--- title: CareCloud breach balloons to 3.75 million, Astra makes... description: CareCloud's healthcare breach turned out to be far bigger than first disclosed, now affecting 3.75 million patients. OpenAI paused frontier training after its... canonical: https://daily.dev/posts/carecloud-breach-balloons-to-3-75-million-astra-makes-openai-hit-the-brakes-g6d43xmqo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CareCloud breach balloons to 3.75 million, Astra makes OpenAI hit the brakes | daily.dev og:description: CareCloud's healthcare breach turned out to be far bigger than first disclosed, now affecting 3.75 million patients. OpenAI paused frontier training after its... og:url: https://daily.dev/posts/carecloud-breach-balloons-to-3-75-million-astra-makes-openai-hit-the-brakes-g6d43xmqo og:image: https://api.daily.dev/og/posts/g6d43XMQo.png og:image:alt: CareCloud breach balloons to 3.75 million, Astra makes OpenAI hit the brakes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CareCloud breach balloons to 3.75 million, Astra makes OpenAI hit the brakes **[Security Digest](https://daily.dev/sources/security_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary CareCloud's healthcare breach turned out to be far bigger than first disclosed, now affecting 3.75 million patients. OpenAI paused frontier training after its Astra model showed signs it might cross a critical cybersecurity threshold. A gem called kobako had a full sandbox escape rated CVSS 10.0, and a coordinated campaign turned 40 Firefox extensions into wallet stealers after they'd built up clean reputations. Also today: CISA's new three-day patch clock kicks in December 7, and a Windows IKE flaw is now under active exploitation. ## Content **TLDR:** CareCloud's healthcare breach turned out to be far bigger than first disclosed, now affecting 3.75 million patients. OpenAI paused frontier training after its Astra model showed signs it might cross a critical cybersecurity threshold. A gem called kobako had a full sandbox escape rated CVSS 10.0, and a coordinated campaign turned 40 Firefox extensions into wallet stealers after they'd built up clean reputations. Also today: CISA's new three-day patch clock kicks in December 7, and a Windows IKE flaw is now under active exploitation. --- ## CareCloud breach grows to 3.75 million patients, notification letters undersell what was actually stolen CareCloud disclosed a breach to the SEC back in March, but the real number just landed: 3,756,469 people had names, addresses, Social Security numbers, medical records, government IDs, and banking details stolen from an AWS environment over six days in March. The notification letters sent to patients on July 25 only mention exposed names, leaving out everything else that was in the HHS filing. Six days of unnoticed access to a system holding SSNs and medical records is a long time, and this is now one of the largest healthcare breaches of the year, alongside TriZetto, Craneware, and DentaQuest incidents. [Read more](https://daily.dev/posts/sYzXbXgxe) ## OpenAI pauses frontier training after Astra model raises cybersecurity red flags OpenAI slowed development after two incidents: a security breach involving Hugging Face's model evaluation infrastructure, and internal evals suggesting its upcoming Astra model might be able to independently develop functional zero-days or run end-to-end attack strategies from a high-level goal. The company paused its largest planned RL run for two weeks, added workload and network isolation, and rolled out activation-classifier monitoring that requires alerts within 30 minutes of anything suspicious. Monitoring overhead now eats roughly 20% of monitored inference compute, which tells you how seriously they're treating this. [Read more](https://daily.dev/feed-by-ids?id=4csn8EQhx&id=5lNcLaU0c) ## Kobako sandbox escape hits CVSS 10.0 via method_missing fallthrough CVE-2026-55107 breaks the isolation guarantee of kobako, a Ruby gem built specifically to run untrusted mruby scripts safely. A guest script can trigger method_missing, which falls through to public_send and grants arbitrary Ruby execution in the host process, completely defeating the sandbox. The same unguarded sink existed under three different dispatcher names across all versions from 0.1.0 to 0.9.0. Fixed in 0.9.1. [Read more](https://daily.dev/posts/4xvooxyOt) ## 77 Firefox extensions traced to one wallet-theft operation that waited to turn evil Socket found a network of 77 linked Firefox extension identities, 40 of which were active wallet or credential stealers impersonating OKX, Rabby, and TronLink. The other 37 were todo apps and sports-score trackers used as cover. The unsettling part is the version history: several extensions started as genuinely harmless tools, built up installs and trust under one extension ID, then got silently updated into wallet drainers once enough people trusted them. That's a much harder pattern to catch than a wallet clone published on day one. [Read more](https://daily.dev/posts/2BtXKHvfi) --- ## Also notable - **CISA's three-day patch clock starts December 7:** Under BOD 26-04, federal agencies get as little as three days to remediate the highest-risk vulnerability class starting December 7, replacing CVSS-based scoring with risk-based prioritization using exploitation status and technical impact. [Read more](https://daily.dev/feed-by-ids?id=KjPZoDkAu&id=ltAKWv3Or) - **Windows IKE RCE now under active exploitation:** CVE-2026-33824, a double-free in Windows IKE Extension letting unauthenticated attackers execute code via crafted UDP packets on ports 500/4500, was patched in April but CISA confirmed active exploitation and gave federal agencies three days to remediate under BOD 26-04. [Read more](https://daily.dev/posts/jME1Jp11r) - **Sakura Internet breach may expose 1.36 million accounts:** The Japanese cloud host's sales management system was breached, potentially exposing contract and membership data for up to 1,360,563 accounts, though passwords were hashed and no card data was stored in the affected system. [Read more](https://daily.dev/posts/UGpbZqP74) - **14,500 Dahua cameras backdoored with an account that survives factory resets:** The CameraSwarm campaign combined brute-forcing, exploitation of CVE-2021-33044/33045 via a tool called p2pwn to plant a persistent backdoor account on 1,923 cameras, and a cloud-relay attack reaching 283 NAT-hidden cameras with no authentication at all. [Read more](https://daily.dev/posts/qsC9Ak4HT) - **Iranian hackers charged over $3.4 billion IP theft spanning 178 universities:** The DOJ charged 17 people tied to the Mabna Institute for a campaign since 2013 that compromised 8,000 accounts and stole 31.5 terabytes of data, with the State Department offering up to $10 million for information on five named defendants. [Read more](https://daily.dev/posts/peHHt426X) ## Similar posts on daily.dev - [Security briefing: September 2026](https://daily.dev/posts/security-briefing-september-2026-effyny3go) · Sysdig Blog · 1 upvotes · 0 comments - [Top 10 Breaches of the Week](https://daily.dev/posts/top-10-breaches-of-the-week-ct6besfbj) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#healthcare](https://daily.dev/tags/healthcare), [#data-breach](https://daily.dev/tags/data-breach), [#ai-safety](https://daily.dev/tags/ai-safety) [View this post on daily.dev](https://daily.dev/posts/carecloud-breach-balloons-to-3-75-million-astra-makes-openai-hit-the-brakes-g6d43xmqo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/carecloud-breach-balloons-to-3-75-million-astra-makes-openai-hit-the-brakes-g6d43xmqo","headline":"CareCloud breach balloons to 3.75 million, Astra makes OpenAI hit the brakes","text":"CareCloud's healthcare breach turned out to be far bigger than first disclosed, now affecting 3.75 million patients. OpenAI paused frontier training after its Astra model showed signs it might cross a critical cybersecurity threshold. A gem called kobako had a full sandbox escape rated CVSS 10.0, and a coordinated campaign turned 40 Firefox extensions into wallet stealers after they'd built up clean reputations. Also today: CISA's new three-day patch clock kicks in December 7, and a Windows IKE flaw is now under active exploitation.","url":"https://daily.dev/posts/carecloud-breach-balloons-to-3-75-million-astra-makes-openai-hit-the-brakes-g6d43xmqo","datePublished":"2026-08-20T04:17:42.557Z","dateModified":"2026-09-13T21:03:47.119Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"CareCloud breach balloons to 3.75 million, Astra makes OpenAI hit the brakes"}]} ```