The IT Nerd

The Cybernews research team has uncovered a major data leak exposing over 100 million detailed records tied to Swedish citizens and companies.

An unsecured server exposed a large collection of sensitive business intelligence and personal data, with records spanning 2019 to 2024 across 25 indices — some over 200GB in size.

Analysis suggests the data originated from Risika, a leading Nordic data analytics firm. However, metadata indicates the server was likely operated by an unidentified third-party client, not Risika itself.

What data was leaked?

• Full legal names, including history of previous names
• Swedish personal identity numbers
• Date of birth and gender
• Address history, both in Sweden and abroad
• Civil status and information about deceased individuals
• Foreign addresses for emigrants
• Debt records, payment remarks, bankruptcy history, property ownership indicators
• Income tax data spanning several years (2019–2023)
• Activity and event logs (including income statement submissions, migration status, and address updates)

Significance of this leak

• These records effectively mapped out a five-year financial and behavioral profile of Swedish citizens and organizations, making the scale and precision of this leak especially concerning.
• The leaked data offered a detailed, time-stamped snapshot of how both individuals and organizations function, tracking everything from address changes and income shifts to debt, tax filings, and business ties.
• The sheer volume and precision of the information make the dataset extremely valuable and dangerous. Banks, lenders, and compliance teams could use it for risk assessments and credit analysis. 
• Attackers could weaponize this intelligence for everything from corporate surveillance and competitor profiling to highly targeted phishing campaigns, social engineering, or extortion. 

To read the full research report, please click here.

By Jurgita Lapienytė

It began, as these stories often do, not with a bang but with a boast. Almost two months ago, a hacker, posting on a shadowy forum, claimed to have siphoned off 1.2 billion Facebook user records – names, email addresses, phone numbers, birthdays, locations, the digital breadcrumbs of real lives. 

The research team at Cybernews set out to verify the claim. They examined a sample of 100,000 unique Facebook user records shared by the attackers, and the data appeared legitimate.

If the hacker’s numbers are even half right, it means hundreds of millions of people could soon find their inboxes flooded with targeted phishing scams, their phone numbers sold to spammers, and their personal details circulating in criminal marketplaces – fuel for identity theft, financial fraud, and years of privacy headaches.

However, Meta’s response was a shrug and a hyperlink: a brief statement, then a redirect to a four-year-old blog post about “combating scraping.” No fresh explanation, no sense of urgency. Just another corporate brush-off, as if the world’s largest social network hadn’t just sprung another leak. It’s as if they don’t even understand what we’re fussing about.

This isn’t a one-off. In 2021, Facebook lost control of data on over 500 million users, and the price was a European slap on the wrist – $266 million. Since then, the leaks have kept coming, each time with the same ritual: denial, deflection, and a vague promise to “do better.”

Why does this keep happening? Because the modern internet runs on APIs – digital pipelines that let apps and services talk to each other, and, too often, let bad actors – in many cases, opportunistic marketists not bothered by ethics or troubled by the notion of privacy – siphon off whatever they please. Facebook’s APIs are gold for anyone with a script and a grudge. In the past few years, many companies – such as LinkedIn, Dell, Duolingo, and DeepSeek – have seen their APIs probed and plundered.

What can criminals do with this data? With a haul this size, they can automate scams at industrial scale. They can impersonate, phish, and defraud with uncanny precision. For the average person, it means a future where your inbox, your phone, and your sense of privacy are under constant siege.

It’s not only criminals who can and will make use of such data. Advertising firms and various data brokers simply blossom on these datasets. With them, our privacy is dead on arrival, as numerous examples show. They don’t even shy away from publicly acknowledging they’re listening to you using your phone just so they could serve you better ads.

We should stop pretending this is a technical inevitability. It’s a choice – a choice to treat user data as a resource to be mined, not a trust to be guarded. It’s a choice to react to breaches with PR instead of prevention.

What would real accountability look like? For starters, transparency: Meta should spell out exactly what was taken, how, and what it’s doing to prevent the next round. 

Regulators should stop accepting apologies and start demanding airtight safeguards for APIs and user data, and also impose penalties that actually sting. 

And we, as users, should demand tools that put control of our digital lives back in our own hands – because accepting business as usual only guarantees we’ll be the next victims.

Until then, the cycle will repeat. Another breach, another apology, another round of “unprecedented” headlines. The only thing truly unprecedented is our willingness to look away.

ABOUT THE EXPERT 

Jurgita Lapienytė is the Editor-in-Chief at Cybernews, where she leads a team of journalists and security experts dedicated to uncovering cyber threats through research, testing, and data-driven reporting. With a career spanning over 15 years, she has reported on major global events, including the 2008 financial crisis and the 2015 Paris terror attacks, and has driven transparency through investigative journalism. A passionate advocate for cybersecurity awareness and women in tech, Jurgita has interviewed leading cybersecurity figures and amplifies underrepresented voices in the industry. Recognized as the Cybersecurity Journalist of the Year and featured in Top Cyber News Magazine’s 40 Under 40 in Cybersecurity, she is a thought leader shaping the conversation around cybersecurity. Jurgita has been quoted internationally – by Metro UK,  The Epoch Times, Extra Bladet, Computer Bild, and more. Her team reports on proprietary research highlighted in such outlets as the BBC, Forbes, TechRadar, Daily Mail, Fox News, Yahoo, and much more. 

The Cybernews’ research team examined billions of passwords from over 200 cybersecurity incidents, revealing that individuals frequently select US states as their passwords. Carolina, Dakota, and Texas are the most popular and appear in thousands, even millions, of analyzed passwords, making them not a reliable choice for account security.

Being proud of your state makes you more likely to get hacked 

Even though everything is bigger in Texas, it is not the biggest and best choice for a password. And even though Texas appeared in passwords around 1M times, it only came out third on the list. Surprisingly, even California, the most populated state in the US, only ranked 11th on the wordlist (p. 18), with 556.9K uses. 

Carolina (1.9M) and Dakota (1.2M) are the two most popular US states that will not keep hackers away. At least one of these states will appear once around every 6K passwords. Interestingly, the number of times Alaska is mentioned in passwords is almost the same as that of its residents. 

The ten most popular states used in passwords

You can find the ten most popular states and how often they were named in passwords here: 

1. Carolina — 1,921,229 
2. Dakota — 1,171,849 
3. Texas — 1,067,634 
4. NewYork — 968,905 
5. Florida — 879,400 
6. Montana — 795,246
7. Maine — 783,380
8. Georgia — 710,455
9. Alaska — 674,948
10. Hawaii — 589,977

Network Assured released a report listing the 10 U.S. states with the most data breaches, both historically and in 2022. The data shows that Texas was the third-worst state for data breaches, with 581 reported incidents, despite having the highest state cybersecurity budget at $800 million. Not only does Texas rank third overall in the report, but it also ranked high in Cybernews research, being the third most mentioned state in passwords. These statistics suggest that investing heavily in cybersecurity alone may not solve issues caused by poor human practices unless resources are used effectively. 

However, some states appeared in passwords the least number of times. States and combinations like “NorthDakota,” “SouthDakota,” “NewHampshire,” “SouthCarolina,” “WestVirginia,” “Massachusetts,” “RhodeIsland,” “Pennsylvania,” “NorthCarolina,” and “NewMexico” were mentioned only about 3K times each.

The combinations mentioned above, especially those containing two words, are safer than the most popular states, but aren’t the safest option. Even though they are longer than eight characters and include both lower-case and upper-case letters, passwords should also incorporate numbers and special characters to reduce the risk of being leaked. Tools like the Password leak checker are available to check if a password has been compromised. 

To read the complete research, please click here. 

The Cybernews research team has uncovered data leak involving Fitify, a popular fitness app with over 25 million installs globally. Researchers discovered that 373,000 sensitive user files — including 138,000 progress photos — were stored in a publicly accessible Google Cloud bucket — with no password protection or encryption at rest, meaning anyone could access them.

Among the leaked files were:

• 206,000 user profile photos
• 138,000 progress pictures uploaded by users to track fitness changes
• 13,000 AI coach message attachments, which may include images or text
• 6,000 body scan files, including photos and AI-generated metadata (e.g., lean mass, body fat, posture)

Key research highlights 

• Many of the exposed photos were semi-nude body scans, captured by users trying to document weight loss or muscle growth.
• Fitify promises encryption in transit, but the lack of basic access controls poses serious privacy risks.
• Researchers also found hardcoded secrets embedded in the app’s code — including Google API and Client IDs, Firebase database URLs, Facebook tokens, and even an Algolia API key, which wasn’t disclosed in the privacy policy.
• These exposed credentials could let attackers access backend infrastructure, impersonate users, or inject malicious content.

To read the full research report and see samples of screenshots, please click here.

Following Russia’s February 2022 invasion, VPN searches surged across Ukraine as citizens sought ways to share critical information and engage in digital activism. Yet in a cruel irony, the very privacy apps designed to protect users became a liability in occupied territories, where their presence on a phone during routine checks could lead to arrest.

An original analysis by the Cybernews research team reveals how VPN usage in wartime Ukraine diverged dramatically from typical patterns. Ukrainians turned to these privacy tools for digital activism and coordinated DDoS attacks rather than streaming Netflix or bypassing geo-blocks.

Study methodology:

• Cybernews analyzed 111 VPN-related posts from Ukrainian Reddit and Telegram channels during the first year of the full-scale war.
• Content was coded into 8 categories: information sharing, digital activism, security/privacy, geo-unblocking, free VPN offers, miscellaneous, and censorship circumvention.
• Data contextualized with search trend analysis and occupation zone dynamics.

Breakdown of Reasons for VPN Usage:

• Information sharing was the reason 34% of Ukrainians turned to VPNs.
• Digital activism, including DDoS attack coordination, accounted for 20% of motivations for VPN usage. 
• Security and privacy protection represented 17% of VPN usage motivations.
• Traditional VPN use cases, such as geo-unblocking (10%) and circumventing Russian censorship (5%), were rare motivations for using VPNs in Ukraine during the first year of war.

Platform-specific patterns:

• Telegram (56% of information sharing): Focused on official safety advisories and survival protocols, reflecting its role as Ukraine’s essential wartime communication tool.
• Reddit (28% digital activism focus): Became a hub for coordinating DDoS attacks and cyber resistance tactics against Russian targets.

Regional risk dynamics:

• VPN searches spiked in occupied/threatened regions: Crimea, Luhansk, Donetsk, Kherson, Zaporizhzhia, Kyiv, and Odesa.
• In occupied territories like Kherson, having VPN apps, Signal, or Tor could trigger arrest during routine phone checks.
• Russia saw a 668% increase in VPN usage due to state censorship, while Ukraine’s adoption remained lower due to physical risks.

The asymmetric risk landscape

Unlike typical scenarios where VPNs enhance privacy, our analysis reveals what cybersecurity scholars call an “asymmetric risk” environment. In occupied territories, privacy tools designed to protect users became potential evidence of resistance, creating a paradox where digital security measures increased physical danger.

Conclusion 

VPNs in wartime Ukraine functioned not as universal privacy solutions but as highly contextual tools whose use depended on geography, occupation status, and individual risk tolerance. While some used VPNs to coordinate digital resistance from safer areas, others in occupied territories avoided them entirely to survive physical scrutiny. This research demonstrates how conflict fundamentally alters the landscape of digital privacy and security.

To see the full study, please visit: https://cybernews.com/cyber-war/study-reveals-reasons-why-ukrainians-use-vpns-during-wartime/ 

As the world prepares to celebrate Artificial Intelligence Appreciation Day on July 16th, the recent Grok scandal has reminded us that AI can’t serve or be celebrated by the public unless it’s secure and trustworthy. 

To address AI security, the Cybernews research team has analyzed potential security issues of AI tools used by the S&P 500 companies, and found that security risks are mounting due to the fast adoption of AI tools across industries. 

Key findings:

• 98% of S&P 500 companies now use AI in their operations – from finance and healthcare to critical infrastructure.
• The report identifies 970 AI-related security risks across 327 leading US companies, including:
  • 194 instances of possibly insecure AI output (e.g., flawed recommendations, unsafe automation),
  • 175 data leakage risks (there already are high-profile cases like Samsung’s code leak via ChatGPT),
  • 64 potential cases of IP theft through AI-driven model extraction and compromised platforms.
• Critical infrastructure and patient safety are at risk, with 35 attack vectors identified in sectors like energy and utilities. Real-world examples already include IBM Watson’s unsafe cancer treatment advice and Zillow’s $400 million loss from predictive algorithm errors.

Please read the full report here. 

The Cybernews research team has discovered that Consentik, a Shopify plugin designed to help merchants comply with privacy laws such as GDPR, LGPD, and CCPA, was exposing hundreds of online stores, broadcasting real-time site analytics and private authentication tokens.

Key research takeaways

• Hundreds of Shopify storefronts were vulnerable to code injection, data theft, and account takeovers due to an insecure Consentik plugin.
• The insecure compliance plugin was leaking real-time site analytics and private authentication tokens, including Shopify admin credentials and Facebook ad tokens.
• The leak was caused by an unsecured Kafka server.
• The data was available to anyone on the internet for at least 100 days before closure. 

What was leaked?

• Site analytics data
• Shopify Personal Access Tokens
• Facebook Auth Tokens

Significance of this leak 

This data leak puts e-commerce businesses operating in sectors like fashion, cosmetics, fitness, and consumer electronics at risk, and may have allowed anyone to intercept with admin-level access.

In the wrong hands, a valid Shopify token can mean total control of a store, including customer data access, price manipulation, malicious code injection, or even replacing entire storefronts with lookalike phishing pages.

Additionally, these kinds of compromises can seriously damage a brand’s trust with users. In the EU and California, such oversights could bring legal scrutiny, fines, or even class-action litigation.

To read the full research report and see samples of leaked screenshots, please click here.

The Cybernews research team has discovered that the iOS app FlirtAI – Get Rizz & Date has leaked over 160,000 chat screenshots, many of which contain private conversations that users submitted for assistance from the app, designed to analyze them and act as an AI “wingman.” 

Worryingly, leaked data indicates that FlirtAI — Get Rizz & Dates was often used by teenagers, who fed the AI screenshots of their conversations with their peers.

What data did the FlirtAI app expose?

• Chat screenshots
• Dating profile screenshots
• Identifying information of other people

Potential dangers of this leak

People whose screenshots were exposed may experience emotional distress. According to the researchers, FlirtAI – Get Rizz & Dates caters to young individuals who might be struggling with self-esteem or confidence. Having their conversations leaked could take a serious toll on their mental well-being.

To read the full research report, please click here.

The Cybernews research team have conducted a comprehensive study of over 19B passwords from over 200 cybersecurity incidents and uncovered several 2025 password creation trends. Not only out of 19B passwords only around 1.1B were unique, but according to the researchers, offesive words are popular choice — many people choose to use fuck, ass, hell and many other in their passwords.

Profane or offensive words are a widespread practice

Cybernews researchers discovered that profanity in passwords is a common trend — the top entry was “ass”, and it was used in almost 1% of all passwords, or over 165M times. However, this can be partly explained by using “pass” or “password.” 

Surprisingly, people more often chose to use hell (19.9M) as their password than Jesus (16.6M) and the word tit (23.4M) was chosen almost the same amount of times as god (23.9M). According to researchers, the chance of a successful attack rate against users with passwords from the swearwords wordlist (p.19) in brute-forcing or hash-cracking scenarios is 1.65%.

Cybernews research team found that the ten most popular swearwords used in passwords were these:

1. ass (165M)
2. god (23.9M)
3. tit (23.4M)
4. hell (19.9M)
5. jesus (16.6M)
6. fuck (16.5M)
7. sex (9.5M)
8. shit (6.5M)
9. butt (5.6M)
10. arse (5M)

Similar research was done by the Cybernews research team back in 2022. The most popular swearwords haven’t changed much: “ass”, “fuck”, “god”, “tit”, and “shit” were used the most in 2022. However, researchers found that people often used such words as “git” and “xxx”, and in 2025, these words weren’t even in the TOP 30.

The US topped the list of countries that swear the most

According to a study that analyzed which countries swear the most online, the United States came out first, followed by the United Kingdom and Australia. Another study found, that the typical American uses up to 90 swearwords a day and the country even shows the highest rates for using “fuck”. 

Using positive words makes it even more likely to be successfully hacked

Many people also choose to use words that they associate with positivity. Researchers found that the most popular positive words were love (87M), win (34M), and star (30M). The chance of a successful attack against users who choose words from the positive words list (p. 12) is 2.12%.

Some people might recognise patterns discussed here in their personal experience. If so, several easily accessible tools can help people review their data. One of them is Cybernews Password leak checker, where you can enter your password and check if it has leaked.

Methodology

Cybernews research team analyzed data from leaks and breaches in 12 months starting in April 2024. The original leaks contained over 3TB of data and were loaded with information that could be used to steal accounts or impersonate affected people in identity theft attacks. The data included leaked databases, combolists, and stealer logs originating from around 200 cybersecurity incidents. Only data that became publicly available was analyzed. The analysed dataset contained 213 GB of leaked passwords.

Cybernews researchers have uncovered what may be the largest unreported credential leak in history — a staggering 16 billion login records exposed across 30 separate datasets. The data most likely originates from various infostealers and was briefly exposed in unsecured cloud storage systems.

Key research findings:

• The datasets that the team uncovered differ widely. The smallest, named after malicious software, had over 16 million records.
• The largest dataset, most likely related to the Portuguese-speaking population, had over 3.5 billion records.
• On average, one dataset with exposed credentials had 550 million records.
• 455 million records in a dataset referencing the Russian Federation, suggesting possible links to regional malware or data operations.
• 60 million records in a dataset labeled “Telegram.”
• Many datasets followed a uniform structure: URL — username/email — password, suggesting the use of modern infostealers as the primary data source.
• Numerous datasets contained tokens, cookies, and metadata, increasing the risk of bypassing multi-factor authentication and launching advanced phishing attacks.
• New datasets continue to surface every few weeks, highlighting how prevalent and persistent infostealer malware is in the wild.

Alarmingly, ownership remains unknown. The Cybernews team believes that some collections may have been curated by cybercriminals seeking to scale attacks.

Leak significance

Even with a low success rate, these massive collections enable phishing, identity theft, and unauthorized access at a global scale — and offer users very limited ways to defend themselves once exposed.

The exposure of 16 billion login credentials represents not just a security lapse but a critical turning point in how credential data is accumulated, stored, and exploited.

These findings raise urgent concerns about account security, data aggregation risks, and the lack of safeguards in credential management ecosystems.

To read the full research report, please click here.