Kaspersky MDR Adds Automatic Correlation with Leaked Credentials via Digital Footprint Intelligence
Kaspersky has enhanced its Kaspersky Managed Detection and Response (MDR) service with new capabilities to detect account takeovers earlier by correlating suspicious activity with leaked credentials.
The update integrates data from Kaspersky Digital Footprint Intelligence, a service that monitors an organization’s digital footprint and external threats. When employee credentials appear in a data breach and the system simultaneously detects anomalous behavior, analysts receive enriched context to investigate and prioritize incidents more effectively.
The feature addresses a growing threat: according to Kaspersky, compromised accounts were the initial vector in one quarter of attacks investigated in 2025. Using stolen credentials is often simpler for attackers than bypassing defenses directly, while distinguishing malicious activity from legitimate user behavior remains challenging.
Additional improvements include new notifications about the protection status of monitored assets. Administrators are alerted when connectivity problems or telemetry collection issues risk degrading monitoring quality. Recommended alert rules can now be customized according to the specific needs of the company or individual departments.
Managed security service providers gain the ability to set expected license usage limits for each client. The service also extends support to Kaspersky Embedded Systems Security for Linux 4.0, enabling protection of embedded Linux systems through the MDR platform.
Kaspersky MDR provides continuous monitoring of corporate infrastructure, threat hunting, incident investigation, and coordinated response to attacks.
Related articles
Major Game Leaks: Rhysida, Cyberleek and High-Profile Breaches at Insomniac, Naughty Dog and Rockstar
A detailed retrospective examines multiple high-impact leaks of unreleased games, including early builds of Marvel’s Wolverine and Spider-Man 2 stolen from Insomniac by the Rhysida group, cutscenes from The Last of Us Part II obtained via an AWS vulnerability at Naughty Dog, and extensive GTA VI alpha footage taken by teenager Arian Kurtaj through social engineering against Rockstar. The article also covers the recent Cyberleek operation targeting GTA VI, where the perpetrator combined leaks with a memecoin scheme. Investigations, legal outcomes, and the broader consequences for developers and platforms are analyzed in depth.
Metascan Confirms Limited Data Breach After Two-Minute Telegram Bot Compromise
Metascan has publicly acknowledged a data breach involving internal materials obtained through a compromised Telegram bot token. The attacker gained access to a corporate Telegram chat for approximately two minutes on September 5 and exported a small set of documents before being removed. The incident stemmed from an overlooked bot token on test virtual machines after an employee departure. Among the leaked items were two pilot project reports from July 2026 that mentioned major Russian organizations including Transneft, Selectel, Lenta, Sberbank, and Rostelecom. Metascan attributed the leak to a former employee now working with a competitor and rejected claims of deliberately hidden vulnerabilities. The company has accepted full responsibility, outlined corrective measures, and launched a bug bounty program.
Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency confirmed that its Government Solution Service (GSS) suffered unauthorized access after attackers exploited a vulnerability in VPN equipment used for external maintenance operations. The intrusion, believed to have begun in late May 2026, allowed threat actors to compromise maintenance accounts and access large volumes of files on internal servers. On June 25, 2026, security teams detected suspicious access to numerous files using a compromised account, prompting an investigation that concluded on July 9 with confirmation of the breach. Some files containing personal information may have been exfiltrated, affecting approximately 246,000 records of government officials, civil servants, contractors, and related individuals. The agency immediately disabled the affected accounts and severed external communications on July 9 but has not disclosed technical details of the exploited VPN vulnerability. The incident was reported by Security NEXT on September 11, 2026.
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.