The Largest Data Breach Ever? How Hackers Stole 16 Billion Credentials

HackenProof revisits the 2018 open-Elasticsearch breach of 57 million US records—and eight years of larger misconfiguration leaks since, a pattern that keeps growing rather than going away.

Five takeaways from the Jones Day/Accellion breach, where a 20-year-old end-of-life FTA file-transfer product was the entry point, illustrating how hard third-party risk management is.

Trojanized proof-of-concept exploits turn the vulnerability-research workflow itself into an attack surface. Researchers should isolate, inspect and verify exploit code before execution.

HackerOne now blocks passwords known to be compromised in major breaches for new accounts and resets, integrating with Have I Been Pwned's database of nearly 850 million compromised passwords.

233 versions across three Laravel-Lang repositories were compromised via malicious tags pointing to attacker fork commits, loading a PHP credential stealer through Composer's autoloader.

The Vercel breach began with a browser extension: an infostealer on a Context.ai employee's machine exposed OAuth tokens. Aikido says treat extensions as supply chain attack vectors.