SecurityWeekSecurityWeek News
UK Education Dept Breach Exposes 607k Records After NPM Attack
Part of the STARDUST CHOLLIMA story · since 1 Apr
- Wed 1 Apr, 22:15 UTC. Microsoft, first report. Mitigating the Axios npm supply chain compromise.
- Wed 22 Apr, 11:01 UTC. SecurityWeek, its first report on the story. North Korean hackers use AppleScript, ClickFix on macOS finance.
- Mon 22 Jun, 11:30 UTC. SecurityWeek. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
- Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
- Thu 30 Jul, 07:20 UTC. The Hacker News, its first report on the story. North Korea's Sapphire Sleet hijacks npm packages via Amazon links.
- Fri 31 Jul, 16:10 UTC. SecurityWeek. UK Education Dept Breach Exposes 607k Records After NPM Attack. This article, 6th of 9.
- Tue 4 Aug, 09:31 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hijack NPM Packages via Social Engineering.
- Fri 21 Aug, 09:30 UTC. SecurityWeek. North Korean hackers breach Rust supply chain via crate arrayref.
- Thu 29 Oct, 18:30 UTC. Microsoft. Microsoft reports North Korean groups expanding AI operations.
The latest cybersecurity news roundup from SecurityWeek covers significant developments: OnTrac experienced a data breach with unauthorized access to its corporate network. Adobe issued critical security updates for vulnerabilities in its software products. A credential stuffing campaign targeted SonicWall VPN accounts, while OpenAI released an open-source Codex Security CLI for security checks.
The UK Department for Education lost 607,000 contact records in a data breach, attributed to North Korean group Sapphire Sleet's attacks on popular NPM packages. Additionally, vulnerabilities in a vehicle management platform were exploited, and advancements in cryptographic attacks were reported by researchers using AI.
How the story developed
9 articles from 5 outlets since 1 Apr. Quiet since 29 Oct. This was the 6th report, 121 days after the first.
- Wed 1 Apr, 22:15 UTC. Microsoft, first report. Mitigating the Axios npm supply chain compromise.
- Wed 22 Apr, 11:01 UTC. SecurityWeek, its first report on the story. North Korean hackers use AppleScript, ClickFix on macOS finance.
- Mon 22 Jun, 11:30 UTC. SecurityWeek. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
- Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
- Thu 30 Jul, 07:20 UTC. The Hacker News, its first report on the story. North Korea's Sapphire Sleet hijacks npm packages via Amazon links.
- Fri 31 Jul, 16:10 UTC. SecurityWeek. UK Education Dept Breach Exposes 607k Records After NPM Attack. This article, 6th of 9.
- Tue 4 Aug, 09:31 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hijack NPM Packages via Social Engineering.
- Fri 21 Aug, 09:30 UTC. SecurityWeek. North Korean hackers breach Rust supply chain via crate arrayref.
- Thu 29 Oct, 18:30 UTC. Microsoft. Microsoft reports North Korean groups expanding AI operations.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 9 articles as a listHide the list
- Wed 1 AprDay 01
- Mitigating the Axios npm supply chain compromise22:15 · Microsoft · First report
Quiet for 3 weeks
Wed 22 AprDay 211- North Korean hackers use AppleScript, ClickFix on macOS finance11:01 · SecurityWeek · Picked up again
Quiet for 9 weeks
Mon 22 JunDay 822- North Korean Group Targets NPM Supply Chain, 8M Devs at Risk11:30 · SecurityWeek · Picked up again
- North Korean hackers breach Mastra via tainted npm packages11:31 · Infosecurity
Quiet for 5 weeks
Thu 30 JulDay 1201- North Korea's Sapphire Sleet hijacks npm packages via Amazon links07:20 · The Hacker News · Picked up again
- Fri 31 JulDay 1211
- UK Education Dept Breach Exposes 607k Records After NPM Attack16:10 · SecurityWeek · This article, 6th of 9
Quiet for 4 days
Tue 4 AugDay 1251- North Korean Hackers Hijack NPM Packages via Social Engineering09:31 · SecurityOnline · Picked up again
Quiet for 2 weeks
Fri 21 AugDay 1421- North Korean hackers breach Rust supply chain via crate arrayref09:30 · SecurityWeek · Picked up again
Quiet for 10 weeks
Thu 29 OctDay 2111- Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again