<\/p>\n
The breach occurred on December 7, 2024, and was discovered on February 27, 2025. The datasets ranged from 16 million to more than 3.5 billion records each, averaging around 550 million. Researchers noted this is not old data being reused, but fresh credentials that could lead to account takeovers, phishing, or business email compromise.<\/p>\n<\/p>\n
<\/p>\n
This breach underscored the importance of organizations conducting regular data inventories and purging or securely archiving legacy data that is no longer needed. Sensitive data from previous years must be treated with the same level of security as live data. The accessed data also contained comprehensive voter analysis based on Reddit post activity which could be used to predict how somebody would vote on a particular issue.<\/p>\n<\/p>\n
However, while the AWS bucket remained misconfigured, cybercriminals may have clandestinely exfiltrated the exposed data. While it isn\u2019t clear how hackers gained access to accounts, it\u2019s speculated that weak passwords are to blame. To prevent further breaches, Nintendo posted a tweet asking members to enable 2-step authentication.<\/p>\n<\/p>\n
<\/p>\n
Join Tenable’s Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats. As of the most recent update posted Monday, Proud wrote that Canvas Data 2 and Beta \u201cshould now be available for all customers,\u201d while another version of the LMS, Canvas Test, remains under maintenance. While Instructure says it has contained the attack, experts say it points to the added value cyberattackers see in going after third-party vendors instead of individual institutions. After the merger, Interstate Management Company, LLC continued to function as a legal operating entity within the Aimbridge Hospitality structure.<\/p>\n<\/p>\n