A recent Cybernews analysis found that 94% of the world’s top 400 oil and gas companies have suffered at least one data breach to date. Over 50% of the analyzed oil and gas firms were breached in just the last 30 days.
Moreover, according to the Cybernews Business Digital Index, which grades businesses based on their online security measures, 69% of the companies received a cybersecurity score of D or F, and only 10% achieved an A grade.
Key research takeaways:
94% of the largest oil and gas companies had experienced at least one breach, and over 50% were breached within the last 30 days.
Nearly 7 in 10 oil and gas companies are in the high-risk category for cybersecurity, with 35% scoring an F and 34% a D.
Asia-based companies had the lowest average score at 65. Europe and North America followed closely with average scores of 74.
Credential hygiene is a major weak spot, especially in Asia, where 68% of companies reused previously compromised passwords.
Email security remains a critical weakness, affecting 48% of organizations worldwide.
74% of companies contain insecure configurations in their servers.
Issues with SSL/TLS configuration were identified in 91% of organizations.
More than 80% of firms had corporate credentials stolen, while 38% of domains were susceptible to email spoofing attacks.
For this study, Cybernews researchers evaluated 391 companies in the oil and gas industry worldwide. The companies were selected from Companiesmarketcap’s “Largest Oil and Gas Companies by Market Cap” list.
This report assesses cybersecurity risk across seven core dimensions: software patching, web application security, email security, system reputation, system hosting, SSL/TLS configuration, and data breach history.
The report’s full Methodology can be found here. It provides detailed information on how researchers conducted this analysis.
The Cybernews research team has uncovered a severe data leak. The iOS app “My Book List – Library Manager” has been spilling sensitive user data of 42,000 users via a misconfigured Firebase database.
The leaked data included users’ book lists, names, email addresses, IP addresses, purchase history, device metadata, and more.
You might think a few book titles here and there are harmless. But in reality, the leaked data from “My Book List” is a treasure trove for malicious actors – opening doors to targeted phishing scams using device and location data, and real-time data scraping by cybercriminals.
Here’s why this matters:
It’s a systemic problem. The current leak was uncovered as part of an investigation by Cybernews, where researchers analyzed 156,000 iOS apps. We found that 71% leak at least one sensitive secret.
The app also leaks API keys, client IDs, and tokens – hardcoded directly into the app. This dangerous practice could give attackers backend access, putting users and infrastructure at further risk.
Access to the leaked data allows attackers to craft highly targeted phishing scams that increase the chances of tricking victims.
A leaked IP address can reveal your approximate location, allowing scammers to create localized messages that appear more convincing.
Exposed device metadata can help malicious actors tailor attacks to clients usage patterns, making the scams feel even more personal and difficult to detect.
Cybernews researchers have uncovered a major data leak — HireClick, the recruitment platform for small to mid-sized businesses, exposed 5.7 million resumes containing sensitive personal details of job seekers.
With private information up for grabs, this leak is a goldmine for scammers. The leaked data could power everything from identity theft and impersonation to phishing campaigns, leaving desperate job seekers highly vulnerable.
What personal data HireClick leaked?
Full names
Home addresses
Email addresses
Phone numbers
Employment information
What are the dangers of this leak?
Attackers can easily craft convincing phishing emails, SMS scams, or impersonate recruiters.
Job seekers may be lured into sharing sensitive documents such as ID scans, Social Security numbers, or banking information under the pretense of job verification or setting up direct deposit.
Scammers could use the resumes to create fake identities or exploit employment verification systems.
The leak also enables doxxing, where personal data is exposed online to harass or intimidate individuals.
About 75% of workers use AI in the workplace, with AI chatbots being the most common tools to complete work-related tasks. While this boosts productivity, it could expose companies to credential theft, data leaks, and infrastructure vulnerabilities, especially since only 14% of workplaces have official AI policies, contributing to untracked AI use by employees.
According to the Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Cybernews researchers analyzed 52 of the most popular AI web tools in February 2025, ranked by total monthly website visits based on Semrush traffic data.
Key analysis findings:
Researchers’ analysis shows that 33% of the analyzed AI platforms earned an A rating, 41% received a D (high risk) or even an F (critical risk).
Of the 52 AI tools analyzed, 84% had experienced at least one data breach.
36% of analyzed tools experienced a breach in just the past 30 days.
93% of platforms showed issues with SSL/TLS configurations, which are critical for encrypting communication between users and tools.
System hosting vulnerabilities were another widespread concern, with 91% of platforms exhibiting flaws in their infrastructure management.
44% of companies developing AI tools showed signs of employee password reuse.
51% of analyzed tools have had corporate credentials stolen.
To read the full research and methodology, please click here.
If you thought downloading a cute cat game was harmless, think again. We at Cybernews have cracked open the code of “Cats Tower: The Cat Game!” – an iOS app with half a million users – and found it purring out plenty of secrets: user IP addresses, Facebook tokens, and locations and credentials for the app’s backend systems.
This is a symptom of a much bigger problem hiding in plain sight on your iPhone – and it’s happening at a scale that should make every user pause before tapping “Install.”
The Cat’s Out of the Bag
Let’s break it down: we went spelunking through the guts of 156,000 iOS apps – about 8% of everything on the App Store. What we found is the stuff of digital nightmares: 71% of those apps were leaking at least one hardcoded secret. We’re talking API keys, cloud credentials, and other sensitive endpoints.
Many people believe iOS apps are more secure. But our research shows developers often leave keys to the kingdom in plain sight. It’s like locking your front door but taping the key to the window. Wouldn’t this make you anxious?
In the case of the cat game, that meant 450,000 users’ IP addresses and ~250 Facebook access tokens were up for grabs. With that kind of data, a savvy bad actor could track you, hijack your social media, or even spin up fake requests to the app’s backend – weaponizing the app against its own users.
How to Keep Your Data Out of the Litter Box
So you’re one of the 1.38 billion active iPhone users in the world, and you love your apps – maybe even that cat game that’s spilling half a million users’ secrets across the internet. Here’s the truth: your data is only as safe as the laziest developer in your app library. But you don’t have to be a sitting duck.
Start with permissions. Every time you install an app, it asks for access – to your location, your photos, your contacts. Most people just tap “Allow.” Don’t. Head to Settings > Privacy & Security and audit who’s got the keys to your digital house. If a game wants your location, ask yourself why. Spoiler: It likely doesn’t need it.
Update like your privacy depends on it – because it does. Apple pushes out security updates for a reason. Hackers love old software. Go to Settings > General > Software Update and don’t let those red notification dots linger. The same goes for your apps: update early and often.
Lock it down. Still using “123456” or your birthday as a passcode? Time to level up. Use a long, unique passcode and enable Face ID or Touch ID. If someone snatches your phone, you want it to be a brick, not a gold mine.
Don’t trust – verify. That adorable new app? Treat it like a stranger at your door. Check reviews, look up the developer, and think twice before granting permissions. Even the App Store’s walled garden isn’t weed-free.
Clean your digital house. Delete apps you don’t use. Every extra app is another potential leak. Before deleting the app, delete the account you created for the service, if they don’t have your data, they can’t leak it. Less is more.
Stay skeptical. Phishing isn’t just for email. If an app asks you to log in with Facebook or Google, make sure it’s legit. And never, ever tap on sketchy links.
Remember, if iOS apps are leaking secrets, it’s up to users to protect themselves first. Assume your favorite app could have a data breach tomorrow. Act accordingly.
The Bottom Line
The cat game leak is a warning shot. As mobile cyberattacks surge and the App Store’s walled garden shows cracks, it’s clear that mobile security is your problem too, not just Apple’s. So next time you download a new app – even one with adorable kittens – remember that on the internet, curiosity doesn’t just kill the cat. It can put your privacy at risk, too.
ABOUT THE AUTHOR
Aras Nazarovas is an Information Security Researcher at Cybernews, a research-driven online publication. Aras specializes in cybersecurity and threat analysis. He investigates online services, malicious campaigns, and hardware security while compiling data on the most prevalent cybersecurity threats. Aras along with the Cybernews research team have uncovered significant online privacy and security issues impacting organizations and platforms such as NASA, Google Play, App Store, and PayPal. The Cybernews research team conducts over 7,000 investigations and publishes more than 600 studies annually, helping consumers and businesses better understand and mitigate data security risks.
Apps designed to protect our peace of mind are increasingly becoming sources of anxiety. Take 7 Minute Chi – Meditate & Move, a meditation app marketed to reduce stress, and Robo Spam Text & Call Blocker, an iOS tool meant to shield users from robocalls and phishing. Both promised safety – one for mental well-being, the other for digital security. Instead, they exposed sensitive user data through security failures, revealing a worrying truth: the apps we trust to guard our privacy are often the weakest links in our digital lives.
The Irony of Leaky Safe Spaces
The 7 Minute Chi breach laid bare the personal details of over 100,000 users-names, emails, and app secrets like API keys and Facebook credentials – due to a misconfigured Firebase database. This is a betrayal. Users sought calm and focus, only to have their data potentially weaponized for phishing or identity theft.
Also, Robo Spam Text & Call Blocker, downloaded 93,000 times, leaked 339,000 reported spam numbers, customer support tickets with real names and emails, and critical app secrets. Criminals now know which numbers users block and which keywords to avoid, and this enables them to craft scams that slip past filters.
These leaks aren’t accidents but symptoms of systemic negligence. Firebase misconfigurations, which leave databases publicly accessible, and hardcoded secrets embedded in app code are shockingly common. Our research shows 71% of 156,080 sampled iOS apps leak at least one secret, with an average of 5.2 per app. When developers cut corners, apps designed to protect become tools for exploitation.
The Human Cost of Broken Promises
For users, the fallout is deeply personal. Just imagine receiving a phishing email that references your meditation habits, perhaps even mentioning the specific app you use or the routines you follow – details you thought were private.
Or picture answering a spam call that not only gets past your trusted blocker, but uses language and tactics tailored to your reported preferences and blocked keywords, making the scam far more convincing.
In both cases, the sense of violation is profound: information you shared in the pursuit of calm or safety is now being used to target and manipulate you, turning trusted digital spaces into sources of new anxiety.
A Failure of Accountability
Neither Apple’s App Store reviews nor developer due diligence prevented these breaches. 7 Minute Chi’s Firebase instance sat exposed for weeks, while Robo Spam Text & Call Blocker’s parent company, Brantley Media Group, has a history of leaks, including an AI app that exposed users’ intimate stories. Yet, Apple’s ecosystem, often perceived as a “walled garden,” lacks mechanisms to scan for hardcoded secrets or enforce secure cloud configurations.
What’s Next?
To restore trust, the industry must prioritize:
Expand app store reviews to include backend security checks: Apple and other platform owners should incorporate automated scans for misconfigured databases, hardcoded credentials, and other backend vulnerabilities before approving apps.
Developers must follow secure coding standards, conduct regular code reviews, and leverage automated security testing tools to catch vulnerabilities early.
Provide real-time privacy visualizations and alerts: empower users with dashboards or notifications that reveal how their data is used, and immediately alert them to potential leaks or suspicious activity.
Offer post-breach support and transparency, and quickly notify users in the event of a breach, provide guidance on protective actions, as well as offer services such as personal data scans to help users recover.
Regularly update and patch apps
As the lead researcher on these investigations, I urge users to demand better. Change passwords exposed in breaches, limit data shared with apps, vet apps before installing them, as much as you can, and pressure platforms to enforce stricter standards. Until then, the very tools marketed to protect us will continue to leave us exposed.
ABOUT THE EXPERT
Aras Nazarovas is an Information Security Researcher at Cybernews, a research-driven online publication. Aras specializes in cybersecurity and threat analysis. He investigates online services, malicious campaigns, and hardware security while compiling data on the most prevalent cybersecurity threats. Aras along with the Cybernews research team have uncovered significant online privacy and security issues impacting organizations and platforms such as NASA, Google Play, App Store, and PayPal. The Cybernews research team conducts over 7,000 investigations and publishes more than 600 studies annually, helping consumers and businesses better understand and mitigate data security risks.
Cybernews researchers analyzed 19B passwords and discovered how people create them: their favorite animals, pop culture terms, celebrities, cities, food, names, swearwords, and more.
Researchers analyzed 19,030,305,929 passwords, of which only 1,143,815,266 (6%) were identified as unique.
Researchers developed custom wordlists covering diverse themes to better understand password composition.
Key findings:
Most people use 8–10 character passwords (42%), with eight being the most popular.
Almost a third (27%) of the passwords analyzed consist of only lowercase letters and digits.
Almost 20% of unique passwords mixed case letters and numbers, but had no special characters.
Passwords composed of profane or offensive words might seem rare, but they’re very common in practice.
Despite years of being called out, default and “lazy” passwords like “password”, “admin”, and “123456” are still a common pattern.
Researchers found “1234” in almost 4% of all passwords – over 727 million passwords use this sequence.
338 million passwords use the “123456” combination.
Only 6% of passwords are unique, leaving other users highly vulnerable to dictionary attacks.
Ana is the most popular name, used in almost 1%, or 178.8M passwords.
The positive wordlist is dominated by words like love (87M), sun (34M), dream (6.1M), joy (6.9M), and freedom (2M).
Some of the most frequently used pop culture terms in passwords include Mario (9.6M), Joker (3.1M), Batman (3.9M), Thor (6.2M), and, surprisingly, Elsa (2.9M) from Disney’s “Frozen”.
Swear words are also very common in passwords. The top entry, ass (165M).
Users often craft their passwords using fuck (16M), shit (6.5M), dick (3.2M), and bitch (3.2M).
The most popular city for passwords is Rome (13M), while 9.8M passwords include lion, and 7.8M – fox.
Summer (3.8M) is the most popular season, and users prefer Monday (0.8M) the most to protect their accounts.
May (28M) appears in lots of passwords but also in many other words used to create passwords.
The second most popular month was April (5.2M).
Over 36M passwords included tea, 10.7M – apple, 4.9M – rice, 3.6M – orange.
Google holds the door for 25.9M accounts, followed by Facebook (18.7M), and Kia (12.7M).
Many believe that hackers will be repelled by boss (10M), hunter (6.6M), cook (4.2M) and other professions.
Soccer (4M) is a more popular account safeguard than football (3.4M).
Carolina (1.9M), Dakota (1.2M), and Texas (1.1M) are the three most popular US states that will not keep hackers away.
Almost 24M users believe “god” will make their password secure, and 20M rely on “hell”.
The list of the top 10 most common passwords in 2025 can be found here.
Apple built its empire on a promise: Your iPhone is safe. The company’s famously walled garden – with tightly controlled hardware, software, and App Store curation – is supposed to be the envy of the digital world. It’s why Apple users sleep a little easier, why regulators give the company more breathing room, and why Apple can credibly claim to “think differently.”
But what if the walled garden has holes?
New research conducted by my team at Cybernews reveals a massive security oversight at the heart of Apple’s App Store: over 110,000 iOS apps – roughly 7 out of every 10 we analyzed – leak “hardcoded secrets,” including API keys, authentication tokens, and cloud storage credentials. Many of these secrets unlock access to sensitive user data. Some could allow full account takeovers. Others – like those found in fetish dating apps – have exposed private photos sent in confidence.
It’s a systemic failure – and Apple, with all its resources and security rhetoric, should be held to account.
Secrets Hidden in Plain Sight
Let’s be clear about what we found. Our researchers downloaded 156,000 iOS apps, about 8% of the App Store. We used automated analysis and reverse engineering – the same techniques used by attackers – to scan for secrets embedded directly in the app’s code. The kind of secrets developers should never store there.
Among the more than 816,000 exposed secrets, we discovered:
94,240 hardcoded Storage Buckets, with 836 (0.89%) lacking authentication. These open instances exposed over 76 billion files, leaking 406TB of data.
51,098 Firebase URLs, of which 2,218 (4.34%) lacked authentication. These open instances exposed 19.8 million records, leaking 33GB of data, including user session tokens and backend analytics. Almost all of these instances are hosted in the US.
8,439 Fabric API keys were exposed. Fabric, an order management system, uses these keys to manage, track, and fulfill orders.
3,343 live Branch keys exposed. Branch.io is a marketing platform used to track campaigns and enable advanced deep linking.
In the case of five niche dating apps – catering to LGBTQ+ users and kink communities – the leaks were especially troubling. Because their developers embedded Google Cloud credentials into their iOS app code, we found 1.5 million private user images sitting in unprotected cloud buckets: intimate photos, identity verification selfies, even images flagged for violating platform rules. All publicly accessible.
This is the kind of leak that can ruin lives – especially in countries where homosexuality is criminalized. Yet these apps passed Apple’s review process and remain live in the App Store.
The Myth of the Secure App Store
Apple’s defenders might point to its App Store Review Guidelines. They’re robust – at least on paper – and cover safety, performance, and legal compliance. But nowhere do they mention scanning for hardcoded secrets. If Apple does check for these weak spots behind the scenes, our findings suggest it’s doing a very poor job.
In contrast, major tech companies like GitHub, Google, and AWS all have automated detection systems to catch exposed secrets in code. Apple, with its trillion-dollar valuation, could easily implement the same – but hasn’t.
Why not?
One reason may be speed. Apple’s app approval pipeline is enormous, and slowing it down to add deep security scanning might cut into App Store revenue – especially from free apps running on ad-driven models. But another reason may be philosophical. Apple prefers to position itself as a hardware company with privacy baked in. What happens inside apps, it implies, is the developers’ responsibility.
This distinction might have worked in 2010. It doesn’t hold up today.
The Cost of Convenience
Most developers aren’t malicious. They’re just under pressure. Hardcoding secrets is faster than building secure authentication flows. Updating an app to fix a leaked secret can be risky and time-consuming. Many developers simply hope no one notices.
But attackers do notice.
In 2016, Uber was breached because hackers found hardcoded AWS credentials. In 2022, Toyota left GitHub keys exposed for five years. These weren’t amateur operations – they were failures by major companies.
If these mistakes can happen at Uber and Toyota, imagine the risks among hundreds of thousands of apps built by small firms or freelance developers.
During the times when 78% of people use mobile devices for sensitive financial and healthcare tasks, and 71% of employees use phones for work, the stakes couldn’t be higher. One compromised API key could allow a threat actor to read your medical history, hijack your crypto wallet, or impersonate you in a phishing attack.
Apple Has the Power. It Should Use It.
Apple often casts itself as the privacy champion in a dangerous digital world. It markets encryption, app tracking transparency, and on-device processing. It draws a sharp contrast with Android, where data collection and security gaps are more openly discussed.
But security doesn’t end at the lock screen. And for all its technical prowess, Apple still hasn’t built the safeguards needed to prevent insecure apps from leaking user data – or even user dignity.
The tools to fix this are readily available:
Static analysis tools can detect hardcoded secrets automatically.
A requirement for credential scanning could be added to the App Store review.
Apple could revoke vulnerable secrets in coordination with developers.
These aren’t radical measures. They’re standard practices at companies far smaller than Apple.
Where Is Apple’s Accountability?
We shouldn’t mistake slick marketing for security. And we shouldn’t let Apple off the hook simply because the alternative might be worse. Apple’s tight control over its ecosystem gives it enormous power – but with that comes responsibility.
Apple already decides which apps can run on its devices, how payments are processed, and what APIs are accessible. It should also ensure that the apps it approves don’t recklessly expose private user data to the internet.
Until then, the walled garden may look pristine – but it’s full of weeds.
ABOUT THE AUTHOR
Vincentas Baubonis is an expert in Full-Stack Software Development and Web App Security, with a specialized focus on identifying and mitigating critical vulnerabilities in IoT, hardware hacking, and organizational penetration testing. As Head of Security Research at Cybernews, he leads a team that has uncovered significant privacy and security issues affecting high-profile organizations and platforms such as NASA, Google Play, and PayPal. Under his leadership, the Cybernews team conducts over 7,000 pieces of research annually, publishing more than 600 studies each year that provide consumers and businesses with actionable insights on data security risks.
Cybernews’ latest 2025 Q1 overview reveals an alarming surge in ransomware activity. According to the Ransomlooker tool, 2,028 known ransomware attacks occurred in just three months, with a 101.8% increase compared to Q1 2024. The number of active ransomware gangs also spiked, with 65 groups operating in the first quarter.
The findings also show ransomware gangs adopting a more calculated, high-stakes approach with attacks aimed at billion-dollar Fortune 500 corporations.
This report offers key insights into where ransomware is headed and who’s next in the crosshairs. The shift toward targeting billion-dollar corporations highlights the growing risk to industries essential to everyday life and the downstream effects the attacks can have on global supply chains and public services.
Key findings of this research:
2,028 ransomware victims were tracked in Q1 2025 — up from 1,005 in Q1 2024. That’s a 101.8% increase in attacks.
LockBit dropped from first place to 21st, with attacks falling from 219 in Q1 2024 to just 23 in Q1 2025.
65 ransomware gangs active in Q1 2025, up from 47 the year before — 14 were new or rebranded.
The top 10 victims had a combined annual revenue of $329.8 billion.
Estimated potential ransom demands (1%) from those top victims could exceed $3.3 billion.
Most targeted sectors are manufacturing and industrial, consumer and retail services, technology and IT, transportation and logistics, and business services.
Cl0p, Akira, and RansomHub were the most active ransomware gangs.
The US remains the top target with 783 known cases, followed by Canada and the UK.
The Cybernews research team has uncovered a severe data leak affecting a popular iOS app, Second Phone Number, which has been downloaded nearly 4 million times – over 3 million in the US alone. Marketed as a solution for “private calls and texts,” the app has instead exposed exactly what it promises to protect.
In our latest investigation, we found that a misconfigured Firebase instance has been leaking user messages, media as well as sender and recipient details.
This leak opens the door to identity theft, blackmail, and fraud. Some users employed the app for business or dating. Others sought anonymity for deeply personal reasons. In either case, their data is now vulnerable to cybercriminals who can scrape Firebase in real-time for new data.
Here’s why this story matters:
It’s a systemic problem. This discovery is part of the large-scale research of 156,000 iOS apps. We found that 71% leak at least one sensitive secret.
Users trust the App Store. Apple’s ecosystem is perceived as safe. This story challenges that perception.
The implications are serious. Leaked messages could be used to impersonate, harass, or blackmail users. Developers could lose access to paid services due to leaked API keys.
Despite multiple outreach attempts, the app’s creators have not secured the database. This is an ongoing and active leak – users are still at risk.
Over 50% of top oil & gas firms hit by data breaches in last 30 days: Cybernews
Posted in Commentary with tags Cybernews on May 20, 2025 by itnerdA recent Cybernews analysis found that 94% of the world’s top 400 oil and gas companies have suffered at least one data breach to date. Over 50% of the analyzed oil and gas firms were breached in just the last 30 days.
Moreover, according to the Cybernews Business Digital Index, which grades businesses based on their online security measures, 69% of the companies received a cybersecurity score of D or F, and only 10% achieved an A grade.
Key research takeaways:
To read the full research, please click here.
Research Methodology
For this study, Cybernews researchers evaluated 391 companies in the oil and gas industry worldwide. The companies were selected from Companiesmarketcap’s “Largest Oil and Gas Companies by Market Cap” list.
This report assesses cybersecurity risk across seven core dimensions: software patching, web application security, email security, system reputation, system hosting, SSL/TLS configuration, and data breach history.
The report’s full Methodology can be found here. It provides detailed information on how researchers conducted this analysis.
Leave a comment »