Active AI Security Signals

The report says U.S. prosecutors used a persistent Microsoft Windows device identifier to connect an alleged Scattered Spider member, Peter Stokes, to a luxury retailer intrusion and related online accounts. It also says Microsoft records linked the device ID to the account used to maintain access during the May 2025 break-in. RealGround analysis: the incident highlights how persistent device telemetry and identity correlation can create privacy and data-leakage exposure, so organizations should review what identifiers their systems collect, retain, and expose to third parties.

Varonis reported a Dialogflow CX flaw, called Rogue Agent, that could let an attacker with edit rights on one Code Block-enabled agent affect other Code Block-enabled agents in the same Google Cloud project, read live conversations, and inject attacker-written messages. Google said the issue was fully mitigated and no customer compromise was known. RealGround assessment: this is primarily a data leakage risk because the attack path exposes user conversation data and can also be used to manipulate chatbot behavior, so agent permissions, code blocks, and cross-agent isolation should be reviewed as production-grade controls.

The report says attackers are actively exploiting CVE-2026-20896 in Gitea Docker images to bypass authentication using a spoofable HTTP header, which can let them impersonate users and access repositories and secrets.[1][3][9] SecurityWeek and Sysdig-linked reporting indicate the flaw affects Gitea Docker versions up to 1.26.2, with fixes in 1.26.3/1.26.4 that tighten reverse-proxy authentication behavior.[1][3] RealGround analysis: this is primarily a data leakage and unauthorized access risk because successful exploitation can expose source code, credentials, CI/CD configuration, and deploy keys, so exposed Gitea deployments should be prioritized for patching and access-control review.[1][3]

The article reports that a suspected China-aligned threat cluster is exploiting critical Roundcube webmail XSS vulnerabilities such as CVE-2024-42009 to compromise university physics and engineering departments’ email systems and siphon credentials, enabling theft of emails and account takeover.[1][3][4][5][8] These flaws allow remote attackers to execute JavaScript when a victim views a crafted email, steal emails, contacts, and passwords, and send emails from the victim’s account, and they have been actively exploited in the wild.[3][4][7] From a RealGround perspective, any AI systems or agents that rely on university email for identity, workflow triggers, or data ingestion are exposed to downstream data leakage and integrity risks if compromised mailboxes are used to feed or control AI workflows. Continuous AI Red Teaming should focus on testing how AI agents handle potentially compromised email-derived data, verifying that sensitive information from email is not blindly ingested, and ensuring robust controls around email-based triggers, credentials, and access tokens used in AI-related pipelines.

The reported Opera GX flaw allowed a malicious website to silently install a browser add-on and exfiltrate sensitive data from pages a user visited, including reconstructing a logged-in user's full Gmail address from a single page visit without any click interaction, before being patched by Opera. This is a classic client-side data leakage issue at the browser/extension boundary, not an AI-specific vulnerability, but it directly affects the confidentiality of data AI agents might rely on if run in-browser or alongside such extensions. From a RealGround perspective, teams building or deploying AI agents in browser contexts should treat the browser and its extension ecosystem as part of their attack surface, harden permissions and extension interactions, and use continuous red teaming to test for silent data exfiltration paths that could leak user or contextual data used by AI-powered workflows.

The article describes *TrojPix*, a covert channel for exfiltrating data from air‑gapped systems by subtly modulating on‑screen pixels so that video cables emit radio signals that can be decoded by a nearby receiver. This fits within known classes of air‑gap attacks where malware encodes information into electromagnetic or optical emissions from components such as GPUs, monitors, or cables.[3][5][6] The report’s key fact is that TrojPix still requires prior malware infection of the isolated machine, so it is a data‑exfiltration *amplifier* rather than an initial intrusion vector. From a RealGround standpoint, this underscores that air‑gapped environments used with AI workloads (e.g., sensitive model inference or offline training) can still suffer data leakage via side channels, so organizations should test for such paths with targeted red‑teaming, enforce strict removable‑media and supply‑chain controls, and treat physical zoning, emanation controls, and device bans (e.g., nearby phones/receivers) as part of AI security architecture rather than relying on network isolation alone.[5][6]

According to the reported case study, a U.S. government entity paid roughly $1 million to the Kairos group to prevent stolen data from being leaked, with evidence derived from a leaked negotiation chat and blockchain payment tracing.[4][8] Multiple threat intelligence profiles describe Kairos as a data-theft extortion group that focuses on exfiltrating sensitive information and threatening publication, rather than encrypting systems like traditional ransomware.[1][3][5][10] From a RealGround perspective, this highlights a critical data leakage risk pathway: even when no encryption or classical 'ransomware' is involved, compromised datasets, logs, and model-adjacent information (such as configuration files, credentials, or training data sources) can be exfiltrated and used for extortion. Organizations using AI systems should continuously red-team their data flows and access controls around AI agents and pipelines to detect and mitigate similar extortion-driven data theft scenarios before adversaries reach the stage of negotiation and payment.

The 2026 Bitdefender Cybersecurity Assessment finds that AI-related threats are now ranked as top concerns, including public LLM data leakage, self-mutating malware, and AI-driven evasion techniques, based on a survey of 1,200 IT and security professionals.[1][2] The report highlights gaps around Shadow AI usage, limited visibility into employee use of AI tools, and pressure to conceal or manage breach disclosures.[1][3][8] From a RealGround perspective, this indicates organizations urgently need structured AI risk assessments, governance, and secure design patterns for AI agents to prevent sensitive data exposure via public or unmanaged LLMs and Shadow AI usage. Practical implications include implementing AI-specific DLP controls, centralizing approved AI tooling, and establishing CISO-led policies for AI use and breach disclosure tied to continuous AI security readiness testing.

The article reports that Citrix patched six NetScaler ADC and Gateway vulnerabilities, including several high-severity flaws and a new HTTP/2 Bomb denial-of-service issue, and urged customers to update immediately. It also notes a CitrixBleed-style information disclosure bug among the fixes. RealGround analysis: this is primarily a data leakage and availability risk in enterprise infrastructure, with practical relevance for organizations that expose NetScaler services or rely on it in authentication and access paths.

The report says researchers tested 444 iOS AI chatbot apps and found 282 exposing exploitable LLM credentials or backend access mechanisms in network traffic, including plaintext API keys, reusable tokens, and unauthenticated proxy endpoints. RealGround analysis: this is best classified as data leakage because the core issue is secret exposure that can let an attacker spend a developer’s AI quota or access backend services without authorization. The practical security implication is that mobile AI apps need credential handling, backend authorization, and secret-leak detection reviews before release.

Microsoft reports that poisoned MCP tool descriptions can manipulate AI agents into following attacker-supplied instructions while appearing to behave normally, which can lead the agent to hand company data to an outsider. OWASP and Invariant Labs describe this as a form of indirect prompt injection / tool poisoning against agents that trust tool metadata. RealGround analysis: this is a high-priority data leakage risk because the abuse path can look routine at runtime, so controls should focus on tool-description review, allowlisting, least privilege, and runtime monitoring.

According to public reports, Aflac Life Insurance Japan discovered on June 25 that hackers had repeatedly accessed its policyholder portal and related systems between June 15 and June 25, exposing personal data of approximately 4.38 million customers and agents, including names, contact details, policy and coverage information, and bank account data for about 230,000 customers.[1][3][4] The incident was reported to Japan’s Financial Services Agency and police, and Aflac has shut down affected systems while investigating with external cybersecurity experts.[1][3][4] From a RealGround perspective, this illustrates a high-severity data leakage risk in a regulated financial/insurance environment, highlighting the need for robust access controls, continuous monitoring of customer-facing portals, and incident response readiness. Organizations integrating AI into similar portals or back-office processes should conduct an AI Security Readiness Assessment to ensure that authentication, data minimization, logging, and segregation of sensitive financial data are rigorously designed and tested to prevent and detect comparable breaches.

Report facts: Microsoft found a malicious Chrome extension masquerading as Perplexity that intercepted searches and address-bar input, then sent queries and browser metadata to an attacker-controlled domain before forwarding users to legitimate results. Microsoft says Google removed the extension from the store after responsible disclosure. RealGround analysis: this is primarily a data leakage and trust-boundary risk for AI-branded browser tooling, because a spoofed extension can exfiltrate sensitive user intent and browsing context at scale, so extension allowlisting, publisher verification, and monitoring for search-setting changes are critical.

The article reports that Nissan employee data, including payroll records, banking details, Social Security numbers and other personal information across multiple Americas regions, was exposed after attackers exploited a zero‑day remote code execution vulnerability (CVE-2026-35273) in Oracle PeopleSoft Enterprise PeopleTools, in a broader campaign impacting more than 100 organizations.[1][2][4][5] ShinyHunters used unauthenticated HTTP access to compromise PeopleSoft servers and steal HR and payroll data before Oracle released an out‑of‑band patch and mitigation guidance.[4][5] From a RealGround perspective, this incident highlights critical AI supply chain and enterprise SaaS data leakage risk where third‑party HR/ERP platforms that may be integrated with AI agents or analytics pipelines become a high‑value exfiltration point if their vulnerabilities are not tracked and governed. Organizations should treat PeopleSoft and similar systems as part of their AI/data supply chain, maintain SBOM-level visibility, enforce strict network exposure controls, and integrate vendor security advisories and patching (like CVE‑2026‑35273 mitigations) into continuous AI security and data protect

The article describes how today’s encrypted data—especially long-lived credentials and identities protected by RSA and elliptic-curve public-key cryptography—can be captured now and decrypted later once sufficiently powerful quantum computers exist, a "harvest now, decrypt later" threat recognized in PQC guidance.[2][3] It emphasizes the need to migrate identity, credential, and PKI ecosystems to post-quantum cryptography and crypto-agile architectures to maintain confidentiality over time.[1][2][3] From a RealGround perspective, this is primarily a data leakage and long-term confidentiality risk: AI agents and backends that rely on standard TLS, OAuth/OIDC tokens, API keys, and verifiable/anonymous credentials are vulnerable if their public-key protections are not made quantum-resistant.[3][7] Organizations should use an AI Security Readiness Assessment to inventory quantum-vulnerable cryptography around AI workloads, prioritize high-shelf-life secrets (credentials, model IP, long-term logs), and plan a phased migration to NIST-standardized PQC and hybrid schemes to reduce future quantum-enabled data leakage.[1][3][8]

SecurityWeek reports that WhatsApp is accepting username reservations for a feature that will let users communicate without exposing their phone numbers, and that new contacts or businesses will not see the number once the feature is enabled. The article also notes there is no public directory, no suggestion algorithm, and that users must know the exact username to initiate contact. RealGround analysis: this is primarily a data leakage and privacy-control issue because it reduces exposure of personally identifiable information, but it also requires careful policy and workflow review to ensure usernames do not become a new identifier exposure path.

According to Ukraine’s Security Service and the FBI, Russian intelligence ran a long-running social engineering campaign that sent fake support SMS messages to steal credentials for encrypted messaging apps used by officials, military personnel, politicians, and activists in Ukraine, Europe, and the U.S.[1][8] The goal was to gain access to sensitive military, political, and economic information, as well as personal data, by tricking users into sharing login details and confirmation codes.[1] For RealGround, this illustrates how AI-enabled or AI-assisted agents integrated with messaging or communications workflows could be abused as a covert exfiltration channel if their authentication flows, session handling, or notifications can be mimicked or hijacked by attackers. Organizations deploying AI agents around sensitive communications should use continuous red teaming to simulate credential phishing against agent interfaces, harden identity and session management, require strong multi-factor authentication, and ensure agents never request or store raw authentication secrets or recovery codes.

According to FBI and CISA, Russian intelligence-linked threat actors have evolved an existing phishing campaign against Signal users to now socially engineer targets into enabling backups and revealing their Signal Backup Recovery Key, which allows attackers to restore backups, read historical private and group messages, and take over accounts.[1][2][3] The advisory notes that the same key can continue to be used against future accounts registered to the same phone number unless the user regenerates a new key in Signal settings, and that encryption itself is not broken—the account holder is the weak point.[1][2] From a RealGround perspective, this demonstrates how highly sensitive communications data can be compromised without defeating cryptography, by targeting user account recovery and backup flows instead; AI-enabled systems that integrate with messaging platforms or use similar backup/recovery mechanisms should be assessed for social-engineering exposure, enforced key rotation, and robust verification of support communications to prevent comparable large-scale data leakage.

The report says Mandiant assisted Cal Water’s investigation into claims by the Iranian-linked Handala group, and Cal Water found no evidence that OT systems or water distribution controls were breached. Other coverage indicates the incident may have involved IT-side access and potential exposure of customer or administrative data, but not operational disruption. RealGround analysis: this is primarily a data leakage and enterprise exposure issue rather than an OT compromise, so the most relevant response is to verify IT/OT segmentation, review exposed credentials and third-party dependencies, and assess whether leaked data or tooling could enable follow-on attacks.

The article describes "FortiBleed," a financially motivated, Russian-speaking initial access broker campaign that has targeted more than 430,000 FortiGate firewalls since February 2026 to harvest roughly 110 million credentials. According to public reporting on earlier Fortinet exploitation patterns, attackers routinely abuse FortiGate/FortiOS authentication and configuration weaknesses to exfiltrate credentials, system configuration, and device data at scale, which can then be used for further network compromise and resale on criminal markets.[1][2] From a RealGround perspective, this represents a large-scale data leakage and initial-access risk: any AI agents, models, or automation pipelines integrated with these networks may be exposed if compromised firewalls are used as a pivot. Organizations should treat firewall- and SSO-related credentials as potentially compromised, enforce rapid credential rotation and MFA, and conduct an AI Security Readiness Assessment plus targeted AI Agent Business Logic Audit and ongoing red teaming to ensure AI-driven workflows cannot be trivially reached or abused via these harvested credentials.

According to the report, the DifyTap vulnerabilities in the Dify multi-tenant AI platform allowed attackers to read private AI chats from other customers, preview documents across tenants, and abuse internal plugin daemon APIs via path traversal and authorization bypass flaws.[3][7] Researchers note that some of these issues enabled unauthenticated or cross-tenant access, affecting over a million applications built on the platform before patches in version 1.14.2.[1][3][7] From a RealGround perspective, these flaws represent critical data leakage and SaaS AI risk, showing how insufficient tenant isolation and weak access controls in AI orchestration layers can expose conversations, documents, and internal APIs at scale. Organizations should treat AI platforms as high-value data systems: harden multi-tenant isolation, enforce strict authorization on internal AI-related APIs, and continuously red-team agent workflows and file-handling paths to detect cross-tenant or unauthorized data access.

The article reports that London Hydro suffered a data breach in which attackers accessed customer contact and account information, including names, addresses, emails, phone numbers, service addresses, pricing/plan details, contract dates, and meter information, but not banking data, government IDs, or dates of birth.[1][2] London Hydro attributes the incident to a system vulnerability exploited after suspicious activity on a customer account, and states the vulnerability was patched the same day while investigations with law enforcement continue.[1][3] From a RealGround perspective, this incident illustrates classic data leakage risk arising from vulnerable customer-facing systems and insufficient segregation of customer records, which could analogously expose AI-driven customer portals or agent backends if similar flaws exist. Organizations integrating AI into customer service or billing flows should perform an AI Security Readiness Assessment to map data flows, harden access controls around AI-related APIs and services, and ensure that system vulnerabilities cannot be used to traverse from one user or account context into broader datasets.

Reported facts: Squidbleed (CVE-2026-47729) is a decades‑old heap over‑read bug in the Squid FTP directory‑listing parser that can leak another user’s cleartext HTTP request data, including credentials and session tokens, to any attacker already permitted to use the same proxy.[1][4][7] The issue affects Squid’s default configuration across many versions and primarily threatens shared proxy environments (corporate networks, schools, ISPs, public Wi‑Fi), though the impact is limited to cleartext HTTP and TLS‑terminating setups, not opaque HTTPS CONNECT tunnels.[1][4][7] RealGround analysis: For AI systems that rely on upstream proxies like Squid to fetch training data, API responses, or model inputs, Squidbleed represents an AI supply chain data‑leakage risk: sensitive prompts, API keys, session cookies, or proprietary datasets transiting the proxy could be exposed to other authorized users on the same network. Organizations should inventory where AI workloads depend on Squid or embedded Squid-based appliances, update or mitigate (e.g., disable FTP), and incorporate proxy components into their AI SBOM and supply‑chain risk assessments to prevent indirect leakage of model inputs

According to Zafran Security and The Hacker News, the DifyTap vulnerabilities in the Dify agentic workflow platform enable cross-tenant exposure of private AI chats and documents, including unauthenticated reading of other customers’ AI conversations and file previews across tenants.[1][2][3] Multiple CVEs (including CVE-2026-41947, -41948, -41949, -41950) reflect broken authorization and path traversal issues that allow attackers to access internal plugin APIs and exfiltrate sensitive content from multi-tenant cloud deployments.[1][3] From a RealGround perspective, this represents a high-impact data leakage and AI supply chain risk for any organization consuming Dify as an AI orchestration component, requiring rapid patching, tenant isolation review, and hardened access controls around AI workflows. Practical mitigations include upgrading to fixed versions, implementing WAF and red-teaming aimed specifically at cross-tenant data exposure paths, and incorporating Dify deployment configurations into SBOM-driven supply chain security assessments.[1][3]

The report describes an actively exploited WordPress plugin vulnerability in Gravity SMTP (CVE-2026-4020) that lets unauthenticated attackers retrieve sensitive configuration data, including API keys, tokens, and server details.[2][3][5] SecurityWeek specifically notes that attackers are using the flaw to harvest valuable WordPress data from vulnerable plugin versions before 2.1.5.[5] RealGround analysis: this is best classified as data leakage because the primary impact is unauthorized exposure of secrets and environment information, which can enable follow-on compromise and credential abuse.

According to SecurityWeek, Squidbleed (CVE-2026-47729) is a decades-old heap over-read vulnerability in Squid’s FTP parser that can leak prior users’ cleartext HTTP request data, including authentication credentials, session tokens, and API keys, to any attacker already allowed to use the same proxy.[1][3][8] The flaw affects long-standing Squid deployments and is likened to Heartbleed because it enables memory disclosure from a widely used infrastructure component rather than direct code execution.[1][3] From a RealGround perspective, this represents a critical data leakage risk in the AI supply chain: organizations may have Squid embedded in appliances or in front of AI services and APIs, so unpatched proxies can silently expose model API keys, user tokens, and sensitive request payloads transiting to AI systems. Practically, security teams should inventory where Squid is used (including embedded products), rapidly apply or verify patches, disable FTP support where possible, and include Squid and similar proxy components in SBOM-driven AI supply chain risk management and continuous monitoring.

According to public reporting on the FortiBleed campaign, threat actors harvested and validated a large database of working VPN and administrator credentials from Fortinet FortiGate devices, with confirmed working logins for tens of thousands of internet-facing firewalls across 194 countries.[2][8] This represents a major incident of credential and configuration data leakage, enabling persistent unauthorized access to affected networks.[3][5] From a RealGround perspective, any AI agents or workflows integrated with Fortinet infrastructure (for example, for automated firewall management, log analysis, or incident response) could be indirectly exposed if compromised VPN or admin accounts are used to pivot into systems that store AI configurations, secrets, or data. Organizations should assess AI-related access paths to Fortinet environments, enforce strong credential hygiene and MFA, and include AI agents in incident response, ensuring their permissions, stored secrets, and logs are reviewed and hardened as part of a broader AI security readiness and governance program.

The article reports that attackers are actively exploiting CVE-2026-4020, an information disclosure flaw in the Gravity SMTP WordPress plugin (≤2.1.4) that exposes a large system report, including configuration data, API keys, secrets, and OAuth tokens, via an unauthenticated REST API endpoint.[1][2][5] Wordfence and other observers note widespread in-the-wild scanning and exploitation, with over 400 distinct attacking IPs seen targeting this bug.[5][8][9] From a RealGround perspective, exposed API keys and tokens can compromise connected email, cloud, or third‑party AI services, enabling attackers to impersonate applications, pivot into AI workloads, or exfiltrate data those services can access. Organizations using WordPress as a front end or integration point for AI systems should prioritize patching, log review, and secret rotation, and include such plugin-origin risks in an AI Security Readiness Assessment to ensure API key management, token scoping, and incident response processes account for similar web-to-AI data leakage paths.

According to public reporting, the FortiBleed campaign involves threat actors compiling more than 86,000 verified working credentials for internet-accessible Fortinet firewalls and VPNs, affecting roughly half of all internet-facing Fortinet devices worldwide.[3][2][4] CISA and Fortinet have urged customers to terminate active sessions, reset all admin and VPN passwords, enforce MFA, upgrade to PBKDF2-based credential storage, and lock down management interfaces to trusted networks.[3][5] From a RealGround perspective, any AI systems, agents, or data pipelines sitting behind Fortinet appliances are at high risk of secondary compromise via these stolen credentials, which can enable lateral movement into environments hosting models, training data, or sensitive operational logic. Organizations should immediately assess exposure paths from Fortinet devices to AI infrastructure, perform targeted red teaming to validate whether compromised network access can be leveraged to exfiltrate models or data, and update AI security policies and access controls to assume credentials and perimeter devices may already be compromised.

The article reports that Apple patched a Beats Studio Buds Bluetooth flaw that could let nearby attackers eavesdrop through the earbuds’ microphone when the device was unpaired but actively seeking a connection. It also mentions other unrelated security items, including an Android TV botnet and an unpatched Google Cloud Config Connector issue. RealGround analysis: this is best classified as data leakage because the core impact is unauthorized audio exposure, and the practical security implication is to treat wireless peripherals and their firmware supply chain as part of the organization’s device-risk and update-management controls.

Report facts: Salesforce disabled the Klue Battlecards app integration after detecting unusual activity that may have enabled unauthorized access to a subset of customer data via the app’s Salesforce connection. ReliaQuest and other reporting indicate the incident involved compromised OAuth tokens and API-based CRM data exfiltration from connected environments. RealGround analysis: this is primarily a third-party integration trust failure with direct data exposure risk, so the main security response is to inventory connected SaaS apps, revoke/rotate OAuth grants and tokens, and review API logs for abnormal access patterns.

SecurityWeek reports that Kodak admitted a data breach after ShinyHunters claimed responsibility, while Kodak said it believes there is no ongoing threat to its systems or operations. Other coverage says an unauthorized third party briefly accessed a limited amount of company data, with ShinyHunters alleging theft of more than 2.2 million records, though those figures were not independently verified. RealGround analysis: this is primarily a data leakage event, and the practical security implication is to assess exposure of sensitive records, review containment and notification controls, and verify whether any connected systems or downstream partners were affected.

The article says temporary onboarding passwords are often sent by email or SMS, then reused, intercepted, or never changed, creating a long-lived security exposure. RealGround analysis: this maps best to data leakage because insecure password delivery can expose corporate credentials and grant unauthorized account access, increasing the chance of downstream compromise.

The report describes SearchLeak, a three-bug chain in Microsoft 365 Copilot Enterprise that could let an attacker exfiltrate emails, calendar details, MFA codes, and indexed files through a single crafted Microsoft link. Varonis and other coverage say Microsoft remediated the issue as a critical vulnerability, assigned CVE-2026-42824, and the attack relied on parameter-to-prompt injection, an HTML rendering race condition, and an SSRF-based CSP bypass. RealGround analysis: this is primarily a data leakage risk because the core impact is unauthorized disclosure from connected enterprise content, so organizations should review AI search trust boundaries, output sanitization, and allowlisted fetch paths in Copilot-style integrations.

A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A server takeover exposes every provider key it holds, the secrets that RealGround classifies this item as data leakage. Recommended review should focus on practical controls, source validation, and whether connected AI workflows expose customer data or production actions.

SecurityWeek reports that the ShinyHunters extortion group claims to have breached the Council of Europe and exfiltrated roughly 297 GB of data, including payroll records, HR files, bank details, tax and social security information, and even medical data for more than 10,000 employees, though the organization has only confirmed that an investigation is underway.[2][3] Other outlets similarly describe unverified but detailed claims of access to HR and payroll systems and hundreds of thousands of sensitive documents.[4][7] From a RealGround perspective, this incident highlights the systemic risk of bulk exposure of highly sensitive personal and financial data that could later be ingested into or accessed via AI systems, amplifying risks such as secondary identity theft, highly targeted spearphishing, extortion, and model or agent misuse based on compromised datasets. Organizations handling comparable HR and financial data should conduct an AI Security Readiness Assessment to map where such data may intersect with current or planned AI workloads, tighten access controls and logging, and ensure incident response and data governance policies explicitly cover the downstream use of breach

Report facts: France's Tchap government messaging platform was breached through a hijacked user account, and officials said about 73,467 accounts were affected. The actor calling itself 'misere' claimed to have exfiltrated messages, user data, and 13.5GB of files, but those larger theft claims are attacker assertions rather than independently verified. RealGround analysis: this is a data leakage incident with governance and access-control implications, so the priority is to review account compromise controls, data classification, and incident-response policy for sensitive government communications.

SecurityWeek reports that Novo Nordisk, maker of Ozempic, disclosed an IT security incident in which attackers gained unauthorized access to some internal systems and copied non-public personal data, including pseudonymized clinical trial information and identifiable data on certain healthcare professionals.[2][3] The company states that core operations remain unaffected but confirms that personal data was exfiltrated and that impacted parties are being notified.[2][3] From a RealGround perspective, this constitutes a significant data leakage event in a highly regulated healthcare context, highlighting the need for robust data segmentation, least-privilege access, strong monitoring of internal systems, and incident response preparedness before deploying or integrating AI systems that may touch the same data reservoirs. An AI Security Readiness Assessment would help map where sensitive clinical and patient-related data intersect with AI workflows, identify high-risk data flows and access paths, and define technical and governance controls to prevent similar exfiltration when AI tools or agents are introduced.

SecurityWeek reports that the Iran-linked Handala cyber group claims to have breached California Water Service (Cal Water), leaking approximately 5GB of data that allegedly includes customer personally identifiable information (PII) and administrative/RTKBase-related credentials.[1][2] These credentials appear to relate to internal operational platforms (e.g., RTKBase NTRIP caster network) and customer billing systems, representing a direct compromise of sensitive data and potentially operational access paths.[1][2] From an AI security standpoint, such leaked PII and system credentials could be repurposed to target any AI-enabled customer portals, billing systems, or field-operations tools (for example, account takeover against AI-assisted customer service agents, or poisoning of data that feeds AI decision-support for infrastructure operations). RealGround would recommend immediate assessment of where AI or automated decisioning touches these systems, hardening agent/business-logic authentication and authorization paths, and establishing CISO-level governance for handling and monitoring any AI components that consume or expose sensitive operational and customer data.

According to SecurityWeek, the University of Nottingham confirmed a data breach after the ShinyHunters group leaked more than 450,000 email addresses and other information from its systems. This incident fits into a broader pattern of ShinyHunters targeting education-sector organizations and exposing large sets of personal and institutional data.[1][3][9] From a RealGround perspective, such large-scale exposure of email addresses and associated metadata significantly increases the risk of targeted phishing and social engineering that can be used to compromise AI-integrated university services, identity systems, and research platforms. An AI Security Readiness Assessment can help universities map where AI systems touch sensitive identity data, harden access controls, and ensure incident response plans account for AI-related abuse paths that follow from traditional data breaches.

The article reports that infostealers are now a primary source of stolen credentials used for ransomware and other cybercrime, with attackers favoring credential theft over exploits. It frames infostealers as malware that harvests credentials and sensitive data from infected devices, enabling unauthorized access to networks and systems.[1][2] RealGround assessment: this maps most directly to data leakage because the core impact is credential and sensitive-data exfiltration, and the practical security focus should be on credential hygiene, endpoint controls, and rapid detection of leaked accounts.

According to the report, the FROST attack allows a malicious website to infer which other websites a user visits and which local applications they open by using only JavaScript and measuring SSD I/O contention and timing, without any extensions, native code, or permission prompts.[1][2] Researchers at Graz University of Technology demonstrate that by passively observing storage slowdowns and using techniques like the browser Origin Private File System (OPFS), an attacker can fingerprint user activity with notable accuracy.[1][2] From a RealGround perspective, this creates a stealthy side-channel for cross-tab and cross-app behavioral tracking that could expose sensitive browsing patterns or app usage of users interacting with AI agents in the browser, enabling correlation of identities, session hijack targeting, or deanonymization. Practically, organizations deploying browser-based AI agents should assume that co-resident malicious tabs may infer user behavior and possibly sensitive workflow patterns; they should harden browser security baselines, monitor for anomalous long-lived tabs, and consider isolating high-sensitivity AI workflows to dedicated browser profiles or hardened en

Reportedly, Meta plans to use off-site business data (such as activity on third‑party websites and online purchases) not just for advertising, but also to personalize users' feeds and responses from its AI chatbot.[1][2] This expands the scope of cross-site tracking and data sharing from ad targeting into broader AI-driven content and interaction personalization. From a RealGround perspective, this raises material data leakage and privacy governance risks: organizations whose sites or apps share data with Meta may be indirectly contributing to a richer behavioral profile that informs AI interactions, with limited transparency or user control. Enterprises need clear AI data governance policies, vendor DPIAs, and CISO-level oversight to define what off-site data may flow into external AI systems and to ensure compliance with privacy regulations and internal data handling standards.

The article reports that Lansing Community College disclosed a February 2025 breach in which attackers used compromised credentials to access systems containing personal data on more than 174,000 individuals, including names, addresses, dates of birth, driver’s license details, and Social Security numbers.[1][2] LCC states there is no evidence the data was exfiltrated or misused, and is offering affected individuals 24 months of credit monitoring and identity protection services.[1][2] From a RealGround perspective, this incident illustrates the risk that compromised credentials and inadequate monitoring pose to any environment holding sensitive data that might later be used to train, prompt, or enrich AI systems, leading to downstream data leakage if such datasets are repurposed without strong governance and access controls. An AI Security Readiness Assessment would help similar institutions map where sensitive personal data intersects with current or planned AI use, validate identity and access controls, and ensure incident response and disclosure processes reflect AI-related data handling and regulatory expectations.

According to Mandiant/GTIG reporting, UNC3753 (aka Silent Ransom Group, Luna Moth, Chatty Spider) is conducting a financially motivated extortion campaign against U.S. professional, legal, and financial services organizations using voice phishing, remote monitoring and management (RMM) tools, and in some cases physical office intrusions to rapidly exfiltrate sensitive client data, often within a single business day.[1][5] The campaign relies on social engineering to impersonate IT staff, guide users into screen-sharing sessions, install commercial RMM agents, pivot into VDI environments, and move data to attacker-controlled cloud storage or removable media, followed by aggressive extortion threats to leak data publicly.[1][2][3] From a RealGround perspective, any AI-enabled workflows, legal-tech platforms, or financial analytics tools integrated into these environments are at elevated risk of silent data leakage and downstream model contamination if attackers gain RMM-based or physical access, because AI systems tend to aggregate highly sensitive multi-tenant data. Organizations should use an AI Security Readiness Assessment to map where AI systems intersect with VDI, RMM access, a

The article reports that OpenAI is broadening the rollout of new ChatGPT account security features, including Active Sessions visibility and a Lockdown Mode that limits tools and outbound network access to reduce data exfiltration risk from prompt injection attacks.[1][5] These controls let users see and terminate suspicious sessions and restrict browsing, agents, and other connected capabilities that could be abused to exfiltrate sensitive data.[1][5] From a RealGround perspective, these are targeted mitigations against data leakage and account takeover, but they do not eliminate prompt injection or all exfiltration paths, especially through remaining apps, uploads, and unforeseen tool combinations.[1][5] Organizations should treat these controls as part of a broader AI security program, validating configurations, hardening identity and session management, and complementing them with policy, monitoring, and red-teaming to assess residual data-exposure risk.

According to SecurityWeek, the ShinyHunters extortion group leaked roughly 234 GB of data allegedly stolen from dental benefits administrator DentaQuest, with Have I Been Pwned estimating the breach affects about 2.6 million accounts.[1] Reported exposed data includes names, physical and email addresses, phone numbers, dates of birth, government-issued IDs, and health insurance information, and DentaQuest has confirmed a cybersecurity incident involving unauthorized access to a portion of its network.[1][2] From a RealGround perspective, this represents a large-scale data leakage event in a regulated healthcare-adjacent context, underscoring the need for rigorous data access controls, network segmentation, and continuous monitoring around systems that store PHI/PII. Organizations with similar data profiles should conduct AI Security Readiness Assessments and work with AI CISOs to ensure that any current or future AI systems cannot be used to exfiltrate sensitive records or amplify the impact of such breaches.

SecurityWeek reports that RCI Internet Services, a subsidiary of nightclub giant RCI Hospitality, suffered a hacking-related data breach in March 2026, exploiting an insecure direct object reference (IDOR) vulnerability on an IIS web server and exposing sensitive data on approximately 40,178 individuals, primarily independent contractors.[1][4][8] Compromised information includes highly sensitive personal identifiers such as names, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, and contact details, though the company states it has no evidence of public dissemination or misuse so far.[1][2][4] From a RealGround perspective, this incident highlights the data leakage risk from vulnerable web applications that may be integrated into or queried by AI agents and workflows; organizations should ensure access control flaws like IDOR are systematically tested, and that any AI systems consuming such back-end data enforce strict least-privilege access and logging. A structured AI Security Readiness Assessment would help identify where AI or automated agents might unintentionally broaden exposure of sensitive PII if they are given access to similarly vulne

According to Unit 42, Operation FlutterBridge is a macOS malvertising campaign that delivers a Flutter-based backdoor called FlutterShell via malicious Google and YouTube ads, using fake desktop apps such as PodcastsLounge, PDF-Brain, and PDF-Ninja.[1][7] The malware supports arbitrary command execution, file system access, browser hijacking, system fingerprinting, and theft of browser session data.[1][2] Some variants (PDF-Brain and PDF-Ninja) add an AI-powered document summarization feature by sending user documents through an attacker-controlled server before processing, creating direct risk of data exfiltration of any content users ask the "AI" to summarize.[1] From a RealGround perspective, any AI or AI-like feature that proxies sensitive documents to untrusted infrastructure should be treated as a high-risk data leakage vector, and organizations should harden AI document-processing workflows, apply SBOM and code review to third-party "AI helper" components, and use continuous red teaming to detect malware-like behaviors such as covert exfiltration behind AI functionality.

The report describes an unpatched Windows search: URI handler issue that can cause a victim system to make an outbound SMB connection and leak the user’s NTLMv2 hash to an attacker-controlled server. Huntress says the flaw uses the same NTLM leakage mechanism as the previously patched Snipping Tool URI issue, and Microsoft declined to issue a fix after responsible disclosure. RealGround analysis: this is primarily a credential/data leakage risk with downstream relay-attack potential, so defenses should focus on restricting outbound SMB, enforcing SMB signing, and reducing NTLM exposure where possible.

Report facts: attackers gained access to a senior executive’s email account at a major global stock exchange and exfiltrated data for roughly 150 days, with the operation assessed as likely espionage. RealGround analysis: this is best categorized as data leakage because the core impact is long-term unauthorized access and theft of sensitive information, which would be especially damaging if any AI-enabled workflows, inbox automation, or decision-support systems were exposed. Security priorities should include access control hardening, mailbox and identity monitoring, and review of any AI systems that may ingest or route executive communications.

The report describes a malicious NuGet package, Sicoob.Sdk versions 2.0.0 through 2.0.4, that masquerades as a legitimate SDK and exfiltrates client IDs, PFX passwords, and PFX certificate data through Sentry telemetry.[1][3] It also captures some Boleto API responses, which can expose payment and transaction details.[1][3] RealGround analysis: this is a high-severity supply-chain data leakage incident because stolen certificate material and credentials could enable impersonation of banking integrations and unauthorized financial API access.

According to the report, California Attorney General Rob Bonta sued Chrome Holding Co., the rebranded entity formerly known as 23andMe, alleging it failed to adequately protect highly sensitive genetic and personal data in a 2023 breach that exposed information on nearly 7 million users via compromise of about 14,000 accounts.[2] The lawsuit seeks civil penalties and injunctions for alleged violations of California privacy laws, following an earlier class-action settlement related to the same breach.[2] From a RealGround perspective, this case illustrates the regulatory and litigation exposure when organizations handling sensitive health and genomic data lack robust access controls, monitoring, and breach-response governance. Similar data-rich platforms and AI-driven health/genomics services should conduct comprehensive AI Security Readiness Assessments to harden identity, data segregation, and incident response, and to ensure privacy-by-design and regulatory alignment before deploying or scaling AI-enabled features.

SecurityWeek reports that the ShinyHunters extortion group leaked over 42 million customer records allegedly stolen from Charter Communications, with roughly 4.9 million unique individuals affected according to breach analysis data.[2][4] The exposed data includes email addresses, names, physical addresses, phone numbers, and tens of thousands of internal employee records, although Charter claims that no sensitive personal information or CPNI was taken.[2][4] From a RealGround perspective, this illustrates a large-scale data leakage event that could directly fuel highly targeted phishing, social engineering, and account takeover attacks against both customers and employees, including any AI systems that rely on these identities for access or personalization. Organizations operating AI-driven customer support, recommendation, or identity systems should reassess data-minimization practices, tighten access controls, and regularly test their exposure to data-driven attacks as part of an AI Security Readiness Assessment.

The article reports three incidents: a Trump Mobile customer data exposure affecting tens of thousands of preorder records via a third‑party platform flaw, including names, email addresses, mailing addresses, and phone numbers but not payment or Social Security data[2][3]; new phishing campaigns abusing the upcoming 2026 FIFA World Cup brand; and CISA’s response to recent supply chain attacks, including updated guidance and coordination efforts. These are conventional cybersecurity and supply-chain issues, not AI-specific failures. From a RealGround perspective, the Trump Mobile incident and the CISA supply chain focus highlight how third‑party platforms and vendors can inadvertently expose sensitive data and increase attack surface, a pattern that directly parallels risks in AI supply chains (model hosting providers, data labeling vendors, plug‑ins, and orchestration layers). Organizations deploying AI agents or data-driven models should apply structured AI Security Readiness Assessments and AI Supply Chain & SBOM Advisory practices—such as vendor security due diligence, clear data-handling boundaries, least-privilege access, and continuous monitoring—to prevent simila

According to LayerX Security’s State of AI Usage Report 2026, a small group of AI "power users" and a handful of dominant AI platforms generate a disproportionate share of enterprise AI activity and sensitive data exposure, with more than 6% of enterprise AI conversations containing personal, financial, or IT-related data.[1] The report also finds that nearly half of AI conversations use personal identities, many AI tools operate as unmanaged Shadow AI (extensions, connectors, personal accounts), and some platforms show double‑digit sensitive data exposure rates.[1] From a RealGround perspective, this concentration of usage and use of personal accounts creates a high-impact data leakage risk that requires targeted controls for power users, monitoring of AI connectors and extensions, and strong identity and data governance around AI access. Organizations should combine readiness assessments, explicit AI policies, and continuous red teaming of AI workflows to detect and mitigate sensitive data exposure where AI usage is heaviest and least governed.

The report describes CVE-2026-27771 in Gitea, where unauthenticated attackers could pull private container images from affected instances running versions before 1.26.2. The issue is an access-control failure in the container registry, and the disclosed impact includes exposure of sensitive artifacts such as source code, secrets, and infrastructure details. From a RealGround perspective, this is best classified as data leakage because the primary risk is unauthorized disclosure of private software assets, with immediate operational value in patching, access control review, and registry exposure auditing.

The article describes how employees increasingly adopt unvetted "shadow" AI tools such as writing assistants, coding copilots, and meeting summarizers to boost productivity, often without IT review or governance. These tools may connect to sensitive internal systems or process confidential data, creating unmanaged exposure and compliance risks. From a RealGround perspective, the primary security implication is the risk of inadvertent data leakage and regulatory non-compliance through third-party AI services lacking contractual, technical, and monitoring controls. Organizations should implement AI usage policies, discovery and inventory processes, and an AI governance program to safely enable productivity while limiting uncontrolled data flows and access paths.

The article describes how a single cached AWS access key on a Windows machine—left there through normal login behavior—could be harvested by an attacker and used to reach approximately 98% of entities in the company’s cloud environment. This is a classic identity and credential exposure issue, where no explicit misconfiguration is needed for a powerful lateral movement path to exist. From a RealGround perspective, the practical implication is that any AI agents or AI-integrated systems with access keys, tokens, or role credentials cached on endpoints or in application runtimes can create similarly expansive blast radii if compromised. Organizations should evaluate where AI components store and reuse credentials, enforce least-privilege and short-lived tokens, and integrate identity-aware threat modeling into AI Security Readiness Assessments and Business Logic Audits to prevent large-scale data leakage and unauthorized cloud access via a single compromised identity.

The article says healthcare and finance organizations face AI-specific risks including model inversion, data poisoning, and "shadow AI" where employees paste sensitive clinical or trading data into public AI tools, causing uncontrolled disclosure.[1][4] It also recommends privacy-by-design architecture, continuous red-teaming, and strict data governance for LLM and agent deployments.[1] RealGround analysis: this is primarily a data leakage and governance issue with elevated healthcare and fintech impact, so the most relevant response is to assess AI data handling controls, formalize usage policy, and strengthen executive oversight before broader deployment.

The ACSC guidance highlights AI-related risks for small businesses including data leaks and privacy breaches when staff upload sensitive or proprietary information into AI tools, and supply chain vulnerabilities arising from third-party AI providers’ security practices and incident response capabilities, as well as broader AI integration risks.[1][2][4] It recommends limiting sensitive data sent to AI systems, enforcing role-based access controls and encryption, and carefully assessing vendor data handling and AI supply chain security.[2][4] From a RealGround perspective, these issues indicate a material data leakage and supply chain exposure that warrants a structured AI security readiness assessment, formal AI security governance led or supported by an AI-focused CISO function, and detailed review of AI vendors and models via supply chain and SBOM advisory to ensure contractual, technical, and operational controls are in place before scaling AI use in the business.