This week’s cybersecurity roundup highlights growing concerns around online child safety, healthcare data protection, supply chain risks, and cyber threats affecting organizations worldwide. From regulatory scrutiny of digital platforms to large-scale vulnerabilities and operational disruptions, recent incidents show how cyber risks continue expanding across industries.  The key theme in this weekly roundup is the increasing pressure on organizations to strengthen security, improve data protection measures, and adapt to rapidly changing threat environments. Regulators, businesses, and cybersecurity teams are facing challenges ranging from social engineering attacks and malware incidents to vulnerabilities affecting widely used enterprise technologies. 

The Cyber Express Weekly Roundup 

UK Investigates TikTok Age Verification Compliance 

The UK communications regulator Ofcom has launched an investigation into TikTok’s age verification system, examining whether the platform is meeting its child safety obligations under the Online Safety Act. The probe comes as the UK government prepares stricter social media restrictions for users under 16, with enhanced age assurance requirements expected to take effect by Spring 2027. Read more… 

Partnered Health Cyberattack Exposes Australian Patient Data 

Healthcare provider Partnered Health has suffered a cyberattack that exposed sensitive patient information from 21 clinics across Australia. The compromised data reportedly includes personal details, Medicare information, health insurance records, and medical documents. Authorities and the company continue investigating the incident to determine the full scope of the breach and whether additional information was affected. Read more… 

Qantas Data Breach Cleared After Privacy Review 

Australia’s privacy regulator has concluded its review of the 2025 Qantas data breach, finding no evidence that the airline failed to take reasonable measures to protect customer information. The incident affected approximately 5.67 million records after attackers used social engineering techniques to compromise a contact center employee. Read more… 

Nichirei Cyberattack Disrupts KFC Japan Supply Chain 

Japanese frozen food and logistics company Nichirei experienced a cyberattack that disrupted deliveries to KFC Japan after unauthorized access impacted its systems. The company isolated affected infrastructure, suspended certain logistics operations, and began recovery efforts with external cybersecurity specialists while investigating the incident. Read more… 

Microsoft Patch Tuesday Addresses 622 Security Flaws 

Microsoft’s July 2026 Patch Tuesday update fixed 622 vulnerabilities across its product ecosystem, making it the company’s largest security release to date. The update included patches for two actively exploited zero-day vulnerabilities, CVE-2026-56164 and CVE-2026-56155, affecting Microsoft SharePoint Server and Active Directory Federation Services. Read more… 

Nihon Kotsu Cyberattack Disrupts Japan Taxi Operations 

Japan’s largest taxi operator, Nihon Kotsu, suffered a malware-related cyberattack that forced the company to shut down parts of its IT infrastructure. The incident, detected on July 11, 2026, affected taxi dispatch services and internal systems as the company worked to contain the attack and investigate potential data exposure. Read more… 

Weekly Cybersecurity Takeaway 

This week’s cybersecurity developments highlight the growing complexity of modern cyber threats, with attacks and security challenges affecting technology platforms, healthcare providers, logistics companies, transportation services, and enterprise software environments. From regulatory action on digital safety to actively exploited vulnerabilities and supply chain disruptions, organizations are facing increased pressure to strengthen resilience and respond faster to emerging risks. 

The ClickFix attacks technique has become a key initial access method for the UAC-0145 cyber threat cluster, according to a new report from Ukraine's Computer Emergency Response Team (CERT-UA). The agency said the threat group, also tracked as Sandworm, APT44, Seashell Blizzard, and a subcluster of UAC-0002, has shifted its tactics during 2026, increasingly relying on fake CAPTCHA prompts and social engineering to compromise systems.

CERT-UA said it has worked with Ukrainian cybersecurity agencies for several years to investigate the activities of UAC-0145. While the group previously relied on infected software installers distributed through torrent websites, recent campaigns have increasingly used ClickFix to trick users into executing malicious PowerShell commands.

ClickFix Attacks Emerging as Primary Initial Access Vector

According to CERT-UA, infections recorded during the spring and summer of 2026 frequently began when victims visited compromised websites displaying fake CAPTCHA pages. Users were instructed to copy and execute PowerShell commands in their terminal, a phishing technique commonly referred to as ClickFix.

The downloaded commands were designed to retrieve malicious files such as GHETTOVIBE, a Visual Basic Script (VBS) that establishes persistence by placing itself in the Windows Startup directory.

Once executed, attackers could deploy SCOUTCURL, a PowerShell reconnaissance tool capable of collecting information about the compromised system, including device specifications, installed software, browser data, and local files before exfiltrating the information.

CERT-UA also observed malware loaders including FLUIDLEECH, disguised as antivirus software, and LOADLOOP being used during these campaigns.

Backdoors and Data Theft Tools Widely Deployed

The report noted that attackers continue using malware families such as KALAMBUR, SUMBUR, and TAMBUR after gaining access to victim systems.

To maintain remote access, the group relied on legitimate utilities including OpenSSH and Tor, forwarding local network ports such as 445, 3389, and 22 to attacker-controlled infrastructure.

CERT-UA also found malware designed to steal messaging data from Signal and WhatsApp, with stolen information reportedly exfiltrated using RSYNC.

On infected systems examined during cyber defense operations, investigators additionally identified FREAKYPOLL, a Python-based backdoor distributed as compiled bytecode (.pyc), providing attackers with persistent unauthorized access.

Compromised Websites Used to Deliver Fake CAPTCHA Pages

During June and July 2026, CERT-UA analyzed more than ten compromised websites involved in ClickFix attacks.

Investigators found attackers using both the Cloaking.House service and custom malware called SMARTAXE to dynamically modify legitimate webpages. SMARTAXE retrieves remote domains from blockchain smart contracts through Ethereum's eth_call function before displaying fake CAPTCHA pages or redirecting visitors to malicious content.

CERT-UA warned that any website used in these attacks should be considered compromised, potentially through vulnerable content management systems (CMS), stolen credentials, web shells, malicious plugins, modified website scripts, or server-side backdoors.

The agency urged website administrators and hosting providers to strengthen website security and respond quickly to incident reports.

Android Malware Also Part of UAC-0145 Operations

The report also highlighted growing use of Android malware distributed through messaging applications.

Attackers were observed sharing APK files disguised as security or antivirus tools. One such malware family, tracked as COWARDDUCK, functions as a full-featured Android backdoor capable of collecting device information, contacts, files, and real-time geolocation.

The malware targets files from directories including DCIM, Documents, Downloads, Pictures, and Alarms while searching for formats such as DOCX, XLSX, PPTX, ZIP, RAR, JSON, and OVPN files.

According to CERT-UA, COWARDDUCK uploads stolen files through the Dropbox API while receiving commands from legitimate services including Steam Community and StockMemory domains through proxy infrastructure.

Microsoft Sees Global Rise in ClickFix Campaigns

Microsoft Threat Intelligence and Microsoft Defender Experts also reported that ClickFix campaigns have increased significantly since early 2024, targeting thousands of enterprise and consumer devices globally each day.

Microsoft said the technique commonly delivers malware such as Lumma Stealer by persuading users to copy and execute commands through Windows Run, Windows Terminal, or Windows PowerShell. The campaigns are often combined with phishing, malvertising, and drive-by compromise techniques that imitate trusted brands.

Because ClickFix attacks rely on user interaction rather than exploiting software vulnerabilities directly, Microsoft recommends organizations strengthen user awareness and apply security policies that restrict unnecessary use of command execution tools.

U.S. authorities have charged two New York residents, including Zhuoying Chen, in connection with an alleged Chinese money laundering network accused of laundering at least $43 million generated through cyber investment fraud schemes. The indictment, unsealed in Brooklyn, alleges the operation ran between 2020 and 2022 and involved an extensive network of shell companies and bank accounts.  According to prosecutors, Zhuoying Chen, 27, of Brooklyn, and Haojie Zhang, 38, of Queens, managed more than a dozen individuals across Brooklyn and Queens. The group allegedly opened 140 bank accounts under approximately 45 shell companies to move proceeds from fraudulent investment scams before transferring the funds to co-conspirators based in China.  Authorities said the investment fraud schemes began with perpetrators contacting victims through messaging platforms and social media. They allegedly built trust over time, persuaded victims to invest in seemingly lucrative opportunities, displayed fake profits to encourage additional investments, and ultimately stole the victims' money. 

Officials Vow Crackdown on Chinese Money Laundering Operations 

Commenting on the Chinese money laundering case, Assistant Attorney General A. Tysen Duva said, "As alleged in the indictment, the defendants laundered fraud proceeds, enabling scammers to continue to victimize Americans and deprive them of their hard-earned money." He added that dismantling Chinese money laundering networks supporting investment fraud is critical to protecting Americans and that the Criminal Division "will relentlessly pursue the financial networks that fuel and profit from these fraud schemes."  U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York described the defendants as "key members of a sophisticated money laundering network" that allegedly routed more than $40 million in victim funds to bank accounts in China. He said the office would continue pursuing individuals involved in investment fraud targeting vulnerable victims.  FBI New York Assistant Director in Charge James C. Barnacle Jr. stated that the operation allegedly laundered more than $40 million from American victims before depositing the funds into Chinese accounts overseas. He said the FBI remains committed to working with federal partners to dismantle such fraud networks.  Acting Executive Associate Director John A. Condon of Homeland Security Investigations said the two Chinese nationals allegedly operated the illicit network for nearly two years, laundering victims' life savings. IRS Criminal Investigation Special Agent in Charge Harry T. Chavis Jr. said the indictment demonstrates that "justice is coming" for fraudsters, while U.S. Postal Inspection Service Inspector in Charge Ketty Larco-Ward noted that investment fraud schemes exploit victims' trust through false promises of returns. 

Investigation and Legal Proceedings Continue 

The conspiracy to commit money laundering charge carries a maximum sentence of 20 years in prison. The investigation is being conducted by FBI New York, HSI New York, IRS Criminal Investigation New York, and the U.S. Postal Inspection Service. The prosecution is being led by Trial Attorneys Claire Galasso, David Ginensky, and Adrienne Rosen, along with Assistant U.S. Attorneys Benjamin Weintraub and David Berman.  The case also forms part of the Homeland Security Task Force initiative established under Executive Order 14159. Officials emphasized that an indictment is only an allegation, and Zhuoying Chen and the co-defendant are presumed innocent unless proven guilty beyond a reasonable doubt in court. 

The latest Notepad++ vulnerabilities addressed in version 8.9.7 include several high-impact security flaws that could expose Windows systems to arbitrary code execution, file overwrite attacks, memory corruption, and authentication bypass.   Among the most critical issues is a PowerShell command injection vulnerability in the installer, alongside fixes for CVE-2026-52886, CVE-2026-54758, and CVE-2026-57233. The release also delivers stability improvements and feature enhancements for one of the most widely used text editors on Windows. 

PowerShell Command Injection Tops the List of Notepad++ Vulnerabilities 

The most severe Notepad++ vulnerability involves improper handling of PowerShell commands during installation. According to the developers, the installer has been updated to improve the robustness of PowerShell command processing, reducing the risk of command injection and unauthorized command execution. If exploited, the flaw could allow attackers to manipulate the installation process and execute arbitrary PowerShell commands. In practical scenarios, a compromised installer distributed through spoofed download sources or social engineering campaigns could enable malware deployment during installation, potentially leading to complete system compromise without the user's knowledge.

CVE-2026-52886, CVE-2026-54758, and CVE-2026-57233 Address Critical Risks

In addition to the installer flaw, the update resolves several other security issues across different components. CVE-2026-54758 addresses a stack buffer overflow in the expandNppEnvironmentStrs function that could result in memory corruption and potentially remote code execution. Meanwhile, CVE-2026-57233 fixes a Zip Slip path traversal vulnerability in the WinGUp updater, preventing attackers from overwriting arbitrary files during the update extraction process.  Another patched issue, CVE-2026-52886, fixes a session handling flaw where manipulated session.xml entries could bypass path validation through the backupFilePath starts_with check. The release also resolves an unassigned vulnerability affecting the macro system, where shortcuts.xml allowed macro execution without proper HMAC verification, creating an integrity bypass that could enable unauthorized macro execution.  Collectively, these Notepad++ vulnerabilities demonstrate how installers, local configuration files, session management, update mechanisms, and macro validation can become attack vectors if not adequately protected. 

Notepad++ v8.9.7 Brings Stability Improvements Alongside Security Fixes 

Beyond addressing Notepad++ vulnerabilities, version 8.9.7 introduces several usability and stability improvements. Users can now retain the expand and collapse state within "Folder as Workspace," while Incremental Search has been enhanced with count and nth-position indicators. The update also fixes crashes, user interface glitches, high-DPI scaling issues, symbolic link freezes, file handling inconsistencies, and search performance problems. Additionally, bundled components have been updated to Scintilla 5.6.4, Lexilla 5.5.1, and pugixml 1.16.  The Notepad++ team recommends that users update to version 8.9.7 as soon as possible, particularly in enterprise and development environments where the editor processes untrusted files or operates within automated workflows. Although the auto-updater is expected to roll out the release within two weeks, provided no regressions are detected, manual installation is recommended for immediate protection.   Developers are also encouraged to verify download sources, as keeping software updated and installing packages only from trusted locations remains an essential safeguard against exploitation of CVE-2026-52886, CVE-2026-54758, CVE-2026-57233, and other Notepad++ vulnerabilities. 

The UK's communications regulator has launched a formal investigation into TikTok age verification, raising questions over whether the platform is adequately protecting children online under the country's Online Safety Act. The move comes as Britain prepares to introduce a social media ban for under-16s, with regulators warning that current age assurance methods used by some platforms may not be sufficient to prevent children from accessing harmful content.

The investigation follows the publication of a new Ofcom report that found age checks are becoming more common across online services, but significant gaps remain, particularly on social media platforms and some pornography websites.

Ofcom Questions TikTok Age Verification Method

According to Ofcom, some social media companies rely primarily on age inference methods to identify child users. These systems estimate a user's age based on their online behavior rather than verifying it directly.

The regulator said it has "serious doubts" about whether these methods are capable of meeting the standards required under the Online Safety Act. Ofcom believes some companies may be failing to correctly identify a significant number of children, potentially exposing them to harmful content, including pornography, self-harm, and suicide-related material.

As a result, Ofcom has launched a formal investigation into whether TikTok is complying with its legal duties to protect children from harmful content.

The regulator also warned that age inference alone will not be considered sufficient for enforcing the government's planned restrictions on social media use by children under 16. Platforms using such methods have been urged to adopt more effective age assurance technologies or provide compelling evidence demonstrating their effectiveness.

Age Checks Increase Across Online Services

The report found significant progress in the adoption of age checks since the Online Safety Act's child protection duties came into force in July 2025.

Between July 2025 and January 2026, the proportion of children encountering highly effective age checks increased from 25% to 43%.

Ofcom said more than 69 million age checks were completed across a sample of 32 UK services during the second half of 2025, representing a 23-fold increase compared to the previous six months.

The regulator also reported that all of the UK's top 10 pornography websites and most of the top 100 now have age verification measures in place.

Among children aged 8 to 14 who attempted to access pornography, only 8% visited such services. Half of those children reached only websites with age checks, while nearly 87% of their visits lasted less than 30 seconds, suggesting age verification discouraged continued access.

Search Engines Also Face Scrutiny

Despite the wider rollout of age assurance, Ofcom found that children can still easily discover pornography websites without age checks through Google Search and Bing.

Its analysis found that 33% of first-page Google search results and 54% of Bing results directed users to pornography websites lacking age verification or equivalent protections.

Following discussions with the regulator, Google and Bing have agreed to work with Ofcom on practical measures to reduce the visibility of such websites in search results.

Meanwhile, Ofcom continues enforcement against adult services that fail to comply with the law. The regulator has opened 23 investigations involving 88 adult service providers, with many either introducing age assurance or blocking UK users after enforcement action.

UK Moves Toward Social Media Ban for Under-16s

The investigation comes as the UK government advances plans to introduce a social media ban for under-16s, modeled on Australia's approach.

Under the proposal, platforms including TikTok, Snapchat, Instagram, Facebook, YouTube, and X would be prohibited from offering social media services to users under 16. Messaging services such as WhatsApp and Signal are not expected to be included.

The government also plans to introduce additional protections, including restrictions on livestreaming and communication with strangers for children under 16 across social media and certain gaming platforms. Similar safeguards would apply by default to users aged 16 and 17 to avoid what officials describe as a "cliff-edge" at age 16.

The proposed measures are expected to be presented to Parliament before the end of the year, with implementation targeted for Spring 2027.

Ofcom said it will submit a rapid assessment to Parliament by the end of October outlining what constitutes highly effective age assurance for verifying whether someone is over 16, helping shape future enforcement of the planned restrictions.

Zoom has released security updates to fix CVE-2026-53412, a critical Improper Input Validation vulnerability affecting its Windows software, which could allow attackers to take over user accounts via network access. The flaw primarily impacts the Zoom Desktop Client and other Windows-based Zoom products, prompting the company to urge users to install the latest updates. According to Zoom, CVE-2026-53412 carries a CVSS score of 9.8 and is tracked under security bulletin ZSB-26014. The company stated, "Improper Input Validation in Zoom Desktop Client for Windows and Zoom VDI Client for Windows may allow an unauthenticated user to conduct an account takeover via network access." The vulnerability is rated Critical with the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE-2026-53412 Affects Zoom Desktop Client for Windows 

The Improper Input Validation issue impacts Zoom Workplace for Windows before version 7.0.0 and Zoom Workplace VDI Client for Windows before versions 7.0.10, 6.6.15, and 6.5.18, depending on the software branch. Zoom advised users to remain protected by installing the latest software updates available through its download portal. The advisory credits Zoom Offensive Security for reporting the vulnerability. It also includes a revision history showing that version 1.0 of the bulletin was published on July 14, 2026, while version 1.1, released on July 15, 2026, removed Meeting SDK for Windows from the list of affected products. 

Three Additional High-Severity Vulnerabilities Addressed 

Alongside CVE-2026-53412, Zoom resolved three high-severity Windows vulnerabilities.  CVE-2026-53411 received a CVSS score of 7.8 and involves an Improper Input Validation flaw in the Zoom Workplace VDI Plugin for Windows before version 6.6.14. The issue could allow an authenticated local user to escalate privileges.  CVE-2026-53410, with a CVSS score of 7.0, is a time-of-check to time-of-use (TOCTOU) race condition affecting the installation and uninstallation process of certain Zoom Windows clients. The flaw could enable an authenticated local user to gain elevated privileges.   It affects Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before versions 6.5.17 and 6.6.14, Zoom Workplace VDI Plugin for Windows before versions 6.5.17 and 6.6.14, Zoom Rooms for Windows before version 7.0.5, and Remote Control for Zoom Contact Center for Windows before version 7.0.0.  The fourth issue, CVE-2026-53409, carries a CVSS score of 7.8 and is an improper privilege management vulnerability affecting Zoom Rooms for Windows before version 7.1.0. It could allow an authenticated local user to escalate privileges through local access.  At the time of publication, there is no evidence that CVE-2026-53412 or the other disclosed vulnerabilities are being actively exploited in real-world attacks. Nevertheless, Zoom recommends users update affected Windows applications as soon as possible to mitigate potential security risks associated with the Zoom Desktop Client and related software.

The Partnered Health cyberattack has exposed sensitive patient information across multiple Australian clinics, raising fresh concerns about healthcare cybersecurity. The Partnered Health data breach, involving clinics owned by healthcare provider Partnered Health, a company backed by Quadrant, affected facilities in New South Wales, Victoria, Queensland, Western Australia, and the ACT. The incident has also renewed scrutiny of the growing number of cyberattacks targeting Australia's healthcare sector.

Partnered Health Data Breach Impacted Medical and Personal Information 

Partnered Health confirmed that a malicious actor accessed its systems on 23 June, compromising data from 21 clinics across cities, including Sydney, Melbourne, and Canberra. The healthcare provider disclosed the breach more than three weeks later, informing patients that investigations had confirmed personal and health information had been taken from some clinics within its network. "Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network," the company said. It added, "As a health services provider, we know our patients and our people trust us with personal and medical information, and we sincerely apologise for any concern and inconvenience this may cause them." The stolen information includes names, dates of birth, addresses, contact details, Medicare information, private health insurance details, concession card information, consultation notes, referral letters, pathology reports, diagnostic results, and other treatment records maintained by general practitioners.

Investigation into the Partnered Health Cyberattack Continues 

Partnered Health said the cyberattack has been reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and law enforcement authorities. The company has also secured an interim injunction from the NSW Supreme Court preventing the stolen information from being used or published. While investigations remain ongoing, the provider said the extent of the breach is still being determined at five clinics, including three in Western Australia and two in Victoria. "While there is no direct evidence that patient records have been viewed, as a precaution we have written to patients from these clinics to make them aware of this and provide details of steps that can be taken to protect their information," a Partnered Health spokesperson said. The spokesperson added, "We understand that this sort of news can cause concern. We sincerely apologize for any distress this may have caused our patients."

Quadrant-backed Healthcare Provider Faces Growing Scrutiny 

Established in 2013, Partnered Health operates more than 60 medical centres, along with skin cancer, allied health, and mental health clinics, providing services to more than 5 million people nationwide. The company is owned by Quadrant, while Bupa announced in June that it would acquire the healthcare provider. The Partnered Health data breach comes amid a record year for cybersecurity incidents in Australia. According to the Office of the Australian Information Commissioner, 1,205 data breach notifications were recorded in 2025, marking an 8% increase compared with 2024. Among the year's largest incidents was the cyberattack on Qantas, which compromised the information of 5.7 million customers and was reportedly leaked on the dark web. A spokesperson for the Department of Home Affairs said the federal government is aware of the Partnered Health cyberattack and confirmed that relevant agencies are engaged as investigations continue. Authorities have not yet disclosed how many patients were affected or the full scope of the stolen data.

Google released a series of Chrome 151 updates on Wednesday, July 15, 2026, covering desktop, Android, and iOS platforms, while ChromeOS devices began receiving their latest Chrome Beta update a day earlier. The latest Desktop Update introduces new Beta and Early Stable builds for Windows, Mac, and Linux, alongside stability and performance improvements across multiple platforms. 

Chrome Beta and Desktop Update Reach Version 151.0.7922.34 

The latest Chrome Beta Desktop Update has been released for Windows, Mac and Linux, updating the Beta channel to version 151.0.7922.34. Google said a partial list of changes is available through the project's Git log.   Users interested in moving between release channels can do so through the available switching options, while any newly discovered issues can be reported by filing a bug. The company also pointed users to its community help forum for troubleshooting and discussions about common issues.  Google also introduced an Early Stable Desktop Update, rolling out Chrome 151 versions 151.0.7922.34 and 151.0.7922.35 to a small percentage of Windows and Mac users. According to the company, a complete list of changes for the build is available in the release log, with additional information provided for its Early Stable rollout process.

Chrome 151 Expands Across Android and iOS 

On Android, Chrome 151 (151.0.7922.29) entered an Early Stable rollout for a limited number of users and is expected to reach more devices through Google Play over the following days. Google stated that the release focuses on stability and performance improvements, with complete technical changes documented in the Git log.  The Chrome Beta release for Android, also carrying version 151.0.7922.29, is already available through Google Play. Google said users can review a partial list of changes in the Git log, while information about new features is available on the Chromium blog alongside updates covering the web platform. For iPhone and iPad users, Chrome Stable 151 (151.0.7922.25) is scheduled to appear on the App Store within hours of the announcement. Similar to the Android release, the update delivers stability and performance improvements. Meanwhile, Chrome Beta 151 (151.0.7922.26) for iOS is expected to reach the App Store over the next few days, with Google publishing a partial change log for the release. 

ChromeOS Beta Update Also Released 

Ahead of the broader Chrome 151 announcements, Google began rolling out a Chrome Beta update for ChromeOS and ChromeOS Flex on Tuesday, July 14, 2026. The Beta channel is being upgraded to OS version 16733.19.0, paired with browser version 151.0.7922.23, for most supported ChromeOS devices.  Google encouraged users across all releases to report newly identified bugs through its official reporting system, submit feedback directly through Chrome, or seek assistance via its ChromeOS and Chromebook community forums. The company also reminded users that instructions for switching release channels remain available for those interested in testing future Chrome Beta and Desktop Update builds. 

A vishing call to an overseas contact center agent. A fake IT ticket. A default setting nobody thought to lock down. That's all it took to expose the personal data of roughly 5 million Australians — and now the country's privacy regulator has decided Qantas isn't to blame for it.

The Office of the Australian Information Commissioner (OAIC) closed the book this week on its year-long preliminary inquiry into the June 2025 Qantas data breach, and the conclusion cuts against the instinct to punish the victim of a cyberattack.

Also read: Australia’s Qantas Confirms Cyberattack: 6 Million Service Records Compromised

According to the OAIC's report, the evidence gathered did not indicate a likelihood that Qantas had "failed" to take reasonable steps to protect the personal information it held, nor that it failed to ensure its overseas third-party provider complied with Australia's privacy principles. No investigation. No enforcement action.

"After more than a year of making inquiries and obtaining information on the data breach, we're satisfied that the evidence does not support the likelihood that a breach of privacy law occurred. As a result, we've decided not to commence a full investigation of Qantas at this stage." - Carly Kind, Australian Privacy Commissioner.

How It Happened

The breach traces back to a single phone call. A threat actor posing as "Qantas IT help" convinced a contact center agent to visit a website tied to the customer relationship management platform used by Qantas agents, walking them through steps framed as necessary to close an IT support ticket. That interaction connected the agent's CRM session to a data extraction tool controlled by the attacker, who then pulled data from every contact profile the agent could access. It was pure social engineering — no malware, no exploited vulnerability, just a convincing lie.

Qantas caught it fast. A staff member spotted an unusual spike in login-attempt alerts on the morning of June 30, two days after the call, and escalated it to the cybersecurity team. Within hours, the company had frozen the compromised account, assessed for data exfiltration, and triggered its incident response process. Public disclosure followed on July 2.

What Was Exposed — And What Wasn't

The regulator's numbers are more precise than what circulated publicly last year. Roughly 5.67 million customer records were compromised, with about 4 million exposing names, phone numbers, email addresses and Frequent Flyer details, and a further 1.7 million records including combinations of home or business addresses, dates of birth, gender and meal preferences. Critically, no credit card numbers, financial information or passport details lived on the compromised platform, and customer passwords and login credentials were never touched.

Also read: Qantas Airways Cyberattack Update: Customer Data Released, Security Measures Enhanced

Why The Regulator Let It Go

The OAIC's reasoning is a rare, explicit acknowledgment that good controls don't guarantee immunity. Investigators found that social engineering training generally targets credential theft, not the rarer tactic of talking an employee into authorizing a legitimate-looking system connection — meaning the attack likely would have succeeded even with standard training in place. They also noted the flaw was structural: a default configuration let the agent authorize a third-party app connection, a setting the CRM vendor has since changed for all its customers.

Commissioner Carly Kind put the broader stakes plainly in the OAIC's statement announcing the report, warning that AI-driven threats are only raising the bar. As she framed it, agentic and advanced AI will keep escalating the cybersecurity risks businesses face, making continuous review of security posture non-negotiable — not optional.

“Data breaches are a persistent feature of today’s digital world, and can occur despite organisations taking steps to protect personal information,” Commissioner Carly said. “Agentic and advanced AI will only increase the cybersecurity risks that businesses face, and it is critical that all organisations continuously review and enhance their security to protect against this growing threat.”

The takeaway here isn't that Qantas got a pass. It's that a regulator has now drawn, in writing, the line between negligence and the limits of what training and access controls can realistically stop.

The Nichirei cyberattack has disrupted food deliveries across Japan after the frozen food and logistics provider confirmed its servers were compromised in a cybersecurity incident involving unauthorized access. The attack affected logistics operations supporting KFC Japan, forcing temporary service disruptions while the company investigates the incident and works to restore systems. Nichirei Corporation said it detected system failures on July 13 and established an emergency response headquarters the same day. "Nichirei Corporation (the "Company") experienced system failures on July 13, 2026, and has since been investigating its cause. The Company hereby announces the facts identified through the investigation to date and the measures it plans to take going forward," reads notice issued by Nichirei. An investigation later confirmed that company servers had been targeted in a cyberattack. While the company has not disclosed technical details to prevent further damage, it said recovery efforts are underway with the support of an external cybersecurity specialist.

Nichirei Cyberattack Disrupts Logistics and Food Shipments

Following the attack, Nichirei disconnected systems across the Nichirei Group to protect customer and business partner data. The decision disrupted inbound and outbound operations at Nichirei Logistics refrigerated warehouses and halted frozen food shipments handled by Nichirei Foods. The company said it plans to gradually resume affected operations from July 17 after implementing additional security measures. Nichirei also confirmed that some affected servers contained personal information. As a precaution, it submitted an initial report to Japan's Personal Information Protection Commission regarding the possibility of a personal information leak. The company emphasized that, as of its latest update, there is no confirmed evidence that personal information or customer data has been exposed externally. Investigations remain ongoing, and Nichirei said it will notify relevant parties if any data leakage is confirmed.

Nichirei Cyberattack Impacts KFC Japan Store Operations

The incident quickly spread beyond Nichirei's own operations, affecting KFC Japan, which relies on Nichirei Logistics to deliver ingredients to stores nationwide. According to KFC Japan, deliveries have been disrupted since July 14 following the unauthorized access at its logistics partner. As inventory levels fluctuate, customers may experience product shortages, limited menu availability, shortened operating hours, or temporary store closures. The restaurant chain also temporarily suspended mobile orders, delivery services, coupons, and online ordering through its official website and mobile application. KFC Japan said it is working closely with Nichirei Logistics and other partners to restore normal operations as quickly as possible. However, it has not provided an estimated timeline for full recovery.

Investigation Continues Into Japan Cyberattack

Nichirei said the financial impact of the incident is still being assessed. The company expects to release its first-quarter financial results for the fiscal year ending December 31, 2026, on August 7 as scheduled unless further developments require additional disclosure. The company added that it will continue investigating the cyberattack on Nichirei and release additional information if material findings emerge. The incident follows a series of recent Japan cyberattack disclosures involving major organizations. Earlier this week, The Cyber Express reported that Nihon Kotsu experienced a malware-related security incident that disrupted taxi dispatch services after portions of its IT infrastructure were taken offline. Earlier this month, The Cyber Express also reported cyber incidents involving Aflac Japan, KDDI, Sapporo Holdings, and Nidec. While those cases affected different industries, attackers frequently gained access through subsidiaries, overseas operations, or third-party infrastructure rather than directly compromising corporate headquarters. Separately, Asahi Group Holdings continues recovering from a ransomware attack that significantly disrupted online ordering and shipment operations, forcing the company to rely on manual processes.

Supply Chain Risks Remain in Focus

The Nichirei cyberattack highlights how attacks on logistics providers can quickly evolve into broader supply chain disruption affecting downstream businesses and consumers. Although Nichirei has begun restoring operations, investigations into the incident remain active. Authorities are also continuing to examine whether any personal information was compromised while the company works to return logistics services and KFC Japan operations to normal. With multiple high-profile cyber incidents affecting Japanese organizations in recent weeks, the latest disruption highlight he growing operational impact of attacks targeting critical logistics and supply chain infrastructure.

Security researchers have identified two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA1000 Series appliances. The flaws are already being exploited in the wild, prompting urgent warnings from SonicWall and CISA. Successful exploitation could result in Remote Code Execution, bypass of security restrictions, and broader compromise of affected systems.  The vulnerabilities impact SonicWall SMA1000 models 6210, 7210, and 8200v running versions 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 (platform-hotfix), 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800 (platform-hotfix). 

CVE-2026-15409 and CVE-2026-15410 Explained 

CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. According to SonicWall, an unauthenticated remote attacker could force the appliance to send requests to unintended locations. The flaw carries a CVSS v3 score of 10.0 with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and is mapped to CWE-918.  CVE-2026-15410 is a post-authentication code injection vulnerability in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote authenticated attacker with administrator privileges could execute arbitrary operating system commands, enabling Remote Code Execution. The vulnerability has a CVSS score of 7.2, uses the vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and is associated with CWE-94. 

Active Exploitation and Impact 

SonicWall confirmed that CVE-2026-15409 and CVE-2026-15410 are being actively exploited. The advisory states, "SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities."  The vulnerabilities may allow Remote Code Execution and bypass of security restrictions, increasing the risk of unauthorized system access. 

Fixed Versions and Detection Guidance 

SonicWall has released fixes in 12.4.3-03453 (platform-hotfix) and later, and 12.5.0-02835 (platform-hotfix) and later. The company noted that these issues do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.  Administrators are advised to inspect extraweb_access.log for HTTP 200 requests to /api/login or /api/logout, suspicious /wsproxy requests returning HTTP 101, ctrl-service.log entries indicating hotfix rollbacks with path traversal names, and unauthorized /api/login or /api/logout routes in /var/lib/unit/conf.json.  If indicators of compromise are found, SonicWall recommends re-imaging hardware appliances or redeploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens after performing a forensic investigation.  The advisory, SNWLID-2026-0008, was first published and last updated on July 14, 2026. The vulnerabilities were internally discovered by Adam Babis of SonicWall PSIRT, while Sean Koessel and Steven Adair of Volexity were credited in Version 1.1 for helping identify an additional indicator of compromise during the investigation. On the same day, CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog. 

Microsoft Patch Tuesday July 2026 delivered the company's largest security update to date, addressing 622 Microsoft CVEs, more than tripling the roughly 200 vulnerabilities patched in June. Among the fixes are two zero-day vulnerabilities—CVE-2026-56164 and CVE-2026-56155—that Microsoft confirmed are being actively exploited, making them the highest-priority updates in this month's release.  According to Microsoft's July 2026 Security Updates, the release includes patches across multiple product families. Windows accounts for the largest share with 416 vulnerabilities, followed by Office with 82, Microsoft Edge with 46, Developer Tools with 27, SharePoint Server with 17, Azure with 11, SQL Server with eight, Defender and Exchange Server with five each, and four additional updates categorized under Other. Microsoft also republished 428 non-Microsoft Chromium CVEs. 

Microsoft Patch Tuesday July 2026 Highlights Exploited Vulnerabilities 

The two most significant flaws in Microsoft Patch Tuesday July 2026 are CVE-2026-56164 and CVE-2026-56155, both elevation-of-privilege vulnerabilities affecting critical enterprise infrastructure.  CVE-2026-56164 impacts on-premises Microsoft SharePoint Server and allows an unauthenticated attacker to elevate privileges remotely over the network without requiring credentials or user interaction. Microsoft said the vulnerability was discovered by Mandiant incident responders and Google's FLARE team, suggesting it was identified during investigations into active attacks. However, the company has not disclosed how the flaw was exploited or who was responsible.  Microsoft also noted that enabling the Antimalware Scan Interface (AMSI) in Full Mode can help reduce the attack risk. The update arrives on the same day that SharePoint Server 2016 and SharePoint Server 2019 reach the end of extended support. Unlike Windows Server and SQL Server, these products do not have a paid Extended Security Updates (ESU) program. SharePoint has remained a frequent target since the ToolShell attack chain affected unpatched servers in 2025. 

The Second Vulnerability (CVE-2026-56155)

The second actively exploited vulnerability, CVE-2026-56155, affects Active Directory Federation Services (AD FS). Microsoft said the flaw enables an authenticated attacker to elevate privileges locally because of weak access controls. The company's Detection and Response Team (DART) reported the issue. While Microsoft has not disclosed the exact privileges attackers gained or how the vulnerability was used, AD FS plays a critical role by issuing authentication tokens across enterprise environments, increasing the potential impact of a successful attack.  Beyond these two zero-days, Microsoft identified CVE-2026-50661, a Windows BitLocker Security Feature Bypass vulnerability, as publicly known.  As of publication, neither CVE-2026-56164 nor CVE-2026-56155 has been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog. However, Microsoft has already classified both as exploited through its own exploitability assessment. The company also assigned the SharePoint flaw a relatively low severity rating, highlighting that active exploitation should take precedence over severity scores when prioritizing remediation.