Rituals: Loyalty Program Member Data Breach

Dutch cosmetics giant Rituals officially confirmed a major personal data breach from its “My Rituals” loyalty database on April 22. Welcome in Security Sunday.

Dutch cosmetics giant Rituals officially confirmed a major personal data breach from its “My Rituals” loyalty database on April 22. The company detected the unauthorized data exfiltration in early April and, after initial forensic analysis, began notifying affected customers.

Attackers downloaded complete member profiles including full name, email address, phone number, date of birth, gender, and postal address. They also obtained data on the customer’s preferred store and account type — information that reveals purchasing behavior. Rituals emphasizes that no passwords or payment information were compromised.

The main risk for affected customers is sophisticated phishing. With a real name, date of birth, address, and preferred-store details, an attacker can craft a message that addresses a specific person, references a real branch, and may mention birthdays or loyalty benefits that Rituals actually offers its members. This level of personalization dramatically increases attack success rates and often serves as an entry point to more serious incidents.

The attack fits into a broader pattern that has been targeting loyalty databases in recent months. In February 2026, telecommunications operator Odido admitted a compromise of 6.2 million customer records, which ended up on the darknet after the ransom was refused. In the last Security Sunday I wrote about Booking.com, and we’ve seen a similar scenario in the Co-op and Marks & Spencer breaches. Loyalty programs have become attractive targets because they combine identification data, contacts, purchasing patterns, and often geographic location in a single database — an almost ideal entry point for social engineering.

Rituals has not yet disclosed the method of intrusion or the identity of the attacker, and no active ransomware group has claimed responsibility for the incident.

Vercel and Lovable: Two Breaches in 24 Hours

Vercel, the hosting giant behind the Next.js framework, and Lovable, an AI vibe-coding startup valued at $6.6 billion, disclosed serious security incidents within a single day.

On April 19, Vercel issued a security advisory stating that an attacker had gained access to its internal systems. The entry point wasn’t the infrastructure itself, but the Context[.]ai Chrome extension that one of its employees had installed and connected to the company’s Google Workspace account.

A forensic analysis by Hudson Rock laid out the entire chain, which is becoming a textbook example of a modern supply chain attack. A Context[.]ai employee was infected with malware after downloading auto-farm scripts for Roblox that contained Lumma Stealer. The infostealer cleaned out the employee’s browser, including credentials for Google Workspace, Supabase, Datadog, AuthKit, and the saved support@context[.]ai account.

Hudson Rock had a record of this infection in its database a month before the actual attack on Vercel. Had Context[.]ai rotated its compromised credentials immediately, the entire incident could have been averted.

The attacker subsequently abused a valid OAuth token that Context[.]ai held for accessing users’ Google Drive accounts through its Chrome extension. One of Vercel’s employees had installed this extension on his corporate account and, according to Context.ai itself, granted it “Allow All” permissions to the entire Drive. The attacker pivoted via Google Workspace from the employee’s account to his Vercel account, and from there into Vercel’s internal environment.

On April 20, 2026, security researcher Matt Palmer disclosed details of a critical vulnerability in the Lovable platform on X — a startup valued at $6.6 billion that counts Uber, Zendesk, and Deutsche Telekom among its customers. With a freely available free-tier account and just five API calls, he was able to access other users’ profiles, their public projects, source code, and from it extract database credentials.

Technically, this was a textbook BOLA (Broken Object Level Authorization) vulnerability, which arises when an API grants access to objects without verifying whether the requesting user has the right to view them. The api[.]lovable[.]dev/GetProjectMessagesOutputBody endpoint verified Firebase authentication but skipped ownership checks — that is, whether the logged-in user actually had the right to access the given project. From the responses, it was possible to obtain user IDs, full session content, AI thinking logs, and tool-use records. Once the attacker obtained the source code, they often found hardcoded Supabase credentials within it, which they could then use to query the live database.

What makes the whole incident even more remarkable is that the report submitted through the HackerOne platform went unaddressed for roughly 48 days.

Both incidents share the same DNA. The attacker didn’t go through the front door, but through an integration that someone had entrusted. At Vercel, it was a Chrome plugin with OAuth scope to the entire Drive; at Lovable, it was the AI platform itself generating the code.

Apple Patches an iOS Bug That Allowed Recovery of Deleted Messages

On Wednesday, April 22, Apple released an emergency security update — iOS 26.4.2 and iPadOS 26.4.2 — patching a flaw tracked as CVE-2026–28950. The vulnerability allowed the FBI to recover deleted Signal messages from a defendant’s iPhone without having to break the encryption.

All it took was looking into the push-notification database, where iOS silently retained previews of incoming messages for up to a month — even after the user deleted them in the app, or uninstalled the application altogether.

The case came to light through the testimony of an FBI agent in federal court in Fort Worth. Investigators obtained copies of incoming Signal messages from the defendant’s iPhone, even though the messenger was set to auto-delete and the application itself was no longer on the device.

The key point is that the FBI didn’t get these messages from Signal. They pulled them from iOS’s internal notification database (NotificationCenter), where previews displayed on the lock screen were stored. Any application with permission to display message previews was therefore unwittingly storing their content in system storage, where the data persisted for up to 30 days.

In its security bulletin, Apple described the bug tersely: notifications marked for deletion may have been unexpectedly retained on the device. The fix consists of improved data redaction. Cupertino did not disclose specific technical details, nor did it say how long the problem actually existed in iOS, or whether it had been exploited in cases other than the one made public.

FIRESTARTER: A Backdoor That Survives Even Cisco Firewall Patching

The U.S. agency CISA, together with the UK’s NCSC, has in recent days uncovered a troubling intrusion into the network of a federal civilian institution. The attackers compromised a Cisco Adaptive Security Appliance (ASA) device and deployed on it a previously undocumented backdoor codenamed FIRESTARTER, designed for remote access and control of the device.

What’s notable is that the attack took place before September 25, and although the affected agency subsequently deployed security patches, the malware persisted on the device and allowed the attackers to regain access in March 2026 without having to re-exploit the original vulnerabilities.

The entry vectors were two zero-day flaws in the ASA VPN web server — CVE-2025–20333 and CVE-2025–20362. Technically, FIRESTARTER is a Linux ELF binary targeted at Cisco Firepower devices, where it serves as a C2 channel for remote access and control.