Hackers hack victims hacked by other hackers

Pinterest on Wednesday announced a new experimental app called “Ask Pinterest” that will allow the company to explore a more conversational approach to shopping and product discovery that could eventually find its way to the main Pinterest app. It also introduced other AI initiatives, including Pinterest Model Context Protocol (MCP), designed for advertisers running campaigns on Pinterest’s platform, and other AI ad tools.

Oracle warned its corporate customers that there is a critical-rated vulnerability in its PeopleSoft software, which is used by large companies to manage payroll and human resources, a day after a cybercrime group took credit for abusing the flaw as part of a mass-hacking campaign.

The company published the security advisory on Thursday after the hacking group ShinyHunters claimed to have breached more than 100 organizations that use PeopleSoft servers.

Mandiant, the Google-owned security unit that investigates cyberattacks, warned in a blog post that the new Oracle flaw is the same bug that the ShinyHunters group is abusing in its hacking campaign targeting PeopleSoft customers.

Oracle, which has not released a patch for the vulnerability at the time of writing, said in the advisory that the bug can be exploited over the internet without needing any authentication, such as a password.

The tech giant recommended that customers who use PeopleSoft software apply its mitigations to prevent exploitation.

On Wednesday, a ShinyHunters member told TechCrunch that the gang compromised the companies by abusing an unpatched flaw in PeopleSoft servers. The bug is known as a zero-day because the company affected, in this case Oracle, had no time to fix it before it was discovered and exploited.

Mandiant confirmed that it has also notified more than “100 global organizations,” most of them in the United States, in an effort to restrict access to their potentially vulnerable systems. The cybersecurity group said that about two-thirds of these organizations are in higher education, which aligns with what ShinyHunters previously claimed.

“While several organizations successfully blocked the activity or remediated the vulnerabilities, others experienced compromise, resulting in stolen data being published on the ShinyHunters [Data Leak Website],” Mandiant wrote.

Oracle did not respond to TechCrunch’s request for comment.

Do you have more information about this hacking campaign? Or other data breaches? We’d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.

The ShinyHunters member told TechCrunch this week that some of the hacked organizations are universities and colleges.

The hacker shared a message they said was sent to one of the victim schools, in which the hackers claimed to have stolen “hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and student ID across all campuses,” among other data.

PeopleSoft, and its customers, are the latest victims in a long series of hacking campaigns where the ShinyHunters gang targeted organizations that all share the same vulnerable software.

In the last year, the group targeted several companies that use Salesforce, Gainsight, and software provided by education giant Instructure, and among others.

Once the hackers identify vulnerable software and companies that use it, they try to steal corporate or customer data, and then threaten to release it unless the victims pay a ransom.

Earlier this year, education tech company Instructure said it paid the hackers after they breached the company’s systems twice. As part of the hacking campaign, ShinyHunters defaced the login pages of several schools that use Instructure’s popular school information portal Canvas. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Lorenzo Franceschi-Bicchierai is a Senior Writer at TechCrunch, where he covers hacking, cybersecurity, surveillance, and privacy.

You can contact or verify outreach from Lorenzo by emailing lorenzo@techcrunch.com, via encrypted message at +1 917 257 1382 on Signal, and @lorenzofb on Keybase/Telegram.

View Bio

For years, your phone’s Camera Roll has served dual purposes. In addition to helping you revisit special moments, it has also served as an archive for all sorts of things you find online, like recipes, fashion inspiration, travel ideas, interesting quotes, funny tweets, product recommendations, and more. Today, a new app called Pool is arriving to help you finally make sense of this digital clutter.

Image Credits:Pool

To get started with Pool, you simply give it permission to access your photos, which are moved into categories it calls “pools.” The pools created in the app are entirely dependent on the products, places, or things that you’ve saved over time, making them specific to you.

The app is one of many reinventing bookmarking in the AI era. Startups like mymind, Fabric, and Raindrop help users organize links, images, or other saved content, but Pool focuses specifically on screenshots and then uses AI to help users rediscover and act on things they intended to revisit later.

Image Credits:Pool

Once imported, Pool is able to track down the original link associated with a given screenshot. For instance, if the screenshot was of a product you were thinking of buying, it would link to the retailer’s website. If it were a recipe you saw on Instagram, it could pull up the ingredients and instructions the creator had shared. And so on.

The idea, explained Pool co-founder Maxime Junique, came about because both he and his co-founder Piet Terheyden had faced the same problem: they would screenshot things they wanted to remember, but then could never find them again.

“It sounds pretty obvious, right now, when we say it, but it’s something that we do so naturally — you don’t notice it, necessarily,” said Junique. The founders, who met years ago in a co-working space, asked their friends about the issue. The friends agreed that they would often screenshot and forget things, too, like design ideas or other types of inspiration.

Image Credits:Pool

The app was actually the first product to emerge from Spinoff Studio, the founders’ product and design studio, around three years ago. The first version was built in Lisbon over a couple of weeks while the founders lived out of a van, cranking out the landing page, website, and initial build. But they soon realized they needed to build some products that made money first, so they pivoted to B2B SaaS and shelved Pool.

The studio went on to build other products, including the CRM software Waitless, which was acquired last year.

What brought Pool back to life was the maturation of AI. Suddenly, its core idea of making sense of personal, largely unstructured datasets seemed feasible.

“We were like, it seems like a perfect time to go after this idea,” Junique told TechCrunch. “And it also seemed to us like it’s a super untapped, unexplored data set for AI. Everyone goes after emails, bank transactions, chat logs — all of those productivity-first datasets. Who is going after this really, deeply emotional data set we all own?”

Image Credits:Pool

Pool’s app also treats your screenshots like memories, meaning some of them are more relevant at the moment, while others disappear over time.

For example, if you screenshot the barcode to an event ticket, it could disappear later on after the event has taken place. Meanwhile, if you screenshot a flyer on Instagram about an upcoming event, Pool’s AI agents can help you find where to buy the tickets and link to the ticketing site.

To find things in Pool, you can search or ask its built-in AI assistant for help.

Image Credits:Pool

Next up, the founders plan to take this concept into a second, separate app that will operate as a personal assistant of sorts. Pool’s mascot — the little rubber duck you press and drag across the screen to enter Pool at launch — will become part of the brand for this agentic AI app they’re planning.

The founders were in Lisbon when we chatted — no longer in a van! — but headed to San Francisco in late May to mee

A new report by cybersecurity giant CrowdStrike found North Korean hackers posing as remote IT workers and online recruiters made up about half of all documented “hands-on-keyboard” intrusions at U.S. tech companies over the past year.

The company’s latest annual report on the cybersecurity landscape highlights the growing threat from North Korean operatives, which have become a significant source of cyber intrusions across the tech industry. Hackers associated with the Kim Jong Un regime continuously target companies and developers with schemes aimed at stealing information and cryptocurrency to fund Pyongyang’s nuclear weapons program, which is banned under international law.

CrowdStrike said that during period covered by the report — April 2025 to May 2026 — the North Korean hacking group that the company calls “Famous Chollima” accounted for 47% of all state-backed activity targeting the tech sector.

The security giant keeps track of hands-on-keyboard intrusions because they typically represent real human hackers conducting malicious and evasive cyber activity, rather than automated malware that traditional security tools can catch. These attacks generally begin with stolen passwords or credentials, followed by the abuse of legitimate tools already present in the target’s systems to maintain persistent access over time.

Famous Chollima is known for posing as tech workers, such as developers, coders, and IT, then applying for remote jobs at U.S., European, and Asian tech companies under false pretenses. To pull it off, the hackers use AI to generate real-time deepfake images to spoof the faces of real people, and pair those with fraudulent identity documents like stolen passports and driver’s licenses to pose as Americans or other foreign nationals. This is because North Korea is heavily sanctioned by the West and the United Nations for its ongoing development of nuclear weapons.

Once in, the hackers also earn a salary from the companies they infiltrate, which gets funneled back to the North Korean regime, all while stealing intellectual property and other sensitive corporate information. That stolen information is frequently weaponized; when the operatives are eventually caught, they often threaten to expose what they’ve taken unless the company pays a ransom.

The hackers also target blockchain developers with the intention of stealing large amounts of crypto, which the Kim regime uses to skirt its broad inability to use the Western banking system. North Korea has netted billions of dollars in stolen crypto over the years, with some $2 billion during 2025 alone. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.

He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.

View Bio

If anything, 2026 has made clear that cybersecurity is no longer a background concern — it’s front and center, woven into almost every major story of the year. Yes, wars are still raging, the climate keeps worsening, and we’re seemingly one dodgy sneeze away from the next global pandemic.

But running beneath all of it is a digital current that touches everything: wars being fought on digital fronts as well as physical ones, governments weaponizing citizens’ own data against them, botnets quietly undermining democratic institutions, nation-state hackers targeting civilian infrastructure from power grids to water systems, and ransomware gangs holding companies and institutions hostage for massive payouts. The attacks are getting bolder, more destructive, and harder to contain.

As we’re halfway through this already horrendous year of digital attacks and hybrid warfare, we look at some of the worst hacks and breaches so far, and how they might affect us going forward.

Questions remain over DOGE’s massive swipe of Social Security data

A year on, after operatives with the Elon Musk-led band of government destroyers known as the Department of Government Efficiency (or DOGE) swept through and dismantled federal agencies from the inside out, we’re still learning about the data lapses that happened under their watch.

After DOGE entered the Social Security Administration, it remains unclear as to what happened with some of the nation’s most sensitive data, as lawsuits battle on in federal court. The most alarming whistleblower’s claim is that DOGE uploaded a live copy of the Social Security database to an unsecured third-party server, leading to a scramble to understand what was stored in it. This database allegedly contained the Social Security numbers and associated personal information of most living Americans.

In court filings, the Social Security Administration doesn’t know for sure what was on the server, but said that the DOGE signed an agreement with an outside political advocacy group under the guise of finding evidence of voter fraud, something that President Trump continues to claim without any evidence. The fears are that the database could be misused to target Americans for spurious reasons.

Two of the top House Democrats investigating some of DOGE’s activities at the Social Security Administration said that the exposure of the government’s Social Security database “could very well be the largest data breach in our nation’s history.”

Image Credits:Bryan Dozier/Middle East Images via AFP / Getty Images

Hackers are increasingly targeting water systems and energy grids

A rash of cyberattacks across Europe targeting civilian energy and water supplies, like power plants and water dams, has set a troubling trend of late. Several hacks attributed to (or at least in part blamed on) Russia have risked real-world harm to communities and populations.

Poland’s energy grid was targeted with computer-destroying malware at the tail end of last year, as well as a Swedish thermal plant and a Norwegian dam that spilled swimming pools’ worth of water. Hackers targeted Poland again earlier this year, this time its water treatment plants, showing that Russia’s hybrid war antagonism continues to extend beyond the digital realm.

Now, thanks to the recent war between the U.S. and Israel against Iran, there are warnings that Iranian hackers are targeting critical infrastructure in the United States. This includes privately owned water utilities, which remain a soft target for hackers, often lacking basic cybersecurity protections.

Iranian government hackers struck Stryker with a destructive device hack

Speaking of Iran, a cyberattack on a U.S. medical tech company, Stryker, in March saw Iranian hackers break in and remotely wipe tens of thousands of employee devices in one fell swoop, causing widespread disruption to the company’s operations for several days.

The breach was a marked shift in Iranian hacking tactics at a time of ongoin

There is a certain wildness in the tech industry these days that both mimics previous eras of large changes, like cloud computing (runaway costs in the early days), and is like nothing we’ve ever seen before (record revenues accompanied by mass layoffs).

A theory doing the rounds attempts to explain the phenomenon: Tech executives, especially CEOs, are collectively suffering from delusions of grandeur thanks to AI. And at least one tech CEO has said so out loud: Box founder Aaron Levie.

“CEOs are uniquely prone to AI psychosis because they’re sufficiently distant from the last mile of work that still has to happen to generate most value with AI,” Levie wrote on X.

CEOs “play with AI,” develop a prototype, or generate a contract, to use Levie’s examples, and then make the leap to believing agents can do the work.

But these top-level executives aren’t the people who have to review code, discover bugs, and identify calls to hallucinated libraries before software is deployed. They aren’t responsible for training AI models on a company’s idiosyncratic contract terms, nor do they have to spend days combing through contracts to find sneaky terms, as Levie indicates.

In other words, Levie’s theory posits, CEOs don’t really understand processes well enough to know what really can and can’t be automated. But that lack of knowledge doesn’t stop them from acting on their beliefs.

It’s important to note that Levie is not an AI hater. Quite the opposite. He mostly posts AI positivity on X to his 2.7 million followers, writing blogs titled, “Headless software is the future” on how software built for AI agents is the way forward. He also puts his money where his mouth is, backing AI startups as an active angel investor.

So what are CEOs to do instead? Levie advises CEOs to use AI “a ton” to really see what it can and can’t do, “and come out the other side with an appreciation for both the upside and the real work.”

CEOs are uniquely prone to AI psychosis because they’re sufficiently distant from the last mile of work that still has to happen to generate most value with AI.So when they play with AI, they see the happy path results, often not considering the next 10 or 20 things that have… https://t.co/ne5mvJ4Rgx— Aaron Levie (@levie) May 24, 2026

I have enough faith in humanity to believe that there are CEOs out there attempting to do just that, but right now, they seem to be in the minority.

In only the first five months of 2026, the tech industry has already had nearly as many layoffs as in all of 2025: 115,430 people have been fired from 152 tech companies so far in 2026, compared to 124,636 people let go by 275 companies in 2025, according to industry layoff tracker Layoffs.fyi.

And the bulk of companies have pointed to AI as a reason for cutting these jobs. Many argue that the biggest tech companies are AI washing, or crediting AI productivity gains in the past or future, when other business decisions and metrics are really driving the cuts.

Still, some of these stories are surprising. Zeb Evans, the CEO of project management and productivity software startup ClickUp, proudly declared on X that he had laid off almost a quarter of his employees — 22% — after rolling out about 3,000 AI agents to do internal work.

Evans swore this wasn’t done to reduce costs. Instead, he wants a workforce composed of people who run AI agents and spend their days quickly reviewing the agents’ work. He believes this will create a “100x org,” as he calls it.

While AI can be a very useful tool, the data on AI and productivity doesn’t support such assumptions. By miles.

A meta analysis of other research published in October in UC Berkeley’s California Management Review found “no robust relationship between AI adoption and aggregate productivity gain.”

Research published in March by the National Bureau of Economic Research did conclude that AI adoption improved productivity, but noted “a productivity paradox, in which perceived productivity gains a

In Brief Posted:

8:26 AM PDT · May 26, 2026

Image Credits:Patrick T. Fallon / AFP / Getty Images

Security researchers say a March breach of the Los Angeles transit system (LACMTA) was the work of Iranian-backed hackers. Israeli startup Gambit Security said in a report on Tuesday that the hackers work for Iran’s Ministry of Intelligence and State Security (MOIS).

Reuters first wrote about the Gambit report.

A hacktivist group calling itself Ababil of Minab claimed responsibility for the earlier hack, saying they stole then deleted data from the LACMTA’s systems. The group’s name is a reference to the U.S. air strike on an Iranian school in the city of Minab that killed more than 175 people, mostly children.

“They are not a new, standalone hacktivist crew as they claim,” said Gambit.

Ababil of Minab did not respond to a request for comment when contacted by TechCrunch.

Gambit said its claims are based on forensic evidence that ties the group to a previous Iran-linked campaign, as well as activity attributed to the MOIS by Israel National Cyber Directorate. Gambit said it investigated other attacks against companies in Israel, Saudi Arabia, and Turkey.

Do you have more information about Ababil of Minab or other Iran-linked hackers and their cyberattacks? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.

If Gambit’s assessment is correct, Ababil of Minab would be the latest in a series of fake hacktivist groups that are working for the Iranian government. The most recent example is Handala, which earlier this year hacked U.S. medical tech giant Stryker, wiping thousands of company systems and employee devices.

Following the Stryker breach, the FBI seized two Handala websites, and the U.S. Justice Department accused Iran’s government of being behind the hacktivist group and its attacks.

Iranian-linked hackers have increased their activities and their claimed hacks after the U.S. and Israel started bombing Iran earlier this year. In April, a coalition of U.S. agencies warned that Iranian hackers were targeting American critical infrastructure.

Topics

Subscribe for the industry’s biggest tech news

Latest in Security

In the long history of hacking, there have been numerous data breaches that, years or even decades later, remain unsolved. Countless hackers and hacking groups behind them have never been unmasked.

But prolific hacking groups do get caught. This is true whether they’re cybercriminals such as LAPSUS$, a notorious extortion gang that compromised companies including Microsoft and Nvidia, who have had multiple members arrested, or sophisticated government hacking groups from Russia and China, whose members have been named, indicted, and placed on most-wanted lists.

Still, some of the most fascinating cases in cybersecurity history remain wide open — no culprits, no answers, and in some cases, not even a clear motive. We decided to revisit several of them in a series of articles, starting with one of the strangest episodes in the history of intelligence leaks.

The first installment centers on the Shadow Brokers — an enigmatic group that surfaced online, dumped a trove of hacking tools believed to belong to the NSA, and then vanished.

In the summer of 2016, in the midst of the Russian hacks related to the U.S. Presidential elections, the group appeared on Twitter. They linked to a Pastebin post and @-mentioned several news outlets — a strange, ineffective strategy that meant most of those outlets likely never saw the tweets.

But if anyone had clicked on the link, they would have seen a document titled “Equation Group Cyber Weapons Auction — Invitation” — a reference to the shadowy hacking operation widely believed to be run by the NSA.

“!!! Attention government sponsors of cyber warfare and those who profit from it !!!! How much you pay for enemies’ cyber weapons?” the hackers wrote, claiming to have hacked the Equation Group.

The document included links to download some hacking tools, as well as a link to download an encrypted file that interested buyers could decrypt by making a bid. “Auction files better than Stuxnet,” they wrote, referring to the famous malware used against Iranian nuclear facilities in a U.S.-Israeli cyberattack in 2007. They asked for at least one million Bitcoin.

The leak quickly attracted press coverage. Once security researchers analyzed the tools, they realized these were exceptionally sophisticated cyberweapons, very likely stolen from the NSA — a suspicion bolstered by the fact that some shared names with programs revealed by NSA whistleblower Edward Snowden.

The auction was likely a ruse, since the group eventually dumped many of the tools publicly months later. Much about the Shadow Brokers made little sense. Their broken English was almost comical, as if they were either trying too hard or deliberately signaling the artifice. Despite clearly seeking attention — and getting plenty of press coverage — the group only spoke to a journalist once, giving a brief interview to 404 Media’s Joseph Cox, then a reporter at VICE Motherboard.

Ten years later, we know literally nothing about who was behind the Shadow Brokers persona. Cox and I interviewed former NSA staffers at the time, who said an NSA insider or former insider could be involved. But nobody has ever been arrested and charged — extraordinary, given this was arguably one of the worst leaks of U.S. intelligence hacking tools ever.

One potential suspect was Harold T. Martin III, an NSA contractor arrested for stealing classified information from the agency. But the theory has a problem: while Martin was in custody, the Shadow Brokers remained active online. He has never been formally charged in connection with the leaks. The most widely credited theory is that the Shadow Brokers were created by a Russian government spy group as a propaganda tool.

The impact was massive. Among the tools released, the Shadow Brokers published EternalBlue — a family of zero-day vulnerabilities targeting Windows that allowed hackers to break into computers on a hacked network, rapidly expand their access, and deploy self-propagating worms. (Zero-day vulnerabili

Industry insiders say the next big thing in AI is “proactive” systems: agents that can anticipate a user’s needs — and fulfill them — before the user even knows what those needs are.

One startup that’s looking to make headway in this area is IrisGo. The company, which closed a $2.8 million seed round led by Andrew Ng’s AI Fund earlier this year, is building a desktop companion for PCs that can learn about a user’s daily workflows and then automate them with limited to no human prompting.

Iris was co-founded by Jeffrey Lai, a former Apple engineer who helped to build the Chinese language version of Siri, the company’s automated assistant. (Somewhat slyly, Iris is Siri spelled backwards.)

The core idea is simple: show Iris how to do something once, and it remembers that process for future automated use — no repeat instructions needed.

During a conversation with TechCrunch, Lai ran a demo, showing how Iris could learn to place a coffee order online. As I watched, Iris recorded the steps it took to select a latte from Philz Coffee (a popular Bay Area chain), fill out credit card information, and then hit purchase. Lai then asked Iris to repeat the order on its own; the agent dutifully complied.

Buying coffee, of course, is not really the point. Instead, the hope is that the system will automate a whole host of business-related tasks. Iris comes with a built-in “skills” library — things like email drafting, invoice processing, report building, document summarization, and many other ready-to-use automated workflows. At the same time, Iris learns from the user’s desktop behavior and automatically adds those tasks to its potential list of action items.

The application also includes a coding assistant — similar in concept to OpenAI’s Codex or Anthropic’s Claude Code — designed to assist developers as they go about their work.

“Our target audience is knowledge workers — white collar companies. There’s a lot of repetitive tasks that those workers do every day,” Lai said, noting that, despite the high-octane power of today’s frontier models, AI-assisted office work can still feel incredibly manual and repetitive. The goal, he said, is to move away from that and toward a more fully autonomous workflow, where the human works on high-level conceptual work while agentic systems take care of all the clerical work in the background.

A particularly appealing feature of Iris is that it is designed to process a lot of data on-device, giving it stronger privacy protections than other applications that rely heavily on the cloud. Lai says that the system is still a hybrid architecture — meaning that larger, more complex tasks are ultimately processed through the cloud, although the company promises that cloud processing “only occurs when explicitly authorized by the user and uses end-to-end encryption.”

Part of the strategy for scaling Iris has been to garner credibility through association with prominent figures and organizations. Support from Ng — notably a co-founder of the formative deep learning research team Google Brain — has helped. Lai managed to set up a meeting with Ng through a shared connection: both are alumni from Carnegie Mellon University. Lai and his co-founder demoed Iris during that meeting, and Ng’s AI Fund ultimately led the startup’s seed round. Nvidia and Google have also backed the company.

IrisGo recently launched the beta versions of its macOS and Windows apps, and the company is also currently pursuing deals with laptop companies to preinstall the app on new devices. It recently struck such a deal with Acer, and Lai said the hope is that the company can strike similar deals with other device makers soon.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Lucas is a senior writer at TechCrunch, where he covers artificial intelligence, consumer tech, and startups. He previously covered AI and cybersecurity at Gizmodo.

You can contact L

GitHub, the popular developer platform owned by Microsoft, confirmed it was hacked and attackers had stolen data from around 3,800 internal code repositories.

The code hosting and sharing giant said in a series of posts on X that it has “no evidence of impact to customer information stored outside of GitHub’s internal repositories,” but noted its investigation was ongoing. GitHub said it “detected and contained a compromise of an employee device involving a poisoned VS Code extension,” referring to a plugin for Visual Studio Code, a popular code editor that developers use for programming.

Hackers are increasingly targeting popular open-source projects, including coding extensions, with the aim of compromising developers’ computers and their projects. Targeting popular projects allows hackers to gain access to vast numbers of computers at the same time, magnifying the impact of their attacks.

GitHub did not name the compromised extension.

The Record and Bleeping Computer report that a hacking group called TeamPCP has taken credit for the GitHub breach, and is selling the data on a cybercrime forum.

GitHub did not immediately respond to a request for comment about the incident, or answer questions on whether it has received any communication from the hackers, such as a demand for ransom.

TeamPCP previously claimed credit for a data breach at the European Commission that resulted in the theft of more than 90 gigabytes of data from the cloud storage of the EU’s executive arm. The hackers had stolen the European Commission’s cloud key during an earlier breach at Trivy, a vulnerability scanning tool, by pushing info-stealing malware to Trivy’s downstream users.

OpenAI was also targeted recently in a similar but separate attack that saw hackers break into Tanstack, a platform used by web developers, to push updates containing malware that let the hackers steal passwords and tokens from users. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.

He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.

View Bio

Hackers hack victims hacked by other hackers

Pinterest launches an experimental AI shopping app called Ask Pinterest

Pinterest launches an experimental AI shopping app called Ask Pinterest

Discussion (0)

Oracle warns of security bug that hackers abused to breach 100+ companies

Pools new app turns your screenshots into something useful

North Koreans behind nearly half of US tech industry hacks, says CrowdStrike

Hacked, leaked, and held for ransom: the worst breaches of 2026 so far

Tech CEOs are apparently suffering from AI psychosis

Iranian hackers blamed for breach of Los Angeles transit system that took weeks to recover

Ghost hackers: the cybersecurity mystery that nobody has solved

IrisGo, a startup backed by Andrew Ng, looks to become the AI desktop buddy you never knew you needed

GitHub says hackers stole data from thousands of internal repositories

Hackers hack victims hacked by other hackers

Pinterest launches an experimental AI shopping app called Ask Pinterest

More in Technology

Best Prime Day Deals on Yoto Players and Accessories

Anthropic will pay xAI $1.25 billion per month for compute

Walmart-backed Flipkart expands quick-commerce push as Amazon ramps up in India

Pinterest launches an experimental AI shopping app called Ask Pinterest

Discussion (0)

Oracle warns of security bug that hackers abused to breach 100+ companies

Pools new app turns your screenshots into something useful

North Koreans behind nearly half of US tech industry hacks, says CrowdStrike

Hacked, leaked, and held for ransom: the worst breaches of 2026 so far

Tech CEOs are apparently suffering from AI psychosis

Iranian hackers blamed for breach of Los Angeles transit system that took weeks to recover

Ghost hackers: the cybersecurity mystery that nobody has solved

IrisGo, a startup backed by Andrew Ng, looks to become the AI desktop buddy you never knew you needed

GitHub says hackers stole data from thousands of internal repositories

More in Technology

Best Prime Day Deals on Yoto Players and Accessories

Anthropic will pay xAI $1.25 billion per month for compute

Walmart-backed Flipkart expands quick-commerce push as Amazon ramps up in India