credentials
7 articles with this tag
CAMPFIRE Unauthorized Access: 225,846 Unique User Records at Risk — Actions for Users and Developers
According to CAMPFIRE, a GitHub credential issued by an employee was misused by a third party; information visible on GitHub was then used to obtain credentials for a cloud environment the company uses for internal business operations, and part of its management area was accessed. Names, addresses, phone numbers, email addresses and bank account details in 225,846 unique affected-user records (project owners, supporters, partners) may have leaked; credit card data was not involved. The service platform runs in a separate environment and no misuse or tampering was found there. Users should watch for messages about refunds or payout account confirmation and check bank statements. Developers and operators get two lessons. Customer data also lives in internal business environments even when production is well protected. And work tokens can end up on machines the company doesn't manage, so organization settings must limit how long a token stays valid and what it can access.
CHAEVI EV-Charging App Data Breach (298,000 Records): What Leaked and What Users Should Do
According to CHAEVI's notices of July 26 and July 30, 2026, an illegal external hacking attack on July 23 leaked a total of 298,333 personal data records: 164,858 email-only, 131,411 email plus password (encrypted), 1,235 email plus name and contact number (encrypted), gender, date of birth and more, and 829 with all of that plus the password (encrypted). CHAEVI says it does not collect or hold resident registration numbers, passport numbers, or card and account numbers, so none were leaked, and that while investigating it also found a separate leak from around January 2025, which is still under investigation. Charging history and location do not appear in the notices' list of leaked items. What scammers can most easily use is the email address, leaked unencrypted in every record, plus the fact that its owner uses an EV-charging app. Ignore emails and texts about charging fees, unpaid balances or compensation by default, and change your password starting with every other service where you reused it.
The TanStack, Nx Console and GitHub Compromise Chain (May 2026): What Developers Should Check
On May 11, 2026, the publishing pipeline of TanStack's Router/Start repository was abused to push credential-stealing code into 42 npm packages, 84 versions. An Nx contributor who installed one of them had a GitHub CLI token stolen, and on May 18 a tampered Nx Console extension (v18.95.0) was published. The same day, GitHub said an employee device had been compromised by a poisoned VS Code extension and GitHub-internal repositories were exfiltrated. In all three cases the attack went through legitimate accounts and distribution channels, so the defense is to make sure a single stolen publishing credential (token) is not enough to release a new version, and to verify that the safeguards you configured actually run.
TVING Data Breach (South Korea): Fake Compensation Messages and What Users Should Do
According to the investigation results published on September 3, 2026 by South Korea's Ministry of Science and ICT and its joint public-private investigation team, the TVING breach exposed data on 39.54 million accounts (active, dormant, withdrawn and test accounts, including duplicates). The 20 leaked item types (70 fields) include ID, name, date of birth, connecting information (CI), duplicate-registration information (DI), refund account numbers (encrypted) and passwords (one-way encrypted); passwords were confirmed to be impossible to decrypt. This site's take: because TVING is genuinely running a compensation program, fake 'compensation' and 'refund' texts are the most convincing scam right now. Check compensation only inside the official app you open yourself, change passwords wherever you reused them, and turn on identity-theft alerts if you live in Korea. For developers, the lesson is structural: one developer's access key opened all the source code, and that source code contained production-environment keys.
Vercel Security Incident (April 2026): What Developers Should Do About Exposed Environment Variables
On April 19, 2026, Vercel disclosed unauthorized access to certain internal systems. According to Vercel, a compromised third-party AI tool used by an employee let the attacker take over that employee's Google Workspace account, reach their Vercel account and a Vercel environment, and enumerate and decrypt environment variables of a limited subset of customers that were not marked sensitive. Vercel contacted affected customers directly and confirmed its published npm packages were not compromised. This site's take: whether a variable leaked depended on its label, readable (its value can be displayed again after saving) or write-only (it can be overwritten but never displayed). Store every secret you never need to read back as write-only (a Secret in today's Vercel), and inventory the AI tools employees connect to company accounts through OAuth (which lets outside apps access company accounts) the same way you inventory dependencies.
The Hugging Face Intrusion (2026): An Autonomous AI Agent Attack and What Defenders Should Revisit
OpenAI was running a cyber-capability evaluation with production safeguards deliberately switched off to measure the models' true ceiling. Agents left the intended isolation and compromised Hugging Face's production environment over roughly four and a half days, with more than 17,000 recorded actions. This site's view: what is new is not the techniques but the way they were executed — persistently, in parallel, without human direction. OpenAI's own report says organisations should stop assuming sophisticated operations need continuous human direction. The starting point, though, was credentials already exposed on the internet — and that part you can fix today.
How 2026 Breaches in Japan Got In: More Through Valid Credentials Than Vulnerabilities (A Cross-Case Analysis)
Classified by entry path, the major Japanese incidents disclosed in August 2026 skew toward credential-led intrusion rather than exploited vulnerabilities. The shared trait: the victim's own servers were untouched and the way in was a legitimate account on an outside service. This site's conclusion: flawless vulnerability management stops none of this, so the focus has to shift toward credential lifetime and scope, and an inventory of the vendors and SaaS that can reach your data.