#data-leak

[cyber-sec]

SafePay ransomware zeroes in on smaller organisations

Leak-site analysis shows SafePay ransomware overwhelmingly targets small and mid-sized firms, especially service providers in tightly regulated regions where data exposure raises pressure.

Source: Flare

Read more: CyberSecBrief

[nacrenecitygardening]

Afternoon on the twenty third of march, somewhere in Aspertia City

They were starting to feel itchy.

It'd been a few days since they got to Aspertia, and so far it felt- chaotic at best. There'd been alot of running around and back and forth all across the city like a trio of headless torchic, following whatever checklist Sasha had of where they could find things.

Their leg bounced restlessly against the tile floor as they were half-burying their face in their jacket. From where they were sat on a ledge by the window, they could see Sasha and Caleb talking to the poor desk attendant.

Thimble chattered at their ear, nudging their face with its little nubs. Reaching up, they grabbed it out of their hood and held it in their arms, while it kept nudging them. It could probably sense their nerves.

They could hear the cousins doing their "polite interrogation", and knew if they didn't get what they needed, they'd just take it.

Cory had helped with that a couple time now, (the "innocent lost kid with a cute sewaddle" thing worked almost better than it had in Driftveil), and it- arc why were they doing this?

And more than that, it'd been- alot. Running here and there and there and here and talking to that guy and this guy so much here there and everywhere and- okay maybe it was starting to wear on them a bit.

They dug their nails into their sleeves.

It felt like their nerves were durants crawling under their skin.

All this work, all this running around- what were they even after? (The guy, duh, obviously, but what then?)

She'd just said "We'll take care of it."

Across the room, Sasha and Caleb had left the counter, and were walking back towards the door, gesturing for them to go.

Biting their tongue, they got up and followed, one hand on their phone.

Why do you keep doing this? Just- No. They needed to know.

File: a video file from CoryPhone43bJ Recorded: 7:08pm, 23/3/2025

[ The view appears pointed mostly towards the ground, shaking from walking. The light was low, and the area appeared to be a backlot of some sort, or an alley.

Cory's shoes were visible in frame, and the audio was largely crunching footsteps on gravel and low conversation ahead of them.

It continued on like that for a minute or so, Cory walking behind the other two, until they stopped dead.

"What is-"

They seemed to almost choke on their own voice and stop, as the footsteps ceased entirely.

"Hm?"

The second voice was Sasha's.

The camera shook as Cory's hands did, and they audibly took a breath.

"I'm just- Why? Why all this? That's- That's the one thing you've never said."

The response had an air of dismissal. "We're finding Nelson, we've said this half a dozen times already."

"No but that's not a why-"

"Cory, drop it. We have to focus right now."

They took a step forward, moving Sasha and Caleb into frame, the latter had her eyes narrowed and the former stood a few feet away, beginning to look nervous.

"No. No, I won't. What is all this even for?"

Fidgeting with their hands, Caleb spoke up, ending up gesturing with an arm almost to separate the two.

"We- We're looking for answers. That- he's the only one who would know. That's- that's what this-this is for."

The view shook when Cory snapped, "We've been running around like- like crazy people! Are whatever those answers are even worth this!?"

"Yes. We've put all this work in for a reason."

Sasha retorted, starting to become visibly agitated.

"I don't think that's true! If- There would have to be an easier way than this!"

Their voice was shaking, but it appeared they tried to keep it level.

There was blur in the frame as Sasha gestured quickly, her voice sharp, and bleeding with emotion. "After what he did, anything is worth this!"

They froze for a moment, jolting back. "Wait- answers my ass, Sasha! That's taurosshit!"

She rolled her eyes, sneering.

By now, Cory was shouting. "What- What's even the plan when we do find him?! You haven't said that! And- how could you even get answers out of him?1"

The response was sharp. "We'll take care of it."

"That means nothing! That's all you've said! What are you even gonna do?! You don't wanna turn him into the cops! And- I know you wouldn't kill him."

She visibly stalled, eyes wide, for a moment, before she took a step forward, fists clenching.

"You don't know the HALF of this, Cory!" Sasha began to shout. "You think yourself SO mature, when you don't even understand the slightest bit of how important this is! But NO, YOU INSISTED ON COMING ALONG! And now you're spewing THIS!"

It wasn't anger, so much as pained desperation. Her voice broke, tears pricking at her eyes, and she gestured wildly.

Suddenly, her eyes snapped towards their hands, "Were you fucking recording this?!"

The view shook violently as she knocked the phone out of their hands and to the ground. The angle was awkward to see how it transpired, but their forms were still visible, as Sasha kept screaming.

"You should've just- kept your mouth shut! But you couldn't do something THAT FUCKING SIMPLE!"

It all went dead, and Cory was frozen, visibly curled in on themself, eyes wide with terror, having taken a step back from where Sasha was towering over them.

The only audio was their hitched, panicked breaths.

It stayed like that for several seconds, before Sasha's eyes went wide, and she jerked back.

She glanced frantically around the scene and at Cory, her expression filling with guilt, before she turned on her heel, and ran away.

"SASH! WAIT-!"

Caleb's voice rang out from offscreen, but it faded after a moment. They appeared in frame, bending down and attempting to comfort Cory, speaking in hushed apologies.

After a moment, they looked back up in the direction Sasha disappeared, eyes filled with shock and concern.

And it goes to black.

End of video. ]

[cyber-sec]

ChatGPT API Keys Exposed Across GitHub and Public Sites

Over 5,000 GitHub repos and 3,000 websites leaked ChatGPT API keys, enabling attackers to abuse AI services for inference, scams, and potential billing fraud.

Source: Cyble

Read more: CyberSecBrief

[cyber-sec]

Cloud Dashboards Leak BigQuery Data

A Google Cloud Monitoring flaw let attackers steal BigQuery data across tenants by abusing auto-running dashboard widgets.

Source: Tenable Research

Read more: CyberSecBrief

[definitelytzar]

Rockstar Games Targeted by ShinyHunters: The Danger of Cloud Data Exfiltration

The gaming industry is currently weathering a storm of high-profile security breaches, with one of the most notorious threat actors, ShinyHunters, leading a coordinated "pay or leak" extortion campaign. Among the primary targets is Rockstar Games, the titan behind the Grand Theft Auto series, which has fallen victim to a sophisticated data exfiltration attack targeting its cloud infrastructure.

The BigQuery Breach

Unlike traditional server hacks, the attack on Rockstar Games specifically targeted Google BigQuery instances. BigQuery is a serverless data warehouse used for massive-scale data analysis and business intelligence. By compromising these instances, attackers were able to bypass traditional perimeter defenses and exfiltrate structured data directly from the cloud backend.

This method of attack is particularly dangerous because it suggests a compromise of high-level service accounts or API keys, allowing the attackers to query and export vast amounts of data without triggering traditional "intrusion" alarms associated with file-system access.

The ShinyHunters Modus Operandi

The group responsible, ShinyHunters, has pivoted from simple data theft to a sophisticated "pay or leak" business model. Their strategy typically follows a specific pattern:

- Targeted Exfiltration: Using specialized tools to target cloud databases (like BigQuery) or third-party analytics platforms. - Proof of Possession: Leaking a small, high-impact sample of the data to prove the breach is real. - Extortion: Demanding significant cryptocurrency payments in exchange for the deletion of the data and a promise not to leak the rest. - Public Exposure: If the company refuses to pay, the data is sold on hacking forums or released publicly to maximize reputational damage.

Broader Context: The Gaming Security Crisis

The attack on Rockstar is not an isolated event. It is part of a wider trend where gaming companies are being targeted not just for their intellectual property (like source code), but for their massive datasets of user behavior, financial transactions, and internal corporate communications.

From the recent 155GB Forza Horizon 6 leak to the NVIDIA GFN.AM breach, the industry is seeing a convergence of three distinct threats: configuration errors in distribution (Steam preloads), regional partner vulnerabilities (GFN.AM), and direct cloud-infrastructure attacks (BigQuery).

Strategic Lessons for Cloud Infrastructure

The Rockstar incident serves as a critical lesson in cloud security management:

- Principle of Least Privilege (PoLP): Service accounts used for BigQuery should have the absolute minimum permissions required. "Administrative" keys should never be stored in environments where they can be easily leaked. - Monitoring and Alerting: Organizations must implement anomaly detection for data export. A sudden, massive export of data from a BigQuery instance should trigger an immediate high-severity alert. - API Key Rotation: Frequent rotation of cloud API keys and the use of short-lived credentials (like IAM roles) significantly reduces the window of opportunity for attackers. - Cloud Posture Management: Regular audits of cloud permissions and public access settings are mandatory in an era of "shadow" cloud instances.

Reflection

When a company as large as Rockstar Games is hit, it's a reminder that no amount of budget guarantees absolute security. The shift toward "data-centric" attacks—where the target isn't the server, but the database—means that security must move beyond the firewall and directly into the data layer.

The "pay or leak" model is an evolving form of digital kidnapping. As these groups become more professional and their tools more specialized, the gaming industry must move toward a "Zero Trust" architecture, where no user, service, or partner is trusted by default, regardless of their location in the network.

[cyber-sec]

Google Cloud Logging Leak Exposes BigQuery Data Across Tenants

A flaw in Google Cloud Logging allowed crafted Log Analytics URLs to exfiltrate cross-tenant BigQuery data, executing SQL queries with victim permissions until Google enforced manual execution and safety warnings.

Source: Tenable

Read more: CyberSecBrief

[cyber-sec]

MongoDB Flaw Actively Leaked Sensitive Data in Federal Systems

A serious MongoDB vulnerability has been exploited to siphon credentials and internal data, forcing US federal agencies to confront widespread exposure across internet-facing databases.

Source: BleepingComputer

Read more: CyberSecBrief

[cyber-sec]

Researchers uncover major ChatGPT flaws risking user data exposure

Security experts revealed seven ChatGPT vulnerabilities that let attackers steal private user data and manipulate AI responses through hidden prompt injections and memory hacks.

Source: Tenable

Read more: CyberSecBrief