Data breach tracking website Have I Been Pwned posted yesterday that US peer-to-peer lending platform Prosper was hit with a breach that affected 17.6 million customers.
Prosper initially announced last month that it had detected unauthorized access on their systems resulting in the exposure of an undisclosed number of customers and applicant information. The company shut down the activity promptly and confirmed that the unauthorized access was revoked as of September 2.
John Carberry, Solution Sleuth with cybersecurity services provider Xcape, Inc., offers perspective:
“The Prosper data breach is a serious one, both in terms of the number of people affected and the sensitivity of the compromised information. With 17.6 million customers impacted, and data including Social Security numbers, credit scores, and income details exposed, this incident could lead to various types of fraud, such as identity theft, synthetic identity creation, and phishing attacks. Although Prosper says there’s no evidence of unauthorized account access or stolen funds, breaches involving financial data often have lasting consequences, with issues appearing months or even years later. This event highlights how crucial it is for financial platforms to have strong identity and access management, continuous monitoring, and robust data encryption. Those affected should immediately take steps like credit monitoring, fraud alerts, and closely monitoring their accounts. For organizations, this serves as a reminder to minimize data retention, enforce least-privilege access, and ensure quick breach detection and response to limit damage.
“Simply put, companies that store this type of PII in the course of operating their businesses have a fiduciary responsibility to protect it. It is no longer enough to have a “proper” response to such breaches. Consumers must demand stronger data protections and accountability from these vendors at the outset.”
Companies need to take better steps to avoid a situation like this. I say that because the sort of information that has been leaked should be extremely difficult to get. In this case, that does not seem to be case.
Salesforce breach escalates: Qantas & Vietnam Airlines data leaked on dark web
Posted in Commentary with tags Outpost24 on October 20, 2025 by itnerdOutpost24 researchers have published an analysis on the recent developments surrounding the Salesforce data breach. The breach has continued to escalate, with Qantas and Vietnam Airlines data now being leaked on the dark web.
The analysis dives into the exact timeline of events, the amount of data being leaked, the broader risk of these events, and how the threat actors behind this, Scattered Lapsus$ Hunters, typically run their attacks. The researchers determined that this incident highlights two critical realities.
One, that an organization’s security perimeter is no longer just the firewall, but all third party platforms that have access to company data and software. And two, that threat actors are increasingly targeting individuals to bypass technical controls. By exploiting insider employees, Scattered Lapsus$ and many other groups, are leveraging major data leaks. All because of effective social engineering.
For full details, the analysis can be read at this link: https://outpost24.com/blog/salesforce-breach-qantas-vietnam-airlines/
Leave a comment »