In today’s cybersecurity news…
16TB MongoDB database exposes nearly 4.3 billion professional records
The data, discovered by researchers at nexos.ai, was discovered on November 23, and secured two days later. Consisting of mainly LinkedIn-style data, the researchers suggest it would be useful in enabling large-scale AI-driven social-engineering attacks. Although it is difficult to determine the age of the LinkedIn data, many records were collected or updated in 2025, but some may have been scraped from LinkedIn leaks that occurred in 2021.
Apple posts updates after discovery of WebKit flaws
The two security updates are for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and the Safari web browser and the two security flaws, both with CVE numbers and one of which was patched by Google in Chrome last week, “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.” Teams at Apple and Google have deduced that the vulnerabilities were “likely weaponized in highly targeted mercenary spyware attacks, given that they both affect WebKit.”
Coupang data breach traced to ex-employee
Following up on a story we have been covering all this month, the Seoul Metropolitan Police Agency now says the data breach at South Korean retailer Coupang that exposed the information of 33.7 million customers has been attributed to a former employee who retained access to internal systems after leaving the company. Last Wednesday, as we reported, the company’s CEO, Park Dae-Jun, announced his resignation and apologized to the public for failing to stop what is the country’s worst cybersecurity breach in history. The suspect is a 43-year-old Chinese national who “joined Coupang in November 2022, was assigned to an authentication management system and left the firm in 2024. He is believed to have already left the country.”
MITRE shares 2025’s top 25 most dangerous software weaknesses
Released in collaboration with the Homeland Security Systems Engineering and Development Institute and CISA, the list contains 25 of the most dangerous software weaknesses behind more than 39,000 security vulnerabilities disclosed between June 2024 and June 2025. Topping the list is cross-site scripting, followed by SQL injection, cross-site request forgery, missing authorization, and out-of-bounds Write, with new entries this year being variations on buffer overflows.
Huge thanks to our sponsor, Adaptive Security
Germany summons Russia’s ambassador over alleged air traffic control cyberattacks
This action was taken after a formal accusation against Moscow of the cyberattacks against Germany’s air traffic control authority in August, along with a disinformation campaign ahead of February’s election. The German government stated it has clear evidence linking the air traffic control attack to the Russia-nexus group APT28, also known as Fancy Bear. A Russia-based disinformation campaign tracked as Storm 1516 was also accused of the election interference attack. This group has also been active in other divisive campaigns in Europe as well as in the U.S.
Hamas-affiliated APT targeting Middle East and Morocco
A group allegedly affiliated with the Palestinian organization Hamas is accused of “using malware-laden documents to breach government and diplomatic entities tied to Oman, Morocco, and the Palestinian Authority. This is according to Palo Alto Networks’ Unit 42, which issued a report on Thursday about a group called Ashen Lepus. The group is allegedly using a new strain of information stealing malware called AshTag.
Canada’s privacy regulator to probe face-scanning billboards
The probe focuses on billboards located near Toronto’s largest train and subway station, Union Station, which allegedly analyze the age and gender of passersby. Owned by the movie and media company Cineplex Digital Media (CDM), they “use cameras, large databases and in some cases artificial intelligence to survey people in public.” CDM has reportedly said that no personal data or images are kept and that the billboards process data within milliseconds.
U.S. sues ex-Accenture manager over Army cloud platform
The U.S. is suing a former senior manager at Accenture for “allegedly misleading the government about the security of an Army cloud platform.” In a court action, The United States of America vs. Danielle Hillmer, the U.S. alleges that between March 2020 and November 2021, Hillmer obstructed federal auditors and falsely represented the security of the company’s cloud platform, which was used by other government customers beyond the Army. The defendant, Hillmer claimed to work for Big Four consulting firm Accenture during the stated timeline, according to a now-deleted LinkedIn account. “The platform in question is described as Nonappropriated Fund Integrated Financial Management System (NIFMS), a cloud-based payroll, pension, and benefits system.” According to the indictment, Hillmer “made efforts to represent the NIFMS platform as having enabled security controls that met the FedRAMP High baseline, and the Department of Defense’s (DoD) Impact Levels 4 and 5,” which are now being described as falsehoods.”