E-Commerce Giant Coupang Discloses Data Breach Impacting 33.7 Millions
E-Commerce Giant Coupang Discloses Data Breach Impacting 33.7 Millions
South Korea’s largest retail giant, Coupang, disclosed a significant data breach impacting the personal information of 33.7 million customers. Coupang discovered the breach on November 18, while the incident happened on June 24. The exposed customer data includes full names, phone numbers, email addresses, physical addresses, and order information. Coupang confirmed sensitive payment details and account credentials were not compromised. While the exact attack type and perpetrator remain officially undisclosed by Coupang, reports suggest the breach was carried out by a former employee. The company apologized and reported the incident to key authorities. Subsequently, they issued an advisory warning affected individuals to be wary of potential phishing scams resulting from the exposed personal data.
Source: Cyber Press, Bleeping Computer
Petco Confirms Exposed Personal Data
Petco confirmed a security lapse that exposed sensitive customer data. The breach was due to a misconfigured setting in one of its software applications. In result, it made a number of files accessible online. The exposed data included highly sensitive personal information such as customers’ names, Social Security numbers (SSNs), driver’s license numbers, dates of birth, and financial account/card numbers. Although Petco quickly corrected the misconfiguration and removed the files, the company did not disclose the full scope of the breach, including the total number of customers affected or the specific duration of the exposure.
Source: Tech Crunch
React2Shell Exploit Campaigns Tied to North Korea
New campaigns have been observed exploiting React2Shell (CVE-2025-55182), a maximum-severity Remote Code Execution (RCE) vulnerability in React Server Components. Now, it is being tied to North Korean cyber intrusion tactics. Researchers found a novel implant that delivers EtherRAT, a sophisticated Remote Access Trojan (RAT), from a compromised Next.js application. This suggests an evolution in exploitation from opportunistic cryptocurrency mining and credential harvesting toward persistent, stealthy, long-term operations.
Source: The Hacker News, Security Week
Google Patches Android 0-Day Vulnerabilities
Google has released critical security updates to address multiple high-severity zero-day vulnerabilities in the Android Framework component. Now, threat actors are actively exploiting in real-world attacks. Specifically, two zero-days, CVE-2025-48633 and CVE-2025-48572, were being exploited, with the former allowing for unauthorized information disclosure and the latter for privilege escalation on affected Android versions. The most severe issue in this update is CVE-2025-48631. The vulnerability can lead to a remote denial-of-service (DoS) attack without requiring additional execution privileges. Google advised users of the affected Android versions to install the available security updates.
Source: Infosecurity Magazine
Click here to subscribe our Newsletter