World Leaks

Nearly every breach disclosed this week entered through someone else's infrastructure — a service provider, a data-centre host, an ITSM platform and a CI/CD pipeline, not the victim's own perimeter

Read as a set, the week's breaches make one point: the perimeter that failed was rarely the victim's own. Four disclosures, four different trust boundaries.

A service provider was the vector for Basel utility IWB — a compromised external provider exfiltrated ~40,000 customer meter records while IWB's own systems and supply were unaffected. A data-centre host was the vector for the Kudankulam nuclear-plant contractor Reliance Group, which confirmed a "partial breach" originating from a server hosted by third-party provider Yotta, after World Leaks posted ~858,000 files (their authenticity only claimed, with Reuters reviewing a sample) (The Week/Reuters, 2026-07-15). An ITSM/IT platform was the vector for Ernst & Young, whose client tax data was exposed through a third-party software breach disclosed in a California Attorney General filing (CA OAG, 2026-07-15).

The CI/CD pipeline case is the most instructive for defenders because it broke an assumed control. The AsyncAPI compromise reached packages with over three million weekly downloads by abusing the org's own trusted-publishing workflow (Wiz, 2026-07-14); Microsoft's timeline then showed the trojanized versions carried cryptographically valid npm/OIDC provenance attestations that correctly name the real repo, commit and workflow — "even though the triggering commits were unauthorized" — and executed at import time, so --ignore-scripts did not stop them (Microsoft, 2026-07-15).

Builds on: 2026-07-16/iwb-basel-third-party-provider-breach-40k-customer-records · 2026-07-16/worldleaks-kudankulam-reliance-third-party-hosting-breach · 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · 2026-07-14/asyncapi-npm-supply-chain-compromise-github-actions · 2026-07-16/asyncapi-npm-compromise-valid-provenance-attestations-delta

World Leaks posts ~858,000 files tied to India's Kudankulam nuclear-plant contractor; Reliance confirms a third-party-hosting breach

The data-theft-extortion group World Leaks — the rebrand of Hunters International already tracked in this store — posted roughly 858,000 files on its dark-web leak site attributed to Reliance Group, a contractor involved in India's Kudankulam Nuclear Power Plant (KNPP), the country's largest nuclear facility (The Week / Reuters, 2026-07-15). Reuters reviewed a subset of about 19,000 files dated 2016–2025 that purport to show facility blueprints, supplier details, meeting and inspection records, equipment reviews and insurance policies; the files are only claimed to originate from the plant and their authenticity is not established. Reliance Group confirmed to Reuters that a "partial breach" of its data occurred from a server hosted by Yotta, a third-party Indian data-centre provider, and that the government has been informed; India's CERT-In is investigating and a Nuclear Threat Initiative expert warned the exposure could pose a serious plant-safety risk.

Media and political (HU, DE)

Two European political / media targets in the week: Mediaworks Kft (Hungary) — World Leaks claimed 8.5 TB of exfiltrated data including payroll, contracts, and internal editorial communications; Mediaworks confirmed "a significant amount of illegally obtained data may have come into the possession of unauthorized persons"; no public regulator notification announcement at window close (The Record, 2026-05-04 · daily 2026-05-06). Die Linke (Germany) — German federal political party confirmed Qilin ransomware encryption and 1.5 TB exfiltration; state DPA notified; no public ransom figure (heise online — covered in daily, 2026-05-08). Two distinct operators (data-theft-only WorldLeaks versus encrypt-and-exfiltrate Qilin), shared targeting of politically significant European entities. The defender lesson: data-theft-only operators defeat backup-centric ransomware defences entirely — effective detection requires egress monitoring and data-loss-prevention tooling capable of alerting on large-volume exfiltration before the attacker goes public on a leak site.