MeridianMeridian

Kensium Faces Unverified Claim of 18TB Data Theft Including Source Code and AWS Backups

An anonymous actor has posted a claim dated November 6, 2026, alleging the theft of more than 18 TB of data from Kensium, a Chicago-based provider of e-commerce integration and IT services. The poster states that nearly 170 GB has already been released, with additional material promised in stages. The claimed contents include source code, recent database backups, and personally identifiable information. References to AWS S3 and EC2 appear in the announcement, yet no proof of initial access, compromised credentials, or misconfigurations has been supplied. Kensium specializes in connecting e-commerce platforms with ERP, WMS, and POS systems, making any confirmed exposure potentially valuable for further attacks. Independent verification of the breach remains absent, leaving the scale and authenticity of the data unconfirmed.

ZATAZTranslated from French

Read at source

An anonymous individual has published a claim asserting the theft of more than 18 TB of data from Kensium, a Chicago-based American provider of IT services and e-commerce integration solutions.

The announcement, dated November 6, 2026, states that nearly 170 GB of material has already been released, with further portions to follow. The claimed archive reportedly contains source code, recent database backups, and information that could identify individuals.

Kensium is described as specializing in e-commerce platforms linked to enterprise resource planning, warehouse management, and point-of-sale systems, commonly referred to as ERP, WMS, and POS.

Limited Evidence and Technical References

The post mentions environments running on AWS S3 and AWS EC2, yet provides no details on the initial access vector, compromised accounts, or configuration weaknesses. No independent confirmation of the exfiltration has been obtained.

If the described archives prove authentic, the source code could aid analysis of application internals, while backups might contain operational data, credentials, or secrets that increase the risk of subsequent attacks.

The distinction between the total claimed volume and the smaller portion already shared remains important for assessing immediate impact.

AWS S3KensiumAWS EC2
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Breaches & Leaks

Hacker Chimeraz Claims 259 Million Records Stolen from SGS French Vehicle Inspection Operations
Breaches & Leaks

Hacker Chimeraz Claims 259 Million Records Stolen from SGS French Vehicle Inspection Operations

French hacker Chimeraz has listed for sale a large dataset allegedly taken from SGS French subsidiaries including Auto Sécurité, Sécuritest and Vérif’Autos. The claimed dump contains 259 million lines covering 22.7 million individuals and mixes vehicle technical data with personal contact information. Advertised volumes include 90.8 million vehicle entries, 74.7 million inspections, 29.2 million service records and 40.9 million distinct license plates. The seller also offers subsets linking names, phone numbers and email addresses to specific vehicles and past services. Data samples contain entries dated between 2016 and 2025. Chimeraz has previously claimed responsibility for breaches affecting French tourism operators and political parties. The authenticity of the SGS claim remains unverified by independent sources.

ZATAZNov 9, 2026Translated from French

Ceres Discloses Data Breach at Point Income and CoinTrade Exposing Customer Records
Breaches & Leaks

Ceres Discloses Data Breach at Point Income and CoinTrade Exposing Customer Records

Japanese company Ceres has confirmed two separate incidents of personal data exposure affecting its Point Income loyalty platform and its subsidiary Mercury's CoinTrade cryptocurrency service. In the first case, unauthorized access to a development environment allowed third parties to view backup customer data including nicknames, email addresses, encrypted passwords, and birth dates for approximately 11,100 users. A smaller set of device identifiers was also exposed. The second incident occurred through a third-party email service provider Arara, whose repica platform leaked 88,289 email addresses belonging to CoinTrade customers. Ceres and Mercury have notified affected users, blocked further access, and suspended email campaigns while investigating the root causes with their vendors.

ScanNetSecurityNov 8, 2026Translated from Japanese

Japan's Fire and Disaster Management Agency Suspends Anzen Joho System After Unauthorized Access Detected by Fujisoft
Breaches & Leaks

Japan's Fire and Disaster Management Agency Suspends Anzen Joho System After Unauthorized Access Detected by Fujisoft

On November 5, Japan's Fire and Disaster Management Agency announced unauthorized access to its 武力攻撃事態等における安否情報収集・提供システム, also known as the Anzen Joho System. The incident was reported by the system's operations and maintenance contractor, Fujisoft, which detected third-party unauthorized access. No personal information leakage has been confirmed at this stage. The agency has suspended the service and blocked external access while Fujisoft investigates the scope of the compromise. The Fire and Disaster Management Agency has directed Fujisoft to complete a rapid root-cause analysis and implement measures to prevent recurrence. The system supports safety information collection and dissemination during armed attack situations and other emergencies.

ScanNetSecurityNov 8, 2026Translated from Japanese