data leak

Bilingual

Claude may have leaked your chats to the public
2 months ago
- Chatbots like Claude are designed to feel personal but are not private, with conversations visible to the company and potentially indexed by search engines.
- Claude share links were indexed by Google, exposing sensitive user chats including legal and personal discussions, though Anthropic quickly fixed the issue.
- The leak primarily affected shared chats, but some users who never shared their chats may also have been exposed.
- AI companies commonly use user chats for training and may have human reviewers, and data can be retained even after deletion.
- Users should never share personal or sensitive information with AI chatbots to protect their privacy.
"Why hack the DHS? I can think of a couple Pretti Good reasons!"
2 months ago
- DDoSecrets published data on ICE contracts hacked from DHS's Office of Industry Partnership, released by the hacker group Department of Peace.
- The group cited the murders of Alex Pretti and Renée Good by ICE agents and a conspiracy to protect the murderers as reasons for the hack.
- The raw data is available as two JSON files: dhs_contractors.json (13.4 MB) and dhs_contracts.json (3.6 MB).
- The author created a static website called DHS Contracts Explorer to easily visualize and search the data.
- The largest contract identified is $70 million with Cyber Apex Solutions LLC, awarded March 31, 2017, ending March 31, 2022, with the CEO using a Hotmail email address.
- The author condemns companies contracting with ICE as morally bankrupt and hopes the data fuels local pressure campaigns to drop these contracts.
Lessons Learned from CISA's Recent GitHub Leak
2 months ago
- CISA data leak involved contractor publishing 844 MB of sensitive data, including AWS GovCloud credentials, on a public GitHub repository for six months.
- CISA's response was delayed; it took over 48 hours to invalidate leaked keys, partly due to system complexities and unclear incident reporting channels.
- The agency's postmortem emphasizes improving key management, establishing distinct reporting channels, and continuously scanning for exposed secrets on platforms like GitHub.
- GitGuardian researcher highlighted that CISA ignored nine automated alerts, prolonging exposure, and urged organizations to make leak reporting trivial and visible.
- CISA noted enhanced logging and zero-trust principles helped limit damage, but its incident playbook lacked procedures for GitHub or cloud service incidents.
- The report is praised for transparency and advocating for secrets scanning and better relations with security researchers, setting a precedent for organizations.

data leak

Claude may have leaked your chats to the public

"Why hack the DHS? I can think of a couple Pretti Good reasons!"

Lessons Learned from CISA's Recent GitHub Leak