Revolve Confirms Data Breach Impacting 1.5 Million Customers After September Intrusion

Binance Denies Alleged Data Breach Claims Involving 335 Million User Records by ShinyHunters Impersonator

Binance has rejected claims of a fresh security breach made by a threat actor using the ShinyHunters handle on an underground cybercrime forum. The actor offered for sale what they described as records belonging to 335 million Binance users, including KYC documents, account passwords, crypto wallet private keys, transaction history, emails, and phone numbers, demanding $900,000. A Binance spokesperson stated that the company found no evidence of compromised systems, customer KYC data, credentials, or private keys, suggesting the listing likely stems from infostealer malware collected from users' devices rather than a direct breach. Binance highlighted inconsistencies in the claims, noting it does not store user passwords in plaintext, does not hold private keys for external wallets, and no longer operates in some referenced jurisdictions. Forum users also expressed skepticism about the legitimacy of the data. The denial follows a confirmed incident last week in which North Korean hackers from the TraderTraitor group, also known as Lazarus Group, compromised an employee and stole approximately $6.34 billion in cryptocurrency.

Topgeschenken Discloses Theft of Customer Data in Cyber Incident, Scope of Breach Still Unknown

Dutch company Topgeschenken, operator of Toptaarten.nl, Topbloemen.nl and Topgeschenken.nl, has confirmed a cyber incident in which attackers gained access to systems containing personal data and stole customer records. The compromised information includes names, addresses, email addresses, dates of birth, gender and, where provided, telephone numbers of both customers and intended recipients. The breach was discovered on 5 November 2026, after which several systems were taken offline as a precaution. Topgeschenken has notified the Dutch Data Protection Authority and stated it will file a police report, while promising to inform affected individuals once the full scope is determined. Customer service has resumed operations via email and WhatsApp, but the investigation into the exact number of affected persons and organizations remains ongoing.

Data Breach Exposes 13.3 Million US Patients After Stolen Credentials Used at Healthcare IT Provider PJ&A

A major data breach in the United States exposed the personal and medical information of 13.3 million patients due to stolen login credentials at IT service provider PJ&A. The company provided billing, medical transcription, and administrative services to healthcare organizations and held extensive patient records including test results, medication data, and treatment plans. Attackers accessed the remote desktop web application using a single employee's username and password because multifactor authentication was not required. They performed lateral movement across the network and reached unencrypted database backups and files containing protected health information. A monitoring system detected the intrusion quickly but was misconfigured and failed to send alerts to security staff despite an earlier unfulfilled request to enable notifications. The breach was only discovered two months later when the attackers contacted the company with a ransom demand. PJ&A, now bankrupt, reached a settlement requiring payment of $300,000 to multiple US states along with security improvements or an additional $9.7 million penalty.