Anthropic Claude Code: 1,900 Files, 512,000 Lines Exposed

Anthropic confirmed that a release packaging misconfiguration exposed the source tree for Claude Code — 1,900 files and 512,000 lines of internal production tooling. The company characterised it as a build pipeline error rather than an intrusion, noting no model weights or customer data were accessed.

From a security standpoint, the distinction matters less than the exposure. 512,000 lines of production code for a frontier AI system hands adversaries a detailed map of prompt handling, toolchain architecture, and internal scaffolding. Even without weights, that intelligence is valuable. KrebsOnSecurity’s analysis of the Claude Code leak.

Lapsus$ Hits Mercor and LiteLLM Supply Chain

The notorious Lapsus$ hacking collective executed a supply chain attack targeting Mercor (an AI hiring platform) and LiteLLM (an open-source LLM proxy library). The attackers exfiltrated Slack workspace data and AI contractor interview videos — sensitive material that could expose client companies, candidate identities, and internal AI evaluation processes.

LiteLLM is widely used across the AI developer ecosystem as a unified interface to multiple LLM APIs. A supply chain compromise at LiteLLM is not an isolated incident — it is a vector into every organisation that depends on it. Lapsus$ has historically used social engineering and SIM swapping rather than purely technical exploits, suggesting insider access or credential theft may have played a role. The Record’s reporting on the LiteLLM supply chain attack.

European Commission: 350GB Stolen by ShinyHunters

The ShinyHunters threat actor group claimed responsibility for exfiltrating 350GB of data from the European Commission. ShinyHunters is a prolific data theft group known for large-scale breaches — past targets include Ticketmaster, Santander, and AT&T. A 350GB EC breach, if confirmed, would represent one of the most significant incursions into EU institutional infrastructure on record.

The European Commission had not issued an official statement confirming the breach at time of publication. ShinyHunters has a history of publicising breaches before organisations acknowledge them, often using the disclosure as leverage. BleepingComputer’s coverage of the ShinyHunters EC claim.

QualDerm Partners: 3.1 Million Patient Records Exposed

QualDerm Partners, a dermatology practice management company, disclosed a breach exposing 3.1 million patient records. The exposed data includes protected health information (PHI) — names, dates of birth, Social Security numbers, insurance details, and medical records. This is a HIPAA-covered breach requiring formal notification to affected individuals and HHS. Additionally, Hasbro filed an SEC 8-K breach disclosure, joining the growing list of public companies required to report material cybersecurity incidents under the SEC’s 2023 cyber disclosure rules.

Apple Emergency Patch: iOS 18.7.7 for DarkSword Exploit

Apple released iOS 18.7.7 as an emergency out-of-band patch targeting the DarkSword exploit — a zero-click vulnerability being actively exploited in the wild. DarkSword reportedly allows remote code execution without user interaction, placing it in the highest severity tier. Apple’s rapid response — an emergency patch outside its normal release schedule — indicates intelligence suggesting active use by sophisticated threat actors, potentially state-sponsored. Update immediately.

April 1, 2026 — Breach Summary

Frequently Asked Questions