Breach of the Day

When Ezekiel Dean Potter left his job as a senior IT support specialist at the Saydel Community School District in Iowa in April 2023, the district should have cut off his access. They didn't. According to BleepingComputer, Potter used his retained credentials to attack the district repeatedly over the next 21 months.

He deleted the school's Facebook page. He stripped staff of access to the educational platforms they needed to teach. He reset usernames and passwords across multiple systems, locking people out of their own accounts mid-school-year. The damage ran to tens of thousands of dollars — not counting the classroom disruption and administrative chaos.

Potter, now 34, was sentenced to 21 months in federal prison. The U.S. government's sentencing memorandum described him as "a plague" on the district throughout that period.

This is not a sophisticated nation-state attack. There was no zero-day, no malware, no elaborate intrusion. Just a set of credentials that were never revoked, handed to someone who had good reason to use them.

What to do: If you manage any organisation — school, small business, charity, anything — offboarding a staff member means immediately revoking every account, credential, and platform access they held. Not tomorrow. Not at the end of the week. The day they leave.

The Hacker News reports that attackers compromised more than 400 packages inside the Arch User Repository (AUR) — Arch Linux's community-run collection of installable software, maintained separately from its official repositories. The official repositories were not affected.

The attackers did not find a flaw in the software itself. They targeted the package maintainers — the trusted individuals responsible for keeping each package current — and once inside their accounts, rewrote the build scripts (the step-by-step instructions your machine follows when installing software) to deliver malicious code alongside the legitimate program.

That malicious code is a Rust-compiled credential stealer: a compact, hard-to-detect program built to harvest developer secrets like SSH keys, API tokens, and stored passwords. On machines where it gained elevated (root) access, it could also load an eBPF rootkit (a hidden program embedded deep in the operating system's core, extremely difficult to find or remove once installed).

The packages kept their names, histories, and reputations intact. Only the build instructions changed. The trap looked exactly like software developers already trusted.

The affected-package list is still growing.

What to do: If you installed or updated any AUR package on or after June 11, check it against the current affected list before trusting that machine.

France built Tchap, a government-issued encrypted messaging platform, specifically for public sector employees to communicate securely. The idea was sound. The implementation had a gap, according to BleepingComputer.

An attacker used a single compromised user account to get into the platform. Private conversations stayed protected by encryption. Public chat rooms, however, were not encrypted, and everything shared in them was exposed. DINUM (France's government digital affairs directorate) disclosed the incident and notified CNIL, France's data protection authority. The attacker may have accessed information shared by around 9% of all registered users, which works out to more than 73,000 employees across the French public sector.

Think of it like a building with a top-grade lock on every office door but an open, unwatched lobby. One stolen access card and the attacker has the run of the common areas.

What you should do: On any messaging platform, treat public and group channels as open rooms. Never share sensitive information there, regardless of how the app markets itself. Private, one-to-one encrypted messages are a different category. Know which type of conversation you are in before you type.

The ShinyHunters extortion gang is back — and this time they went after the back office.

Oracle PeopleSoft, an enterprise software suite used by large organisations to manage payroll, HR, finance, and supply chain operations, is being targeted in an active data theft campaign, according to BleepingComputer. ShinyHunters claims to have stolen data from 300 instances across more than 100 organisations, and affected customers are already receiving extortion demands.

The attackers say they are chaining old and zero-day vulnerabilities together to gain access — though they note the method does not work on every system, suggesting configuration or version differences affect their success rate.

What makes this particularly sensitive is the kind of data PeopleSoft holds. This is not a list of email addresses. HR and payroll systems store names, national ID numbers, salary records, and employment histories. If your employer uses PeopleSoft — especially in a university, government body, or large enterprise — your personal data may be in scope.

No CVE identifiers have been confirmed in the source material at the time of writing. ShinyHunters has not disclosed the specific vulnerabilities used publicly.

What you should do: If you work in IT at an organisation running Oracle PeopleSoft, check with your vendor contact for guidance and monitor for extortion-related communications. If you are an employee at a large organisation, watch for phishing attempts that reference your employer or personal employment details — this is exactly the kind of data that fuels targeted scams.

Between January and May 2026, a hacker group tracked as UNC3753 — also known as Luna Moth and Silent Ransom Group — ran a campaign against dozens of U.S. firms in the legal, financial, and professional services sectors, according to Google Mandiant.

The method: vishing (voice phishing — phone calls designed to trick people into handing over access). Attackers called employees pretending to be IT support, using fake pretexts like data migrations or invoice issues. Once they had the target on the line, they convinced them to start a screen-sharing session and install remote monitoring software on their own machine. At that point, the attacker could see and control everything.

From there, UNC3753 searched for and stole proprietary legal agreements, personal records, and financial data. The goal was extortion — pay up, or the files go public.

The detail that stands out: in some cases, attackers showed up physically at victim premises. No keyboard required.

Stolen data included contracts, personal records, and financial files. No ransomware was deployed — this was pure theft and pressure.

What to do: Your IT team will never cold-call you and ask to take control of your screen. If someone calls claiming to be tech support and asks you to install anything or share your screen, hang up and call your IT department back on a number you already know.

Oxford University disclosed last week that its CareerConnect platform — a career services portal run by third-party provider Group GTI — was breached on 28 May, according to BleepingComputer. CareerConnect is also used by King's College London and the University of Manchester, meaning the impact reaches well beyond Oxford.

Attackers got into the platform and walked away with users' first names, last names, email addresses, and encrypted passwords (scrambled password data — harder to use immediately, but not impossible to crack). Users who log in via SSO (Single Sign-On — a system that lets you use one login, like your university account, across multiple services) were not affected in the same way.

Oxford confirmed that no financial data, course records, or uploaded files appear to have been accessed. Passwords for affected users have already been invalidated — you will be asked to reset yours next time you log in.

The university is warning that the stolen email addresses could now be used for phishing (fake emails designed to trick you into handing over more information). This is the second Oxford data breach disclosed this year.

What you should do:

1. If you have a CareerConnect account at any UK university, reset your password when prompted and do not reuse it elsewhere.
2. Be suspicious of any emails claiming to be from your university's careers service over the coming weeks.
3. If you used the same password on other sites, change it on those too — immediately.

A self-replicating worm called Miasma has infected 73 repositories across four of Microsoft's GitHub organisations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — in what researchers are calling an active supply chain attack (an attack that poisons the tools developers use to build software, so the damage flows downstream to everyone who uses that software).

According to The Hacker News, the campaign is ongoing.

Here is why this matters to you even if you have never touched a line of code. Software you use every day — apps, cloud services, productivity tools — is built using components pulled from repositories like these. When a worm corrupts those components, malicious code can end up inside software that looks completely legitimate. You install an update. You never know.

What you should do:

1. If you use any Microsoft Azure-based services at work, flag this to your IT team today and ask if they have reviewed their software dependencies.
2. If you are a developer: audit any third-party packages you pulled from Microsoft GitHub repos in the last two weeks.
3. Everyone else: keep automatic updates on, but give it 48–72 hours after a major release before installing — this gives security teams time to catch anything poisoned.