SEGA Newsletter Data Breach Exposes 2.2 Million Email Addresses via Third-Party Provider ARARA

York University Breach Exposes Personal Information Submitted Since 2007

York University in Toronto has confirmed a cybersecurity incident where an unauthorized actor accessed personal information from online forms on 14 university websites. The breach, discovered on October 25, affected data submitted between 2007 and 2026. Exposed information includes email addresses, phone numbers, dates of birth, York identification numbers, government ID information, health information, academic history, and more. The university has secured the forms and will notify affected individuals whose sensitive data like government IDs or financial information was exposed, offering two years of credit monitoring. No details on the number of victims or perpetrators have been released, and no ransomware groups have claimed responsibility. This incident highlights risks of phishing and social engineering due to the combination of contact and sensitive data.

Binance Denies Alleged Data Breach Claims Involving 335 Million User Records by ShinyHunters Impersonator

Binance has rejected claims of a fresh security breach made by a threat actor using the ShinyHunters handle on an underground cybercrime forum. The actor offered for sale what they described as records belonging to 335 million Binance users, including KYC documents, account passwords, crypto wallet private keys, transaction history, emails, and phone numbers, demanding $900,000. A Binance spokesperson stated that the company found no evidence of compromised systems, customer KYC data, credentials, or private keys, suggesting the listing likely stems from infostealer malware collected from users' devices rather than a direct breach. Binance highlighted inconsistencies in the claims, noting it does not store user passwords in plaintext, does not hold private keys for external wallets, and no longer operates in some referenced jurisdictions. Forum users also expressed skepticism about the legitimacy of the data. The denial follows a confirmed incident last week in which North Korean hackers from the TraderTraitor group, also known as Lazarus Group, compromised an employee and stole approximately $6.34 billion in cryptocurrency.

Revolve Confirms Data Breach Impacting 1.5 Million Customers After September Intrusion

Online fashion retailer Revolve has updated the Indiana Attorney General’s Office with a final victim count of 1,515,073 individuals affected by the data breach first disclosed in October. The company initially reported the incident to the US Securities and Exchange Commission on October 29 and began notifying customers around the same period. Earlier regulatory filings in five states had only accounted for roughly 197,000 impacted people combined. Attackers gained access to Revolve systems, including its e-commerce platform, on September 11 and were detected on September 29. The exposed data includes names, contact details, mailing addresses, and stored payment card numbers with expiration dates for customers who saved payment methods in their accounts. Revolve notified federal law enforcement and engaged external cybersecurity experts, though the initial access method remains undisclosed and no group has claimed responsibility.