companies. Anthropic disclosed that Irregular was responsible for creating the tests that led to Claude hacking into real world targets and for providing the models with internet access. Irregular claims that it was unaware at the time that it provided internet access to those AI models.

In a more normal media ecosystem, the reactions to these cybersecurity issues would be obvious. American AI companies would reconsider doing business with Irregular, not only because of its failure to secure its systems, but because it is an Israeli firm potentially outside US oversight. Lawmakers would consider taking action against Irregular or against its American business partners, which include OpenAI, Anthropic, and Meta. They may consider strengthening liability against firms which instruct AI models to commit cyberattacks, and whose models then commit those cyberattacks.

Instead, Irregular, Anthropic, and their allies have begun a media campaign promoting a literally apocalyptic ideology with sensationalist language. Anthropic’s incident assessment blames their own AI’s “recklessness”; Irregular describes “the agent itself becoming a threat actor”; Anthropic CEO Dario Amodei warned, about a similar OpenAI–Hugging Face hack, that a future swarm “could be capable of taking over the entire internet”; and an Associated Press headline claimed bots are “going rogue”.

In one report from Anthropic, its Claude model breached a real company’s system through a simulated-name collision, publishing a malicious package, and scanning outside systems. In this test, Anthropic and Irregular incorrectly provided internet access to this model and did not instruct the model “which systems were in scope for the exercise”.

While Anthropic claims that their issues were caused by “rogue swarms” and “misalignment,” their later disclosure shows that exactly zero percent of the agents went “rogue”. In this experiment, Claude models’ real-world hacking dropped to zero percent once Anthropic employees told the models not to do real-world hacking. According to their own findings, Anthropic and Irregular bear all of the responsibility for the cybersecurity incidents they caused.

Keep reading

MASSIVE SPYWARE BREACH: Spain’s President Lost Millions of Messages, Emails, Photos and Audio to Pegasus

A new assessment of the Pegasus spyware attack on Spanish President Pedro Sánchez has revealed the extraordinary scale of information extracted from his cellphone, reigniting questions about who was behind the operation and what may have happened to sensitive government data.

Spain’s National Intelligence Centre, known as the CNI, has acknowledged that Pegasus extracted approximately 2.7 gigabytes of data from Sánchez’s phone during the 2021 cyberattack.

To illustrate the enormous volume of information represented by that amount of data, the CNI estimates it could correspond to roughly 5 million text messages, 100,000 emails, 1,200 photographs or 40 hours of recorded audio, according to reports published in Spain.

A Spyware Attack on the President

Sánchez’s phone was compromised by Pegasus in May 2021, with investigators determining that approximately 2.6 gigabytes of information were extracted during the first attack and another roughly 130 megabytes during a subsequent intrusion.

The phone of then-Defense Minister Margarita Robles was also targeted.

The Spanish government said at the time that the attacks were external and had not been authorized by Spanish authorities. But the identity of the person or organization responsible for the attacks has remained a major unresolved question.

Pegasus, developed by Israeli technology company NSO Group, is among the world’s most sophisticated commercial surveillance tools. Once a device is successfully compromised, attackers can potentially gain access to highly sensitive communications and information stored on the phone.

For a sitting president, that could include private conversations, diplomatic communications, government documents, photographs, contacts and information involving national-security matters.

One of the most troubling questions surrounding the case is not simply how much data was extracted, but what the attackers obtained.

Spanish authorities have previously acknowledged that forensic investigators could establish the amount of data removed from the devices but could not necessarily determine exactly which documents or pieces of information were taken.

That means the 2.7-gigabyte figure provides an indication of the scale of the breach without answering the more consequential question: What did the attackers actually see?

The uncertainty has fueled political controversy in Spain and prompted renewed scrutiny of the government’s handling of sensitive communications.

Keep reading

Hackers Withdraw 320 Million In Bitcoin From Blockstream’s Liquid Network Federation Reserves

The Liquid Network said Sunday that purported white-hat hackers withdrew about 4,000 bitcoin, worth about $320 million, from the federation wallet that backs L-BTC.

Bridge nodes were disabled, and the sidechain was paused. Other issued assets, including USDT, DePix and RWAs, were unaffected, the official account said on X.

The Liquid Network is a federated sidechain of Bitcoin, founded by Adam Back’s Blockstream. The Liquid chain issues a variety of assets such as LBTC, which it backs with BTC on the Bitcoin main chain, held in a large multisig of 15 corporate and known members. 11 of the 15 members need to sign a valid multi-signature transaction to move coins from the treasury. Before the hack, the treasury held over 4200 BTC; after the hack, Blockstream’s proof of reserves page reports a little over 207 BTC left. 

The hackers withdrew 4,019.4 BTC from the reserve address in a peg-out transaction using the SideSwap Peg-out Authorization Key. SideWap is a bridge exchange and a member of the Liquid Federation. While details on the mechanism of the hack are not confirmed yet, it appears an inflation bug on the LBTC side chain was exploited by the hackers to create over 4,000 LBTC that did not exist before, and cash them out for on-chain bitcoin from the federation. Because the transaction appeared as valid, given the consensus bug, the federation members’ HSM security servers signed the BTC withdrawal transaction, worth roughly 320 million at the time. 

The hacker moved the funds to an address ending in 6gyqjlte, from which they quickly signed a new transaction with a message on the OP_RETURN arbitrary data field saying “we are whitehats. contact us on chain.” Those coins were still at that address at the time of writing.

A small mainnet transaction to the hacker address followed by an OP_RETURN saying “Please contact security@blockstream.com”, presumably from a Blockstream public address, though that remains unconfirmed. A later OP_RETURN spend from the hacker address carried “Please contact us on Signal @m671aw.70”, however, this may be spam and does not share a link to the address with the stolen funds.

In response to the breach, exchanges were told to pause L-BTC deposits and withdrawals. Bridge nodes on the Liquid Network have been paused, limiting access to the side chain, which continues to produce blocks. 

JAN3 CEO Samson Mow said Aqua’s Liquid features were affected and that on-chain bitcoin still worked. Other wallets in the industry that use the Liquid Network are expected to be affected. Users holding LBTC now effectively have their savings at risk, since the underlying BTC is currently not redeemable. Given the private nature of the Liquid chain, user onchain analytics are scarce and not much public information is known about how much LBTC is held by retail users versus corporations of Blockstream itself. Nevertheless, should the funds not be returned, it would be a heavy blow to the Liquid Network’s user base.

Users of LBTC don’t have many options but to wait for conversations with the hackers to resolve. Given the size of the hack, it would be difficult for the hackers to get away with stealing all that bitcoin, though perhaps not impossible.

What may happen is that the hackers ask for a finder’s fee and return the majority of the funds. 

Keep reading

ID Verification Breach Exposes Millions of Sensitive Identity Documents

If you ever needed more proof that governments pressuring companies to collect ID data from customers or users is a bad idea, you only have to look at what happened this week. A dark-web service advertised on August 31 has been offering over 153 million scans of driver’s licenses, more than 10 million other identity cards, over 3 million travel documents and/or international IDs, and at least 579,000 medical cards.

The data apparently stems from a company hired to verify people’s identities. The service, called Nexus, was advertised on the Russian-language cybercrime forum Exploit.

Security researcher Brian Krebs found that a blank search on Nexus returned about 11.5 million result pages with roughly 15 results per page. This would support the claim that there were over 153 million license scans in the database, and the number increased by nearly 400,000 in 24 hours.

Nexus itself claimed to have “continuously exfiltrated new data for over a year into our private database” – but this is not verified and could be an advertising claim.

What Krebs was able to verify is that his own Virginia license was among those available on the site. He searched with permission for the licenses of more than a dozen friends and relatives; nine people whose records appeared said that the attached timestamps matched or closely tracked their travels.

In the case of Krebs and his mother, the timestamps corresponded to a June 2025 car rental from Hertz. Their records were created seconds apart, matching their account that they handed both licenses to the rental representative at the same time.

Krebs’s record contained three pairs of images showing the front and back of the license in visible light, infrared, and ultraviolet.

Privacy researcher Zach Edwards also found his license on Nexus. Its timestamp matched a trip to Las Vegas, where he had presented the document to TSA, the Aria hotel and the Planet13 dispensary. Edwards said the dispensary was the only one of the three places where he knew the license had been scanned.

Keep reading

MASSIVE SECURITY NIGHTMARE: FBI Investigates Dark-Web Service Selling 153+ MILLION Driver’s License Scans — Including Secretary Pete Hegseth’s Information for $100

The FBI is investigating what could be one of the most devastating identity-data breaches ever uncovered in North America.

A newly launched dark-web service called “Nexus” claims to be selling actual digital scans of more than 153 million driver’s licenses belonging to people across the United States and Canada, according to cybersecurity journalist Brian Krebs, who first reported the incident.

This is not merely another database containing stolen names, email addresses, and passwords.

The criminals reportedly obtained digital images of government-issued identification documents, including front-and-back scans and, in some cases, the infrared and ultraviolet images used to authenticate them.

According to cybersecurity journalist Brian Krebs, the massive collection allegedly includes:

  • More than 153 million driver’s licenses
  • More than 10 million identification cards
  • More than 3 million travel documents and international IDs
  • At least 579,000 medical cards

The database reportedly contains the driver’s license of Secretary of War Pete Hegseth, along with identification documents belonging to other high-ranking federal officials, including an assistant director of the FBI. According to the report, the hacker offered Hegseth’s driver’s license for $100.

Krebs discovered that his own Virginia driver’s license was also in the database after the criminals behind Nexus displayed it as a free sample while advertising their service on the Russian-language cybercrime forum Exploit.

Keep reading