Global Cyberattack Exposes Sensitive Data from 50 Major Companies via Stolen Credentials An Iranian hacker, operating under the aliases Zestix and Sentap, has breached the private files of approximately 50 corporations worldwide, including Iberia Airlines, Pickett & Associates, Sekisui House, and CRRC MA. The attack, uncovered by Israeli cybersecurity firm Hudson Rock, exploited weak security practices—specifically, the absence of multi-factor authentication (MFA)—to gain unauthorized access to corporate file-sharing platforms like ShareFile, Nextcloud, and OwnCloud. Rather than targeting the companies directly, the hacker leveraged infostealer malware—including RedLine, Lumma, and Vidar—to harvest passwords from unsuspecting individuals. These viruses, often distributed through malicious downloads or cracked software, silently extract saved browser credentials, which the attacker then used to infiltrate corporate systems. The stolen data spans highly sensitive materials: Iberia Airlines lost 77 GB of files, including aircraft safety manuals, while U.S.-based Pickett & Associates had 139 GB of utility infrastructure maps exposed. In Turkey, Intecro Robotics’ military drone and fighter jet designs were compromised, and Brazil’s Maida Health saw 2.3 TB of military police medical records stolen. Other victims included firms tied to public transit, aerospace, and financial services. Notably, some of the compromised passwords were years old, underscoring the risks of outdated credentials and the lack of basic security measures. Hudson Rock’s findings also revealed that employee credentials from companies like Samsung, Walmart, and Deloitte are circulating in hacker logs, leaving them potentially vulnerable to similar attacks. The incident highlights the critical role of MFA in preventing unauthorized access, as the breaches could have been thwarted with a simple secondary authentication step. The stolen data is now being auctioned on dark web forums, with no indication of whether affected organizations have secured their systems post-breach.