• Qilin ransomware group claims breach of TWU Local 100 in New York
• Data allegedly leaked to dark web; union represents 41,000 workers and 26,000 retirees
• Stolen PII could fuel phishing and fraud; members urged to stay vigilant

The dreaded Qilin ransomware operators has added the Transport Workers Union of America (TWU) Local 100 chapter to its data leak site, saying it broke into the organization and has already leaked everything it stole onto the dark web.

The Local 100 chapter of the TWU is the local union which represents tens of thousands of transportation workers in and around New York City, including people who operate and maintain the subways, buses, and other transit services, as well as workers at some private bus and ferry companies.

Instagram is one of the most used social media apps today. People share photos, videos, and Reels every day. If you noticed your post getting more attention, you might be curious to know who shared it. While there is no direct list of usernames available, Instagram does offer some helpful information.

Can You See Who Shared Your Instagram Post?

No, Instagram does not allow you to see who shared your post. It keeps this information private. However, if you change to a professional account, you will be able to see how many times your post has been shared.

Switch to a Professional Account

To see how many times your post was shared, you need a professional account. Personal accounts do not show shared insights. You can switch to either a Creator or Business account in your settings. Once you switch, you will get access to Instagram Insights. Follow these steps:

1. Go to your profile.
2. Tap the menu icon (the three lines) in the top corner.
3. Open Settings and Privacy.
4. Tap Account type and tools.
5. Select Switch to professional account.
6. Select Creator or Business.

Check Shares Using Insights

Insights will show you how your posts are performing. To check the share count:

1. Open your Instagram profile.
2. Choose the post you want to check.
3. Tap View Insights below the post.

This section displays likes, comments, saves, and the share count indicated by a paper airplane icon. Instagram keeps the names private, but it shows the total number of shares.

Furthermore, if you are using a personal account, you cannot see post insights. Instagram does not show share numbers for personal profiles. If you want to track shares and other data, you will need to switch to a professional account.

What About Story Shares?

If someone shares your post to their Story and tags you, you will receive a notification. You can then tap it and view their Story. But if they don’t tag you, Instagram won’t notify you. Also, you can only see the Story for 24 hours.

Moreover, the same rules apply to Reels as regular posts. If you’re using a professional account, you can check Reel shares through the Insights section. Just open the Reel and tap View Insights to view the share count. Instagram keeps the names private and only shows the total number.

Xflow, an Indian fintech startup, has secured backing from both Stripe and PayPal Ventures in a $16.6 million funding round. The investment comes as the company works to carve out a position in cross-border B2B payments, a market still dominated by banks and manual processes.

The Series A round was led by General Catalyst, with participation from existing investors Square Peg, Stripe, Lightspeed, and Moore Capital, while PayPal Ventures joined as a new backer. The all-equity round values the Bengaluru-based startup at $85 million post-investment and brings its total funding to more than $32 million to date.

Despite rapid digitization in domestic payments, cross-border B2B transfers for Indian exporters remain heavily reliant on banks, often with limited visibility into fees, settlement timelines, and the final amount received in rupees. The friction is particularly acute for larger exporters moving millions of dollars into India to fund salaries and local operations, creating an opening for fintech infrastructure players such as Xflow that promise greater transparency and speed in international money movement.

Founded in 2021, Xflow provides cross-border payment infrastructure for businesses ranging from exporters and SaaS firms to platforms and freelancers, enabling them to collect international payments, manage foreign exchange, and settle funds in India.

“Cross-border B2B payments were stuck in a different age compared to UPI,” co-founder Anand Balaji (pictured above, center) said in an interview, referring to India’s widely used instant domestic payments network, the Unified Payments Interface.

Balaji, who previously helped build out Stripe’s India business, founded Xflow with former Stripe colleagues Ashwin Bhatnagar (pictured above, right) and Abhijit Chandrasekaran (pictured above, left).

Last year, Xflow said it enabled Indian businesses to collect payments from more than 100 countries in over 25 currencies. It processed close to $1 billion in annualized cross-border payment volume last year, marking roughly 10-fold growth from the same period in 2024, Balaji told TechCrunch.

According to the company, its customer base has expanded to about 15,000 businesses spanning SaaS firms, global capability centers (which are offshore units that multinationals operate in India), IT services exporters, freelancers, and fintech platforms.

Transaction sizes vary widely by segment, with global capability centers averaging about $1 million to $2 million per transaction, goods exporters around $30,000 to $40,000, and freelancers roughly $3,000, according to Balaji.

Xflow is positioning itself as a payments infrastructure provider rather than a direct payments application, offering APIs that allow platforms and exporters to embed cross-border money movement into their own products.

“We didn’t want to build the next Wise — we want to power the next thousand Wises,” Balaji said.

The startup has also introduced an AI-based foreign exchange tool to help finance teams optimize the timing of currency conversions. Xflow says the feature has generated incremental gains for some customers through data-driven foreign exchange decisions.

The tool allows businesses to set target conversion rates rather than accepting prevailing bank quotes. Balaji likened the feature to limit orders in trading — instructions to buy or sell only at a specified price.

“What we’ve added is the prediction layer and the ability to actually set a limit order,” he said. The model currently provides a three-day forecast with about 92% confidence, Balaji said, though TechCrunch could not independently verify that figure.

Xflow faces competition from banks that still dominate large cross-border B2B transfers, as well as fintech players such as Wise, Payoneer, and Skydo at the lower end of the market. But Balaji said the startup’s focus on high-value transactions and API-led infrastructure differentiates it from many rivals.

The startup plans to deploy the new capital toward building additional products on top of its core payments infrastructure and securing regulatory licenses in new markets, Balaji said. Xflow is preparing to roll out import capabilities in the coming months and is pursuing licenses in markets including Singapore, while already holding a payments license in Canada, even as it remains focused on India as its primary market.

Xflow said it has also received final authorization from the Reserve Bank of India for a Payment Aggregator–Cross Border (PA-CB) license covering both exports and imports. The startup has signed platform partnerships with Easebuzz and Drip Capital to embed its cross-border capabilities into their offerings.

Backing from Stripe and PayPal Ventures, Balaji said, has helped strengthen the startup’s credibility with banking and regulatory partners, even as it continues to work with multiple payment providers commercially.

The startup currently has about 65 employees as it scales its cross-border infrastructure business.

Finally, it has my two favorite things: drop-bar handlebars and a dropper seat post. I guess I should disclose here that my everyday analog ride is also a gravel bike, and that personally, I like to tool around on a long, relaxed frame with my hands sloppily splayed this way and that on comfortable padded drop bars. I’m on dirt and gravel a lot, but I’m just not a fan of super technical riding.

Also, everyone should have a dropper seat post. I took the bike out for multiple 15- to 20-mile rides over a few weeks. OK, it’s not that hard, physically, to ride for an hour with electric assist while listening to podcasts, but I appreciate being able to move my seat around quickly at stop lights when my butt and quads decide to stop working that well.

Even with these additions and the full MTB front and rear suspension, the bike weighs a surprisingly little 40 pounds for the large frame. From riding a lot of electric bikes, I’d estimate a bike with these specs to weigh around 60 or 65 pounds. (I estimated my XS frame to be around 35 pounds, but that’s just by feel.)

Everywhere at Once

Photograph: Adrienne So

There are a couple of mixed-surface routes I ride regularly that I’m somewhat reluctant to reveal because I worry some of you might see me there. One is a loop that travels around the northernmost point of Portland, Oregon, and goes through a couple sloughs; I also like Leif Erikson Trail, a 20-mile gravel trail in Forest Park, Mount Tabor, and the loop around Pier Park, which was one of the first places where anyone ever raced cyclocross and which is primarily now used by elementary schoolers on teeny mountain bikes.

As someone who regularly rides a gravel bike, it is cool and freaky to ride a bike that is, to all appearances, a gravel bike, but then feels like a very cushy, premium electric mountain bike once you’re on it. It’s like nibbling what looks like a bit of bitter dark chocolate, and finding it full of puffy, sweet marshmallow. Here I am, braced to roll over some rocks, but … these tires are huge! This suspension is soft! What is this strange sensation? Is it comfort?

The ShinyHunters extortion gang has claimed responsibility for breaching Dutch telecommunications provider Odido and stealing millions of user records from its compromised systems.

Odido is one of the largest telecommunications companies in the Netherlands and offers mobile, broadband, and television services to millions of customers nationwide.

The company disclosed the breach on February 12, revealing that attackers downloaded the personal data of many of its users after gaining access to its customer contact system on February 7. However, Odido added that no Mijn Odido passwords, call details, location, data, billing data, or scans of identity documents were exposed during the incident.

According to the telecom firm, the exposed information varies per customer and may include a combination of full name, address and city of residence, mobile number, customer number, email address, IBAN (bank account number), date of birth, and some identification details (passport or driver’s license number and validity).

It also told local media at the time that the data breach affected 6.2 million customers and that the threat actors reached out to say they had stolen millions of user records.

After discovering the incident, Odido has reported the breach to the Dutch Data Protection Authority, blocked the attackers’ access to its systems, and hired external cybersecurity experts to assist with incident response and mitigation.

An Odido spokesperson didn’t provide further information on the incident when asked about which threat group was behind the attack and whether they demanded a ransom “due to the ongoing investigations.”

While Odido has yet to attribute the attack, the ShinyHunters extortion gang has now added the company to its dark web leak site, claiming they’ve stolen nearly 21 million records containing data the company already revealed as exposed in the breach.

ShinyHunters also told BleepingComputer on Monday that the stolen data also contains internal corporate data and plaintext passwords.

“This is a final warning to come back to our chat and finish what we set out to do before we leak along with several annoying (digital) problems that’ll come your way,” the extortion gang says on the leak site. “Make the right decision, don’t be the next headline. You know where to find us.”

However, an Odido spokesperson denied their claims in a statement to BleepingComputer, reiterating that “no passwords, call details, social security numbers, or billing data are involved.”

In recent weeks, ShinyHunters has claimed responsibility for a wave of other security breaches, including Panera Bread, Betterment, SoundCloud, Canada Goose, PornHub, and online dating giant Match Group (which owns the Tinder, Hinge, Meetic, Match.com, and OkCupid dating platforms).

Some of their victims had their systems compromised in voice phishing (vishing) attacks targeting single sign-on (SSO) accounts at Google, Microsoft, and Okta, where the threat actors call employees while impersonating IT support staff and trick them into entering credentials and multi-factor authentication (MFA) codes on phishing sites that mimic their companies’ login portals.

As BleepingComputer first reported, the ShinyHunters group has also recently adopted device code vishing, abusing the OAuth 2.0 device authorization grant flow to obtain Microsoft Entra authentication tokens.

After stealing their targets’ credentials and auth codes, the threat actors hijack the victims’ SSO accounts to breach connected enterprise services like Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

King of Meat‘s reign is ending. The game will end service on April 9, less than a year after its October 2025 debut. The Amazon Games-published title will be playable until that date, but will then be taken entirely offline.

“Despite the creativity and innovation Glowmade brought to King of Meat, the game has unfortunately not found the audience we hoped for,” the announcement read.

Developer Glowmade had high hopes for King of Meat, its debut game, but it fell starkly short of expectations. The developer wanted a concurrent player count of at least 100,000, but peaked at 320, according to Insider Gaming. The game had a multi-million dollar marketing budget that included a video on MrBeast’s YouTube channel and custom-wrapped London buses. The company even made a pilot for an animated TV show. Here at Engadget, we were so-so on a preview version of the game.

December brought voluntary redundancies to Glowmade after previous assurances to staff. Anyone who has purchased King of Meat will be able to get a refund through their purchase platform and, in most cases, these refunds should process automatically by April 9.

While it seems that King of Meat struggled to reach its audience, Amazon has a history of pulling games that are popular. Last fall, Amazon Games announced it would wind down support for New World: Aeternum, which first debuted in 2021. The news came as the division faced layoffs, but just that week the game had reached almost 50,000 concurrent players on Steam.