Technology news

Full text

TSMC, the juggernaut that produces roughly 90% of the world's most advanced chips, has discovered a data leak said to contain over 46,000 employee records, according to Seeking Alpha .

The company made a Form 6-K filing with the US Securities and Exchange Commission on Thursday, stating: "TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC’s systems have been compromised."

The company says the info has been verified to match data "stored in the system services of a cloud service provider," although said provider is not named. TSMC says it has informed those impacted by the breach and is providing support, and has also engaged with the cloud service vendor, investigating authorities, and a third-party cybersecurity agency to "ascertain the facts and take necessary actions."

Taiwanese outlet United Daily News reports that hackers were allegedly offering the employee records on an underground forum for the princely sum of three bitcoin, in exchange for 6.9 GB worth of private data.

The outlet also says that, "according to information online" (via machine translation), hackers were also selling what appears to be TSMC employee data on other forums, releasing a small sample which is said to contain a vast array of personal details, including national ID numbers, addresses, and banking information.

(Image credit: TSMC) TSMC has confirmed in its statement that the leaked data is unrelated to the company's operations, or customer-related information.

This isn't the first time TSMC has been in the headlines in relation to cybersecurity. Back in 2023, ransomware outfit LockBit attempted to extort the company for $70 million after a claimed hack.

TSMC denied it had been directly hacked , revealing in a statement that IT hardware supplier Kinmax Technology had been the victim of a "cybersecurity incident" instead, which "led to the leak of information pertinent to server initial setup and configuration." Kinmax also released a statement at the time confirming the breach .

Being such a large and wealthy company at the heart of the tech supply chain, it's no surprise that hackers are keen to gain any details on TSMC if they can. In both these cases, it seems that TSMC's own systems remained secure, but an outside party may have let the side down.

Regardless, I doubt it's the last major data leak I'll be writing about before 2026 is out. This year has been characterised by cybersecurity incidents left, right and centre, and in this every-more-interconnected world, it seems even some of the most security-conscious companies are far from immune.

Full text

Threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories

At least 1,835 repositories executed the payload and had credentials exfiltrated

Authentication tokens, AWS, Azure and Google Cloud credentials, and more, targeted

Cybercriminals were recently seen abusing multiple GitHub features to deploy infostealers and exfiltrate user’s cloud login credentials and other secrets.

Tens of thousands of repositories have already been targeted, and almost 2,000 fell prey to the attack, cybersecurity researchers Aikido said, in a recent report outlining how the attackers used stolen GitHub credentials to abuse GitHub Actions and workflows, two features designed to speed up and automate certain activities.

GitHub is a platform for developers working on open source projects. Each project has its own “repository” - a folder containing source code, configuration files, and other resources. Developers can propose changes to public repositories through a process called “pull request”, after which other developers can review and approve/decline the changes.

GitHub also has an automation service called Actions, that allows developers to automatically execute various tasks, including pull requests. These automated processes are called workflows and can be described as a set of instructions telling GitHub what to do. Here is another vital nugget of information: workflows can access sensitive credentials when required to perform these tasks.

Using compromised accounts

According to Aikido, the threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories. The researchers did not say how the attackers obtained these accounts, or how they were compromised. The pull requests were probes, not actual attacks, and were used so the attackers can see which projects they could modify.

“We're tracking this campaign as wfx-loot based on the threat actor's name for the malware and the term used for stolen secrets,” Aikido said. The pull requests were titled docs: dependency audit notes, and were submitted from branches named wfx-docs.

Of the 60,000+ matching pull requests, more than 10,000 targeted repositories the compromised accounts did not own, but could access. After establishing write access, the attackers used one of three methods to deploy a malicious script: modifying existing GitHub Actions workflows, adding a shell script triggered by an npm installation hook, or creating a new workflow file on a temporary branch.

The payload included roughly 1,500 lines of code that was present in all three scenarios. The code searched the compromised environments for sensitive information such as GitHub Actions secrets, authentication tokens, AWS, Azure and Google Cloud credentials, Docker and Kubernetes configuration files, SSH keys, API keys for AI services such as OpenAI and Anthropic, and developers' shell histories. It also searched for .env files, private keys and credentials belonging to tools such as npm, PyPI, HashiCorp Vault and Terraform.

Stealing credentials

The malware also tried to expand its access, exchanging stolen tokens for cloud sessions, spoofing service accounts, and even creating new credentials. It also modified AWS and Azure configurations to maintain access when victims rotated their compromised credentials.

Aikido says that at least 1,835 repositories executed the payload and had credentials exfiltrated. The attackers subsequently reverted their changes and deleted workflow execution logs, sometimes within a minute, to cover their tracks and make detection that much harder.

The wfx-look campaign apparently spilled into the software supply chain, as Aikido also found compromised PHP packages on Packagist and two affected Go module versions. However, the researchers said this might have been a side-effect of the attackers abusing automated publishing processes, rather than something they planned on doing.

Aikido advises anyone whose repository executed the malicious payload to consider all of their secrets and cloud credentials their workflows can access as compromised, and needing urgent rotation.

Via BleepingComputer

Full text

In today’s newsletter: US intelligence reportedly believes the former tech executive was recruited by Beijing, raising questions about the security of the AI industry and Trump’s close ties to Nvidia chief Jensen Huang

Good morning. Espionage is supposed to be a secretive business, and spies are supposed to be virtually invisible. That hasn’t been the case for Alice Huang, the mysterious Shanghai executive who formed a romantic relationship with Jensen Huang, the founder of Nvidia, one of America’s most powerful tech companies.

Many questions have arisen since it emerged that US intelligence believes that Huang (no relation of Jensen’s) is an asset recruited by the Chinese intelligence services to spy on behalf of Beijing. This morning’s newsletter explains what we know about the story, and what it tells us about the effectiveness of Chinese espionage. That’s after the headlines.

UK | Ministers are considering changing the law to force the entertainment industry to better protect women and children in the wake of the revelations over David Walliams and the conviction of Russell Brand.

Climate | The UK government has appointed the world’s first special representative for climate security, in the strongest sign yet of fears that climate breakdown will bring chaos to the country.

US midterms | Democrat Scott Colom has become the first Black senator in Mississippi to be elected since Reconstruction, in a stunning upset after more than a week of vote counting in one of the country’s most reliably red states.

Europe | Millions of people across Spain have joined the country’s first general strike in 14 years , setting up picket lines to protest against soaring housing prices before an election in which the far right could be catapulted into power.

Technology | Police officers risk arresting innocent people , especially from ethnic minorities, if they treat inaccurate facial recognition data as evidence, an official report has found.

Continue reading...

Full text

Google DeepMind researchers used agentic AI to mathematically prove, or “formally verify,” a number of the Signal protocol’s key cryptographic guarantees—a landmark development for the widely used cryptography and AI itself.

Conducted as a sort of proof-of-concept project in just four weeks, the work is significant in two ways. It serves as further independent validation of the cryptography that protects massive quantities of the world's communications on platforms like the Signal app , Google Messages, and WhatsApp. And it demonstrates Google DeepMind's formal verification capabilities using a new AI framework called AlphaProof Code.

More broadly, AI-aided formal verification is having a moment, but it is unclear how practical it will be for widespread use and how effective it can be at securing large amounts of code. Proponents of formal verification have long referred to it as a sort of holy grail in software security, because it uses math to check and validate that software is functioning as intended—in other words, that it doesn't have critical vulnerabilities.

Read full article

Comments

Full text

Nitori discloses cyberattack that may have exposed data from up to 37.6 million customer records

Stolen information included personal and business customer details, though passwords and payment data were unaffected

Company remediated the intrusion, continues investigating the breach, and warned users about phishing attempts

Japan’s largest furniture chain Nitori Holdings has disclosed suffering a cyberattack which saw it lose tens of millions of customer records.

Both consumer and business customers are affected, but passwords and payment data have not been compromised.

In a statement, Nitori said it spotted unauthorized access to its systems on November 6 2026 - and after ousting the intruder and launching an investigation, the company discovered that up to 37.6 million of customer records may have been exfiltrated, including people’s first and last names, membership numbers, email addresses, postal addresses, phone numbers, gender information, as well as birth dates.

Nitori's warning

Aside from these records, corporate members also had their company names and department names exposed, as well as names of company representatives, phone numbers, designated contact persons, and other details.

The specific combination of information varies from customer to customer, it said, adding that the data was most likely generated by Nitori Net and Nitori’s official stores on third-party e-commerce marketplaces. The company also stressed that credit card information and login credentials were not exposed.

The investigation is currently ongoing and crucial details are still missing. We don’t know who the threat actors are, or if they reached out demanding payment in exchange for deleting the stolen files.

Nitori also said it identified the flaws used to break in, remedied them, but was still analyzing and monitoring them.

“We have addressed the identified vulnerabilities and completed improvements to our monitoring systems”, it said.

“We are continuing to work with external specialists to investigate the cause of the incident, the method of intrusion, the extent of the impact, and whether any secondary damage has occurred.”

Often compared to IKEA, Nitori Holdings is considered Japan’s largest home furnishing retailer, selling affordable furniture, home accessories, kitchenware, and similar household products. It operates more than 1,000 stores across the region and 11 overseas markets, including China, Taiwan, South Korea, and a handful of Southeast Asian countries. Last year it reported $6.1 billion in revenue, while employing more than 41,000 people, and making almost 93 million customer purchases. Its mobile apps have more than 25 million registered members.

Those millions of members and thousands of employees are now being warned to pay attention to their inboxes for incoming email pretending to be from Nitori, or having to do something with the company and the breach.

“Personal information that may have been leaked could be misused for impersonation emails, phishing scams, suspicious telephone calls, and other fraudulent activities,” the company said in the announcement.

“We urge customers to exercise particular caution when receiving communications claiming to come from our company, delivery service providers, or e-commerce marketplaces.”

“Please do not open unfamiliar links or attachments.”

Japan under siege

There has been a barrage of cyberattacks against Japanese companies lately, with Iris Ohyama , a major Japanese consumer goods manufacturer, confirmed losing data on 7.7 million people in a data breach that affected its ecommerce website Iris Plaza.

Internet giant GMO also recently told its customers to unplug their devices from the network, after a cybercriminal threatened to release ransomware on user machines, and just before that gaming behemoth Capcom reported losing sensitive information on more than 11.7 million people. Most of them had their emails exposed, with a small subset also having to change their passwords.

Strangely enough, no threat actors claimed responsibility for any of these incidents. Usually, criminal organizations would try to extort money for the data, rather than trying to sell it on the black market, since some companies are more willing to pay. Leaking data could trigger class-action lawsuits or pressure from regulators and data watchdogs.

Via BleepingComputer

Full text

VIENNA — Hackers linked to Russia’s FSB quietly compromised a Romanian government organization’s servers to collect emails related to NATO and the EU in December 2025, a Slovak cybersecurity firm has revealed.

Using an advanced suite of tools that the researchers dubbed Cereal, a pun on the technology of serialization, emails going through Romanian government servers were scanned for a relation to NATO and the European Union. If this was discovered, the malicious software would create a copy for its Russian spymasters.

In particular, one component, CerealBox, targeted messages involving NATO and EU institutional addresses, the cybersecurity form ESET said. The module selected emails with Word or PDF attachments using predefined filters, then compressed and encrypted copies for later retrieval by the attackers.

The hack was discovered by the Bratislava-based company and made public on Nov. 10. ESET had first discovered the tool being used against Kazakhstan in November 2025, and found the infiltration of Romania’s Microsoft Exchange servers a month later.

In a blog post and press release, the company attributed the attack to the known hacking group Turla, which it said was generally considered to be affiliated with Russia’s FSB, the country’s domestic intelligence agency. Turla has also been involved in attacks against high-profile Ukrainian targets, and the researchers said 70% of countries the group targeted were post-Soviet or post-communist states in Eastern Europe and Central Asia. The APT – a term designating an “Advanced Persistent Threat,” or known hacking group – primarily attacks government institutions.

ESET attributed the toolset to Turla with high confidence, citing the simultaneous use of another component publicly linked to the group and conceptual similarities to older Turla malware.

The researchers also noted a surge in activity in Kazakhstan on Jan. 15, 2026, the day after Old New Year, an informal holiday observed in Russia and some neighboring countries. “While malware does not celebrate holidays, its operators do,” the company wrote.

Romanian servers were compromised on Dec. 23, 2025, ESET researchers said; roughly a month after the cybersecurity firm first detected the same malicious code on the server of a Kazakh government agency. That discovery was the first time this tool had been seen, which the researchers described as “a previously undocumented toolset: a collection of modular .NET malware designed to run on Microsoft Exchange servers, receive commands, execute them in memory, map the compromised organization, and collect selected email messages.”

The tool was unusual for its “combination of novel techniques requiring deep knowledge of Exchange internals with unusual .NET execution methods,” ESET wrote.

The tool was designed to be especially stealthy, meant to allow it to spy undetected at length. While malware commonly communicates with an external command-and-control server, which can lead to detection and help cybersecurity professionals trace the origin, Cereal used the target organization’s own Microsoft servers as its infrastructure.

Romania is an eastern flank member of NATO and has faced physical and digital spillover of the confrontation between Russia and the West, particularly since the full-scale invasion of Ukraine began. Airspace violations, drone shootdowns and even the strike of commercial vessels in its exclusive economic zone have been among the consequences.

The country has also been targeted by cyber warfare. In May 2025, another known Russian APT actor attacked arms makers involved in supporting Ukraine, including those located in Romania; and just months after the war broke out, government websites were hit by a crude distributed denial-of-service attack, making Romanian public-authority and financial-sector websites unavailable for several hours.

Full text

Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users, including the very same Elon Musk-owned company that offers the platform, new research shows.

The information is revealed through links allowing Grok Build users to share their apps with others. Grok takes steps to randomize the URLs so only people who know the exact URL can access the data stored there. A design decision by developers of the platform, however, completely torpedoes that objective and makes it possible for anyone to enumerate thousands of live Grok Build projects. Except in rare cases, clicking those links opens the app and reveals all data associated with it.

You had one job

Research from security firm Claroc shows that the exposed data includes things like internal business plans, ad proposals, medical exam results, galley checklists from a celebrity cruise line, and employee names and ID numbers. Ironically, some of the sensitive data comes from two-dozen apps built by SpaceXSI (the name of the now-merged SpaceX and xAI) itself. A small sampling of the documents revealed in the SpaceXSI apps—Claroc found 24 of them—include an onboarding plan, marked confidential, for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, internal system addresses for sales team tools, and advertising proposals.

Read full article

Comments