Bilingual

A Third Party Breached the Intercept's Signal Tip Line
20 days ago
- The Intercept's Signal tip line was breached by an unknown third party, who solicited whistleblowers while impersonating the outlet, posing a significant risk to sources.
- Despite becoming aware of the breach, The Intercept only changed its tip line account and cited 'security best practices' without informing the public or potential sources about the compromise.
- The third party, linked to a fraudulent social media account active since February, continued to operate the breached Signal line, and The Intercept has not provided details on the breach's duration or impact.
- The incident highlights a failure in safeguarding confidential sources, raising concerns about operational security and transparency in whistleblower programs.
- Drop Site News, founded by former Intercept staff, reported the breach and ongoing risks, criticizing The Intercept's handling as a catastrophic duty failure.
A Puerto Rico Government Agency Exposed 1M Social Security Numbers
13 days ago
- A cybersecurity vulnerability in Puerto Rico's Municipal Revenue Collection Center (CRIM) property map exposed Social Security numbers of about 1 million people.
- Despite notification, CRIM denied any security breach and did not inform affected users or the oversight agency, but patches were applied after media contact.
- Puerto Rico has faced multiple cyber incidents in recent years, with over 2 million attempted attacks in 2024, prompting a new cybersecurity law, though implementation is incomplete.
Hackers Use Fake Emergency Requests to Steal Data from Apple, Meta and Others
12 days ago
- Hackers tricked companies like Apple, Meta, and Discord into handing over user data using fake emergency data requests (EDR).
- Criminals exploit compromised law enforcement email accounts to send forged EDRs with real names and signatures, appearing legitimate.
- Companies often verify requests via valid domains but lack specific tools, leading to quick compliance (e.g., within 30 minutes).
- Discord, Apple, and Meta have been targeted since early 2021, with some complying despite later discovering the compromised accounts.
- A privacy service like Bitdefender's Digital Identity Protection can help users manage digital footprints and receive breach notifications.
I think I was part of a model distillation attack
12 days ago
- The author received emails from OpenAI about inconsistent API usage and a 'Prohibited Biological Use' policy violation.
- Upon investigation, they found 114 unauthorized interactions with gpt-5.5 using a compromised legacy API key from 2023, possibly from bettergpt.chat.
- The attackers used the key for various tasks including a video QA benchmark, coding agents, and exporting insulin molecule chains, which triggered the policy violation.
- The attack involved a repo named 'ga-synthesis' where agents ran in environments like PyMOL, interacting with GUI apps via virtual desktop.
- The system prompts indicated usage of Anthropic's Claude Agent SDK, with paths suggesting a Chinese lab on Alibaba Cloud.
- The attack lasted about 10 minutes, used 4M tokens, cost $23, and was stopped by disabling the key after noticing it at midnight.
Hugging Face Data Breach
2 days ago
- Hugging Face disclosed a hack compromising internal datasets and service credentials.
- Attackers exploited a vulnerability via a malicious dataset to escalate permissions and access internal systems.
- Stolen credentials have been revoked and rotated; users advised to review their accounts.
- The vulnerability has been fixed, highlighting platform abuse challenges.
- Hugging Face attributed the breach to an external AI agent executing numerous actions.
- Anomaly detection and an internal AI model analyzed attack logs, avoiding external data upload.
- Security researchers note constraints on frontier AI models for cybersecurity investigations.
- The incident was reported to law enforcement, with forensic specialists involved.
- Prior security audit status unclear; no comment from Hugging Face on this.
55M unique email addresses affected in Suno data breach
16 hours ago
- Suno, an AI music generation tool, experienced a data breach in November 2025 that was disclosed in July 2026.
- The breach exposed over 55 million unique email addresses and phone numbers used for sign-ups.
- A small portion of the compromised data included tens of thousands of Stripe records containing names, physical addresses, purchase amounts, and partial credit card details (card type, expiry date, last 4 digits).
- Recommended actions include changing passwords, enabling two-factor authentication, using identity theft protection services like Aura, real-time cybersecurity tools like Guardio, and a password manager like 1Password.

Hasty Briefsbeta

#data breach

A Third Party Breached the Intercept's Signal Tip Line

A Puerto Rico Government Agency Exposed 1M Social Security Numbers

Hackers Use Fake Emergency Requests to Steal Data from Apple, Meta and Others

I think I was part of a model distillation attack

Hugging Face Data Breach

55M unique email addresses affected in Suno data breach