# Threat Watch by Helix — Breaches

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1786 incidents, 40 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 987 incidents, 5 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 8 incidents, 5 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (5)

### [medium] Assurance Retraite data breach: 70K accounts exposed
https://helix.ml/threat-watch/i/assuranceretraite-data-breach · Breaches · no-fix-needed · since 2026-10-20
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account. Exposed data: dates of birth, email addresses, family members' names, government issued ids, income levels, marital statuses, names, phone numbers, physical addresses. The breach dates from Sep 1, 2024; Have I Been Pwned loaded it on Oct 20, 2026.
Do: If you had a Assurance Retraite account, change its password and the password of any other account that reused it.; Turn on multi-factor authentication wherever it is offered.; Check whether your addresses are in this breach at https://haveibeenpwned.com.; Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.

### [high] PingCAP (TiDB Cloud): Extortion group FulcrumSec used stolen service account credentials to access internal systems, copying business data and source code
https://helix.ml/threat-watch/i/pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying · Breaches · no-fix-needed · since 2026-10-19
On Oct 19, 2026, PingCAP disclosed that extortion group FulcrumSec breached its internal systems between Sept 9 and Oct 7 using stolen service account credentials, copying data and source code. Forensics found no evidence attackers accessed customer TiDB databases or ran malicious commands, but exported records included TiDB Cloud account info, billing/contract details, email addresses, SQL editor text, encrypted API keys, and a four-year log of customer connections. FulcrumSec claims broader access (financial records, Google Cloud files, Jira, CRM, analytics) and named ~2,500+ affected organizations including Airbnb, Booking.com, Baidu, Fujitsu, Capcom, Konami, and Square Enix. PingCAP has invalidated compromised credentials, fixed four reported vulnerabilities, and advised API key rotation.
Do: Rotate TiDB Cloud management API keys immediately and audit for anomalous usage; Be alert for targeted phishing using stolen billing/contract/contact data; brief staff and verify vendor communications out-of-band; Review exposed account and usage data for sensitive contents and assess downstream compliance/notification obligations; Monitor PingCAP's Trust Hub for customer-specific impact confirmations; Harden service account credentials and access paths for cloud vendors holding business data

### [medium] Gîtes de France data breach: 117K accounts exposed
https://helix.ml/threat-watch/i/gitesdefrance-data-breach · Breaches · no-fix-needed · since 2026-10-18
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details. Exposed data: booking details, email addresses, names, phone numbers, physical addresses. The breach dates from May 16, 2026; Have I Been Pwned loaded it on Oct 18, 2026.
Do: If you had a Gîtes de France account, change its password and the password of any other account that reused it.; Turn on multi-factor authentication wherever it is offered.; Check whether your addresses are in this breach at https://haveibeenpwned.com.; Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.

### [medium] Crunchbase data breach: 559K accounts exposed
https://helix.ml/threat-watch/i/crunchbase-data-breach · Breaches · no-fix-needed · since 2026-10-14
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, social media profiles. The breach dates from Jan 22, 2026; Have I Been Pwned loaded it on Oct 14, 2026.
Do: If you had a Crunchbase account, change its password and the password of any other account that reused it.; Turn on multi-factor authentication wherever it is offered.; Check whether your addresses are in this breach at https://haveibeenpwned.com.; Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.

### [medium] Sharecare data breach: 318K accounts exposed
https://helix.ml/threat-watch/i/sharecare-data-breach · Breaches · no-fix-needed · since 2026-10-12
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers). Exposed data: dates of birth, email addresses, employers, genders, government issued ids, job titles, marital statuses, names, phone numbers, physical addresses. The breach dates from Aug 12, 2026; Have I Been Pwned loaded it on Oct 12, 2026.
Do: If you had a Sharecare account, change its password and the password of any other account that reused it.; Turn on multi-factor authentication wherever it is offered.; Check whether your addresses are in this breach at https://haveibeenpwned.com.; Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.