Two of today’s three biggest stories trace back to the same entry point: a phone call an employee believed was internal. Here’s what’s new since yesterday’s digest.
Data breach watch: ShinyHunters claims 284 million McKesson patient records after vishing two employees
McKesson discovered unauthorized access to its network on August 25 and disclosed the incident in an SEC Form 8-K filing days later; the investigation is still in its early stages. The extortion group ShinyHunters claims it voice-phished two McKesson employees to gain a foothold, then pulled data out of connected Salesforce and Snowflake instances. The group is demanding $55.2 million to prevent release of the files. Exposed data reportedly includes names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication and allergy information, and physician details. ShinyHunters itself has walked back the headline figure, clarifying that 284 million is a raw count of data rows rather than unique individuals — the group says it hasn’t finished analyzing what it took. CyberInsider · BleepingComputer
The attack path is the part worth stealing for your own defenses, not the record count: a vished employee reaching a SaaS data warehouse is a session-scoping and conditional-access problem, not a Salesforce or Snowflake problem. If your team can’t answer “what could one compromised login pull out of our CRM or data warehouse right now,” that’s this week’s task.
Data breach watch: Manchester Airports Group breach exposes 8.7 million customers across three UK airports
An unauthorized third party accessed customer data tied to Manchester, Stansted, and East Midlands airports, affecting roughly 8.7 million people. The exposed records cover car park, lounge, and Fast Track bookings, plus in-airport WiFi sign-ups — email addresses, phone numbers, vehicle registrations, and postcodes. Payment data was not involved, and MAG says airport operations, passenger safety, and aviation security were unaffected. The company says it contained the incident quickly, brought in outside specialists, and has notified the UK Information Commissioner’s Office. Help Net Security · ITPro
No passwords or payment cards in the exposed set doesn’t make this low-risk — email, phone, vehicle registration, and postcode is exactly the combination that makes a convincing “your parking booking has an issue” phishing lure. If a partner or vendor holds this kind of ancillary booking data on your customers, it’s worth asking now what their breach notification SLA actually is.
Vulnerability watch: Critical Gitea RCE under active exploitation, 8,300+ servers still unpatched
Security researcher Shai Rod reported CVE-2026-60004, a code injection flaw in Gitea’s diffpatch API that lets an attacker with repository write access plant a malicious patch and run shell commands as the Gitea service account. Because Gitea ships with self-registration enabled by default, an unauthenticated attacker can register an account, create a repo, and trigger the bug without any prior access. A fix shipped July 27 in version 1.27.1, but Shadowserver still counts over 8,300 internet-exposed instances unpatched as of this week, and attackers are actively dropping cryptocurrency-mining payloads on them. CISA added the CVE to its Known Exploited Vulnerabilities catalog and, under the newly issued Binding Operational Directive 26-04, gave federal civilian agencies a three-day window — until August 28 — to patch or take affected instances offline. BleepingComputer · The Hacker News
A patch that’s been available for a month and is still unapplied on thousands of servers is the more useful signal here than the CVE itself: if you self-host Gitea, confirm you’re on 1.27.1+ and turn off self-registration unless you actually need it — that alone closes the unauthenticated path.
Also noted
Hasbro disclosed on August 28 that attackers accessed the personal and financial information of an undisclosed number of employees — potentially including names alongside email, address, phone number, national ID number, or financial details, depending on the individual. The disclosure came through notification letters filed with the Massachusetts attorney general’s office; Hasbro has not linked it to an earlier incident from March. BleepingComputer
Final thought
McKesson and Manchester Airports Group land on opposite ends of the sensitivity spectrum — protected health information versus car-park bookings — but both breaches came down to what a compromised login or a stolen dataset can reach downstream, not a single dramatic exploit. The Gitea story is the counterpoint: a known, patched bug that’s still open on thousands of servers a month later. Patch management and access scoping aren’t the exciting parts of the job, but they’re what showed up in every story today. If you want a second set of eyes on how far a single compromised account could reach in your environment, see our how-to guides or book a discovery call.