THREAT FEED

Comcast Xfinity confirmed unauthorized access to customer accounts affecting approximately 35 million users. Exposed data includes usernames, hashed passwords, security questions, and partial Social Security numbers. The breach was traced to a vulnerability in the Citrix Bleed exploit (CVE-2025-4921).

Data breach at Chicago Public Schools exposed records of 500,000+ students and staff. Compromised data includes names, emails, student IDs, and Google Workspace credentials used for remote learning platforms.

Unsecured Verizon API endpoint exposed customer records including names, addresses, phone numbers, and account PINs for approximately 7.5 million customers in the NYC metro area. The endpoint was publicly accessible for an estimated 3 weeks before being secured.

Coordinated SIM swap attacks targeting PayPal users with Verizon phone numbers. Attackers port victim phone numbers to new SIMs, intercept 2FA codes, and drain PayPal balances. Over $2.3 million stolen in February alone.

Automated scanning reveals thousands of valid AWS access keys committed to public GitHub repositories. Exposed keys are being used within minutes for cryptocurrency mining and data exfiltration. Developers using Amazon services are urged to rotate all access keys immediately.