PcComponentes hit by cyberattack
Incident
Summary
Hide ▲
Show ▼
PcComponentes confirmed a credential stuffing attack on its platform, and the event mattered because a small number of accounts were compromised and account protections had to be tightened. The company responded with CAPTCHA, mandatory 2FA, and session invalidation to block further abuse.
Related Happenings
DraftKings hit by network compromise
Incident
First: 17.04.2026 10:10
Last: 17.04.2026 10:10
Sources 1
About this happening:
**DraftKings** suffered a **credential-stuffing account compromise** that exposed nearly **68,000 accounts** and enabled theft from roughly **1,600 accounts**. Attackers reused cr...
DraftKings hit by network compromise
IncidentAbout this happening: **DraftKings** suffered a **credential-stuffing account compromise** that exposed nearly **68,000 accounts** and enabled theft from roughly **1,600 accounts**. Attackers reused cr...
Unnamed high-profile Lebanese journalist hit by network compromise
Incident
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
An **unnamed high-profile Lebanese journalist** had an **Apple account** successfully compromised in **2025**, creating unauthorized access to a personal and professional identity...
Unnamed high-profile Lebanese journalist hit by network compromise
IncidentAbout this happening: An **unnamed high-profile Lebanese journalist** had an **Apple account** successfully compromised in **2025**, creating unauthorized access to a personal and professional identity...
Microsoft Entra device code phishing and vishing campaign
Campaign
First: 19.02.2026 14:30
Last: 19.02.2026 14:30
Sources 1
About this happening:
A **device code phishing campaign** is targeting **Microsoft 365 identities** through the **OAuth 2.0 device authorization flow**, letting attackers steal valid access tokens afte...
Microsoft Entra device code phishing and vishing campaign
CampaignAbout this happening: A **device code phishing campaign** is targeting **Microsoft 365 identities** through the **OAuth 2.0 device authorization flow**, letting attackers steal valid access tokens afte...
ShinyHunters vishing campaign targeting SSO accounts
Campaign
First: 02.02.2026 15:46
Last: 02.02.2026 15:46
Sources 1
About this happening:
The **ShinyHunters** group ran a **voice phishing** campaign against **single sign-on (SSO) accounts** at **Okta, Microsoft, and Google**, widening risk across **more than 100 hig...
ShinyHunters vishing campaign targeting SSO accounts
CampaignAbout this happening: The **ShinyHunters** group ran a **voice phishing** campaign against **single sign-on (SSO) accounts** at **Okta, Microsoft, and Google**, widening risk across **more than 100 hig...
Latest development: 26.05.2026 22:46
ShinyHunters claims it breached Charter Communications on April 1 by vishing an employee's Microsoft Entra account, then used that access to export millions of consumer and business customer records from the company's Salesforce instance; Charter says no sensitive personal information or CPNI was exfiltrated.
Custom vishing campaign stealing Okta SSO credentials
Campaign
First: 22.01.2026 23:43
Last: 22.01.2026 23:43
Sources 1
About this happening:
A **custom vishing campaign** is actively stealing **Okta SSO credentials** through live, adversary-in-the-middle phishing pages, creating immediate risk of account takeover and d...
Custom vishing campaign stealing Okta SSO credentials
CampaignAbout this happening: A **custom vishing campaign** is actively stealing **Okta SSO credentials** through live, adversary-in-the-middle phishing pages, creating immediate risk of account takeover and d...
Timeline
-
21.01.2026 22:55 1 articles · 4mo ago
daghetiaw claims 16.3 million-record PcComponentes leak
Initial DisclosureA threat actor named daghetiaw claimed to have stolen a PcComponentes customer database with 16.3 million records, leaked 500,000 records, and offered the rest for sale, with the claimed dataset containing order details, physical addresses, full names, phone numbers, IP addresses, product wish-lists, and Zendesk support messages.
Show sources
- Online retailer PcComponentes says data breach claims are fake — www.bleepingcomputer.com — 21.01.2026 22:55
-
21.01.2026 22:55 2 articles · 4mo ago
PcComponentes confirms credential stuffing and hardens logins
Mitigation Patch UpdatePcComponentes said its investigation found no illegitimate access to databases or internal systems, but did find evidence of a credential stuffing attack against its platform. Hudson Rock said the stolen logins were likely taken from infostealer logs, with some credentials dating back to 2020, and PcComponentes responded by adding CAPTCHA on login pages, requiring two-factor authentication for all accounts, and invalidating active sessions.
Show sources
- Online retailer PcComponentes says data breach claims are fake — www.bleepingcomputer.com — 21.01.2026 22:55
- Online retailer PcComponentes says data breach claims are fake — www.bleepingcomputer.com — 21.01.2026 22:55