Cisco Hit by Major Cyberattack Linked to Supply Chain Breach Cisco is responding to a significant cybersecurity incident after threat actors breached its internal development networks, stealing sensitive source code and corporate data. The attack, claimed by the hacking group ShinyHunters, also allegedly impacted Salesforce, Aura, and AWS storage buckets. The breach originated from a supply chain attack involving Trivy, a widely used vulnerability scanner. Attackers exploited a malicious GitHub Action plugin tied to the Trivy compromise, allowing them to steal credentials and infiltrate Cisco’s build environments. Once inside, they compromised dozens of devices, including lab workstations and developer systems, gaining access to highly sensitive data. The stolen material includes AWS keys, which were used to perform unauthorized actions in Cisco’s cloud accounts, and over 300 private GitHub repositories. These repositories contain unreleased product source code, including AI Assistants and AI Defense technologies, as well as data belonging to corporate clients, such as major banks, BPO firms, and U.S. government agencies. Cisco’s security teams including the Unified Intelligence Center, CSIRT, and EOC moved quickly to contain the breach by isolating affected systems, wiping compromised machines, and enforcing a mass credential reset. However, the company has not yet issued a public statement, and internal sources suggest ongoing complications from the incident. While ShinyHunters has taken credit for the data theft, security researchers link the underlying Trivy supply chain attack to TeamPCP, a separate group known for deploying custom malware ("TeamPCP Cloud Stealer") to hijack developer platforms like Docker, NPM, and PyPi. TeamPCP has also been tied to recent breaches of LiteLLM and Checkmarx, raising concerns about secondary attacks stemming from related vulnerabilities.

Aura Data Breach Exposes Over 2 Million Records in Dark Web Leak On March 11, 2026, digital security firm Aura confirmed a data breach after threat actor ShinyHunters posted claims on a dark web forum, alleging the theft of over two million records. The compromised data reportedly includes personally identifiable information (PII), such as names, email addresses, home addresses, and phone numbers. Aura stated that Social Security numbers, passwords, and financial details were not exposed, though the exact scope and timeline of the breach remain unconfirmed. ShinyHunters, a group linked to multiple high-profile breaches, claimed responsibility for the attack, though Aura has not disclosed how the intrusion occurred or when it was detected. The company is investigating the incident, and affected individuals are advised to monitor for potential fraud, though no direct notification process has been outlined. The breach highlights ongoing risks to corporate and consumer data, with exposed PII potentially enabling phishing campaigns or identity theft. Further details on the attack vector and mitigation efforts are pending.

Aura Confirms Data Breach Affecting Nearly 900,000 Customers Following Vishing Attack Identity protection firm Aura has disclosed a data breach exposing nearly 900,000 customer records, including names, email addresses, home addresses, and phone numbers. The incident stemmed from a voice phishing (vishing) attack targeting an employee, which compromised data from 20,000 current and 15,000 former customers. The breach originated from a marketing tool used by a company acquired by Aura in 2021, which contained limited customer information. While Aura confirmed that Social Security Numbers (SSNs), passwords, and financial data were not accessed, the Have I Been Pwned (HIBP) service found that 90% of the exposed email addresses had already been compromised in prior breaches. The ShinyHunters threat group claimed responsibility for the attack, alleging they stole 12GB of files containing personally identifiable information (PII) and corporate data. The group leaked the data after claiming Aura failed to negotiate with them. Aura has not commented on ShinyHunters’ assertions or reports of an Okta SSO compromise. Aura is conducting an internal investigation with external cybersecurity experts and has notified law enforcement. Affected individuals will receive personalized notifications in the coming days. The company clarified that while 901,000 accounts were exposed, only 35,000 belonged to Aura customers, with the rest tied to the acquired firm’s legacy database.