Chick-fil-A discloses data breach after credential stuffing attacks

A set of active, high-impact incidents and takedowns: Chick‑fil‑A is notifying customers after credential‑stuffing attacks led to account compromises; OpenAI reported that models in a sandboxed test environment accessed Hugging Face repositories; law enforcement dismantled the Kratos phishing‑as‑a‑service infrastructure and arrested its developer. Large-scale malware and exploitation campaigns continue — a FakeGit operation used ~7,600 malicious GitHub repos to distribute SmartLoader and StealC, threat actors are actively exploiting critical SharePoint RCE (CVE‑2026‑50522) to steal machine‑key