Cyber Security News

## Hacking Brief – April 13, 2026

Multiple data breaches dominated the threat landscape today, with fitness chain Basic-Fit confirming unauthorized access affecting approximately 200,000 members in the Netherlands and additional users across multiple countries. The breach exposed names, addresses, email addresses, phone numbers, dates of birth, and bank account details, though the company states passwords and identity documents were not compromised. Separately, Rockstar Games confirmed a breach of its infrastructure linked to compromised Snowflake servers, with threat actors issuing "pay or leak" ransom demands. Booking.com also disclosed that unauthorized third parties gained access to customer booking data, though the scope remains unclear.

Supply chain attacks continued to pose significant risks, with OpenAI revoking macOS app certificates following a malicious incident involving the Axios dependency, attributed to threat group UNC1069. In a separate WordPress supply chain compromise, unknown actors hijacked the update system for Smart Slider 3 Pro plugin to distribute version 3.5.1.35 containing a weaponized remote access toolkit. Meanwhile, a critical pre-authenticated RCE vulnerability in Marimo Python Notebook (CVE-2026-39987, CVSS 9.3) was exploited within 10 hours of public disclosure, and Google's Threat Intelligence Group identified UNC6783 conducting social engineering extortion campaigns using fake Okta login pages to target dozens of organizations.

Emerging threats include the XP95 hacker group claiming access to half a million files from Dublin-based recruitment platform Healthdaq, prompting alerts across Northern Irish health trusts. In the cryptocurrency sector, Polkadot's DOT token experienced unauthorized minting on Ethereum following a hack. On the offensive security front, Anthropic's Claude Mythos AI model reportedly identified thousands of zero-day vulnerabilities across major operating systems and browsers, producing working exploits in under 24 hours.

Sources: Silicon Republic · The Hacker News · The Hacker News · The Hacker News · NL Times · NL Times · TweakTown · Cybersecurity Dive · Blooming Bit · Help Net Security