DIY store chain ManoMano is notifying customers of a data breach that was caused by hackers compromising a third-party service provider.

The company confirmed to BleepingComputer that it learned of the hack in January 2026. An investigation into the incident determined that 38 million individuals are affected.

“We can confirm that ManoMano has recently notified customers about a security incident involving one of our third-party customer service providers (a subcontractor),” the company told BleepingComputer.

“In January 2026, we identified unauthorized access linked to this provider, which resulted in the unauthorized extraction of certain personal data associated with customer accounts and customer service interactions.”

ManoMano is a French e-commerce firm operating an online marketplace specializing in DIY, home improvement, gardening, and related products. It operates in France, Belgium, Spain, Italy, Germany, and the United Kingdom, and its e-stores reportedly have 50 million unique visitors per month.

Earlier this month, someone using the alias “Indra” claimed the ManoMano attack on a hacker forum, alleging that they were holding details on 37.8 million user accounts, as well as thousands of support tickets and attachments.

According to unconfirmed reports, the compromised organization was a Tunis-based customer support service provider that suffered a Zendesk breach.

Cybersecurity firm Hackmanac posted that ManoMano started notifying customers this week that their data had been stolen.

A spokesperson of ManoMano explained to BleepingComputer that the exposed information varies per individual, depending on the type of interactions they had with the platform. Exposed data types include:

• Full name
• Email address
• Phone number
• Customer service communications

ManoMano emphasizes that no account passwords were accessed and that no data modifications occurred on the company’s systems.

“Upon discovery, we took immediate steps to secure our environment, including disabling the relevant access, revoking the subcontractor’s access to customer data, and strengthening access controls and monitoring,” said a ManoMano spokesperson.

“We also notified the relevant authorities, including the CNIL and ANSSI, and informed impacted customers with guidance to remain vigilant against phishing and social engineering attempts.”

The notification sample ManoMano shared with BleepingComputer contains recommendations for customers, including verifying incoming communications and sender identity, monitoring bank accounts for fraudulent transactions, and avoiding clicking on suspicious links or downloading email attachments.

ManoMano notes that the investigation is ongoing and that they cannot share additional technical details at this stage.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Advertisement

Get the guide

The raise will fund Allica’s expansion plans outside the UK.

London’s Allica Bank has joined the European unicorn league with a $155m Series D raise that values the company at $1.2bn. New investors Ventura Capital, GLG and Sona AM, and existing investors TCV and Blue Owl, took part in the round.

Allica’s digital banking services are geared toward small, and medium enterprises (SMEs), currently offering services to more than 30,000 SMEs across the UK. The 2011-founded company has been named the fastest growing technology company in the UK by Deloitte in both 2023 and 2024.

According to Allica, SMEs are an underserved customer base in the fintech market.

The digital bank said the capital will enable continued investment into AI to develop newer lending mechanisms for SMEs. The infusion will also fund the company’s expansion plans outside the UK.

“We’re building the category defining digital bank for established SMBs, and are excited to be taking our proprietary platform into new markets,” said Allica CEO Richard Davies.

“This Series D investment is a major vote of confidence in Allica’s strategy and performance.”

Allica joins the fintech unicorn league alongside companies such as the UK’s Cleo and Denmark’s Flatpay. It was one of the new firms invited to participate in a new UK scale-up unit designed to support fast-growing, innovative financial services firms to scale and create high-skilled jobs in the country.

“Allica is a world class business that is executing exceptionally well in a large, underserved market,” said Mo El Husseiny, the managing partner of Ventura Capital.

Earlier this week, Irish fintech Stripe, founded by brothers John and Patrick Collison, announced it had hit a $159bn valuation – up from $106bn a year ago. Bloomberg reported shortly after that Stripe is considering acquiring PayPal, which has been struggling to grow for a few years.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Robert Walters’ data suggests that microshifting could be the next evolution of flexible working.

The global pandemic and AI wave have in many ways altered how modern-day employees approach working life. Remote and hybrid opportunities have given professionals greater control over their hours, creating a stronger sense of work-life balance. 

New research from recruitment platform Robert Walters indicates that there may now be a new working trend impacting the professional space: microshifting. This is defined as an approach to hours which sees the traditional working day split into shorter blocks of time, based around a professional’s personal obligations or energy peaks.

Robert Walters collected data from 850 white-collar, full-time, permanent professionals based in Ireland between December of 2025 and January of this year. What the report discovered is that more than half (59pc) of contributing Irish employees want their place of employment to adopt a microshifting schedule. 

Some respondents have noted that available flexible working models are not operating as efficiently or effectively as they could. Only 36pc of Irish workers stated that their company’s current policy is fit for purpose.

“Despite years of debate around flexible working, many organisations still measure commitment by visibility rather than results,” said Suzanne Feeney, the country manager at Robert Walters Ireland. “Trends like microshifting will continue to emerge as professionals seek flexibility that actually works, instead of policies that look progressive on paper but fail in practice.”

Shifting values

Despite concerns that flexible working results in lower engagement, Robert Walters’ report highlights that flexibility in hours can lead to increased office attendance. Of those who contributed their data, 42pc responded that switching to a microshifting approach would encourage them to increase the number of days they spend in the office each week.

Feeney said: “Offering flexible hours may feel counterproductive for employers looking to increase office attendance. Yet, a more adaptable schedule, without the pressure of rush hour commutes or staying at their desk all day, could motivate professionals to attend the office more frequently.”

More than a third of line managers (37pc) surveyed by Robert Walters thought microshifting could help improve engagement within their teams, while a further 44pc said they were open to testing it out.

Feeney added: “Microshifting is a more transparent version of the unofficial flexible working arrangements that already exist in many organisations. For managers and senior leaders, the question is whether it should be governed by trust and outcomes or quietly negotiated between colleagues.”

According to the data, however, worries persist, as nearly 50pc of surveyed managers expressed concerns that microshifting could result in higher instances of “quiet quitting“ and “slacking”. 

Feeney said: “While fears of microshifting fuelling disengagement are justified, the reality is that rigid working patterns are already pushing professionals to seek workarounds.

“Our findings suggest that when expectations are clear and performance is measured by results rather than visibility, microshifting has the potential to increase engagement, accountability and even time spent in the office.”

Additional research published today (26 February) by CPL also explored how organisations have to do more to encourage key talent loyalty. CPL’s Salary Guide for Ireland 2026 found that while compensation and benefits continue to be the top priority for 35pc of contributing employees, 24pc of professionals said that leadership and culture are the most important factors to consider when choosing an employer.

CPL’s research also found that flexible working has evolved from a perk to a critical component of employee packages, ranking as the second most important benefit overall among contributing participants. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Honor has confirmed an expanded version of its Honor Share file transfer system ahead of MWC 2026 in Barcelona, with new cross-OS capabilities that allow its latest Android devices to exchange files and share screens directly with iPhone, iPad, and Mac hardware.

The update builds on a cross-platform push Honor first introduced at MWC 2025, when the company announced its AI Alpha Plan and teased what it called an all-ecosystem exchange capability that would reduce the friction of moving files between Android and iOS devices.

The 2026 iteration goes further by expanding the scope of what Honor Share can do, moving beyond basic file transfer to include real-time display extension and a single-tap transfer method that Honor states no other Android manufacturer currently offers for Mac.

The Magic V6 foldable gains OneTap transfer to Mac, a feature that sends photos, videos, and documents from the phone directly to an Apple desktop without requiring a cable, a shared cloud account, or any third-party application running in between.

Google API keys for services like Maps embedded in accessible client-side code could be used to authenticate to the Gemini AI assistant and access private data.

Researchers found nearly 3,000 such keys while scanning internet pages from organizations in various sectors, and even from Google.

The problem occurred when Google introduced its Gemini assistant, and developers started enabling the LLM API in projects. Before this, Google Cloud API keys were not considered sensitive data and could be exposed online without risk.

Developers can use API keys to extend functionality in a project, such as loading Maps on a website to share a location, for YouTube embeds, usage tracking, or Firebase services.

When Gemini was introduced, Google Cloud API keys also acted as authentication credentials for Google’s AI assistant.

Researchers at TruffleSecurity discovered the issue and warned that attackers could copy the API key from a website’s page source and access private data available through the Gemini API service.

Since using the Gemini API is not free, an attacker could leverage the access and make API calls for their benefit.

“Depending on the model and context window, a threat actor maxing out API calls could generate thousands of dollars in charges per day on a single victim account,” Truffle Security says.

The researchers warn that these API keys have been sitting exposed in public JavaScript code for years, and now they have suddenly gained more dangerous privileges without anyone noticing.

TruffleSecurity scanned the November 2025 Common Crawl dataset, a representative snapshot of a large swath of the most popular sites, and found more than 2,800 live Google API keys publicly exposed in their code.

According to the researchers, some of the keys were used by major financial institutions, security companies, and recruiting firms. They reported the problem to Google, providing samples from its infrastructure.

In one case, an API key acting just as an identifier was deployed since at least February 2023 and was embedded in the page source of a Google product’s public-facing website.

Truffle Security tested the key by calling the Gemini API’s /models endpoint and listing available models.

The researchers informed Google of the problem last year on November 21.  After a long exchange, Google classified the flaw as “single-service privilege escalation” on January 13, 2026.

In a statement for BleepingComputer, Google says that it is aware of the report and has “worked with the researchers to address the issue.”

“We have already implemented proactive measures to detect and block leaked API keys that attempt to access the Gemini API,” a Google spokesperson told BleepingComputer.

Google stated that new AI Studio keys will default to Gemini-only scope, leaked API keys will be blocked from accessing Gemini, and proactive notifications will be sent when leaks are detected.

Developers should check whether Gemini (Generative Language API) is enabled on their projects and audit all API keys in their environment to determine if any are publicly exposed, and rotate them immediately.

The researchers also suggest using the TruffleHog open-source tool to detect live, exposed keys in code and repositories.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

Block is the latest business to announce layoffs, with the operator of payment platforms Square and Cash App opting to cut jobs in favor of using more AI tools. The financial tech company, helmed by Twitter founder Jack Dorsey, is slashing its current staff of 10,000 to “just under 6,000.” CNBC highlighted a letter Block sent to shareholders announcing the decision to nearly halve its workforce. According to the message from Dorsey:

“The core thesis is simple. Intelligence tools have changed what it means to build and run a company. We’re already seeing it internally. A significantly smaller team, using the tools we’re building, can do more and do it better. And intelligence tool capabilities are compounding faster every week.”

We learned last year that Block had developed an AI agent called “codename goose” for interacting with LLMs. Leadership is clearly putting high expectations on that project and any other in-house tools to fill the shoes of thousands. “intelligence will be at the core of how the entire company works. How we make decisions, how we build trust and manage risk, how we build products, and how we serve customers,” the shareholder letter states.

Block also reported its latest financial results today. It finished the 2025 financial year with operating income (profit after expenses) of $1.71 billion.

This isn’t the first time the fintech company has made deep cuts in its employee count. Layoffs numbering about 1,000 were rumored both in 2024 and 2025.

PayPal may not be pursuing an acquisition, Semafor reported, citing people familiar with the matter. 

Earlier this week, Bloomberg reported that Stripe expressed interest in buying some or all of PayPal Holdings, which includes the flagship product PayPal and its services, as well as other companies like Venmo. Stripe declined to comment on the news. 

But unnamed sources tell Semafor that the company has been working with bankers in preparation for a possible activist investor campaign or a hostile takeover. The bankers were working with Alex Chriss, PayPal’s now-ousted CEO, the outlet reported. The company’s new CEO starts next week, PayPal has said. 

PayPal did not respond to TechCrunch’s request for comment.

Most VPN providers offer a VPN app for Mac computers, but it can be difficult to choose the right provider with so many options available. Based on our extensive research and hands-on testing of VPNs over the years, these are the most important factors to consider when choosing a VPN: 

Privacy

The primary consideration for any VPN — including a Mac VPN — should be privacy. If your Mac VPN is unable to sufficiently protect your online privacy, then your VPN is useless. At a minimum, your VPN should employ industry-standard AES 256-bit encryption (with the OpenVPN or IKEv2 VPN protocols) or ChaCha20 (with the WireGuard or IKEv2 VPN protocol), along with offering basic privacy protections like a kill switch, DNS leak protection and a no-logs policy. If you need to use a VPN in situations where they’re frowned upon — like on school Wi-Fi — you may want a provider that offers obfuscated servers or obfuscation-focused VPN protocols, such as Proton VPN’s Stealth or NordVPN’s NordWhisper. Obfuscation tries to hide the fact that you’re using a VPN, making your connection look like standard web traffic instead.

For critical privacy needs, you’ll also want a VPN provider that’s based in a privacy-friendly jurisdiction, offers obfuscation and has a RAM-only server architecture. Additional privacy features to look out for include Tor over VPN capabilities, ad and tracker blockers and multihop connections. Also, look for a VPN that undergoes regular third-party security audits, as audits can help bolster trust in the VPN’s ability to protect its users’ privacy. 

Speed

Mac computers are generally known to be pretty fast, so you’ll probably want a fast VPN that can deliver excellent speeds. The speed of your VPN can have a major effect on activities like streaming, downloading, video conferencing, gaming and general web browsing. All VPNs lower your connection speed somewhat, so to keep things running as smoothly as possible, you’ll want to look for a VPN that will have as minimal an impact on your regular internet speeds as possible. Generally, the best VPNs only drop your download speed by an average of 25% or less, with the best performers — NordVPN, Proton VPN and ExpressVPN — staying under 20% speed loss.  

Usability

MacOS is designed to be clean and intuitive, so if you’re used to the feel of the operating system, you’d probably want a similar experience with the VPN software you use. A good Mac VPN should run smoothly and have a decluttered user interface that’s easy to use regardless of your technical expertise. It should have a large network of servers around the world so you can connect easily and reliably from wherever you are, and it should be able to help you access geo-restricted content from various regions. You should also consider advanced features, like specialty servers (such as Tor over VPN and obfuscated servers), double hop/multi-hop, a dedicated IP address and split tunneling (which lets you use a VPN connection for some VPN apps but not others).

Cost

VPN pricing varies greatly from provider to provider, so if you’re on a budget, you may want to consider the cost and overall value of your MacOS VPN. Typically, you can expect to spend about $5 to $15 a month for a monthly VPN subscription plan. If you want to save money, you can opt for an annual subscription, where prices can range from roughly $50 to $150 a year. Be careful with free VPNs, though, because you may end up putting your privacy at risk instead of protecting it if you go with a free option. Proton VPN is currently the only free VPN that CNET recommends. However, most VPNs offer a money-back guarantee that can be anywhere from a week to 45 days. You can also get a seven-day free trial with many VPNs if you sign up through Apple’s App Store. So you’ll most likely have options to try various Mac VPNs risk-free before you decide whether to fully invest in one. 

Device support

You’ll want a VPN that works well on your Mac devices, like your MacBook Pro, MacBook Air, Mac Mini, Mac Studio or Mac Pro. Additionally, if you’re heavily ingrained in the Apple ecosystem, you may want to consider a VPN that works well on your iPhone, iPad and even Apple TV. Thankfully, most VPNs support MacOS and iOS/iPadOS, and Apple TV compatibility is increasingly common. With the majority of VPN providers, you can install a VPN on all of your Mac devices, from MacBooks and Mac desktops to iPhones, iPads and Apple TV streaming boxes.

Streaming

VPNs can elevate your streaming experience thanks to their ability to hide your IP address, thereby making apps and websites think you’re in a different geographical location. For instance, you can use a VPN to unblock region-restricted content, like watching HBO Max while traveling outside the US, or watching BBC iPlayer while vacationing outside the UK. Alternatively, you can access foreign Netflix, Disney Plus and Amazon Prime Video libraries. Think about the streaming services you want to use with a VPN, and make sure those apps work with your desired VPN service. If you want to install a VPN on your smart TV, Android TV device, Amazon Fire TV or Apple TV, make sure your VPN provider has a compatible app for that device. Using a VPN for streaming may even help you save money on streaming service subscriptions.