On December 29, 2025, the Sandworm hacking group attempted a cyberattack on Poland's power infrastructure, deploying a new wiper malware called DynoWiper. This malware is designed to erase data and disrupt operations, posing a significant threat to critical systems. ESET, the cybersecurity firm that reported the incident, noted that the attack could have serious implications for power stability and national security in Poland. As the incident unfolds, it raises concerns about the vulnerabilities in power grids and the potential for similar attacks on other nations. The situation underscores the ongoing risks posed by state-sponsored cyber activities.
The Cybersecurity and Infrastructure Security Agency (CISA) has published a list of products that are capable of using post-quantum cryptography (PQC) in response to potential threats posed by quantum computing. This list is intended to assist businesses in identifying hardware and software that can better protect sensitive information against future quantum attacks, which could compromise current encryption standards. As quantum computing technology evolves, traditional encryption methods may become vulnerable, making this guidance particularly relevant for organizations looking to future-proof their security measures. The release emphasizes the importance of preparing for these advancements in technology and the potential risks they bring. Companies are encouraged to review the list to ensure they are equipped with the necessary tools to safeguard their data.
Researchers discovered over 20 security vulnerabilities in Dormakaba's physical access control systems, which are used by various major companies across Europe. These flaws could potentially allow hackers to unlock doors and gain unauthorized access to secure areas. The vulnerabilities were identified and subsequently patched, but the incident raises concerns about the security of access systems that protect sensitive locations. Companies using Dormakaba products need to ensure that their systems are updated to avoid exploitation. This situation serves as a reminder of the importance of regularly reviewing and updating security measures in physical access systems.
Researchers have identified a new threat from North Korea's Konni group, which is targeting blockchain developers with a PowerShell backdoor. This malicious software aims to infiltrate development environments and steal cryptocurrency holdings. The attackers are using AI-generated techniques to enhance their capabilities, making it easier for them to compromise systems and access sensitive data. This development poses a significant risk to individuals and companies involved in cryptocurrency, highlighting the need for enhanced security measures in development practices. As the threat evolves, developers need to be particularly vigilant about the tools and scripts they use in their environments.
Crunchbase has confirmed a data breach after the hacking group ShinyHunters announced that they stole over 2 million personal records from the company. The breach was made public when ShinyHunters leaked a 402 MB compressed archive containing the data on their website, which they did following a failed attempt at extorting Crunchbase. This incident raises concerns for users whose personal information may be exposed, potentially leading to identity theft or phishing attacks. Crunchbase's confirmation of the breach underscores the ongoing risks that companies face in securing sensitive user data. The situation highlights the need for organizations to bolster their cybersecurity measures to prevent similar incidents in the future.
As organizations increasingly rely on Okta for identity management, misconfigurations can unintentionally compromise security. Nudge Security has identified six specific settings in Okta that many teams overlook, which can lead to vulnerabilities in their SaaS environments. These settings, if not properly configured, could weaken the overall identity security and increase the risk of unauthorized access. The article emphasizes the importance of regularly reviewing and adjusting these settings to ensure that security measures keep pace with evolving threats. For businesses that utilize Okta, addressing these overlooked configurations is crucial to safeguarding user identities and sensitive data.
Researchers from Fortra have identified a new SEO poisoning scheme named 'HaxorSEO.' This operation aims to manipulate search engine results to direct unsuspecting users to malicious websites. The attackers exploit popular search terms to increase the visibility of their harmful content, which can lead to malware infections or phishing attempts. This discovery is significant because it highlights the ongoing tactics used by cybercriminals to deceive users and compromise their security. Companies and internet users need to be vigilant about the links they click on, especially those appearing in search results, to avoid falling victim to these kinds of attacks.
Recent discussions during the Pall Mall Process have focused on establishing voluntary guidelines for commercial hacking tools. This initiative involves input from various sectors, including industry representatives, government officials, and nonprofit organizations. The goal is to create a framework that addresses the ethical use of these tools, which can be misused for malicious purposes. As hacking tools become more accessible, the need for regulation is becoming increasingly urgent to prevent potential abuse. The outcomes of these discussions could shape how hacking tools are developed and used, impacting cybersecurity practices across multiple sectors.
Recent findings reveal that the security measures NPM implemented after the Shai-Hulud supply-chain attacks have vulnerabilities that can be exploited by hackers. Specifically, attackers can bypass these defenses by using Git dependencies, which undermines the protections designed to prevent malicious code from infiltrating projects. This issue affects developers and companies relying on NPM for package management, as it opens the door for potentially harmful code to be included in their applications. The ability for threat actors to exploit these weaknesses highlights the ongoing risks in software supply chains, making it crucial for developers to be vigilant when using Git dependencies. Understanding and addressing these vulnerabilities is essential to maintaining security in the software ecosystem.
Hackread – Cybersecurity News, Data Breaches, AI, and More
Actively Exploited
A significant data breach involving Nike has come to light, with the hacking group WorldLeaks leaking approximately 1.4 terabytes of sensitive files online. This leak reportedly includes internal documents, customer data, and other confidential information. The breach appears to coincide with ongoing concerns about data security at various companies, including Under Armour. With the scale of the leak, there are serious implications for Nike's customers and partners, as their personal information may be at risk. Companies like Nike must enhance their cybersecurity measures to prevent such incidents and protect their users' data.
Poland recently thwarted a cyberattack aimed at its energy infrastructure, attributed to suspected Russian hackers. The attack occurred on December 29 and 30, 2025, targeting two combined heat and power plants and a system that manages electricity from renewable sources like wind and solar. Fortunately, the malware designed to wipe data failed to execute its intended damage. This incident emphasizes the ongoing risks that critical infrastructure faces from cyber threats, particularly from state-sponsored actors, and highlights the importance of robust cybersecurity measures in the energy sector to protect against such attacks in the future.
Crunchbase has confirmed it was part of a data breach following claims by the hacking group ShinyHunters. Along with Crunchbase, SoundCloud and Betterment were also targeted in this campaign. The attackers reportedly accessed sensitive data, although specific details about the type of information compromised have not been disclosed. This incident raises concerns about the security of user data across these platforms and highlights the ongoing risks posed by organized hacking groups. Companies like Crunchbase are now under pressure to enhance their security measures to protect user information from future breaches.
Okta has reported a new type of vishing attack where scammers impersonate IT support teams to steal user credentials. These attackers create fake login pages in real-time using phishing kits, which makes it challenging for victims to detect the fraud. This method allows them to bypass multi-factor authentication (MFA), a security measure that many organizations use to protect sensitive information. Users who fall for this trick may unknowingly provide their login details, putting their accounts and sensitive data at risk. Companies should remain vigilant and educate employees about these tactics to prevent successful attacks.
The Irish government is set to enhance police powers regarding digital surveillance, which includes the ability to intercept communications, even those that are encrypted, as well as the legal use of spyware. This move aims to provide law enforcement with better resources to combat crime, particularly in the context of increasing digital threats. However, it raises significant concerns about privacy and civil liberties, as the potential for abuse of such powers could infringe on citizens' rights. The proposal is part of a broader trend where governments are seeking more control over digital communications in response to evolving security challenges. The implications for users and their data privacy could be profound, sparking debates on the balance between security and individual rights.
This week, cybersecurity experts noted a series of vulnerabilities and security incidents that demonstrate how attackers are exploiting both old and new methods to breach systems. Flaws in firewalls and browser-based traps are particularly concerning, as they reveal weaknesses in tools that users often trust. These security lapses suggest that just because a software issue has been patched doesn't mean it is safe. The ongoing evolution of malware, including AI-generated variants, presents a significant challenge for companies trying to defend against increasingly sophisticated threats. Organizations need to stay vigilant and update their defenses regularly to protect against these emerging risks.