shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

263
active users

#incident

4 posts4 participants0 posts today

PeopleCheck reports data breach caused by ransomware attack

PeopleCheck, an Australian background screening provider, suffered a data breach via compromised login credentials that was claimed by the Everest ransomware group. The hackers claim to have stolen 4.3 GB of SQL data including client profiles, payment details, and sensitive personal information of individuals processed between June 2024-June 2025. PeopleCheck is offering 24 months of complimentary identity monitoring services.

****
#cybersecurity #infosec #incident #ransomware
beyondmachines.net/event_detai

BeyondMachinesPeopleCheck reports data breach caused by ransomware attackPeopleCheck, an Australian background screening provider, suffered a data breach via compromised login credentials that was claimed by the Everest ransomware group. The hackers claim to have stolen 4.3 GB of SQL data including client profiles, payment details, and sensitive personal information of individuals processed between June 2024-June 2025. PeopleCheck is offering 24 months of complimentary identity monitoring services.

DOGE Employee exposes AI API Keys in source code, giving access to advanced xAI models

A Department of Government Efficiency (DOGE) employee exposed a private xAI API key on GitHub, providing unauthorized access to over 52 large language models. This is very concerning given the employee's extensive access to sensitive systems across multiple government agencies in the USA. This marks the second such xAI key exposure by DOGE personnel in recent months, indicating a pattern of operational security failures that indicate a broken security culture within the organization.

**Build a culture of not saving API keys, passwords, or any secrets directly into your code. Use environment variables or proper secret management tools instead. If leaking API key becomes a practice, consider stronger discipline and awareness measures, paired with technical scanners to detect secrets in code.**
#cybersecurity #infosec #incident #dataleak
beyondmachines.net/event_detai

BeyondMachinesDOGE Employee exposes AI API Keys in source code, giving access to advanced xAI modelsA Department of Government Efficiency (DOGE) employee exposed a private xAI API key on GitHub, providing unauthorized access to over 52 large language models. This is very concerning given the employee's extensive access to sensitive systems across multiple government agencies in the USA. This marks the second such xAI key exposure by DOGE personnel in recent months, indicating a pattern of operational security failures that indicate a broken security culture within the organization.

McDonald's AI hiring platform found to be vulnerable, risking 64 million job applications

Security researchers discovered vulnerabilities in McDonald's McHire hiring platform developed by Paradox.ai, including an insecure direct object reference (IDOR) flaw and trivial default credentials ("123456:123456") that potentially exposed personal data of up to 64 million job applicants across McDonald's franchises.

**Make sure to authenticate and authorize every single request to your APIs. And don't use integer auto-incrementing IDs for users, too easy to guess. Naturally, NEVER use trivial credentials for test systems.**
#cybersecurity #infosec #incident #databreach
beyondmachines.net/event_detai

BeyondMachinesMcDonald's AI hiring platform found to be vulnerable, risking 64 million job applicationsSecurity researchers discovered vulnerabilities in McDonald's McHire hiring platform developed by Paradox.ai, including an insecure direct object reference (IDOR) flaw and trivial default credentials ("123456:123456") that potentially exposed personal data of up to 64 million job applicants across McDonald's franchises.

WorldLeaks claims data breach of Myrtue Medical Center

Myrtue Medical Center, a hospital serving Iowa communities, discovered a data breach on June 13, 2025. The WorldLeaks ransomware group claimed responsibility on June 24, 2025, alleging theft of approximately 1.2 terabytes of data. The hospital has not confirmed the accuracy of these claims or disclosed the specific types of exposed data or number of affected individuals.

****
#cybersecurity #infosec #incident #databreach
beyondmachines.net/event_detai

BeyondMachinesWorldLeaks claims data breach of Myrtue Medical CenterMyrtue Medical Center, a hospital serving Iowa communities, discovered a data breach on June 13, 2025. The WorldLeaks ransomware group claimed responsibility on June 24, 2025, alleging theft of approximately 1.2 terabytes of data. The hospital has not confirmed the accuracy of these claims or disclosed the specific types of exposed data or number of affected individuals.

Paraguay hit by catastrophic data breach as hacktivists leak personal data of entire population

Paraguay suffered one of the most devastating national data breaches in history when hackers leaked personal information of approximately 7.4 million citizens (essentially the entire population) on June 13, 2025, after the government refused to pay a $7.4 million ransom demand from "Brigada Cyber PMC." The attack began with Redline infostealer malware compromising government employee credentials at the Ministry of Public Health and Social Welfare, enabling hackers to slowly exfiltrate data.

**Infostealers are extremely dangerous. Especially on government system accounts.**
#cybersecurity #infosec #incident #databreach
beyondmachines.net/event_detai

BeyondMachinesParaguay hit by catastrophic data breach as hacktivists leak personal data of entire populationParaguay suffered one of the most devastating national data breaches in history when hackers leaked personal information of approximately 7.4 million citizens (essentially the entire population) on June 13, 2025, after the government refused to pay a $7.4 million ransom demand from "Brigada Cyber PMC." The attack began with Redline infostealer malware compromising government employee credentials at the Ministry of Public Health and Social Welfare, enabling hackers to slowly exfiltrate data.

Truesec has published a most excellent case-study of a recent incident. Personally I think this sets the bar for how these stories should be told. Technical writing but with a clear storyline and interesting series of events.

In addition to providing great details about hardening infrastructure, detection logic etc.

The Ransomware That Was Not.

truesec.com/hub/blog/the-ranso

Truesec · The Ransomware That Was Not - TruesecTruesec intervened before ransomware struck, uncovering how attackers abused certificate templates and stopped a full-blown cyber crisis in its tracks.