identity theft6 articles
Advantest Took Months to Tell People Their Data Was Stolen in a Ransomware Attack
Japanese chip testing company Advantest has disclosed that a ransomware attack, first reported in February 2026, resulted in the theft of sensitive personal information including names, SSNs, passport numbers, and medical and financial data. The company is now notifying affected individuals, warning of potential risks of identity theft or fraud, though it states there is no evidence the stolen data has been publicly disclosed or misused. The total number of individuals impacted has not been revealed, though filings with state attorneys general confirm affected residents across California, Massachusetts, and Vermont.
Denmark's Entire Population Registry Scraped Through a Single Company Account
Unauthorized parties accessed names, addresses, and personal identification numbers (CPR numbers) of approximately 8.8 million people — around four in five of all records — in Denmark's national population register over roughly ten days in September 2025, exploiting a small private company's legitimate access to the system. An employee of the register's administration noticed the unusual automated lookups on 2 October, prompting authorities to revoke the company's access and refer the case to Denmark's data protection authority, Datatilsynet, while police launched an investigation. It remains unclear how the attackers gained access to the company's systems, whether they have retained or used the data, and whether affected individuals will be notified or issued new CPR numbers.
Apollo Global Got Social Engineered. SSNs Walked Out the Door.
Apollo Global Management suffered a data breach between July 6–10 after attackers used social engineering tactics to gain unauthorized access to its cloud systems, stealing sensitive personal information including names, Social Security numbers, dates of birth, and home addresses. The breach is consistent with a broader campaign targeting private equity and financial firms, with Google previously warning that an extortion-focused group called UNC6671 was posing as IT staff to harvest employee credentials. Apollo has notified law enforcement, engaged cybersecurity experts, and is offering affected individuals 24 months of credit monitoring, though key details — such as the number of people affected and which cloud platforms were compromised — remain undisclosed.
Heights Finance Breach Exposes Data of 1.2 Million Borrowers
Consumer lender Heights Finance Holdings suffered a data breach in early May when hackers accessed a third-party cloud-based storage platform, compromising the personal and financial information of over 1.2 million individuals. Stolen data includes names, Social Security numbers, bank account details, and other sensitive information belonging to current and former borrowers. Heights has secured the platform, notified federal law enforcement, and is offering affected individuals 24 months of free credit monitoring and identity protection services.
Belgian eID Software Had Holes Big Enough to Sign Away Your Life
Security researcher James Arnott discovered critical vulnerabilities in Belgium's Connective eID software, used by over two million people across major banks and government agencies, which failed to verify which websites could communicate with the application. The flaws allowed malicious websites to silently read card details, trick users into revealing their PINs via spoofed prompts, forge legally binding electronic signatures, and even execute remote code on victims' machines without any special permissions. Nitro Software Belgium fully patched the vulnerabilities 146 days after the initial report and awarded a $200 bug bounty, with no CVEs assigned.
EY Breach Exposes Client Tax Data Including SSNs and Card Numbers
Ernst & Young (EY) has begun notifying clients of a data breach involving a third-party service management platform used for tax-related work, with hackers gaining access between March 28 and April 12 after the incident was discovered on April 23. The compromised data includes sensitive personal and financial information such as names, addresses, Social Security numbers, and credit/debit card numbers. EY states it is unaware of any misuse of the data and is offering affected clients two years of free credit monitoring and identity protection services.