This week’s cybersecurity news includes a PayPal data breach, dismantling of fraud operations in Ukraine, and an AI password warning.
This week’s cybersecurity news features significant developments, including a data breach at PayPal, the dismantling of fraudulent call centers in Ukraine, and the targeting of Olympique Marseille by hackers.
- Ukrainian authorities shut down four fraudulent call centers in Dnipro.
- AI-generated passwords are deemed insecure by experts.
- French football club Olympique Marseille confirmed a cyberattack.
- A Ukrainian man faces 15 years in prison for selling fake documents.
Fraudulent Call Centers Shut Down in Dnipro
Ukrainian law enforcement, in collaboration with Baltic states, has dismantled a fraud operation in Dnipro, arresting the organizer and ten accomplices. Over the last year, this group reportedly defrauded EU citizens of at least $1.2 million by convincing them to invest in fake cryptocurrency projects through four call centers. They initially paid small dividends to gain victims' trust before blocking their contacts and disappearing once larger sums were invested.
AI-Generated Passwords Found Vulnerable
Experts from Irregular have revealed that passwords created by large language models (LLMs) can be cracked within hours. An experiment showed that LLMs such as Claude, ChatGPT, and Gemini generate passwords based on predictable patterns, making them insecure. Out of 50 passwords generated, many were duplicates or shared similar characters, indicating a lack of randomness. Researchers recommend that developers discontinue the use of AI-generated passwords and utilize password managers instead.
Cyberattack on Olympique Marseille Confirmed
On February 24, Olympique Marseille acknowledged a cyberattack following a hacker’s claim of a data breach. The hacker alleged that they stole a database containing information on approximately 400,000 individuals, including club employees and fans. Although the club has not disclosed specific details, the hacker posted samples of the stolen data online, which reportedly includes names, email addresses, and phone numbers.
Ukrainian Man Pleads Guilty to Selling Fake Documents
Ukrainian national Yuriy Nazarenko admitted guilt for operating the OnlyFake website, which produced over 10,000 fake identification documents using AI technology. The site allowed customers to customize these documents to evade KYC verification for money laundering. Nazarenko was extradited from Romania and faces up to 15 years in prison, with sentencing scheduled for June 2026.
PayPal Reports Data Breach Due to Software Bug
PayPal has informed clients of a data breach linked to a software bug in its Working Capital loan application. The breach, which began on July 1, 2025, exposed sensitive information such as names, email addresses, Social Security numbers, and dates of birth. Although the issue was discovered on December 12, PayPal has since rectified the problem and compensated clients for unauthorized transactions. The company emphasized that it does not request sensitive information through phone or email and that around 100 clients were affected by this incident.
