NEW: Hackers stole more than $2.7 billion in crypto last year, according to multiple blockchain monitoring companies. North Korea alone stole 2 of those billions, thanks to the jackpot of the Bybit hack, which netted them $1.4 billion. techcrunch.com/2025/12/23/h...

NEW: U.S. insurance giant Aflac says its June data breach affected 22.6 million people. The hackers, the company says, stole data such as Social Security numbers, government IDs, and health information. techcrunch.com/2025/12/23/u...

What's up with all these "secret location" Barcelona offensive cybersecurity conferences?

NEW: La Poste, France's postal and banking services company, hit by a suspected Distributed Denial of Service attack. The postal service called the incident “a major network incident” that was disrupting “all of our information systems.” techcrunch.com/2025/12/23/f...

NEW, by me: Uzbekistan publicly exposed its nationwide license plate surveillance system, no password needed. The system reveals a hundred locations where banks of cameras have been placed, including cities and rural areas; and contains raw video footage of millions of vehicles and their occupants.

This is 404 Media's @jasonkoebler.bsky.social waving at himself through a Flock camera; one of 60 we learned was left exposed to the open internet. Not only could anyone with a link livestream it, but some admin portals were open with no login credentials required. www.404media.co/flock-expose...

Tomorrow's edition of my weekly cybersecurity newsletter this.weekinsecurity.com is a very busy, very special, awesome dispatch for the holiday season. Featuring all the cyber news you need to know but might've missed, plus a festive cyber-cat, and more. Sign up/RSS! No email open/link tracking. 🐈‍⬛

Online casino and betting site Stake emailed customers saying their personal data was stolen in Mixpanel's breach. Stake says usernames, email addresses, dates of birth & phone numbers were compromised. That's OpenAI, CoinTracker, CoinLedger, SwissBorg, SoundCloud, Pornhub & Stake affected so far.

NEW: Researchers say hundreds of Cisco customers are vulnerable to the newly revealed Chinese government-backed hacking campaign. It appears the attacks right now “are targeted,” according to Shadowserver’s chief executive Piotr Kijewski. Censys for now only sees 220 exposed systems.

Apple was very smart to send Ivan Krstić, who's been fighting spyware and exploit makers for years now, to Hexacon, a conference attended by a lot of spyware and exploit makers. www.youtube.com/watch?v=Du8B...

As every year, 2025 was a dumpster fire of data breaches, disruptive cyberattacks, and damaging hacks. Here's our annual look back at the worst cybersecurity incidents of the year. techcrunch.com/2025/12/19/h...

NEW: British healthcare technology provider DXS International, which sells to the National Health Service (NHS), disclosed a data breach today. Earlier this week, ransomware gang DevMan took credit for hacking the company, claiming to have stolen 300 gigabytes.

NEW: Cisco discovered a Chinese hacking campaign targeting an unknown number of customers. The hackers have been exploiting a zero-day in some of Cisco's most popular products "since at least late November 2025," the company said. There is no patch available at this point.

These are the questions that TechCrunch asked Mixpanel CEO Jen Taylor about the company's data breach. If anyone else wants to follow up with any of these questions, be my guest. Mixpanel is welcome to respond to my emails at any time.

Everytime someone mentions "bare metal" in my timeline my brain wonders: "What new genre is this?"

NEW: Hacking group Scattered Lapsus$ Hunters says it's trying to extort Pornhub after stealing Premium users's data. The data reportedly includes the registered email addresses and location; activity type, such as which videos and channels they watched, including the video name and web address.

Genuine question: what's the most practical application for blockchain or crypto?

NEW: Google and Apple have fixed zero-days that the two companies said were being exploited in the wild. There are no details about these attacks, but usually when this happens, there's a goverment using spyware behind it. Hopefully we will get the full story soon. techcrunch.com/2025/12/12/g...

NEW, by me: Home Depot exposed access to its internal systems for a year after an employee posted a private GitHub token online, likely by mistake. When a security researcher found it and tried to alert Home Depot, he was ignored. I alerted the company, which revoked access, but wouldn't comment!

NEW: A flaw in the website of Hama Film, a photo booth maker with presence in Australia, UAE and the U.S., exposes pictures and videos of its customers. Security researcher alerted the company last month, no answer. We reached out to the company a few times, no answer.

NEW: Right-wing messaging app Freedom Chat had security flaws that allowed a researcher to guess all numbers registered on the platform, and one that exposed user PINs to other users. The researcher enumerated around 2,000 phone numbers. techcrunch.com/2025/12/11/s...

Serious question: if you get a threat notification from Apple, WhatsApp, Google...and you are not a journalist ot dissident so you can't go to Citizen Lab/Amnesty/AccessNow, where do you go? Asking for an article, not for someone who's gotten that notification.

NEW: Petco has taken down parts of its Vetco website after we discovered a massive data leak exposing customers' personally identifiable information (and their pets!) to the open web. After flagging the leak, Petco still took four days to respond. Millions of customers could be affected.

There's a new offensive cybersecurity conference in Barcelona. The tagline: "Sun, seafood, and spyware." That rings a bell...🤔 offensive-bcn.com

NEW: The FTC denied a request from serial spyware maker Scott Zuckerman to be unbanned from the surveillance industry. Zuckerman used to run the stalkerware app SpyFone, which in 2018 exposed extremely sensitive data of both its customers and the people they were spying on.

NEW: Petco's data breach exposed customers' Social Security numbers, driver’s license numbers, financial information, and more. The company is still not saying how many customers in total were affected by this security incident. techcrunch.com/2025/12/08/p...

New from 404 Media: DHS’s immigrant-hunting app just got removed from the Google Play Store. Let’s local cops do facial recognition on people, app says to contact ICE or not. I’m told Google workers took issue with app in an internal report. We revealed app in Nov www.404media.co/dhss-immigra...

After we published this story, Kohler has removed all mentions of "end-to-end encryption" from its website. Company PR said: "We used the term with respect to the encryption of data between our users (sender) and Kohler Health (recipient)."

NEW: Pet products and services giant Petco has disclosed a data breach, but it is not saying how many people were affected, nor what personal data was exposed. Spokesperson said company had “provided further information to individuals whose information was involved.”

Wherever there's spyware, there's always an Italian angle...

NEW: Staffers at notorious spyware maker Intellexa had live remote access to their customers' surveillance systems. This allowed them to see the personal data of targets hacked with Intellexa's spyware Predator, according to research based on a leaked training video. Needless to say, this is bad.

Stop. Using. Spotify.

NEW: Your "end-to-end encrypted" poop pictures taken by this $599 (+ subscription) smart toilet camera are actually not end-to-end encrypted. ¯\_(ツ)_/¯ techcrunch.com/2025/12/03/e...

New, by me: Fintech firm Marquis is alerting dozens of U.S. banks and credit unions after an August ransomware attack allowed hackers to steal reams of customers' personal information and financial data, including SSNs. At least 400,000 people known to be affected so far, and will likely rise.

New, by me at TechCrunch: Mixpanel's pre-Thanksgiving blog post revealing a security incident could win awards for how *not* to handle a data breach. This is what you need to know about analytics giant Mixpanel and how the company tracks users' taps and clicks both inside apps and across the web.

This sounds like a terrible idea.

This is stunningly good reporting by two bylined reporters and six credited researchers, and it's undermined throughout by links to an "Ask the Post AI" that delivers insipid answers to its own contrived prompts under the guise of "More context on this article"

NEW: Europol shut down Cryptomixer, a crypto service alleged to have facilitated the laundering of 1.3 billion euros since 2016. Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs. techcrunch.com/2025/12/01/e...

We're running a 💻 CYBER MONDAY 💻 sale. Get 25% off an annual subscription: access to all of our articles, podcasts, bonus content, FOIA Forum trainings, full text RSS feed, no ads, and support independent journalism. Get yours here: www.404media.co/cyber-monday...

BREAKING NEWS from… * checks notes * …”DogeDesigner”

I was really thrilled to get to work on The WIRED Guide to Digital Opsec for Teens with @aumasson.jp. I think we did a good job but also apologies in advance to the teens that we tried to make jokes and generally Be Chill. Also no paywall to make it easier to share! www.wired.com/story/digita...

NEW: A trivial-to-exploit bug in jury systems used across the United States exposed jurors' sensitive personal data, such as full names, date of birth, emails, cell phone numbers, and home addresses — and potentially health data. The bug allowed anyone to brute-force and access jurors' accounts.

A spox for the ShinyHunters group told @lorenzofb.bsky.social that Gainsight "was a customer of Salesloft Drift, they were affected and therefore compromised entirely by us." So far, these hackers have breached hundreds of companies simply by targeting Salesloft and Gainsight alone.

New, by me and @lorenzofb.bsky.social: CrowdStrike has confirmed it fired a "suspicious insider" who passed screenshots of company systems to a prolific hacking group — which then went on to post them publicly.

NEW: Google says the new wave of supply chain attacks by Scattered Lapsus$ Hunters impacted more than 200 companies' Salesforce-stored data. Hackers said they breached CrowdStrike, Linkedin, Malwarebytes, Verizon etc. Malwarebytes said is investigating. CrowdStrike said company is "not affected."

NEW: Salesforse says said it’s investigating an incident where hackers compromised some of its customers' data after breaching customer experience company Gainsight. Notorious hacking group ShinyHunters has reportedly claimed responsibility for this new wave of data breaches.

NEW: The classic anime "Ghost in the Shell" turned 30 years old this week. Despite coming out at the dawn of the internet, it was incredibly prescient in terms of imaginig a future where governments use hackers for espionage, people use malware to spy on their loved ones, and much much more.

running down the computer aisle of best buy with a megaphone and shouting "copilot, install malware"

In case folks forgot what happened, Khashoggi entered a Saudi consulate in Istanbul to get a document so he could get married while his fiancée waited outside. He never left because he was murdered and dismembered with a bone saw inside the building. The US intel community said MBS ordered it.

I am afraid I convinced @zackwhittaker.com to let me write about anime. Stay tuned.