company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO

Application Security Engineer

DevsecOps Engineer

IT Manager

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Russia

DDoS

loading..
loading..
loading..

Ukraine accuses Russia of launching massive DDoS attacks on their government web portals

Ukraine has reported that Russian hackers compromised their government file-sharing systems intending to plant malicious files and disseminate harmful documents...

25-Feb-2021
2 min read

No content available.

Related Articles

loading..

Shineyhunters

Stellantis reveals unauthorized access occurred at a third-party service provide...

In a development that underscores the staggering challenges of digital security in the automotive sector, **Stellantis**, the world’s fourth-largest car manufacturer, confirmed a **data breach involving one of its third-party customer service providers**. While the company asserts there is no evidence that personal account credentials or financial data were stolen, the revelation has ignited concerns about the safety of sensitive customer information and the broader risks of vendor-related cyberattacks. ## How the Stellantis Breach Happened The breach was not a direct attack on Stellantis’ own IT infrastructure but instead occurred through a **vendor system used for customer contact services**. Cybersecurity experts warn that such **supply chain vulnerabilities** have become a favored entry point for attackers. Hackers increasingly exploit weaker links within large corporate ecosystems, gaining access through contracted service providers who may lack the same stringent security defenses. Stellantis reported that once it became aware of the unauthorized access, it **swiftly disabled the compromised vendor’s connection**, launched an immediate forensic investigation, and began working with external cybersecurity specialists to contain the incident. ## What Data Could Be at Risk? Although Stellantis has emphasized that **no payment information, passwords, or personal login credentials appear compromised**, some **customer service records may have been exposed**. These records often contain personal details such as names, email addresses, phone numbers, and service interaction histories. While these data points may seem less sensitive than financial credentials, cybersecurity analysts caution that **attackers can weaponize such information for phishing campaigns**. Armed with names and customer service history, criminals can craft highly convincing scams designed to trick individuals into revealing further personal or financial details. ## Stellantis’ Response to Customers To reassure customers and maintain transparency, Stellantis has: * **Disabled all access** to the affected vendor platform. * **Engaged digital forensic experts** to trace the source and scale of the breach. * **Notified law enforcement agencies**, cooperating fully with ongoing investigations. * **Launched a customer notification program**, informing potentially affected individuals of the risks. * **Encouraged customers** to remain vigilant, avoid suspicious communications, and regularly monitor their online accounts. ## Why This Incident Matters to the Auto Industry The Stellantis breach is part of a troubling pattern: **cybercriminals targeting third-party providers** linked to global corporations. With automakers expanding into digital ecosystems that include **connected cars, subscription services, and customer support platforms**, their exposure to cyber threats grows exponentially. This case reinforces that **data security is no longer confined to company firewalls**. Automakers must scrutinize the cybersecurity measures of every vendor they work with, from IT services and cloud platforms to call centers and marketing agencies. ## Expert Reactions on Vendor-Related Cybersecurity Risks Cybersecurity analysts note that the Stellantis breach reflects the same risks exposed in previous high-profile incidents such as the **SolarWinds attack** and other **supply chain compromises**. These breaches often bypass the fortified defenses of major corporations by slipping in through outsourced contractors or technology partners. According to [specialists](https://media.stellantisnorthamerica.com/newsrelease.do?id=27079&mid=1), **vendor risk management and zero-trust security models** are now essential for corporations handling millions of customer records. This means continuous monitoring of third-party systems, mandatory encryption standards, and contractual obligations to maintain cybersecurity parity with parent companies. ## Protecting Yourself as a Stellantis Customer Stellantis advises customers to take the following proactive steps: 1. **Beware of phishing attempts** that reference Stellantis, Chrysler, Jeep, Dodge, Ram, or related services. 2. **Avoid clicking unknown links** in texts or emails claiming to represent Stellantis customer care. 3. **Check your credit reports** and set up fraud alerts with your bank if unusual activity occurs. 4. **Update your online passwords regularly**, using strong combinations that differ across accounts. Stellantis has promised to **tighten its cybersecurity oversight** and **enhance safeguards for customer data** across all third-party partnerships. As the company continues to expand its digital services, the challenge will be ensuring that every vendor in its global network adheres to the same rigorous standards of data protection. The Stellantis data breach, though reportedly limited in scope, is a wake-up call for the automotive sector. As customer trust hinges on secure data handling, both automakers and their partners face mounting pressure to **prioritize cybersecurity at every level of their supply chain**.

loading..   22-Sep-2025
loading..   4 min read
loading..

Airport

Cyberattack hits Collins Aerospace check-in system, crippling Heathrow, Brussels...

Europe’s busiest airports descended into disarray this weekend after a cyberattack on Collins Aerospace’s *Muse* system, a shared airline check-in and baggage platform, disrupted operations across multiple hubs. Heathrow in London, Brussels Airport, and Berlin’s Brandenburg Airport were hardest hit, forcing thousands of passengers into long queues and prompting airlines to revert to manual systems. The incident began late Friday night and cascaded into Saturday, causing *hundreds of flight delays and cancellations*. While authorities stressed that aviation safety was not compromised, the attack exposed how heavily airports rely on third-party digital infrastructure. ### What Went Wrong At the center of the disruption is Collins Aerospace’s *Multi-User System Environment (Muse)*, software that allows different airlines to share check-in desks and boarding gates. Its outage disabled electronic check-in, boarding pass scanning, and baggage drop services. RTX, Collins Aerospace’s parent company, confirmed a “cyber-related disruption” and said teams were working to restore normal operations. “The impact is limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations,” the company said in a statement. British Airways was largely unaffected thanks to a back-up system, but most other carriers using Heathrow were caught in the digital bottleneck. EasyJet and Ryanair, which do not operate from Heathrow, confirmed they were unaffected. ### Airports in Emergency Mode * **Heathrow**: Passengers reported chaotic scenes in Terminals 3 and 4, with two-hour waits at check-in and boarding passes failing to scan at gates. Extra staff were deployed, and airlines resorted to handwriting baggage tags. Despite delays, the airport insisted that “the vast majority of flights have continued to operate.” * **Brussels Airport**: Eurocontrol, Europe’s aviation safety coordinator, ordered airlines to cancel 50% of flights in and out of Brussels until Monday. The airport warned of “large impacts on the flight schedule” with widespread cancellations. * **Berlin Brandenburg**: Officials reported longer wait times as staff manually processed passengers. * **Dublin and Cork**: Minor impacts were noted, with some carriers switching to manual check-in. ### Missed Connections in Frustration For travelers, the disruption was deeply personal. * Lucy Spencer, stuck in Heathrow’s Terminal 4, described “hundreds of people queuing” while staff manually phoned in passenger details. * Monazza Aslam missed her onward connection in Doha after sitting on the tarmac for over an hour, saying: “I’ve been here since 05:00 with my elderly parents. We are hungry and tired.” * Johnny Lal, due to fly to Mumbai for his mother-in-law’s funeral, said his family missed their flight. His mobility-impaired mother was left without support: “They keep just telling us the systems are down.” While some passengers praised airlines for moving queues efficiently and prioritizing urgent flights, overall sentiment was of exhaustion and confusion. ### Official Reactions The UK’s **National Cyber Security Centre (NCSC)** is leading investigations alongside the Department for Transport and law enforcement. A spokesperson confirmed: “We are working with Collins Aerospace and affected airports to fully understand the impact.” At the European level, the **European Commission** said it was “closely monitoring” the cyberattack but noted there was no evidence it was “widespread or severe.” Transport Secretary Heidi Alexander confirmed she was receiving “regular updates” and urged passengers to follow airline advice. ### Who Is Behind It? No group has claimed responsibility, and experts caution against premature conclusions. While some politicians speculated about Kremlin-backed hackers — noting recent Russian incursions into Estonian airspace — security analysts point to the more likely culprits: **criminal ransomware gangs**. These groups, many based in Russia or Eastern Europe, have earned billions through extortion, often disrupting critical services to demand payment in cryptocurrency. Cybersecurity researchers noted similarities to ransomware attacks that hit Las Vegas casinos and major UK retailers last year. However, until Collins Aerospace discloses more technical details, theories remain speculative. Travel journalist Simon Calder summarized the stakes: “At Heathrow, any disruption is serious. Departure control is complex, and if one node fails — in Brussels, in Berlin — pilots, planes, and passengers are all out of place. Things can get a lot worse before they get better.” Until answers emerge, airlines and passengers alike are bracing for turbulence on the ground — long before take-off.

loading..   21-Sep-2025
loading..   4 min read
loading..

PyPi

PyPI invalidates stolen tokens in the GhostAction supply chain attack, urging ma...

The Python Software Foundation (PSF) has confirmed the invalidation of all PyPI publishing tokens compromised in the recent *GhostAction* supply chain attack. These tokens—used to push packages to the Python Package Index (PyPI)—were exfiltrated via malicious GitHub Actions workflows but, critically, no evidence suggests they were exploited to distribute malware. ### Anatomy of the Attack The incident began on September 5, 2025, when GitGuardian detected GitHub Actions workflows (e.g., *FastUUID*) modified to leak PyPI tokens to attacker-controlled servers. Initially, GitGuardian’s findings were delayed due to email filtering errors, but by September 10, the scale became clear. More than 570 repositories were affected, prompting coordinated notifications to GitHub, npm, and PyPI security teams. GitGuardian later revealed over **33,000 secrets stolen** across ecosystems: PyPI, npm, DockerHub, GitHub, Cloudflare, AWS, and databases. The breadth of exposure meant entire SDK portfolios of some companies—spanning Python, Rust, JavaScript, and Go—were simultaneously compromised. ### PyPI’s Response PyPI administrators invalidated all potentially exposed tokens and contacted project maintainers directly. While no PyPI accounts were abused to publish malicious packages, administrators emphasized transitioning from long-lived tokens to **short-lived Trusted Publisher tokens** for GitHub Actions workflows. Maintainers were also urged to review security histories for anomalies. > *“Attackers targeted a wide variety of repositories… While they successfully exfiltrated tokens, they do not appear to have used them on PyPI.”* — Mike Fiedler, PyPI Admin ### Wider Context of Supply Chain Risk This breach follows a string of software supply chain incidents. In August, attackers exploited GitHub workflows in the *Nx* repository (*s1ngularity attack*), compromising 2,180 accounts and 7,200 repositories. Just weeks earlier, the PSF had also warned of phishing campaigns leveraging fake PyPI sites. * **Root Vector**: Insecure GitHub Actions workflows modified to exfiltrate secrets. * **Scope**: Over 33,000 credentials compromised across multiple ecosystems. * **PyPI Mitigation**: Token invalidation, maintainer outreach, promotion of Trusted Publisher tokens. * **Industry Impact**: Reinforces systemic fragility of CI/CD pipelines and interlinked package ecosystems. The *GhostAction* campaign underscores how continuous integration misconfigurations can cascade into ecosystem-wide threats. Though PyPI narrowly avoided a mass malware injection, the cross-ecosystem theft of credentials reveals the attackers’ sophistication. The path forward demands strict adoption of ephemeral credentials, vigilant monitoring of CI workflows, and coordinated threat intelligence across open-source registries.

loading..   18-Sep-2025
loading..   2 min read