#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.
Timeline
Non-Human & AI Identity Breaches
Non-Human & AI Identity Breaches
June 2026
Klue OAuth Supply Chain Breach: How Stolen SaaS Credentials Hit 700+ Organisations
In June 2026, a credential theft campaign targeting Klue, a market intelligence SaaS platform, exposed OAuth tokens held on behalf...
Mastra npm Supply Chain Attack: North Korea’s Sapphire Sleet Backdoors 144 AI Packages in 88 Minutes
On 17 June 2026, North Korea's Sapphire Sleet hacking group executed one of the most precisely engineered software supply chain...
Coupang Signing Key Breach: Unrevoked Credentials Expose 33.7 Million Records After Employee Offboarding
In 2025, South Korea's largest e-commerce company Coupang suffered a data breach traced to a single NHI lifecycle failure: a...
JetBrains Marketplace AI Plugin Campaign: 15 Malicious Plugins Steal AI API Keys from 70,000 Developers
Over eight months from October 2025 to June 2026, attackers operated a coordinated credential theft campaign through the JetBrains Marketplace,...
Meta AI Instagram Account Takeover: 20,225 Accounts Hijacked via AI Support Chatbot
In late May and early June 2026, attackers exploited a fundamental design flaw in Meta's AI-powered support chatbot to take...
Miasma and Hades: Self-Propagating Supply Chain Worms Hit npm, PyPI and Azure
In June 2026, two related supply chain worms, Miasma and Hades, swept through the npm and PyPI package ecosystems in...
May 2026
Gravity SMTP CVE-2026-4020: A Single HTTP Request Exposed API Keys Across 100,000 WordPress Sites
In May and June 2026, attackers exploited a critical vulnerability in the Gravity SMTP WordPress plugin to harvest live API...
Storm-2949: How a Phone Call Turned One Cloud Identity into a Full Azure Breach
In May 2026, Microsoft Threat Intelligence published a detailed account of a sophisticated cloud intrusion conducted by a threat actor...
April 2026
Canvas/Instructure Data Breach: ShinyHunters Exploits LMS Platform to Expose Millions of Student Records
In late April and May 2026, Instructure, the company behind Canvas, the learning management system used by 41% of US...
Vercel Context.ai OAuth Supply Chain Breach: How One Shadow AI App Exposed Customer Data
In April 2026, Vercel disclosed a data breach originating from a compromised third-party AI productivity tool. A Vercel employee had...
March 2026
LiteLLM PyPI Package Breach: Credentials Stolen from Users
In March 2026, the cybersecurity landscape was rattled by a significant data breach involving the widely-used LiteLLM Python package on...
McKinsey AI Platform Hack: A security Flaw Exposed 46M Chats and Sensitive Data
In March 2026, McKinsey & Company, a global leader in consulting services, faced a significant data breach involving its internal...
Stryker Microsoft Intune Wiper Attack: Handala Wipes 200,000 Devices Across 79 Countries
On 11 March 2026, employees at Stryker Corporation offices across 79 countries switched on their computers and found them blank....
February 2026
Google API Keys Exposure: Gemini AI Turns Public Keys into Data Leak Risk
In February 2026, a significant data breach emerged when security researchers uncovered that Google API keys used in client-side code...
Millions of Misconfigured Git Servers Are Leaking Secrets Online
In February 2026, a significant cybersecurity breach was uncovered, revealing that nearly 5 million web servers were exposing sensitive Git...
Moltbook Breach Exposes 1.5M AI Agent Keys: What You Need to Know
In February 2026, a major cybersecurity breach emerged involving Moltbook, a social network platform for AI agents. The vulnerability exposed...
December 2025
MongoBleed Breach Exposes Secrets of 87K MongoDB Servers
In December 2025, a significant cybersecurity breach known as MongoBleed emerged, exposing over 87,000 MongoDB servers to severe threats. This...
Amazon Breach: Hacked AWS Accounts Fuel Ongoing Crypto-Mining
In December 2025, Amazon’s AWS (Amazon Web Services) faced a significant security breach that saw compromised accounts being utilized for...
Attackers Are Exploiting Gladinet’s Hard‑Coded Keys for Remote Code Execution
In December 2025, Security researchers have sounded the alarm on an actively exploited vulnerability in Gladinet’s CentreStack and Triofox file‑sharing...
Massive Docker Hub Leak: 10,000+ Images Expose Secrets and Auth Keys
Security researchers have uncovered a widespread and dangerous credential exposure issue affecting the Docker Hub container image registry. In a...
November 2025
Media Pressure, Then Action: Inside Home Depot’s Year-Long Token Exposure
In a troubling cybersecurity oversight, The Home Depot, one of the largest home improvement retailers in the United States, inadvertently...
17,000+ Secrets Exposed in Public GitLab Repositories — What Went Wrong and How to Fix It
In late November 2025, a major security analysis revealed a startling reality: public repositories on GitLab Cloud have leaked over...
Inside the Shai-Hulud Campaign: npm Malware Attack Exposes Secrets on GitHub
In November 2025, security researchers uncovered a widespread supply-chain attack targeting the JavaScript ecosystem. A new malware strain named Shai-Hulud...
Code Formatting Tools Cause Massive Credential Leaks in Enterprises
In November 2025, security researchers discovered that a code beautifier tool, used to format and clean source code, inadvertently exposed...
TruffleNet BEC Attack: Over 800 Hosts Compromised Using Stolen AWS Credentials
In November, Security researchers have uncovered a large and sophisticated campaign, dubbed “TruffleNet,” in which attackers are abusing stolen Amazon...
Hardcoded Credentials in SAP SQL Anywhere Monitor Expose Enterprises to Critical Remote Access Risk
On November 11, 2025, SAP issued a security update patching a severe flaw in SQL Anywhere Monitor (non-GUI version), tracked...
October 2025
Copilot Studio Agents Exploited in New CoPhish OAuth Token Theft
A new phishing technique known as CoPhish was disclosed in October 2025. This attack abuses Copilot Studio agents to trick...
Hard-Coded Secrets in VSCode Extensions Trigger Massive Supply-Chain Risk — Over 500 Plugins Expose Tokens & Credentials
In October 2025, Wiz publicly disclosed a major supply-chain security problem affecting the VSCode extension ecosystem (including both the official...
How Stolen Credentials Enabled Mass Breach of SonicWall VPN Accounts
In October 2025, researchers disclosed a large‑scale campaign targeting SonicWall SSL VPN accounts. In this wave of attacks, threat actors...
OneLogin Breach: API Key Vulnerability Exposes OIDC Secrets
In October 2025, OneLogin, a prominent identity and access management provider, experienced a significant data breach that has raised alarms...
September 2025
CrewAI GitHub Token Leak Exposes Sensitive Source Code
In September 2025, researchers from Noma Labs discovered a critical security flaw in CrewAI’s platform: an internal GitHub token, with...
Microsoft Entra ID Flaw Exposed: How Attackers Could Hijack Any Company Tenant
In September 2025, a critical vulnerability was disclosed in Microsoft’s Entra ID (formerly Azure Active Directory) that could allow adversaries...
August 2025
Palo Alto Networks Key Breach Exposes Customer Information – What Really Happened?
In August 2025, Palo Alto Networks confirmed that it was impacted by a supply-chain data breach connected to the compromise...
Salesloft Drift AI ChatBot Key Breach: Hackers Steal OAuth Tokens to Access Salesforce Data
Between August 8 and August 18, 2025, a widespread data theft campaign targeted over 700 Salesforce customer organizations. Attackers exploited...
Over 2,300 Credentials Leaked in Malicious Nx Package Attack
In late August 2025, a sophisticated supply chain attack compromised the widely used Nx build platform, a popular open-source tool...
Replit AI Tool Deletes Live Database and Creates 4,000 Fake Users
In late July 2025, an experiment using Replit’s “vibe coding” AI assistant went off the rails. During a 12-day test...
July 2025
Hard-Coded Secrets Compromise HPE Aruba Instant On Access Points
Overview On July 18, 2025, HPE disclosed a critical vulnerability affecting its popular Aruba Instant On Access Points, widely used...
Gemini CLI Breach: Vulnerability Allows Silent Code Execution
In July 2025, a significant security vulnerability within Google’s Gemini CLI was identified, allowing attackers to execute malicious code and...
Docker Hub Key Breach Risk: Leaked Auth Secrets Hidden Inside Container Images
In July 2025, A comprehensive academic study conducted by researchers at RWTH Aachen University in Germany has uncovered a widespread...
Amazon’s AI Coding Agent Compromised: Hackers Inject Data-Wiping Commands
In July 2025, security researchers disclosed a troubling breach involving Amazon Q, Amazon’s AI-powered coding agent embedded in the Visual...
McDonald’s AI Chatbot “McHire” Exposes 64 Million Job Applications via Default Credentials
Overview On June 30, 2025, security researchers uncovered a critical vulnerability in the AI-powered recruitment platform McHire, used by McDonald’s...
April 2025
Co-op Group DragonForce Breach: Scattered Spider Steals 20 Million Member Records
In April 2025, the Co-op Group, the UK's fifth-largest food retailer with over 2,500 stores and 70,000 employees, fell victim...
Leaked SpotBugs Token Behind Massive GitHub Supply Chain Attack in 2025
A cascading supply‑chain attack on GitHub, traced in April 2025, started with a leaked personal access token (PAT) from SpotBugs,...
March 2025
How iOS Apps Are Leaking Secrets and Endangering User Privacy
In March 2025, The mobile world is buzzing after recent research uncovered a shocking truth about iOS apps: many are...
GitHub Action Supply Chain Attack Leaks Thousands of CI/CD Secrets
Overview In March 2025, a major supply-chain attack compromised the popular GitHub Action tj-actions/changed-files, used by roughly 23,000 repositories. The...
How reviewdog action Exposed Thousands of Secrets?
On March 11, 2025, The reviewdog/action-setup GitHub Action became the focus of a significant supply chain attack. Malicious activity was...
Nearly 12,000 Secrets Found in Public LLM Training Dataset
In early March 2025, security researchers at Truffle Security discovered that the publicly‑available dataset from Common Crawl, widely used to...
February 2025
OmniGPT Breach: 34M Conversations Exposed
In February 2025, a significant data breach involving OmniGPT, a widely-used AI-powered chatbot platform, was reported. A threat actor known...
Salt Typhoon Used Cisco Flaw & Stolen Credentials to Hack U.S. Telecoms
In February 2025, Cisco Talos reported that the advanced persistent threat (APT) group known as Salt Typhoon, believed to be...
Cisco Data Breach – Leaks Active Directory Credentials
On 10th February 2025, the Kraken ransomware group claimed responsibility for a data breach involving Cisco Systems. They alleged that...
Zacks Breached, Again: The Fallout for 12 Million Users
In February 2025, the cybersecurity world faced yet another wake-up call, this time, the target was Zacks Investment Research, a...
How ASP.NET Machine Keys Triggered Remote Code Execution Attacks
On February 6, 2025, Microsoft revealed a major security issue involving over 3,000 publicly exposed ASP.NET machine keys. These keys,...
January 2025
DeepSeek Breach: What Went Wrong?
On January 29, 2025, a major security breach involving DeepSeek, a prominent Chinese artificial intelligence (AI) startup, was reported. The...
AWS S3 Buckets Under Attack
In January 2025, the ransomware group "Codefinger" has exploited Amazon Web Services (AWS) to launch a sophisticated campaign targeting Simple...
December 2024
Secrets Exposure Via Azure Key Vault Role
In December 2024, Researchers identified a potential privilege escalation vector in Azure Key Vault. The issue arises from the misconfiguration...
Microsoft Azure OpenAI Service Breached By Hacking-As-A-Service Group To Generate Harmful Content
In December 2024, Microsoft took decisive legal action against a Hacking-as-a-Service (HaaS) platform that exploited vulnerabilities in its Azure OpenAI...
BeyondTrust Breach Causes Major Incident At US Treasury
On December 2, 2024, BeyondTrust, a leading cybersecurity solutions provider specializing in Privileged Access Management (PAM) and Secure Remote Access,...
October 2024
AI LLM Hijack Breach
In October 2024, Permiso Security reported a sophisticated cyberattack revealed critical vulnerabilities in the infrastructure of cloud-hosted large language models...
Emerald Whale Breach
In October 2024, a significant cybersecurity incident known as Emerald Whale shocked the DevOps community. This incident revolved around exposed...
The Internet Archive Breach
In October 2024, The Internet Archive, famous for its Wayback machine and massive digital archives, fell victim to a major...
Cisco Breach
In October 2024, Cisco experienced a significant cybersecurity breach related to Non-Human Identities (NHIs). The threat actor ‘IntelBroker’ exploited exposed...
June 2024
Hugging Face Breach
In early June 2024, Hugging Face, which is considered as a leading company and AI platform, announced a security breach...
The New York Times Breach
In June 2024, the New York Times (NYT), a media powerhouse known for its reporting excellence, became the subject of...
GitLocker Breach
In June 2024, GitHub users fell victim to an extortion campaign targeting their repositories. The threat actor gained unauthorized access...
May 2024
Snowflake Breach
One of the leading cloud data platforms, Snowflake, fell victim to a major cybersecurity breach in May 2024. The breach...
Dropbox Sign Breach
Even the users without Dropbox Sign accounts but involved in signed transactions had their In April 2024, Dropbox Sign, a...
JetBrains Breach
In May 2024, a critical vulnerability (CVE-2024-37051) with a CVSS score of 9.3, was reported in JetBrains’ GitHub plugin for...
November 2023
SAP Breach
In a digital world driven by cloud infrastructure, no one is immune to mistakes even the most established organizations. In...
PyPI Breach
In November 2023, a significant security incident was uncovered involving the exposure of thousands of hardcoded secrets in packages hosted...
Sumo Logic Breach
In the digital era, even security-focused organizations like Sumo Logic aren’t immune to evolving cyber threats. On November 3, 2023,...
Cloudflare Breach
On Thanksgiving Day, November 23, 2023, Cloudflare disclosed a significant breach involving their internal Atlassian systems. The intrusion occurred after...
September 2023
MGM Resorts Breach 2023: Scattered Spider Social Engineers Okta Access in a 10-Minute Phone Call
In September 2023, a member of the Scattered Spider hacking group called MGM Resorts' IT helpdesk, spent approximately 10 minutes...
Caesars Entertainment Breach 2023: Scattered Spider Pays $15 Million Ransom After Okta Credential Theft
In September 2023, Caesars Entertainment, operator of over 50 major casino and hotel brands including Harrah's, Bally's, Horseshoe, and Paris...
July 2023
JumpCloud Breach
In July 2023, JumpCloud, a well-known directory-as-a-service provider, made headlines by invalidating all administrator API keys in response to a...
GitHub Dependabot Breach
In July 2023, a sophisticated cyberattack shook the developer community, targeting GitHub repositories at an unprecedented scale. Threat actors exploited...
June 2023
Microsoft Azure Key Breach
In June 2023, Microsoft experienced a major security breach that left many businesses and government agencies vulnerable. The breach, dubbed...
Microsoft SAS Key Breach
Overview In June 2023, Microsoft AI researchers inadvertently exposed 38TB of sensitive internal data while publishing open-source training materials on...
January 2023
T-Mobile Breach
In January 2023, T-Mobile reported a data breach affecting 37 million accounts. The breach, caused by a vulnerable Application Programming...
CircleCI Breach
CircleCI, which is considered as a leading continuous integration and delivery (CI/CD) platform, fell victim to a major security breach...
Slack GitHub Breach
In January 2023, Slack, a leading collaboration platform, experienced a security breach involving the unauthorized access of private code repositories...
September 2022
Microsoft OAuth Breach
In September 2022, Microsoft disabled compromised verified partner accounts exploited by attackers to conduct OAuth phishing campaigns. These campaigns utilized...
Uber Breach
In September 2022, Uber Technologies Inc. faced a significant cybersecurity breach that exposed vulnerabilities within its internal systems. This incident...