Tag: hackers

UK Biobank Failures Expose the Permanent Cost of Sharing Genetic and Medical Records

The genetic sequences, medical scans, and lifestyle records of half a million British volunteers spent days listed for sale on Alibaba before anyone at UK Biobank noticed.

Three academic institutions, since banned from the platform, had quietly walked the data out through a research system that was supposed to keep it under lock and key.

At least one of the three Alibaba listings appeared to contain the full dataset covering every one of the 500,000 participants who handed over their blood, their DNA, and decades of personal health information on the understanding it would be used for medical research.

The UK government confirmed the breach on Thursday. Technology minister Ian Murray told the House of Commons that Biobank had flagged the incident on Monday, and that the Chinese government and Alibaba had cooperated to pull the listings down before any purchases went through. Murray thanked Beijing directly for its “speed and seriousness” in taking down the data, a sentence that carries some weight given the three research institutions identified as the source are Chinese, though officials have declined to draw conclusions about intent.

Professor Rory Collins, Biobank’s chief executive and principal investigator, issued a statement saying the listings “were swiftly removed before any purchases were made.” He apologized to participants and confirmed that access to the research platform had been suspended while the organization installs file size limits designed to stop researchers from walking off with bulk datasets.

An automated checking system to vet outgoing files is not expected to be ready until late 2026.

The sales listing is not the scandal. The scandal is what the sales listing reveals about how often Biobank’s data has already been exposed and where it now sits.

Prof Luc Rocher of the Oxford Internet Institute has been tracking the problem and maintains a public record of known incidents. By his count, the Alibaba posting is “the 198th known exposure of UK Biobank data since last summer.” Rocher added that the data “is not just available for sale, it also remains available online for anyone to download today.” Researchers have repeatedly uploaded the dataset to code-sharing platforms by accident, and copies have since been replicated across the web. Taking down one Alibaba listing does nothing about the other 197.

Biobank’s response to this pattern has been to emphasize that the data is “de-identified” and that no participant has been knowingly re-identified. The reassurance rests on a technical claim that does not survive contact with the evidence.

Keep reading

France’s ID Portal Hacked: 19 Million Records Up for Sale

French authorities have added another case study to the growing argument against centralizing citizen identity data.

France Titres, formerly known as ANTS, operates the portal where residents apply for passports, national ID cards, residence permits, driver’s licenses, and vehicle registrations.

On April 15, something broke inside that system. A week later, the Interior Ministry confirmed what anyone watching digital ID schemes has been saying about this exact architecture for years, and the scale on offer from the attacker makes the warning harder to wave away.

A threat actor using the aliases “breach3d” and “ExtaseHunters” appeared on criminal forums on April 16, claiming to have stolen between 18 and 19 million records from the agency’s internal systems.

If accurate, that is roughly a third of France’s population sitting in a for-sale listing. The seller describes the haul as a fresh, structural compromise rather than a recycled dump, and is actively shopping it.

Early French press reports, including Le Figaro, initially pegged the figure at around 12 million accounts before later estimates climbed. The government has not confirmed any number.

What the ministry has confirmed is a “security incident that may involve the disclosure of data from both individual and professional accounts.”

Login credentials, full names, email addresses, dates of birth, unique account identifiers, postal addresses, places of birth, and phone numbers may all have been extracted. That combination is a starter kit for identity fraud, synthetic identity construction, and convincing phishing attacks against people who already expect email from French government domains.

Keep reading

Brussels’ New Age Verification App: Hacked in Two Minutes

The European Union’s age verification app arrived on Wednesday with a promise that it was “technically ready” for deployment across the bloc. Within hours, security researchers had torn it apart.

Commission President Ursula von der Leyen presented the tool in Brussels as the answer to a continent-wide push to keep minors off social media and adult websites. “It is fully open source. Everyone can check the code,” von der Leyen said. Researchers took her at her word. What they found has turned the launch into exactly the kind of security embarrassment that should make anyone think twice about digital identity systems.

Security consultant Paul Moore published a widely shared post on X documenting what he discovered after examining the GitHub repository. The app stores sensitive data on users’ phones and leaves it unprotected. Moore claimed he hacked it in under two minutes.

Brussels is standing by its product. “Yes, it is ready. Maybe we can add, ‘and it can always be improved’,” Chief Spokesperson Paula Pinho told reporters Friday. Digital spokesperson Thomas Regnier added a revealing clarification. “Now, when we say it’s a final version, it’s … still a demo version.” He said the final product is not yet available for citizens and “the code will be constantly updated and improved … I cannot today exclude or prejudge if further updates will be required or not.”

Moore led the technical takedown on X, describing the app’s architecture as broken at the foundation. The encrypted PIN the app stores locally, according to Moore, has no cryptographic link to the identity vault holding the actual verification data.

That gap enables a bypass that requires no exploit code or specialized tools. Delete a few specific values from the app’s configuration files, restart the app, set a new PIN, and the software happily hands over access to credentials that belong to the previous profile. Identity data gets reused under whatever access control the attacker defines.

The weaknesses deepen from there. Rate limiting, the standard defense against someone trying PIN after PIN until one works, lives in the same editable configuration file as a plain counter. Set it to zero and the app forgets every failed attempt.

Keep reading

Data Breach Exposing French Gun Owners a Warning to America

Anytime there’s a list of anything, there are going to be people who want to view that list for whatever reason. As we are firmly in the 21st century, that list is going to be digital more often than not, and that means the number of people who want to get that data increases exponentially. Especially when it’s something like a gun registry.

Luckily, federal law bars the federal government from creating a gun registry, though let’s be real here. If they change their minds, they’ll repeal the law in a heartbeat. It won’t stop them. Hell, it’s not even stopping the ATF from digitizing old records, which is really just a gun registry with a different name.

France, however, didn’t think gun registries were a bad thing.

Now, though, they’re finding out that data breaches into that registry are.

In a development that will shock absolutely nobody acquainted with the realities of gun control, there was another security breach of firearm owner data maintained by a government agency. This one took place in France, and an online cybersecurity resource, NeuraCyb Cybersecurity, reported it involved that country’s firearm registration system. Known as the Système d’Information sur les Armes (SIA), all law-abiding French gun owners are required to register information with it that includes, among other things, the gun owner’s name, address, firearms (including serial numbers), and a complete transaction history of each gun.

Because the SIA can be accessed in a number of ways—the firearms industry can access it to report commercial activity while gun owners can also access it to report any changes to their personal collection of firearms—it may be susceptible to being hacked from multiple points.

According to the NeuraCyb article:

Authorities detected the unauthorized access in late March 2026. The intrusion did not involve a direct hack of the central SIA database. Instead attackers used a compromised account belonging to a legitimate company or professional user authorized to interact with the system. This allowed them to extract commercial files stored within that specific account.

An anonymous hacker who took credit for the breach claimed to have stolen information on roughly 60,000 firearms and has allegedly offered to sell the data on underground online forums.  It is currently unknown how many law-abiding French gun owners might now have their personal information floating around the Internet and offered for sale to the highest (and shadiest) bidder, but some estimate it would be in the tens of thousands.

The absolute best-case scenario here is that the hacker just took the data because he needed proof he’d actually hacked it. In the hacker world, there are bragging rights to hacking certain systems, and having data from it proves you did it. They don’t want to do anything with the data so much as just support their claims and win acclaim in the hacking universe. He’s just saying he was going to sell it to make himself look cooler.

Keep reading

Dad stuck in support nightmare after teen lied about age on Discord

Brady Frey did not realize that his daughter lied about her age when she set up her Discord account. He only found out after her account got hacked and he got trapped in a spiraling support nightmare while trying to stop the hacker from targeting dozens of her young friends with financial extortion scams.

When Frey’s daughter signed up for Discord, she was 12 and technically not old enough to have an account. But like many kids who, regulators have found, commonly lie about their age to access social media platforms, she didn’t want to wait another year to join her friends on the messaging app. Hiding her age, she created an account that listed her as over 18 years old.

Now 13, the teen had been happily using the app for months when she suddenly got locked out of her account after clicking on a link from an attacker posing as Discord support. Since she didn’t enable two-factor authentication, the attacker was able to commandeer the account. Frey only found out what was happening when the attacker asked the teen to share her parents’ banking information if she wanted to get her account back.

Once Frey realized his daughter had been hacked, he assumed that Discord would promptly intervene, recognizing that many minor victims on her friends list could be harmed the longer the attacker kept control. Instead, Discord’s chatbot, Clyde, and a seeming human support member, Nelly, automatically closed her support tickets after telling her it would be best to report the issue from inside the app, which she could not access.

Frey told Ars he was shocked to see a platform as big as Discord relying on such poor support infrastructure.

“There’s no pathway for a parent to step in and advocate for a minor whose account has been compromised,” Frey told Ars.

Keep reading

FBI Warns Congress of ‘Major’ Cyber Hack Involving China That Could Threaten National Security

Not even the FBI is safe from Chinese hacking operations.

A computer security breach in the bureau’s Virgin Islands offices, first detected in February, has been reported to Congress as a “major incident” that could threaten national security, Politico reported Wednesday.

And it appears that the Beijing regime is behind it.

As Fox News reported Thursday, it was unclear what information was accessed in the hack.

However, the FBI reported the breach in compliance with the Federal Information Security Modernization Act of 2014, a law that requires specific committees in both Houses of Congress to be notified if a federal agency’s computer system is compromised to the point where national security is at risk.

“The determination suggests the hackers successfully compromised swathes of sensitive data stored directly on FBI systems, likely marking a major counterintelligence coup for China,” Politico reported.

Keep reading

White House renamed ‘Epstein Island’ on Google phones – WaPo

The White House was briefly renamed ‘Epstein Island’ for some Google Pixel phone users, the Washington Post has reported.

The term is used to refer to the Caribbean island of Little St. James, which had been owned by the late convicted pedophile Jeffry Epstein. According to the prosecutors, it served as the venue for sex trafficking and other abuses involving some high-profile figures in business and politics.

WaPo said in an article on Saturday that when its journalist tried calling the White House switchboard earlier this week, the name on screen indicated that they were contacting “Epstein Island.”

Only users of Google’s Pixel phones experienced the issue. For those calling the presidential residence from other Android phones and iPhones, no name was displayed, the report read.

Keep reading

Who’s behind the mysterious ‘Iran-backed terror cell’ haunting Europe?

Claims that an Iran-backed group is carrying out attacks in European cities raise questions about why they’re not targeting countries directly involved in the US-Israeli war, and why they appear to communicate like Israelis.

Strangely, suspects arrested in the attacks have been released on bail.

A specter is haunting Europe – the specter of Ashab al-Yamin. Officially known as “Harakat Ashab al-Yamin al-Islamia (HAYI),” or the “Islamic Movement of the Companions of the Right,” the group mysteriously appeared in early March, and, according to mainstream media, it’s taking the continent by storm.

But a closer look at the supposedly Iran-backed terror organization suggests that it does not exist in any concrete form, and may be a confection of Israeli intelligence.

Though the nebulous HAYI claimed credit for torching ambulances belonging to a Jewish community organization in London on March 23, two suspects in the attack have been released on bail, and are not charged with any terror-related crimes. What’s more, London Metropolitan Police have so far refused to release the men’s names, raising questions about their identities. Were they even Muslim? 

HAYI’s first public mention in the West came on March 9, when the previously non-existent organization released a video showing an explosive device detonating outside a synagogue in Liege, Belgium, alongside a statement taking credit for the attack. Within hours, the group had somehow been identified by the “SITE Intelligence Group,” an Israeli-led private intelligence firm founded in the aftermath of Sept. 11 to cash in on the newly-minted Global War on Terror.

The materials HAYI published were promptly circulated on social media by Joe Truzman, a self-described “Senior Research analyst examining Palestinian armed groups and Iranian proxy organizations” at the Foundation for the Defense of Democracies (FDD), a neoconservative DC-based think tank founded in 2001 with the stated goal of working to “enhance Israel’s image.” As The Grayzone reported, the Trump White House plagiarized its public justification for attacking Iran word-for-word from an FDD paper. 

Though Truzman declined to state where he’d found the materials, he wrote that “Telegram channels linked to the Axis of Resistance… widely disseminated the publications,” using a reference to a variety of resistance factions sympathetic to Iran and Palestine throughout the greater Middle East. The group he linked to, a popular Telegram channel called Sabereen News, made it clear they were reposting the video, which they said was the work of a group calling themselves “the companions.” 

Almost immediately, Truzman began asserting that these “companions” were all but guaranteed to be a Tehran-linked cutout. For starters, he told British media, “their logo with the wording is a sign of a classic Iranian front organization.” And Iran had already threatened to carry out just such a wave of attacks, Truzman claimed. After all, he wrote, “On March 8, Majid Takht-Ravanchi, Iran’s deputy-foreign minister, warned that if a European country joined the US and Israel in the current war against the Islamic Republic, it would be a ‘legitimate’ target ‘for Iranian retaliation.’”

Over the next two weeks, the shadowy group would go on to take credit for burning a vehicle in a Jewish neighborhood in Antwerp, arson at a synagogue in Rotterdam, explosions near a Jewish school and financial office building in Amsterdam, firebombing Jewish-dedicated ambulances in London, and an unspecified attack in Greece. 

So far, the only media outlet to have interviewed a member of HAYI is CBS News, which was recently purchased by David Ellison, the ultra-Zionist billionaire son of the largest individual donor to Israel’s military, Larry Ellison, who happens to be a close friend of Israeli Prime Minister Benjamin Netanyahu. Bari Weiss, the editor-in-chief installed by Ellison at CBS, is a self-described “Zionist fanatic.”

Keep reading

Iran-linked hackers breach FBI director’s personal email, publish excerpts online

Iran-linked hackers on Friday claimed they had accessed ​FBI Director Kash Patel’s personal email inbox, publishing photographs of the ‌director and other documents to the internet.

On their website, the hacker group Handala Hack Team said Patel “will now find his name among the list of ​successfully hacked victims.” The hackers published a series of personal photographs ​of Patel sniffing and smoking cigars, riding in an antique ⁠convertible, and making a face while taking a picture of ​himself in the mirror with a large bottle of rum.

A Justice Department ​official confirmed that Patel’s email had been breached and said the material published online appeared authentic. The FBI did not immediately respond to a request for ​comment. The hackers did not immediately respond to messages.

Handala, which ​calls itself a group of pro-Palestinian vigilante hackers, is considered by Western researchers to ‌be ⁠one of several personas used by Iranian government cyberintelligence units. Handala recently claimed the hack of Michigan-based medical devices and services provider Stryker (SYK.N), opens new tab on March 11, claiming to have deleted a massive trove of ​company data.

Reuters was ​not able to ⁠independently authenticate the Patel emails, but the personal Gmail address that Handala claims to have broken into ​matches the address linked to Patel in previous ​data breaches ⁠preserved by the dark web intelligence firm District 4 Labs. Alphabet-owned Google, which runs Gmail, did not immediately respond to a request for comment.

A ⁠sample ​of the material uploaded by the hackers ​and reviewed by Reuters appears to show a mix of personal and work correspondence ​dating between 2010 and 2019.

Keep reading

Sweden Breach Shows the Security Risks of National Digital ID Systems

A hacker group calling itself ByteToBreach has posted what it claims is source code stolen from CGI’s Swedish division, among the allegedly compromised systems: the codebase powering BankID logins for the Swedish Tax Agency.

It’s a ransacked filing cabinet inside the architecture of a country that digitized itself completely, then discovered the cost of doing so.

BankID is the single authentication layer Swedes use for nearly everything; government services, banking, digital signatures, and tax filings.

Over 8.6 million people in a country of just over 10 million run their digital lives through it. That’s a national dependency, a single point of failure dressed up as infrastructure modernization.

The dump appeared on Breached.

Journalists at Dagens Nyheter reviewed portions of the leaked material and reported finding source code, passwords, and encryption keys. Breached was taken offline over the weekend as part of a cybersecurity operation, limiting independent verification.

Also reportedly being sold separately: databases containing Swedish citizens’ personal data and electronic signature documents. The breach exposes a layered vulnerability.

CGI confirms it, but frames it narrowly

Keep reading