ZERO|TOLERANCEZERO|TOLERANCE
"True security begins when you stop assuming you're protected and start proving you're not exposed."
- Zero Tolerance Principle
Latest Advisory
CERT/CC VU#487875CERT/CC-Coordinated Disclosure in an Enterprise AI Platform
Coordinated disclosure of five vulnerability classes in Deloitte AI Assist for Customer, affecting six tenants. Three CVEs assigned — CVE-2026-57474 / -57475 / -57476, MEDIUM under the coordinator record — and published in CISA CSAF VA-26-191-01. Coordinated with CERT/CC under VU#487875.
VU#487875 · Published May 18, 2026 · Updated Aug 3, 2026 · PGP-signed, SHA-256 verifiable
READ THE COORDINATED DISCLOSURE
Breach Intelligence
182 ARTICLESIndependent OSINT research and published threat analyses across critical infrastructure, healthcare, cloud, and software supply chains. These are recent breach analyses.
Medtronic: ShinyHunters Breach Exposes SSNs and Health Data of 3.8 Million
An intrusion into Medtronic corporate IT systems between April 13 and April 19, 2026 exposed the names, dates of birth, Social Security numbers and health information of 3,834,294 device patients. No Medtronic medical device, and no manufacturing or distribution system, was affected.
Itron: 8-K Said No Customer System Access, Amendment Said Otherwise
Itron told the SEC on April 24, 2026 that no unauthorized activity was observed in its customer hosted systems. Seven days later it filed an amendment identifying limited unauthorized access to certain customer-hosted systems.
HHS OCR Settles Four HIPAA Ransomware Investigations in One Day: $1,165,000 Over Missing Risk Analyses
OCR announced four HIPAA Security Rule settlements on a single day, all turning on the same failure: no accurate and thorough risk analysis. The four actions bring OCR's completed ransomware investigations to 19.
France Titres (ANTS): Claimed IDOR on National Identity Portal Exposes 11.7 Million Citizen Accounts
The French agency issuing every passport, ID card and driving licence detected unauthorised access to its portal on April 15, 2026. The Interior Ministry confirmed 11.7 million accounts; an actor using the handle breach3d claimed 19 million.
Vercel: Compromised Context.ai OAuth App Exposed Customer Environment Variables
An employee's OAuth grant to a third-party AI tool gave an attacker the employee's Google Workspace account and, from there, a path into Vercel. Non-sensitive environment variables belonging to a limited subset of customers were enumerated and decrypted.
French Education Ministry: ÉduConnect Pupil Data Stolen via Impersonated Staff Account, the Second of Three Intrusions in Four Months
An attacker impersonated an authorised staff account and exploited a flaw in the ÉduConnect pupil account management service, taking names, identifiers, schools, classes and activation codes for unactivated accounts. The ministry has published no victim count.
What We Do
Security research operating under zero-trust principles. Never trust, always verify.
Data Exposure Advisory
Passive external reconnaissance to identify exposed assets, leaked credentials, and misconfigured services before adversaries do.
Security Posture Assessment
External attack surface analysis from an adversary's perspective.
Supply Chain Risk Assessment
Vendor inventory mapping, third-party risk scoring, and supply chain exposure analysis for organizations relying on external data and infrastructure access.
Responsible Disclosure
Coordinated vulnerability disclosure with verified remediation. We document, we notify, we follow through.
Incident Analysis
Post-breach forensic analysis and timeline reconstruction. Understanding the kill chain to prevent recurrence.
OSINT Research & Publishing
Independent open-source intelligence research on cyber threats. We investigate, analyze, and publish breach reports on our Cyber Threats page.
PROFESSIONAL SERVICES
One breach exposes every client. We assess the attack surface your partners create.
HOLDING COMPANIES
A subsidiary's exposure is yours. We map risk across your portfolio.
GOVERNMENT
Critical infrastructure under persistent threat. We verify what internal programs miss.
HEALTHCARE & EDUCATION
The costliest breach sector for 14 consecutive years. We quantify the exposure.
FINANCIAL SERVICES
Banks, insurers, and payment platforms across three continents. We find what compliance audits miss.
RETAIL & E-COMMERCE
Millions of records, hundreds of vendors. We test the boundaries.
under zero-trust principles.
Never trust. Always verify.
Holding Organizations Accountable
Zero Tolerance is a security research firm built on one principle: Breaches are inevitable, but negligence isn't.
We conduct passive external reconnaissance - no intrusion, no exploitation. We observe what's already exposed and document what organizations fail to protect.
Every disclosure is responsible. Every remediation is confirmed. Every analysis is published to raise the standard of accountability in cybersecurity.
Contact
Responsible disclosure, advisory engagement, or media inquiries.
We do not use web forms. Your message is sent directly from your own email client - no data passes through or is stored on our servers. For sensitive disclosures, encrypt with our PGP key.
RESPONSE WITHIN 48 HOURS
KARIM EL LABBAN · FOUNDER & PRINCIPAL · ZERO TOLERANCE LLC