Topgeschenken Discloses Theft of Customer Data in Cyber Incident, Scope of Breach Still Unknown

Data Breach Exposes 13.3 Million US Patients After Stolen Credentials Used at Healthcare IT Provider PJ&A

A major data breach in the United States exposed the personal and medical information of 13.3 million patients due to stolen login credentials at IT service provider PJ&A. The company provided billing, medical transcription, and administrative services to healthcare organizations and held extensive patient records including test results, medication data, and treatment plans. Attackers accessed the remote desktop web application using a single employee's username and password because multifactor authentication was not required. They performed lateral movement across the network and reached unencrypted database backups and files containing protected health information. A monitoring system detected the intrusion quickly but was misconfigured and failed to send alerts to security staff despite an earlier unfulfilled request to enable notifications. The breach was only discovered two months later when the attackers contacted the company with a ransom demand. PJ&A, now bankrupt, reached a settlement requiring payment of $300,000 to multiple US states along with security improvements or an additional $9.7 million penalty.

Hacker Chimeraz Claims 259 Million Records Stolen from SGS French Vehicle Inspection Operations

French hacker Chimeraz has listed for sale a large dataset allegedly taken from SGS French subsidiaries including Auto Sécurité, Sécuritest and Vérif’Autos. The claimed dump contains 259 million lines covering 22.7 million individuals and mixes vehicle technical data with personal contact information. Advertised volumes include 90.8 million vehicle entries, 74.7 million inspections, 29.2 million service records and 40.9 million distinct license plates. The seller also offers subsets linking names, phone numbers and email addresses to specific vehicles and past services. Data samples contain entries dated between 2016 and 2025. Chimeraz has previously claimed responsibility for breaches affecting French tourism operators and political parties. The authenticity of the SGS claim remains unverified by independent sources.

Kensium Faces Unverified Claim of 18TB Data Theft Including Source Code and AWS Backups

An anonymous actor has posted a claim dated November 6, 2026, alleging the theft of more than 18 TB of data from Kensium, a Chicago-based provider of e-commerce integration and IT services. The poster states that nearly 170 GB has already been released, with additional material promised in stages. The claimed contents include source code, recent database backups, and personally identifiable information. References to AWS S3 and EC2 appear in the announcement, yet no proof of initial access, compromised credentials, or misconfigurations has been supplied. Kensium specializes in connecting e-commerce platforms with ERP, WMS, and POS systems, making any confirmed exposure potentially valuable for further attacks. Independent verification of the breach remains absent, leaving the scale and authenticity of the data unconfirmed.