Crypto Journalist

Amin Ayan

Crypto Journalist

Amin Ayan

About Author

Amin Ayan is a crypto journalist with over four years of experience in the industry. He has contributed to leading publications such as Cryptonews, Investing.com, 99Bitcoins, and 24/7 Wall St. He has…

Share

Last updated: 

July 29, 2025

A new study has revealed the extent of sensitive information leaked through ransomware attacks and data breaches, including key financial documents and crypto keys.

The report, published by cybersecurity firm Lab 1, analyzed over 141 million records from 1,297 breach incidents.

Unlike most breach assessments that focus on structured data like usernames and passwords, Lab 1’s analysis targeted unstructured files, the type often overlooked but potentially more damaging.

Hidden Dangers: Financial Docs, Crypto Keys, and Emails Exposed

The breaches include financial documents, cryptographic keys, email archives, and internal business records.

According to Lab 1 CEO Robin Brattel, the goal was to expose the risks hidden in everyday files that rarely draw attention.

“We focused on the huge risks associated with unstructured files that often hold high-value information, such as cryptographic keys, customer account data, or sensitive commercial contracts,” he said.

The findings are alarming. Financial documents appeared in 93% of the breach incidents studied, accounting for 41% of all analyzed files.

Nearly half included bank statements, and over a third contained International Bank Account Numbers.

In 82% of the cases, customer or corporate personally identifiable information (PII) was exposed, much of it originating from customer service interactions.

A staggering 51% of incidents included emails containing U.S. Social Security numbers.

Perhaps most concerning was the discovery of cryptographic keys in 18% of the breaches.

These keys can be used to bypass authentication systems, giving attackers a powerful advantage in future cyber intrusions. Source code and internal scripts were also widely leaked, appearing in 17% of the analyzed data sets.

The study underscores a shift in cybercriminal tactics. Hackers are increasingly operating like data scientists, mining stolen data for high-value assets to use in fraud, identity theft, or ransomware follow-ups.

“With cybercriminals now behaving like data scientists to unearth these valuable insights to fuel cyberattacks and fraud, unstructured data cannot be ignored,” Brattel warned.

16 Billion Logins Leaked: New Mega Breach Puts Crypto Users at Risk

Last month, a massive data breach exposed more than 16 billion login credentials from platforms like Apple, Google, Facebook, Telegram, and GitHub, according to cybersecurity researchers at Cybernews.

The breach, among the largest ever recorded, is not a single leak but a combination of datasets gathered through infostealer malware, credential stuffing attacks, and undisclosed breaches tracked since early 2024. Some individual sets held as many as 3.5 billion entries.

Researchers warned the leaked credentials—many recently harvested—pose a severe threat to users, especially those in crypto, due to the inclusion of sensitive login details, cookies, and tokens.

The structure of the data suggests it was harvested by modern malware, making it far more dangerous than older, recycled leaks.

One dataset tied to Telegram included 60 million records, while another, allegedly linked to Russia, had over 455 million.

Much of the data was found in unsecured Elasticsearch databases and object storage systems, briefly exposed but long enough to be copied.

Although the exact source remains unclear, cybersecurity experts suspect criminal actors compiled the records.

With such a vast trove of credentials, attackers now have tools for phishing, ransomware, and unauthorized access to crypto wallets, especially for users lacking multi-factor authentication.

Wells Fargo has confirmed a mass outage that has prevented customers from accessing their accounts.

Customers began reporting issues on Saturday morning, with the vast majority unable to log in, according to DownDetector.

Users on social media also reported issues with their account balances, transactions and Zelle transfers, with one frustrated user saying he struggled to get answers.

“Local branch no responses to phone. Mobile banking down. Customer service 57 minutes to get someone and they cannot answer any question.”

The bank told the user to send a direct message for assistance.

The New York City-based news station PIX11 says the bank responded to a request for comment, stating system maintenance is to blame.

“This morning our ATMs and online banking services experienced a brief outage as a result of planned maintenance.”

The bank says all services are now restored.

At time of publishing, DownDetector says some user reports “indicate possible problems at Wells Fargo” with dozens of customers reporting Login, Zelle and debit card issues over the last six hours.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

The CEO of investment firm Pantera Capital says the current value of the crypto market is currently a massive buying opportunity.

In a presentation at the TOKEN2049 crypto conference in Dubai, Dan Morehead says that digital assets like Bitcoin (BTC) will likely remain bullish amid pro-crypto regulatory changes under US President Donald Trump.

“If right before the US election a genie showed you a crystal ball and said that a pro-crypto candidate would win, the pro-crypto party would be in charge of the House and Senate, 54 anti-crypto people would be out of Congress, there’d be executive orders with Bitcoin strategic reserve, all kinds of things like this happening, and you said that the market would be only up 35%, they would say you were crazy.

So although people are kind of freaking out about the markets right now, I think it’s unbelievably cheap. The way I think about it is, our Bitcoin fund has a 13-year compound annual growth rate of 85%, so being up 35% over three or four months, it’s just kind of normal, like it’s not even up. So we’re still very, very bullish on the markets. Bunch of great policy things are happening.”

Morehead also says that traditional assets like stocks are likely overvalued and present a higher investment risk, whereas Bitcoin is likely to continue to outperform the S&P 500.

The investor notes that Bitcoin is up 50% in value compared to one year ago, while the SPX is up just 8% during the same time period.

“Stocks and bonds are super expensive to their long-term average, and that doesn’t even count weird things like tariffs and the impact of lower growth, higher inflation. So if you’re looking for a place to invest, the old school assets really do seem scary from an equity risk premium standpoint, either bond yields have to go up 75 basis points, or stocks have to come down quite a bit.

Blockchain is the safest place to hide, and you’re already seeing that. This is the change in the price of Bitcoin, gold and then the top 25 cryptocurrencies market cap weighted since a year ago (see chart below). It’s the only place to hide in an admittedly confusing world.”

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Windows administrators from numerous organizations report widespread account lockouts triggered by false positives in the rollout of a new Microsoft Entra ID’s “leaked credentials” detection app called MACE.

These alerts and lockouts began last night, with some admins believing they were false positives as the accounts have unique passwords that are not used on any other sites or applications.

Microsoft Entra ID, formerly Azure Active Directory, is a cloud-based identity and access management service that helps organizations manage user identities and secure access to resources.

In a Reddit thread posted early this morning, Windows admins reported receiving multiple alerts from Entra indicating that some of their user accounts had been found with credentials leaked on the dark web or other locations.

These accounts were automatically locked out of the tenant, with numerous users impacted per organization.

“Us as well… about 1/3rd of our accounts got locked out about ~1 hour ago. We’re a MSP so I’m assuming this is happening to our clients as well,” posted an admin on Reddit.

The locked-out accounts showed no signs of compromise, such as suspicious sign-ins, and were protected with MFA. Furthermore, breach notification services like Have I Been Pwned (HIBP) had no matches for these accounts.​

Another report on Reddit further corroborated that this was widespread, with an MDR provider stating they received over 20,000 notifications from Microsoft overnight regarding leaked credentials from different customers 

While Microsoft has not publicly confirmed the cause of these lockouts, Microsoft told one of the affected organizations it was caused by an issue with the rollout of a new Enterprise application called “MACE Credential Revocation.”

“Just got off with engineer. It is Tenant Lockout due to this MACE ninja rollout they did. no signs of compromise. He needs an hour to convert the ticket from compromise to lockout but can breathe a sigh of relief. It was Error Code: 53003 for conditional access policy,” an admin reported on Reddit.

Multiple people confirmed this application was added to tenants right before they began receiving the alerts.

MACE Credential Revocation app is a Microsoft Entra feature used to detect leaked credentials and lockout potentially compromised accounts.

While all alerts of leaked credentials should be investigated to confirm that an account was not compromised, if you received a flurry of alerts at once this rollout likely caused it.

BleepingComputer contacted Microsoft with questions about this incident but has not received a response at this time.