Breach Watch
Written for risk decisions, not headlines.
Breach, ransomware, vulnerability, advisory and threat intelligence, classified by LiveThreat and analysed in an ADTP brief for every item.
Showing 20 of 2,533
BREACH WATCH BRIEF
LiteLLM Master Key Leak Exposes GitHub Tokens, Enables Malicious Package Hijack
A LiteLLM configuration file containing a master key was accidentally pushed to a public GitHub repo, allowing attackers to steal GitHub tokens and push a malicious Python package. The incident underscores the importance of secret‑management controls and continuous supply‑chain monitoring for audit readiness.
BREACH WATCH BRIEF
Capcom breach leaks 11.7M email addresses and account details
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, […]
BREACH WATCH BRIEF
Stolen ConnectWise API Secret Exposes Microsoft 365 Environments Across Thousands of Organizations
A ConnectWise API secret was stolen and used to pull data from Microsoft 365 tenants belonging to thousands of downstream customers. The breach underscores the importance of continuous vendor‑oversight controls and audit‑ready evidence for credential lifecycle management.
BREACH WATCH BRIEF
Quest Diagnostics Breach Exposes Patient Records via Unauthorized Access to Quanum LSM System
Quest Diagnostics confirmed that threat actors accessed its Quanum LSM platform using stolen credentials, exposing patient records. The incident underscores the need for continuous access‑control monitoring and audit‑ready evidence for compliance frameworks.
BREACH WATCH BRIEF
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign that compromised exposed Fortinet and Palo Alto firewalls, stealing more than 70 000 credentials. The incident highlights the importance of continuous configuration monitoring and audit‑ready evidence for network perimeter controls.
BREACH WATCH BRIEF
Capcom Breach Exposes 11.7 Million Account Records, Triggers Phishing Threat
Capcom disclosed that an attacker accessed its CAPCOM ID service, exposing over 11.7 million email, IP and activity records and changing passwords on 196 accounts. The leak fuels credential‑phishing campaigns, highlighting the need for strong access controls and user awareness in audit‑ready environments.
BREACH WATCH BRIEF
Quest Diagnostics Lab Services Manager Compromised, Potential Patient Data Exposure
Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager platform, potentially exposing patient test results. The incident underscores the need for continuous access monitoring, immutable logging, and a documented incident‑response program to satisfy audit and regulatory expectations.
BREACH WATCH BRIEF
Hacker Leaks 281 GB of Internal Emails from Germany’s AfD Party
AfD confirmed that a hacker accessed its hosting provider, copied over 421 k internal emails and 100 k files, and released a 281 GB archive. The breach highlights the need for continuous third‑party risk monitoring and auditable evidence of vendor security controls.
BREACH WATCH BRIEF
Microsoft 365 Accounts Hijacked at 79 Organizations via Token Replay – No Passwords Needed
A threat actor replayed stolen Microsoft 365 session tokens to access email accounts at 79 organizations, bypassing passwords and MFA. The breach underscores the importance of continuous authentication monitoring and robust MFA lifecycle controls for audit readiness.
BREACH WATCH BRIEF
Russian‑Linked Hackers Use Mesh‑Network Backdoor to Wipe Ukrainian Logistics Firm
A Russian state‑sponsored group, Sandworm, in collaboration with another actor, delivered a spear‑phishing attachment that installed a novel mesh‑network backdoor, leading to a destructive wiping of a Ukrainian logistics company’s systems. The incident underscores the need for continuous phishing defenses and evidence‑driven incident‑response controls for audit readiness.
BREACH WATCH BRIEF
Crime Stoppers Chapter Halts Anonymous Tips After P3 Global Intel Breach Exposes 1.5 M Reports
A breach of the P3 Global Intel tip‑management platform exposed over 1.5 million crime‑tip records, breaking the anonymity promise for Toronto Crime Stoppers. The incident underscores the need for continuous third‑party risk monitoring and defensible audit evidence.
BREACH WATCH BRIEF
Capcom breach exposes 11.7 million player account records
Capcom disclosed that a third‑party accessed its CAPCOM ID service, extracting 11.7 M account records and changing passwords on 196 accounts. The incident underscores the need for strong identity‑access controls and audit‑ready evidence for regulators.
BREACH WATCH BRIEF
Quest Diagnostics Lab Services Manager Portal Compromised, Exposing Patient Records
Quest Diagnostics reported that an unauthorized party accessed its Quanum Lab Services Manager portal, leading to the exposure of patient records. The incident highlights the need for robust access‑control monitoring and audit‑ready evidence for health‑care regulators.
BREACH WATCH BRIEF
State Bank of India Customer PII Data Leak Exposes Thousands of Account Holders
State Bank of India experienced a breach that exposed customer personally identifiable information. The incident highlights gaps in privacy controls and underscores the need for continuous evidence of data protection for audit readiness.
BREACH WATCH BRIEF
Railway warns developers to rotate secrets after potential breach of encrypted environment variables
Railway discovered suspicious activity that may have let an unauthorized third party decrypt stored environment variables, exposing API keys and database credentials. The incident highlights the need for robust secret‑management and audit‑ready controls in cloud‑native development platforms.
BREACH WATCH BRIEF
Crime Stoppers Toronto Chapter Halts Operations After 1.5M Tips Exposed in Data Breach
More than 1.5 million Crime Stoppers tips were leaked after a vendor platform was compromised, revealing personal identifiers for roughly half of the records. The breach highlights the need for robust privacy controls and vendor oversight to protect anonymity‑critical data.
BREACH WATCH BRIEF
China‑Linked Storm‑0940 Uses AI Tool ARTEX to Compromise ConnectWise Cloud Backup, Gaining Privileged Access to 2,250 Microsoft 365 Tenants
Storm‑0940 leveraged the AI framework ARTEX to automate credential‑spraying against ConnectWise, stealing service‑account keys and using them to infiltrate over 2,250 Microsoft 365 tenants. The breach illustrates why continuous third‑party risk monitoring and evidence‑based control assurance are essential for audit readiness.
BREACH WATCH BRIEF
Capcom Data Breach Exposes 11.7 Million User Accounts
Capcom confirmed that attackers accessed its CAPCOM ID service, leaking email addresses and login metadata for 11.7 million users and altering passwords for a subset. The breach highlights the need for robust identity‑access controls and continuous audit evidence for credential management.
BREACH WATCH BRIEF
EU Supermarkets Lose Millions Due to Unpatched Refrigeration Firmware Managed by a Third‑Party Vendor
Hundreds of EU grocery stores suffered multi‑million‑euro losses after a third‑party OT provider failed to update refrigeration firmware, causing cooling failures. The incident highlights the need for continuous vendor‑risk monitoring and auditable evidence of firmware compliance.
BREACH WATCH BRIEF
Supply Chain Attack Compromises LiteLLM PyPI Package, Distributing Credential‑Stealing Malware to Millions of Developers
Hackers breached the LiteLLM open‑source project's release pipeline and published a malicious 1.107.0 wheel on PyPI and compromised Docker images. The payload steals cloud, AI, and developer credentials, exposing any organization that installs the package. This highlights the need for continuous third‑party risk monitoring and software‑integrity controls for audit readiness.
Breach Watch intelligence is provided by LiveThreat, a product of a founding sponsor of the association. Every ADTP brief carries LiveThreat's analysis and links the original source.
Practitioner briefings
Written by the association: what the week's intelligence means for the controls you run.
Reading a vendor's breach notice for what it does not say
A practitioner checklist for turning a supplier notification into an evidence request and a monitoring change.
Where AI inventory efforts stall, and the control that unblocks them
Findings from practitioner roundtables on AI governance programs in their first year.
Evidence reuse across customer diligence and audit
How practitioners are organizing one evidence base to serve buyers and auditors at the same time.
Global Privacy Control signals and state opt-out obligations
What a site must do when it sees a GPC signal, and how to evidence it.
Get the digest
No membership required. Confirm by email; unsubscribe in one click.