[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-EbkRsdgeZKlZLEw1_oF223FeMW3HM9Fr-YsFPqcT4c":3},{"article":4,"iocs":37,"watch_terms":42,"solutions":43,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"7b8cb0c9-8311-4fd6-9b55-a342a3a0414c","‼️ Plot twist.\n\nThe BF actor taking claim to breaching OVHcloud is now saying that an employee ma...","plot-twist-the-bf-actor-taking-claim-to-breaching-ovhcloud-is-now-saying-that-an","‼️ Plot twist.\n\nThe BF actor taking claim to breaching OVHcloud is now saying that an employee may have been socially engineered.\n\nThe data in the screenshot contained: service, department, phone, email, postal code, city, store name, address.\n\nStill 560 TB claimed and only 2 https:\u002F\u002Ft.co\u002FEf0tbFiIgt https:\u002F\u002Ft.co\u002FSjH9ZoZm6H","A threat actor claiming responsibility for the OVHcloud breach has shifted its narrative, now alleging that an employee was socially engineered as the attack vector. The stolen data reportedly includes customer service records with personal information (names, departments, phone, email, addresses, postal codes). The actor maintains the theft of approximately 560 TB of data.","BF actor claims OVHcloud breach via employee social engineering, 560TB data stolen.","https:\u002F\u002Fx.com\u002FDarkWebInformer\u002Fstatus\u002F2036574020452360463",null,"2026-03-24T22:40:58+00:00","2026-03-24T23:00:14.911153+00:00",7,[],"2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":17,"icon":12,"name":19,"slug":20},"Breaches","breaches",[22,27,32],{"category":23},{"id":24,"icon":12,"name":25,"slug":26},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":28},{"id":29,"icon":12,"name":30,"slug":31},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[38],{"type":39,"value":40,"context":41},"malware","BF actor","Threat actor claiming responsibility for OVHcloud breach via social engineering",[],{"controls":44,"vendors":125},[45,74,100],{"slug":46,"name":47,"problem":48,"products":49},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":75,"name":76,"problem":77,"products":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[79,84,92],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":80,"product_name":81,"url":82,"description":83},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":101,"name":102,"problem":103,"products":104},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[105,112,118],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":101,"product_name":109,"url":110,"description":111},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":122,"url":123,"description":124},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":138},"ovhcloud-breach-social-engineering-exploits-human-vulnerability","OVHcloud Breach: Social Engineering Exploits Human Vulnerability","The OVHcloud breach demonstrates how social engineering attacks can bypass technical security controls by targeting the human element. An employee was allegedly manipulated into providing access or credentials, resulting in the theft of 560 TB of customer service data including personal information. This incident highlights that even well-secured infrastructure can be compromised when attackers successfully deceive authorized personnel. The massive scale of data accessed suggests the compromised employee had significant system privileges.",[131,132,133,134,135,136,137],"CIS Control 14","CIS Control 6","NIST AC-2","NIST AT-2","NIST AT-3","GDPR Article 32","GDPR Article 25",{}]