Of course, this is the report from HF (the victim): https://huggingface.co/blog/security-incident-july-2026
Very serious incident.