Post-quantum security, product updates, and plain-English takes on keeping sensitive files private. From the team building SpaceBox.
Encrypted traffic captured today can be stored and unlocked once large quantum computers arrive. SpaceBox seals every file with ML-KEM-768 (NIST FIPS 203) key exchange and AES-256-GCM, so what you send now stays unreadable then. We break down the threat, the maths, and why we chose these primitives over the alternatives.
Read the article →UpGuard found 16,326 Supabase databases whose tables could be read by anyone holding the public key shipped in the site's own code, and over half showed signs of personal data. Each one depended on an access rule that was missing or wrong, which is the case for encrypting files before they reach the server.
Read the article →A file-sharing system at the Pentagon's personnel data center held unencrypted Social Security numbers for 2.76 million living people and 294,000 who have died, and unauthorized users had access from October 2025 to July 2026. The exposure was set by how the files were stored, long before anyone noticed the intrusion.
Read the article →A flaw in Gyazo's upload server let an attacker take about 23.62 million user records and roughly 490 million image metadata records, including the identifiers and OCR text that go with each image. Helpfeel says that metadata could be used to view the images themselves, so image delivery was switched off service-wide.
Read the article →Researchers found an Elasticsearch cluster holding 220,783,700 passenger and crew records, nine years of passport numbers and flight details, reachable with credentials the operator had never changed. Three months on, nobody has claimed the database, so nobody has to notify the people in it.
Read the article →A dark web service advertised document images for more than 170 million people in the US and Canada, and said it had been pulling fresh data from an identity verification company for over a year. A password can be rotated after a breach; a license scan cannot.
Read the article →McKesson disclosed a cybersecurity incident on 28 August after attackers used voice phishing to take over single sign-on accounts and export data from Salesforce and Snowflake. Every platform involved encrypts data at rest, and none of it was in the way of a valid session.
Read the article →The EU's e-evidence Regulation became applicable on 18 August, letting a judicial authority in one member state order stored data straight from a provider in another, within ten days or eight hours in an emergency. What any order returns is decided long beforehand, by where the keys live.
Read the article →Apple has filed a fresh challenge at the Investigatory Powers Tribunal against a UK notice requiring access to encrypted iCloud data. Eighteen months in, the strongest iCloud encryption is still unavailable to an entire country.
Read the article →An AI model spent about 60 hours on the post-quantum signature candidate HAWK and found a lattice symmetry that halves its security margin. The submission team withdrew the scheme from NIST's process the next day, and nothing already deployed had to change.
Read the article →Attackers reached engineering files on internet-exposed PTC Windchill servers through a CVSS 9.3 deserialization flaw, then emailed hundreds of employees at the affected companies. Nothing was locked, and backups say nothing about who else now holds a copy.
Read the article →Attackers spent two weeks inside a third-party support platform used by Ernst & Young and downloaded documents containing client tax information. Sensitive files accumulate in the systems that are easiest to reach, which are rarely the systems anyone is watching.
Read the article →Ransomware shut down hospitals in Dublin, London and Dusseldorf, and networked backups were no help because attackers reach them too. The case for storage that is offline, append-only and impossible to encrypt from afar.
Read the article →A European cloud company left a database open to the internet and roughly 367,000 records spilled out, no exploit required. Misconfiguration is the most common way stored data leaks, and it is exactly the case where ciphertext-only storage earns its keep.
Read the article →Turn any device into a SpaceBox and receive sealed files from anyone you invite. No account, no card, no email. A tour of what ships in the free beta, and how the two-device model keeps senders anonymous.
Read the article →Providers are legally compelled to hand over your data, and every backdoor becomes a target the moment it exists. What zero-knowledge, non-custodial storage actually changes for the people who need it.
Read the article →