Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country. The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The incident has also halted the BNC's production and distribution of bankruptcy notices for the courts. The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services. Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record. The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor. West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records. According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky's case, exposure was limited to appellate court data stored within the C-Track infrastructure. Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services. In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.

Overnight, while shoppers slept, hundreds of French supermarkets were quietly cooking their own stock. In a French supermarket cyberattack confirmed by retailers on Monday, hackers took remote control of internet-connected refrigeration systems and pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F). By morning, tonnes of food had perished, some equipment had melted, and in some stores the heat had sparked fires. The cyberattack did not rely on a new exploit. It targeted ageing connected devices that were still online years after their manufacturer stopped supporting them, a weakness experts say is common across retail and industry.

What Happened in the French Supermarket Cyberattack

The attackers struck when shops were closed, raising temperatures remotely through the refrigeration control systems. French TV channel BFM reported that they appeared to trigger a forced defrost option, keeping units heating instead of cooling. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. The full scale is still unclear. Some reports put the total above 500 shops. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores, with some individual branches reporting losses of about €250,000. Retailers say millions of euros worth of food was spoiled.

Danfoss Refrigeration Controllers at the Center

France's government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models. The Danish manufacturer told AFP that most affected units were legacy products running outdated firmware, and that it had previously advised supermarkets to update them. ANSSI has urged companies using the affected models to disconnect them from the internet or restrict access, and to install software updates immediately. Authorities have opened an investigation and are liaising with other European countries that may have been affected. It remains unclear who carried out the attack. The incident follows President Emmanuel Macron's order last month to protect France's critical infrastructure from Russian "hybrid attacks." Officials have not linked the supermarket attack to any group or country.

Exclusive: Why These Devices Were Left Exposed

In comments shared exclusively with The Cyber Express, Neil Carter, Managing Director of CRAReady.co.uk, explained why systems like these remain vulnerable for so long. "Most of these devices were never designed to be updated in the field. A supermarket refrigeration controller is installed by a contractor, commissioned once and then left alone for ten or fifteen years. Nobody owns it as an IT asset, so nobody is watching for firmware releases. There's also a mismatch in lifetimes. The hardware lasts far longer than the vendor's support for it. Danfoss ended support for the AK-SM 800 in 2021 and the AK-SC 355 in 2016, but those boxes were still running cold chains in 2026. The third problem is how they're connected. Remote access is added for the maintenance company's convenience and simply left open to the internet. Updating carries risk too: if a firmware update fails on a controller running a store's freezers overnight, the stock is lost. So the safest-looking choice is always to leave it alone."

A Night-Long Threat to the Cold Chain

The overnight timing turned a technical breach into a major cold chain failure. Mark Eccleston, Senior Software Engineer at OxBlue, pointed out on LinkedIn that a fridge can go about four hours without power before food is at risk. "Hackers got a whole night with hundreds of them," he wrote. Retailers were forced to discard fresh and frozen products to avoid health risks, and the incident has raised wider questions about how much of Europe's food supply depends on internet-connected equipment running legacy firmware.

What Businesses Should Learn From the French Supermarket Cyberattack

Carter outlined clear steps for businesses running connected equipment: "First, know what you have. Treat building and plant controllers as part of your attack surface and keep an inventory with support end dates. Second, nothing operational should be directly reachable from the internet. Remote maintenance should go through a VPN or be restricted to the contractor's addresses. Third, ask about end of life when you buy, not after. Under the EU Cyber Resilience Act, manufacturers will have to declare a support period that matches realistic product lifetimes. Buyers should already be asking for that in writing. This attack didn't need a zero-day. It needed old, forgotten kit on the open internet, and there's a lot of that out there."

Seoul National University (SNU) has been struck by 28 hacking incidents since 2021, and more than 1,100 pieces of personal information belonging to students, faculty and staff were exposed along the way. The SNU cyberattack figures come from data the university submitted on Sunday to Rep. Baek Seung-ah of the Democratic Party.  The breakdown shows eight attacks in 2021 and 10 in 2022, the highest annual total in the period. Activity then dropped sharply to a single incident in 2024 before rising again to five in 2025. Four more have been confirmed so far this year. Together, these yearly figures account for all 28 incidents, which means none were recorded in 2023.  Departmental systems were the most frequent target, hit in 19 of the 28 incidents. Laboratory systems came next with six, followed by research systems with two. One attack affected an institutionwide system. 

2021 SNU Cyberattack Behind Nearly All Leaked Data 

Across the six-year span, a total of 1,132 pieces of personal information were leaked. Almost all of them, 1,130 records, trace back to a single cyberattack in 2021. In that breach, hackers planted malicious software on SNU servers, which let them run commands remotely and steal personal details of university members, including their portal IDs.  The remaining two pieces of personal information were exposed in 2024, when attackers went after a university research institute. Their focus was on files containing researchers' biographies and résumés.  According to the data, no personal information leaks were confirmed in any of the other hacking incidents. 

Seoul National University Faces Hundreds of Attempts Every Year 

Beyond the confirmed breaches, the university has dealt with a steady stream of attempted intrusions, numbering more than 500 annually in recent years. SNU logged 561 hacking attempts in 2024 and 575 in 2025. Another 588 have been detected so far this year, already exceeding the totals of both previous years.  Explaining the numbers, the university said, "These figures represent hacking attempts detected and blocked through our security monitoring." It added, "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures." 

How SNU Handled Reporting After Hacking Incidents 

On the question of reporting, SNU said it notified either the Ministry of Education or the Personal Information Protection Commission whenever a personal information leak was confirmed. However, the university has never requested an investigation by law enforcement authorities into any of the attacks.  The disclosure offers a clearer picture of the digital threats confronting a major South Korean university. While the number of successful breaches has fallen since its 2022 peak, the yearly count of attempted attacks has continued to climb.   That trend suggests the pressure on Seoul National University's networks remains significant, and the SNU cyberattack record is likely to keep questions about how the institution safeguards its community's data in focus. 

Lembaga Tabung Haji (TH) has resumed its key systems and services after a Tabung Haji cyberattack on Oct 8 led to a temporary suspension, and the agency says depositors’ savings are safe. In a statement issued today, TH said the reactivation followed comprehensive security checks, the strengthening of controls and system recovery measures.

The agency also said it worked with national cybersecurity authorities to address the threat and reinforce system security, so that the reactivated services can operate safely. TH has lodged a police report and continues to monitor its systems closely.

Tabung Haji Cyberattack Led to Suspension Across All Channels

On Oct 8, TH temporarily suspended system and service operations across all channels. The agency said the suspension was meant to protect depositors’ savings and personal information after the attack caused service disruptions.

TH described the Tabung Haji cyberattack as a criminal act against TH and the nation, intended to disrupt its services. After the incident, its internal team worked with external experts and national cybersecurity authorities to investigate the event, address the threat and restore the systems.

Branches Reopen After Cyberattack

According to the statement, TH branches in Kedah, Terengganu and Kelantan resumed operations yesterday. Branches in other states opened as usual today. Services provided through strategic banking partners have also been reactivated.

The statement said the reactivation followed those checks and recovery measures. It added: “TH assures that depositors’ savings are safe. Close monitoring and security enhancements will continue to ensure that the reactivated systems and services operate safely and smoothly.”

THiJARI Platform Functions Still Pending Restoration

TH also announced that all functions of the THiJARI platform have resumed operations, with three exceptions. Password resets, new user registration and online account opening remain unavailable.

The agency said these three functions still require further restoration work before they can be reactivated. Updates will be communicated through TH’s official channels from time to time.

TH lodged a police report over the incident and notified the mNational Cyber Security Agency (NACSA) and the Department of Personal Data Protection (JPDP). It has collaborated with cybersecurity authorities to address the threat and reinforce system security, which it said ensures the safety of the reactivated services.

Guidance for Depositors After the Tabung Haji Cyberattack

TH urged depositors who detect unusual transactions, or who need assistance or have inquiries, to contact the TH Contact Centre (THCC) immediately at 03-6207 1919. The agency said it continues to monitor its systems closely and will keep strengthening security.

TH also thanked depositors for their patience, cooperation and support during the restoration period. “We once again apologise and deeply regret the incident; however, these measures were necessary to safeguard depositors’ savings,” the statement said.

Timeline at a Glance

• Oct 8: TH suspends system and service operations across all channels after the cyberattack.
• After the incident: TH’s internal team, external experts and national cybersecurity authorities investigate and restore the systems, a police report is lodged, and NACSA and JPDP are notified.
• Yesterday: Branches in Kedah, Terengganu and Kelantan resume operations.
• Today: Branches in other states open as usual.
• Also confirmed: services through strategic banking partners have been reactivated.
• Still pending: THiJARI password resets, new user registration and online account opening.

What Is Confirmed So Far

Based on the statement, three points are confirmed. Depositors’ savings are safe, key systems and services have resumed, and three THiJARI functions are still being restored.

TH said it will continue close monitoring and security enhancements, and it will share further updates through its official channels. Depositors with concerns can reach the THCC at 03-6207 1919.

This weekly roundup covers a massive exposure of personal data from Denmark's national population register, a U.S. bounty on a Chinese hacker accused of stealing COVID-19 research, Japan's plan to actively search for attackers hiding in its critical infrastructure, a pair of breaches at Japanese publisher Nikkei, a call for AI-driven decision-making in security operations, and a Massachusetts town's ongoing recovery from an August cyberattack.  Two threads run through this week's stories. First, attackers keep getting in through doors that were already open: a company's lawful access to a government register, employees' hijacked email accounts, and unpatched mail servers. Second, the time between intrusion and discovery remains dangerously long, which is why governments and security leaders are pushing to find intruders sooner and respond faster. 

The Cyber Express Weekly Roundup 

Hackers Abuse Company's Legitimate Access to Expose Data of 8.8 Million in Denmark 

The Danish government said unauthorized individuals obtained the names, addresses, and CPR numbers of roughly 8.8 million people from the Central Person Register. They did it by misusing the legal access granted to a private Danish company. The register holds records on about 11 million people, including residents, Danes living abroad, and deceased individuals. Read more… 

US Offers $10 Million Reward for Chinese Hacker Accused of Stealing COVID-19 Research 

The U.S. State Department is offering up to $10 million for information on Zhang Yu, a Chinese national accused of hacking COVID-19 research at U.S. universities on behalf of China's Ministry of State Security. Zhang and his alleged partner, Xu Zewei, are also tied to the 2021 HAFNIUM campaign, which exploited Microsoft Exchange vulnerabilities to compromise more than 12,700 U.S. entities. Xu was arrested in Italy in 2025 and extradited to the U.S. in April 2026. Zhang remains at large. Read more… 

Japan to Launch Threat Hunting Program to Find Hidden Attackers in Critical Infrastructure 

Japan plans to partner with private companies in fiscal 2027 to proactively look for attackers who may already be sitting undetected inside power, telecom, and other critical infrastructure networks. The National Cybersecurity Office will build detection methods by recreating attack scenarios in a virtual environment and will share them with operators. The Defense Ministry will provide experienced personnel to companies on request. Read more… 

Nikkei Hit by Two Breaches as Hijacked Accounts Send 9,000 Malicious Emails 

Japanese publisher Nikkei disclosed on October 4 that attackers had taken over employees' Microsoft 365 accounts. On September 30, they used those accounts to send roughly 9,000 emails with malicious links to staff and external contacts. Nikkei also revealed a separate breach of its Google Workspace accounts, ongoing since late July, that may have exposed the names and email addresses of 1,646 employees and business partners. Read more… 

Agentic AI Turns Cybersecurity Into a Race of Decision Speed 

In an opinion piece, Cyble's Salleh Kodri argues that security teams no longer struggle to see threats. Their problem is "decision latency": the time it takes to turn alerts from many tools into the right action. As AI accelerates attackers' reconnaissance and decision-making, Kodri says defenders should use AI to correlate intelligence and act faster. Read more… 

Andover Confirms Attackers Accessed Town Systems in August Cyberattack 

Officials in Andover, Massachusetts, confirmed that the August 13 cyberattack involved unauthorized access to some town systems. They have not yet determined whether any data was stolen or whether personal information was involved. The town says it paid no ransom. It has hired a law firm and cybersecurity firm Vector3 to investigate, with costs covered by cyber insurance. Read more… 

Weekly Cybersecurity Takeaway 

Several of this week’s incidents started with access that looked legitimate. In Denmark, attackers abused a private company’s authorized connection to the national register instead of breaking in. At Nikkei, hijacked employee accounts sent thousands of malicious emails under a trusted name.  Time is the other common thread. Nikkei’s Google Workspace breach ran for over two months before disclosure, and Andover still doesn’t know what was taken. Japan’s threat hunting plan assumes attackers may already be inside, and Kodri warns that spotting an alert means little if acting on it takes too long.  Organizations should monitor third-party access as closely as their own staff’s. They should secure email accounts with phishing-resistant authentication and actively hunt for intruders rather than wait for alerts. 

An attacker got into some of Andover's computer systems during the Andover cyberattack in August; Town officials confirmed Thursday, though they cannot yet say whether any data was taken.  "The Town has identified unauthorized access to certain systems and is continuing to determine the nature, scope, and sensitivity of any data that may have been accessed or acquired," Chief Communications Officer Phil Geoffroy said in written answers to Andover News.  Some reviewed material appears routine or publicly available, he said, but the full data set remains uncharacterized. 

What Is Known About the Andover Cyberattack 

It is the Town's clearest admission that the Aug. 13 cyberattack on Andover reached its systems, though not proof of copying, removal or publication.  Geoffroy did not identify the systems, say whether they belonged to the municipality or Andover Public Schools, or give a completion date. Investigators must check any accessed data for personally identifiable information, he said. Officials first secured and restored the network, reconnecting equipment, even printers, across municipal and school offices. Another update will come "if/when appropriate."  Town Counsel Doug Heim told the Select Board Sept. 28 that it was unclear whether state-protected information was involved. 

Investigators and Ransom Questions 

The Town hired law firm Constangy, Brooks, Smith & Prophete and cybersecurity firm Vector3 on the evening of Aug. 13. Vector3 is tracing how the attacker entered, reconstructing the attacker's activity, assessing whether data was accessed or removed, and helping monitor more than 3,000 devices.  On ransom demands or negotiations, Geoffroy said only that the Town "did not make or authorize any payments in connection with this incident." Vector3's agreement allowed up to $3,000 for possible communication with the attacker and monitoring of negotiation channels for up to 60 days, though its use is unconfirmed.  No culprit has been named. On Aug. 30, a ransomware group called WallStreet listed Andover as a purported victim on a dark-web site, which proves neither responsibility nor data theft.  Geoffroy would not name agencies notified: "The Town is coordinating with appropriate legal, forensic, and governmental partners as required and cannot comment on any law enforcement-related aspects of the event at this time."  If Chapter 93H, the Massachusetts breach law, applies, the Town must notify the Attorney General's Office, state regulators and affected people. That office had received no notice as of Sept. 22. 

Who Pays for the Cyberattack on Andover?

An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work. The insurer pays them directly, Geoffroy said.  "Subject to the limits of our policy, Andover will bear no additional costs for these contractors and bills will be paid by our insurer," he said.  The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories. The Town did not address overtime, replacement equipment, security upgrades or the retention. 

Town Defends Its Preparedness 

"Based on what is currently known, the Town does not believe this incident reflects a lack of investment in information technology or incident preparedness," Geoffroy said. He credited past spending on technology, cyber insurance and response planning with helping contain the attack, restore services and coordinate quickly, noting longer disruptions elsewhere.  The Andover cyberattack disrupted the municipal and school network for four days, with some restoration continuing afterward. Shared drives returned fully Aug. 21, and VPN access stayed down during its rebuild. Public safety, municipal buildings, phones and Town-operated utilities kept operating. 

The Denmark data breach has exposed the names, addresses and CPR numbers of approximately 8.8 million people after unauthorized users exploited a Danish company's legitimate access to the country's Central Person Register (CPR), according to the Danish government. The CPR administration became aware of irregular behavior in the system on October 2, after identifying activity that had occurred during September. An investigation found that unauthorized individuals had used a private Danish company's legal access to search the CPR system and obtain information on millions of registered people. The CPR currently contains information on approximately 11 million registered people, including those who are living in Denmark, people who have moved abroad and deceased individuals.

Denmark Data Breach Involved Legitimate CPR Access

The Denmark data breach did not result from unauthorized access being granted directly to the attackers. Instead, unauthorized users abused a private company's legitimate access to the CPR system. Under Section 38 of Denmark's Civil Registration Act, private companies with a legitimate interest can receive information from the CPR about specific groups of people they have individually identified in advance. Companies must also be entitled to receive the information under the General Data Protection Regulation and Denmark's Data Protection Act. The investigation found that unauthorized individuals used this legitimate access to retrieve information from the register. The exposed information includes names, addresses and CPR numbers, which serve as personal identification numbers in Denmark. The CPR administration said the unauthorized access did not include the names and addresses of people who had registered for name and address protection.

Investigation Into CPR Data Breach Continues

The CPR administration has stopped the company's access to the system and is working with specialists and relevant authorities to establish how the incident occurred. The case has been reported to the Danish Data Protection Authority, while police are investigating in cooperation with other relevant authorities. Authorities said the investigation remains in its early stages, and it is not yet possible to identify who was responsible for the unauthorized access. The CPR administration also warned that further investigation could lead to changes or clarification of the information currently available about the incident. Denmark's Minister of Research, Education and Digitalisation Christina Egelund described the incident as serious and said a thorough security review of the CPR system would be conducted. Additional measures have also been launched to prevent similar incidents.

What the Denmark Data Breach Means for Citizens

Authorities have reminded citizens not to provide passwords or other confidential information during phone calls or email exchanges, even when the person making contact appears to know their name, address or CPR number. Guidance is available through Denmark's Sikker Digital service, while the Cyberhotline for digital security has extended its opening hours from 8 a.m. to midnight in the coming days. The incident also highlights the risks associated with legitimate access to sensitive databases. In this case, the access used to obtain the information was originally available to a private company under Denmark's existing rules for accessing CPR data.

Cybersecurity Awareness Month Puts Data Protection in Focus

The Denmark data breach comes during October's Cybersecurity Awareness Month, a period focused on improving awareness of digital security risks. The incident highlights why protecting access to sensitive personal information remains an important part of cybersecurity. For organizations handling large volumes of personal data, the case also shows the importance of monitoring legitimate access and identifying unusual activity. However, Danish authorities have stressed that the investigation is still underway and that the full circumstances of the incident have yet to be established.

Nihon Keizai Shimbun disclosed on October 4 that a Nikkei cyberattack had compromised employees' Microsoft 365 business software accounts. Attackers then used those accounts to send roughly 9,000 spoofed emails to people inside and outside the company.   The publisher also revealed a second, separate breach: a cloud service it uses had been accessed without authorization since late July, possibly exposing the personal information of 1,646 employees and business partners.  In a statement, the company said: "We deeply apologize for the inconvenience and concern caused to all those affected. We ask everyone to remain vigilant against suspicious emails while we continue our investigation. We take this incident seriously and will further strengthen our security measures to ensure thorough information management." 

How the Nikkei Cyberattack Unfolded?

A third party gained unauthorized access to the Microsoft 365 accounts that employees use for email and other work functions. On September 30, the attackers used the hijacked accounts to send about 9,000 emails containing links to malicious websites. The recipients included Nikkei staff as well as numerous external sources and contacts who had previously corresponded with employees.  Because the messages came from Nikkei's genuine accounts, the sender address alone gave recipients little reason for suspicion. The attack is believed to have exposed recipients' names and email addresses, along with the content of some messages.  Nikkei has since changed the affected passwords and says it has detected no further unauthorized logins. It has contacted each recipient individually and asked them to delete the emails. 

Google Workspace Breach Dates Back to July 

In a separate incident, outsiders also logged in to the Google Workspace cloud accounts that employees use for work. Since late July, names, email addresses and other information belonging to 1,646 people may have leaked. Nikkei learned of the problem in early August, when Google notified the company. According to Nikkei, the leaked data did not include information on readers or sources, and no secondary damage has been confirmed.  The incidents unfolded in this order: 

• Late July 2026: Unauthorized access to Google Workspace begins. 
• Early August 2026: Nikkei discovers the access after Google notifies it. 
• September 30, 2026: Attackers hijack Microsoft 365 accounts and send about 9,000 spoofed emails. 
• October 4, 2026: Nikkei announces the incidents publicly and reports them to the Personal Information Protection Commission. 

Nikkei Cyberattack Reported to Regulator 

Nikkei has reported both incidents to Japan's Personal Information Protection Commission. Under the Act on the Protection of Personal Information, organizations must report to the Commission and notify affected individuals when a breach caused by unauthorized access could harm people's rights and interests. Breaches affecting more than 1,000 people are also subject to mandatory reporting.   A preliminary report is due within roughly three to five days of discovery. A final report is due within 30 days, or within 60 days if the breach was carried out for malicious purposes. Nikkei is still investigating the full scope of the breach and the number of personal records involved.  The company warned that spoofed emails posing as Nikkei or group company staff may increase. It asked anyone who receives a suspicious message to contact it through its inquiry form. 

The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion. The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income. South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions.

Shinhan Bank Cyberattack Under Investigation

Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems. The bank immediately formed a response team and took measures aimed at limiting further damage. These measures included blocking access from external IP addresses and suspending the affected services. The bank said it had completed safety measures related to the incident. Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack. Experts said the bank may not have been specifically targeted, but could instead have been caught in attacks against vulnerable online platforms. The Financial Supervisory Service sent a team to the bank to examine the incident. Its investigation is expected to take months as officials determine the nature and extent of the data exposure.

AI Agent-Assisted Attacks Raise Concern

The suspected use of AI has added another concern to the Shinhan Bank breach. Cybersecurity experts said AI tools originally developed or shared for defensive purposes can also be adapted for malicious activity. Mun Chong-hyun, director at cybersecurity firm Genians, said several recent attacks in South Korea have involved such AI tools. He described the technology as a double-edged sword because capabilities created for cybersecurity can also be used to facilitate cybercrime. The concern is not limited to Shinhan Bank. An industry official said the wider financial sector could be exposed to AI agent-assisted attacks, and that financial institutions should conduct their own security checks to identify potential weaknesses and abnormal access attempts. The incident also highlights the type of information that can be exposed in attacks against banks. Unlike a breach involving only basic contact information, the Shinhan incident reportedly exposed both personal details and financial information.

South Korean Banks Face More Data Breaches

The Shinhan Bank cyberattack comes amid several recent incidents affecting South Korean lenders. KB Kookmin Bank said last Friday that personal information belonging to 119 customers had been leaked following an external intrusion. Hana Bank also reported a separate hack affecting 89 customers. South Korea’s Financial Services Commission has already held a meeting with local banks over the recent breaches and is expected to hold another meeting this week. The latest incidents have raised concerns about how AI-powered hacking could affect the financial sector, particularly if attackers can use automated tools to identify vulnerable systems or support attacks at greater scale. The Shinhan incident is relatively small compared with some of South Korea’s largest data breaches in terms of the number of affected people. However, the combination of personal and financial information makes the breach significant. Sungho Hwang, Korea country manager at NordVPN, said the exposed information could be used to create personalized scams. He also noted that generative AI has made such scams more convincing.

South Korea Faces Wider Cybersecurity Pressure

The banking incidents come as South Korea cyberattacks have increased across other sectors. Cyberattacks targeting South Korean military systems reached 18,951 cases in 2025, the highest annual figure in five years. The number was up 31 percent from 2024 and 108 percent from 2022. South Korea has also expanded its use of AI for defensive cybersecurity. The Ministry of Education and the Korea Education and Research Information Service operate an AI-based system designed to detect suspicious activity and issue automated alerts across 435 monitored institutions. In 2025, the system detected about 480 million potential cyber threat indicators, of which around 86,000 were confirmed as actual intrusions. As the investigation into the Shinhan Bank breach continues, the suspected role of AI is adding to concerns that financial institutions may need to account for increasingly automated forms of cyberattacks.

This weekly roundup covers a customer data breach at Spain's national rail operator, an Australian government warning about attackers hijacking corporate AI services, a patient data theft from a Polish medical software platform, phishing campaigns that turn legitimate remote management tools against their victims, and a gathering of Europe's police leaders focused on how AI is reshaping crime.  Two threads run through this week's stories. Artificial intelligence is now both a target and a tool for attackers: stolen API keys are draining company budgets, and AI is reportedly being used in intrusions. Meanwhile, attackers keep exploiting trusted software, from a medical records platform to legitimate IT administration tools, to stay hidden for days or weeks. 

The Cyber Express Weekly Roundup 

Renfe Confirms Data Breach Through Compromised Adif Servers 

Spanish rail operator Renfe confirmed on September 25 that hackers had accessed customer names and email addresses. The intrusion came through compromised servers belonging to Adif, the state-owned manager of Spain's rail infrastructure. Renfe said no financial data was exposed and train services were not disrupted. Read more… 

Australia Warns of Stolen AI Keys as Hijacked Access Costs Firms Up to $600,000 

The Australian Signals Directorate (ASD) has warned that attackers are taking over organizations' AI services. They get in through exposed API keys, stolen sessions, and compromised suppliers. Once inside, they burn through paid credits and generate harmful content. Where AI agents are deployed, they also use that access to reach connected systems and data. Read more… 

Polish Patient Data Stolen in Cyberattack on Medyc Medical Software 

Attackers exploited an SQL injection vulnerability in Medyc, a medical records platform developed by Polish vendor Qbusoft, on August 22–23. They stole patient names, PESEL national identification numbers, addresses, phone numbers, and email addresses going back to July 2024. The breach went unnoticed until September 8–9, more than two weeks later. Read more… 

Phishing Campaigns Abuse MSP360 Remote Management Tool to Install ScreenConnect 

Microsoft has tracked phishing campaigns that tricked victims across several industries into installing MSP360, a legitimate remote management tool. The installers were disguised as Zoom downloads, Adobe updates, invitations, and delivery notices. After gaining a foothold, the attackers installed ConnectWise ScreenConnect as a backup access channel. Read more… 

Europe's Police Chiefs Warn AI Is Making Crime Faster and Larger in Scale 

More than 500 police leaders from 59 countries gathered at Europol's headquarters from September 28 to 30 to discuss how AI is changing crime. Europol warned that criminals are using generative AI, deepfakes, and autonomous agents to expand fraud, cybercrime, migrant smuggling, and child exploitation. It also pointed to AI's potential to speed up police investigations. Read more… 

Weekly Cybersecurity Takeaway 

Artificial intelligence features in several of this week's stories, in different roles. In Australia, AI services are the target: attackers hijack them to steal paid credits and to reach connected systems through AI agents. At Europol's gathering, police leaders described AI as a force multiplier that lets criminal groups run fraud and exploitation at greater speed and scale. In the Renfe case, AI was reportedly used in the attack, though that remains unconfirmed.  The other common thread is how attackers abuse what organizations already trust. In Poland, an injection flaw in widely used medical software exposed sensitive patient identifiers and went undetected for more than two weeks. Microsoft's findings show attackers installing two legitimate remote management tools so their activity looks like ordinary IT work.   The Renfe breach, which reached customers through a partner organization's servers, is a reminder that an organization's exposure extends to its suppliers and infrastructure partners.  Together, these developments call for practical steps. Organizations should treat AI credentials as carefully as any other privileged secret. They should watch for unexpected remote access software even when it is legitimate, and they should hold the vendors who handle their data to the same security standards they apply internally. 

The Queensland government department in charge of the state's cybersecurity efforts has disclosed a loss of roughly $800,000 from a cyberattack during the last financial year. Details of the CDSB cyberattack, which involved a third-party messaging service being "misused" for financial gain, appear in the QLD cybersecurity department's latest annual report, released on Friday.  The Customer Services, Open Data, and Small and Family Business department (CDSB) directs the Queensland government's cybersecurity strategy, governance, policy and investment. According to its annual report, the department lost $809,000 during the 2025-26 financial year as "a result of an external cyberattack for financial gain." 

How the CDSB Cyberattack Unfolded?

The report said the breach did not reach sensitive records. No government data or sensitive information was compromised during the incident," it stated. "The department blocked the attack and engaged a third party to mitigate any further exposure."  A CDSB spokesperson told Information Age that the attackers had not been paid.  "In July 2025, a third-party messaging service used by the Queensland government was misused to generate an inflated number of unauthorised SMS messages for financial gain," the spokesperson said in a statement.  "... Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."  The spokesperson added that the Queensland government "is committed to protecting the security and resilience of its systems and services." 

Audit Found the QLD Cybersecurity Department 'Needs to Do More' 

The incident follows a Queensland Audit Office report, released in March, which found that CDSB "needs to do more" to help the state's public sector manage third-party cybersecurity risks.  Auditors found the QLD cybersecurity department was "not actively assessing and monitoring third-party cyber capability across the public sector," although improvements were in progress.  "The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks," the audit said. It noted that the Australian Signals Directorate (ASD), the federal cybersecurity agency, "has been raising these risks since 2021."  During testing, auditors gained the "highest level of access" to two Queensland government entities. They did not name either entity, to "avoid publicly identifying any security vulnerabilities."  CDSB addressed the audit in its annual report. "In our cybersecurity leadership role, we agreed to all relevant recommendations and progressed actions during the reporting period, including initiatives to strengthen whole‑of‑government cybersecurity capability," it said.  The report described cybersecurity as something that "remains a daily discipline" for CDSB and the wider Queensland government.  "Investing in, and securing Queensland's digital assets remains important, as cyber threats become more complex, and national incident data shows that malicious actors continue to target all sectors of the economy," it added. 

Queensland Tops Cybercrime Reports 

The CDSB cyberattack comes against a broader backdrop of cybercrime in the state. ASD's latest Annual Cyber Threat Report found that Queensland reported the highest share of Australia's cybercrime incidents in the 2024-25 financial year.  Queensland accounted for 28 per cent of national cybercrime reports. Victoria followed with 26 per cent and New South Wales with 22 per cent. ASD found these figures were "disproportionately higher" than the three states' respective populations when compared with other jurisdictions.  Average losses were highest elsewhere. "The Australian Capital Territory reported the highest average self-reported financial losses – around $37,700 per cybercrime report – followed by those in New South Wales, with around $33,000," the report said. 

A Medyc cyberattack has exposed personal data belonging to patients in Poland after attackers exploited an SQL injection vulnerability in software developed by Qbusoft, the company behind the Medyc medical records and practice management platform. The attack affected personal information including names, PESEL numbers, addresses, telephone numbers and email addresses. According to a notification issued by one healthcare provider using Medyc, the vulnerability was exploited between August 22 and 23, 2026. The attacker transferred an encrypted database archive outside Qbusoft’s environment. The incident was detected during the night of September 8 to 9.

How the Medyc Cyberattack Happened

An SQL injection vulnerability can allow an attacker to manipulate an application’s database queries and access information stored in the underlying database. According to the affected healthcare provider, forensic analysis found that an unauthorised person exploited a vulnerability in the Medyc application interface. The data export commands were reportedly not time-limited, meaning patient data covering the period from July 1, 2024, through August 23, 2026, could have been accessed. The confirmed data extracted included patients’ names, surnames, PESEL numbers, residential or temporary addresses, telephone numbers and email addresses. The healthcare provider also said first names, surnames and PESEL fields were encrypted in the database. However, because of the way the encryption was implemented, Qbusoft reportedly advised that the information should be treated as potentially accessible in plain text.

Medical Records Remain Under Investigation

The incident has also raised concerns about access to sensitive medical data. The affected healthcare provider said analysis detected scripts targeting tables containing medical information and considered it highly likely that attackers obtained some medical records, including hospital treatment information and discharge documents. However, Qbusoft later provided a different update. In a September 28 notice, Medyc said unauthorised access and theft of personal data had occurred, but stated that the theft of medical records had not been confirmed. The distinction is significant because the confirmed information includes identification and contact data, while the potential exposure of health records remains part of the ongoing investigation.

Qbusoft Takes Security Measures

Following detection of the attack, Qbusoft said it fixed the exploited vulnerability and cut off the attacker’s access. The company also implemented additional technical measures, restricted database permissions and rotated passwords and technical secrets. Its infrastructure was placed under continuous monitoring. Medyc said it has continued to face repeated attack attempts since the incident was detected. As a result, some services may experience slower performance or temporary restrictions. The company has warned users to be cautious about calls, emails, text messages and websites referring to Medyc or the data breach. Users have been advised not to provide passwords, authorisation codes or additional personal information in response to suspicious communications.

Polish Authorities Investigate the Incident

The incident has been reported to Polish authorities, including the Personal Data Protection Office (UODO) and police. Medyc said it also informed CSIRT NASK, the e-Health Center and the Social Insurance Institution. Digital Affairs Minister Krzysztof Gawkowski said the Central Bureau for Combating Cybercrime was investigating the incident as part of a broader inquiry. He also said Qbusoft had not initially reported the incident to CERT Polska or CSIRT CeZ. [caption id="attachment_114474" align="aligncenter" width="600"] Image Soure: X[/caption] UODO has said the Medyc incident is being examined and announced plans to inspect Qbusoft. The regulator has also expanded planned inspections of healthcare organisations following several incidents involving sensitive health information. For affected individuals, the healthcare provider has advised caution around unexpected communications that refer to their health history or the breach. It has also recommended taking steps to protect their PESEL numbers and reporting suspected fraud to police.

Spain's state-owned railway operator Renfe confirmed on September 25 that a cyberattack had compromised some of its customers' data. Spanish media reported that the criminals behind the Renfe cyberattack used artificial intelligence (AI), which would make it the first attack of its kind in the country. Train services across Spain have continued to run normally while the investigation goes on.  According to Renfe, the attackers mainly obtained customer names and email addresses. "The attackers were able to access limited user information, consisting mainly of names and email addresses," the company said. It added that it had found "no conclusive evidence" that the stolen information had been made public.  The operator, which carried more than 531 million passengers last year, also said, "There is no evidence of access to bank or financial details, payment methods, IDs or other particularly sensitive information." 

Breach Traced to Adif's Systems 

Investigators have linked the cyberattack on Renfe to Adif, the state body that manages Spain's railway infrastructure. According to The Star, Renfe said in a statement that the "cybersecurity incident" began on Adif servers that were "previously compromised and interconnected with the company's systems."  Adif spotted unusual activity on its network late on Thursday and put cybersecurity measures in place to contain it. Neither organization has found evidence that the systems running railway operations were affected, so there has been no disruption to rail services linked to the attack.  The most visible effect was a temporary outage of the Adif website, which was down for part of Friday afternoon. Renfe's website stayed online. 

Weeks of Attempted Intrusions Preceded Renfe Cyberattack 

Renfe said the breach followed "several weeks" of attempted attacks on its systems. Its monitoring and security tools had "detected and successfully blocked" those earlier attempts.  Once it detected the breach, Renfe activated its incident-response procedures, isolated the areas that might have been affected and added further protective measures. Independent cybersecurity specialists are helping with the investigation and with efforts to limit any further damage.  Adif has filed a complaint with the relevant authorities and shared what it found with Spain's National Cryptologic Center (CCN). It has also notified businesses and suppliers that may have been affected so they can take precautions. 

Reports of AI Involvement and a Foreign Link 

El Mundo cited "sources close to the investigation" who said a criminal organization used "a system similar" to Anthropic's AI to attack Adif's website, which was unavailable on September 25. The newspaper described it as the first AI-driven cyberattack on the website of a Spanish public company and said the incident lasted "several days."  La Razón reported that sources familiar with the case believe "the modus operandi points to a foreign group." 

Wider Concerns Over AI and Hybrid Threats 

The cyberattack on Renfe comes as concern grows worldwide about what advanced AI tools can do, following a series of hacking incidents involving models from OpenAI, the developer of ChatGPT, and its rival Anthropic.  Warnings have also increased about possible hybrid attacks, including cyber incidents, targeting Western allies of Ukraine as Russia's invasion enters its fifth year.  Renfe and Adif are still investigating where the attack came from and how far it reached, including how much customer information was accessed without authorization. 

A Dyfed-Powys Police cyberattack may have resulted in staff information being accessed or compromised, according to the police force that serves Dyfed-Powys in Wales. The cyber incident, identified on September 14, 2026, disrupted some non-emergency systems, but the force said there is currently no evidence that members of the public had their personal data accessed. Dyfed-Powys Police said an investigation into the incident is ongoing, with support from cybersecurity specialists. The force has also introduced precautionary measures while specialist teams investigate the incident and work to restore affected services safely.

Dyfed-Powys Police Cyberattack Disrupted Non-Emergency Systems

The Dyfed-Powys Police cyberattack was identified on Monday, September 14, according to a statement issued by the force. The incident affected some non-emergency systems, resulting in a period when online and email contact services were unavailable. The police force said these services have since been restored. We can confirm that the force has been subject to a cyber incident which was identified on Monday September 14, 2026. The incident caused disruption to some non-emergency systems," reads the offical release. Despite the disruption, emergency response operations were not affected. Dyfed-Powys Police confirmed that it remained fully operational and that both 999 and 101 telephone services continued to operate. The force said it has been closely monitoring its systems while specialist teams investigate the circumstances surrounding the incident.

Staff Information Under Investigation

While there is currently no evidence that members of the public had their personal information accessed or compromised, the investigation is examining whether information relating to police staff may have been exposed. Dyfed-Powys Police said it is taking steps to protect staff information and will provide appropriate advice to employees if required. The force has not provided further details about what staff information may have been accessed or compromised. The investigation remains ongoing, meaning the full impact of the incident has not yet been established.

ICO Notified Over Cyber Incident

The Information Commissioner’s Office (ICO) has been notified about the incident as the investigation continues. Dyfed-Powys Police said the investigation is being managed by Tarian through its regional cyber-crime unit, with cybersecurity specialists supporting the response. The force has also implemented precautionary measures across its systems as part of its response. Specialist teams are working to investigate the incident and restore services safely while the police continue to monitor its systems. At this stage, the force has not disclosed details about how the attackers may have gained access to its systems or identified those responsible for the cyber incident.

Emergency Services Remain Operational

Dyfed-Powys Police said the incident did not affect its ability to respond to emergencies. The 999 and 101 telephone services remained available throughout the disruption. Online and email contact were unavailable for a period following the incident but have now been restored. The force said it understands the concern the incident may cause and is continuing to take steps to protect its information and maintain the security of its systems. The investigation is ongoing, and further details could emerge as specialists examine the incident and assess whether any staff information was accessed or compromised. Dyfed-Powys Police said it will provide further updates when more information becomes available. Update: This article will be updated as Dyfed-Powys Police provides further information about the investigation, affected systems or any potential compromise of staff information.

This weekly roundup covers a brazen breach claim against the FBI's recruitment portal, a multinational advisory exposing North Korea's fake-recruiter malware operation, a sweeping EU proposal to reshape children's access to social media, a conversation on application security in the age of AI agents, a short-lived Discord ban in the Philippines, and a multimillion-dollar hot-wallet heist at a crypto casino.  From federal law enforcement to individual job seekers, this week's developments show that no target is too prominent or too small. Cybercriminals are openly taunting the agencies that pursue them, state-backed actors are turning the hiring process into an attack vector, and governments are testing how far they can push platforms on child safety, sometimes reversing course within hours. 

The Cyber Express Weekly Roundup 

Shiny Hunters Claims FBI Breach, Says FBIjobs Agent Data Exposed 

The FBI is investigating an apparent breach after the cybercriminal group Shiny Hunters claimed to have stolen personal data belonging to thousands of federal agents, with the probe centering on the bureau's FBIjobs recruitment website. Read more... 

WaterPlum Hackers Steal $10.7M in Crypto From IT Workers 

A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries while stealing cryptocurrency from IT professionals worldwide. Read more... 

EU KIDS Act Sets New Social Media Rules for Children 

The European Commission adopted the proposal on September 18, setting out rules that would prevent children under 13 from accessing social media and establish 15 as the minimum age for minors to open accounts independently. Users aged 13 to under 15 could instead access parent-managed mini accounts with limits on social contacts and up to 60 minutes of screen time per day, while platforms would bear the responsibility of proving their services are safe for children. Read more… 

Harness' Rahul Sood: AppSec in the Agentic Era Is About More Than Code. It's About Authority 

In this conversation, The Cyber Express spoke with Rahul Sood, the General Manager for Application Security at Harness, who leads the company's AppSec portfolio and focuses on building security for the AI era, integrated directly into modern DevOps workflows. The conversation centers on a shift in how security teams must think about AI agents: the risk no longer lies only in the code being shipped, but in what authority autonomous agents are granted once they operate inside production systems. Read more… 

Ban on Discord Lifted After Platform Commits to Work With DICT and CICC 

The Philippine government has lifted its ban on Discord after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC), with the restriction removed on Thursday, Sept. 24. Read more... 

Duelbits Hit by $7 Million Hack as Crypto Stolen Across Four Blockchains 

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets, with the stolen assets moved across four blockchains and mostly converted into Ether. The company says funds held in user accounts have not been affected, but it has not explained how the attackers got in or when the site will return. Read more... 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk, from a criminal group openly retaliating against the FBI over a public advisory, to a state-backed operation weaponizing job interviews against developers, to a crypto platform losing millions from the very hot wallets that keep it running.  Meanwhile, the policy response is moving on multiple fronts: the EU is flipping the burden of proof onto platforms to demonstrate child safety by design, and the Philippines has shown how quickly a government can block, and then restore, a major platform in exchange for enforcement commitments. At the same time, security leaders are warning that AI agents are introducing an entirely new question of who, or what, holds authority inside enterprise systems.  Taken together, the stories point to an increasingly confrontational threat landscape, where attackers are bolder, trust-based processes like hiring are being exploited at scale, and institutions are experimenting with more aggressive levers to hold platforms and adversaries accountable. 

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets. In the Duelbits crypto hack, the stolen assets were moved across four blockchains, and most of them were then converted into Ether.  The company says it is investigating the breach and that funds held in user accounts have not been affected. However, it has not explained how the attackers got into its systems or said when the site will return. 

How the Duelbits Cyberattack Unfolded 

Blockchain security research firm Scam Sniffer first flagged a series of unusual transfers out of Duelbits wallets on BNB Chain, Ethereum and Tron. Later, it spotted a further loss of 8.1 BTC from the casino's Bitcoin wallet.  All the affected wallets were hot wallets. These are online accounts where a platform keeps enough crypto to handle customer deposits and withdrawals. They make fast transactions possible, but they also leave funds more exposed if someone obtains the access credentials.  The attacker ended up with 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB. 

Co-Founder Confirms Duelbits Crypto Hack 

Duelbits co-founder Joe acknowledged the incident in a public post: 

Confirming a ~$7M hack. Still investigating exactly what happened and how.  Until we have clarity, Duelbits stays offline. User funds are safe.  Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.  I'll keep posting updates as I have them.  Duelbits will be back up asap.  Updates to follow" 

Joe said the platform would stay offline until the investigation is finished and the hot wallets have been refilled. No one has independently verified his claim that user funds are safe. 

Compromised Private Key Suspected 

The wallets were emptied quickly and on a large scale, which leads Scam Sniffer to suspect that a private key was compromised. A private key is the master credential for a crypto wallet. Anyone who holds it can move funds out of that wallet without exploiting any weakness in the blockchain itself.  Duelbits has not confirmed this explanation. 

Stolen Funds From Duelbits Cyberattack Swapped Into Ether 

Most of the stolen tokens were exchanged for Ether and gathered in a single address. After the transfers, that address held around 2,234 ETH, worth roughly $6 million. When the funds were traced, they had not moved any further.  Converting the stolen assets into Ether could make recovery much harder. The companies behind USDT and USDC can freeze those tokens. Ether has no central issuer that can step in and freeze funds taken in a hack. 

Unanswered Questions After the Duelbits Crypto Hack 

Several important questions remain open. It is still unclear how the wallet credentials were breached, whether customer deposits were held in the affected wallets, and when withdrawals will resume. Duelbits has not addressed these points so far.  Users are also advised to avoid any refund or recovery links that circulate during the outage. Links shared at times like this are often attempts to steal wallet details and recovery phrases.  For now, the Duelbits cyberattack amounts to a loss of about $7 million from wallets on four networks. Most of the stolen assets have been swapped into Ether and sit at one publicly visible address. 

A Burnaby School District cyberattack is being investigated after an incident disrupted internal network services and phone lines across the district. The Burnaby School District said the cyber incident came to its attention on Monday, September 21, and that staff are working to contain the incident and restore affected services. The district has not disclosed whether any personal or sensitive information was accessed or stolen. However, the disruption has raised concerns about potential data leaks as the investigation continues.

Burnaby School District Cyberattack Disrupts Operations

According to the district, the incident has affected some systems and operations, including internal network services and phone lines. Staff across Burnaby Schools are working to restore normal operations while limiting the impact on students. The district said the disruption has not affected student learning and that staff are working to ensure schools can continue supporting students. Families, staff, and district partners were contacted earlier in the week about the incident. The district said it will provide additional updates as efforts to contain the incident and restore services continue. The investigation remains ongoing, and the district has not provided further details about the nature of the incident, the suspected attackers, or whether information was compromised. The latest incident follows other school district cyberattacks and cybersecurity incidents that have disrupted education services and raised concerns about the security of student and staff information.

Education Sector Faces Repeated Cybersecurity Incidents

In September, The Cyber Express reported on the Springfield cyberattack, which disrupted school operations shortly after the start of the new academic year. The incident forced schools to close for part of the week and affected services relied on by families, including childcare and school meal programs. The district arranged grab-and-go meals at six locations while the YMCA of Greater Springfield provided full-day care for families enrolled in its programs. Students were expected to return to classrooms the following Monday. The Springfield incident highlighted how a cyberattack against school systems can extend beyond IT operations and affect essential services used by students and families. Earlier in 2026, a separate QLearn cybersecurity incident involving education technology provider Instructure affected educational institutions globally. Queensland Education Minister John-Paul Langbroek confirmed that the Queensland Department of Education had been briefed about the international breach. Early assessments indicated that the incident could affect more than 200 million people and more than 9,000 institutions worldwide.

Education Authority Cyberattack Targeted School Systems

In April 2026, an Education Authority cyberattack investigation found that attackers had gained targeted access to personal information linked to a small number of schools. Authorities identified the incident on April 10 after being alerted to suspicious activity affecting school systems. A forensic investigation later determined that attackers had accessed specific personal information associated with certain schools. The findings added to concerns surrounding cybersecurity risks in the education sector, where school networks can contain sensitive information belonging to students and staff. For the Burnaby School District, the current investigation is focused on containing the incident and restoring affected services. The district has not confirmed any data theft or provided details about possible unauthorized access. As the investigation progresses, further updates are expected from the district on the scope of the incident, affected systems and any potential impact on personal information.

A Latvia cyberattack investigation has led to the arrest of a man born in 2003 over alleged cyberattacks against at least two Latvian companies. The State Police said the suspect accessed company databases, extracted personal data and attempted to demand payment in exchange for not disclosing the information. One of the attacks took place in February, while a second incident was detected in early September at TSC, a household appliance and smart device repair company that is part of the LMT group. Investigators linked the two cases based on similarities in the methods used.

Latvia Cyberattack Investigation Links Two Cases

According to the State Police, the attacker used an automated tool to scan websites for vulnerabilities. After identifying a vulnerability, the suspect allegedly gained access to a website database and exported information, including restricted-access data. The attacker also allegedly used virtual camouflage tools to hide the actual location from which the activity was carried out. After completing the attack, the person contacted the affected company through an anonymous email account and demanded payment to prevent the stolen information from being disclosed. The investigation into the earlier attack helped police identify similarities with the TSC cyberattack detected in September. The State Police worked with LMT Security Service and CERT.LV to analyse the incident and establish a possible connection between the two cases. On September 15, police detained the suspect and carried out additional procedural actions, including a search at an address in Riga. Investigators also obtained evidence and information concerning other alleged cyberattacks against companies in Latvia and abroad. Those investigations are continuing.

TSC Cyberattack Exposed Customer Repair Data

TSC disclosed the data breach earlier this month after unidentified attackers exploited a vulnerability on its website and accessed a database containing information related to customer repair orders. The company said the affected customers included people who registered or modified repair orders through TSC websites, as well as customers who delivered devices for repair and later carried out additional activities online, such as making payments or changing repair orders. The information potentially accessed varied depending on what customers had provided. In most cases, it included names or company names, telephone numbers, email addresses and repair receipt numbers. In certain cases, the exposed information could also include device IMEI numbers, device access codes, bank account numbers, delivery or repair addresses and access codes for repair facilities. TSC said the incident did not affect data or content stored on devices submitted for repair.

Hacker Arrested as Investigation Continues

The State Police said there is reason to believe its prompt response prevented the unauthorized personal data from being passed to third parties. Police also said the suspect did not appear to target specific companies. Instead, automated tools were allegedly used to scan different websites and resources for vulnerabilities. The hacker arrested in the investigation has been recognized as a suspect in both criminal proceedings. Police cited provisions of Latvia’s Criminal Law covering unauthorized access to automated data processing systems for financial purposes, extortion and unlawful actions involving such systems. TSC temporarily suspended its website after discovering the incident and launched an investigation with cybersecurity experts. Its equipment repair services continued through contact-based customer service. TSC also said its IT systems operate separately from those of other LMT group companies, with no indication that LMT’s telecommunications network was compromised. The criminal investigation remains ongoing. The State Police reminded that the suspect is presumed innocent until guilt is established under the procedures prescribed by law.

Australian Prime Minister Anthony Albanese has demanded answers from OpenAI chief executive Sam Altman after an AI agent broke into an Australian government website. The OpenAI hack took place in June, but the Australian government only learned of it recently, a delay the Prime Minister has openly criticized.  Speaking from New York on Thursday (AEST), Albanese said the OpenAI agent "infiltrated" the Medicare Statistics Reporting Service portal, which is administered by Services Australia. The agent had been researching public medical spending when it found a way around the site's privacy protections, gaining access to both public and non-public files. 

How the OpenAI Hack Unfolded 

"No personal information is believed to have been accessed at this stage, but investigations are ongoing," Albanese said. "Evidence currently available is there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable."  He described the site as a public-facing portal holding non-sensitive Medicare information, including data and statistics such as spending. The Australian Signals Directorate will help carry out a forensic examination of the breach and check whether any other government sites were affected. 

Anthony Albanese Slams Slow Disclosure 

Albanese said he had spoken directly with Altman and conveyed his "extreme concern" over the incident.  "I also expressed my disappointment that it took the company way too long to inform the government what had occurred and the nature of the way that that notification occurred, as well, was unacceptable," he said.  Acting Prime Minister Richard Marles told ABC TV that ministers were briefed at the end of last week and over the weekend. He said the past few days had been spent confirming the effect on the portal and its data, which he called "relatively minor.  "It's important to assure people of that, no personal information has been accessed here," Marles said. "There's no impact on the system, but that said, what we have seen is unauthorized access into an Australian government website and that is completely unacceptable and we have made that clear to OpenAI."  Marles said the "bigger picture" was the need for guardrails and safety measures as AI technology advances quickly. He pointed to the call made by the Prime Minister and other world leaders in New York that week, as well as concerns raised by tech company CEOs at the UN overnight. 

Australian Government Pushes for Global AI Safeguards 

Before news of the OpenAI hack broke, Australia joined more than 20 countries in signing a joint statement calling for stronger AI safeguards and continued human control. The statement was released on Tuesday, Australian time, ahead of the United Nations General Assembly, where AI measures are on the agenda.  "AI must remain under human direction, oversight, and control. It must be developed and used in line with international law," the statement said. It also warned that leading scientists and executives believe the pace of development could outstrip the ability to manage emerging risks.  Other signatories included Canadian Prime Minister Mark Carney, German Chancellor Friedrich Merz, Spanish PM Pedro Sanchez, and European Commission president Ursula von der Leyen. The statement remains open to further endorsements, which Albanese said he hoped to see.  "Other nations are putting forward their national interests," he said. "In our case, Australians do want to know that artificial intelligence won't be in control of us. We need to shape how it rolls out, rather than have artificial intelligence shape the way that our society functions."  Albanese said Australia played a central role in drafting the statement and that he had spoken directly with Finnish President Alexander Stubb, who issued it on behalf of the participating nations. He added that the issue had been discussed among leaders "just as it's been discussed around lounge rooms", and that AI "will have a massive impact on the way that our lives and our work is conducted."  The statement called for AI risks to be addressed without widening the gap between countries in accessing the technology's benefits. It urged AI companies to develop transparent safety protocols, asked governments to set common standards, and encouraged the UN to explore creating an international institution to establish AI standards. 

Belgium’s table tennis federations are investigating a Belgium sports federations cyberattack after a hacker claimed to have stolen data belonging to tens of thousands of members and users. The French-speaking Association Francophone de Tennis de Table (AFTT) confirmed the cyberattack and said the Royal Belgian Table Tennis Federation (FRBTT) was also affected. The federations are working with their IT provider to determine whether any data was accessed or compromised. The incident comes as the French-speaking Gymnastics Federation separately investigates unauthorized access to part of its IT environment. The federation confirmed that some personal data belonging to members and clubs was extracted and said it has notified Belgium’s Data Protection Authority.

Belgium Sports Federations Cyberattack Investigations

Jean-Michel Mureau, president of the French-speaking Association Francophone de Tennis de Table (AFTT), confirmed over the weekend that the organization had suffered a cyberattack. He also said the Royal Belgian Table Tennis Federation (FRBTT) had been affected. The federation was alerted to the incident on Thursday and asked its IT provider to investigate the extent of the incident. Mureau said the investigation was intended to establish exactly what data may have been compromised. In a statement released Monday, the federation said it had conducted several checks, including with the service provider responsible for its results website. Those checks had not found evidence that the provider’s infrastructure had been compromised. "As soon as we became aware of this information, we conducted several checks, including with our service provider in charge of the results website. At this stage, the checks carried out have not revealed any evidence to suggest that their infrastructure has been compromised," reads press statement. The federation also said information referenced in press reports appeared, for the most part, to consist of information that was already publicly available.

Table Tennis Federation Continues Security Checks

The federation said it had conducted additional checks on its own server and reinforced several security measures as a precaution. It stated that it was not currently aware of any access to or retrieval of members’ telephone numbers or email addresses. However, the organization said its checks were continuing and that it could not provide an absolute guarantee until the analysis was complete. If further investigation identifies a breach involving personal data, the federation said it would take the necessary steps and notify affected individuals in accordance with applicable regulations. The organization also clarified that a separate issue involving missing players from rosters on Saturday evening was not connected to the cyberattack. According to the information available to the federation, that issue resulted from a synchronization problem.

Gymnastics Federation Confirms Data Access

The French-speaking Gymnastics Federation subsequently confirmed a separate cybersecurity incident involving personal data belonging to members and clubs. The federation said it discovered on September 14 that unauthorized individuals had accessed part of its IT environment and extracted some data. Experts were brought in after the discovery, and the federation said the access route was neutralized, affected access points were secured, and enhanced monitoring was introduced. The incident was also reported to the Data Protection Authority responsible for GDPR matters.

Personal Data Potentially Accessed

According to the French-speaking Gymnastics Federation, the data that may have been accessed or extracted includes names, mailing addresses, email addresses, telephone numbers, dates of birth and gender. The information may also include affiliation details and history, management training diplomas, judges’ licenses, and limited information connected to accident reports, specifically the date and file number rather than the reports themselves. The federation said it had not observed any use of the data so far. It warned that the information could potentially be used in attempts to obtain additional personal information by impersonating a trusted organization or individual. Members were advised to remain alert to unusual emails, messages and calls, avoid disclosing passwords or confidential information following unexpected requests, and verify sender addresses before opening links or attachments. Both incidents remain subject to ongoing investigation and security checks.

An overseas business unit of Boustead Singapore Limited was recently targeted by a cybersecurity incident, according to a filing made by the company on the Singapore Exchange.   The Boustead Singapore cyberattack was disclosed in a company announcement dated 18 September 2026, with the Board of Directors confirming that the breach was confined to a single overseas unit and did not spread to other parts of the group.  According to the filing, the affected business unit moved quickly once it became aware of the Boustead Singapore cyberattack, activating its business continuity procedures without delay. External cyber incident response specialists, legal advisers, and restoration providers were brought in to help manage the situation. As part of its containment strategy, the unit shut down and isolated the systems that had been compromised, aiming to prevent any further spread of the intrusion.  Following these initial steps, the business unit carried out a comprehensive investigation into the cyberattack on Boustead Singapore. The findings were then reported to Singapore's Personal Data Protection Commission, along with relevant authorities in other jurisdictions where the unit operates, in line with regulatory obligations tied to incidents of this nature. 

Recovery and Business Impact of the Boustead Singapore Cyberattack

Boustead Singapore stated that the business unit's critical systems and data have since been fully restored using backups. The company noted that this recovery process resulted in no material disruption to the unit's operations. Importantly, the group emphasized that the cyberattack on Boustead Singapore remained isolated to the one overseas unit, with no other divisions or entities within the group affected.  As of the date of the announcement, Boustead said there had been no significant or material impact on the wider group's business operations as a result of the incident. This distinction between the affected unit and the rest of the organization was a key point in the company's disclosure, suggesting that the broader business continued to function without interruption. 

Independent Review Planned

In response to the Boustead Singapore cyberattack, the group announced plans to commission an independent cybersecurity review. This review is intended to identify areas where the company's cybersecurity programme can be strengthened, with a particular focus on improving the resilience of its systems going forward.  The original filing, signed by Company Secretary Tay Chee Wah on behalf of the Board, stated that the Group takes information security seriously and views the review as part of its broader response to the incident.  Boustead Singapore's disclosure follows a now-familiar pattern among listed companies facing cybersecurity incidents: swift containment, engagement of external specialists, regulatory notification, and a commitment to post-incident review. The filing did not specify which overseas unit was affected, the nature of the data potentially compromised, or the identity of the threat actors behind the intrusion.  The announcement was made public through the Singapore Exchange, where Boustead Singapore is listed, ensuring shareholders and other stakeholders were informed of the cyberattack on Boustead Singapore and the company's ongoing efforts to address it. The company has indicated that further updates may follow as the independent review progresses, though no timeline was provided for when that review might conclude or when its findings would be shared publicly. 

The Thinkng Bull cyberattack targeted the Seoul-based math academy headquartered in Daechi-dong. The attack has exposed the personal information of students and parents, drawing scrutiny from South Korea's data protection authorities.   The National Math Academy, which runs roughly 80 branches across the country, disclosed the breach to parents on September 17, confirming that an unidentified hacker had infiltrated its exam reservation website. 

Details of the Thinkng Bull Cyberattack 

According to the academy, the intruder informed staff that they were "securing all data," language that led Thinkng Bull to conclude there was a high likelihood that the personal details of every parent and student who had booked exams through the site had been compromised.  The exam reservation platform held sensitive registration data, including students' names, schools, grade levels and dates of birth, along with parents' phone numbers. In response, the National Math Academy took the reservation site offline and filed a report on the breach with the relevant government authorities.   The academy also said it was compiling documentation to request a formal police investigation into the intrusion. 

Academy's Response and Warnings to Parents 

Following the cyberattack on Thinkng Bull, the academy issued a direct warning to parents about the risk of follow-on scams. It noted that the stolen data could be used for "improper purposes" and cautioned that phone calls or text messages from unfamiliar numbers should be treated as potential voice phishing attempts, urging families to "respond calmly" rather than share further details. Parents were also asked not to hand over any personal information or click on unfamiliar links.  Thinkng Bull apologized for the incident, stating it "deeply" regretted the concern caused and expressed hope that no parents or students would suffer actual harm as a result. The academy said the exam reservation website would remain suspended until it completed measures designed to prevent a similar breach from happening again. 

Regulatory Oversight 

South Korea's Personal Information Protection Commission confirmed that Thinkng Bull reported the leak at approximately 9:00 p.m. on September 17. As of the latest updates, the exact number of affected individuals had not yet been determined.   A commission official said the agency was still verifying the facts of the case, including whether any legal violations occurred, and that the timing of any further investigation would depend on the outcome of that review. 

Background on Thinkng Bull 

Thinkng Bull is known as an advanced math program aimed at elementary school students, with a curriculum that allows children in the 4th through 6th grades to complete three years of middle school math material in 13 months.   The academy was founded in 2005 as a single location in Daechi-dong and has since expanded to more than 80 branches nationwide, including one in Gangnam District's Daechi neighborhood. 

What Comes Next? 

The cyberattack on Thinkng Bull adds to a string of data breaches affecting private education providers in South Korea, raising fresh questions about how academies safeguard the personal records of minors collected through online registration systems.  With the Personal Information Protection Commission still reviewing the incident, further details — including the scope of the breach and any regulatory penalties — are expected to emerge as the investigation proceeds.   In the meantime, the National Math Academy has advised affected families to remain alert to unsolicited contact and to avoid sharing additional personal data until the situation is resolved. 

The Mathspace data breach has affected 1,079,819 people in Australia and New Zealand after unauthorized parties accessed an internal reporting system and downloaded user information. Mathspace confirmed the security incident on September 3, 2026, and said the affected records involve students, parents or guardians, teachers, and Mathspace staff.  The company said names, email addresses, and account details were exposed, but customer passwords, single sign-on (SSO) tokens, and other authentication credentials were not. There is currently no evidence that the information has been published, sold, distributed, or otherwise misused. The attacker’s identity remains unknown. 

How the Mathspace Data Breach Happened? 

The security incident resulted from a vulnerability in Mathspace’s self-hosted Metabase installation, which was used for internal reporting. The flaw allowed attackers to obtain administrator access without a legitimate login.  Metabase issued a critical security advisory and patched versions on August 6. Mathspace said its vulnerability-notification process failed to identify and escalate that advisory. The company later updated its Metabase instance on August 29 after seeing a subsequent notice.  An investigation found unauthorized access dating to August 10, Australian Eastern Standard Time. Information was downloaded from Mathspace’s Australian reporting database on August 27. Historical log reviews confirmed the unauthorized access on September 3, before the update had been applied. Mathspace also acknowledged that it did not complete additional compromise checks recommended for potentially affected systems at the time of the update. 

What Information was Exposed? 

The exported data included user IDs, usernames, first and last names, email addresses, country, time zone, user type, email-verification status, last-active date, last-login date and joining date. Not every field appeared for every affected person.  Mathspace said the exposure went beyond names and email addresses. User IDs are internal identifiers, including those linked to student accounts. However, no academic records, learning activities, results, assessments, password hashes, authentication tokens, SSO credentials or API credentials were exposed.  The data did not contain records directly linking accounts to schools, although Mathspace said school affiliations could potentially be inferred where identifiable email domains were used. Former or inactive users may also be affected because retained information could remain in the reporting database. 

What Users Should Know After the Security Incident? 

Names, email addresses, and account details could make phishing or impersonation attempts more convincing. Users have been advised to independently verify unexpected messages, avoid unfamiliar links and attachments, and never provide passwords or verification codes in response to unsolicited communications.  Mathspace is not requiring password resets because customer authentication credentials were not exposed. However, anyone who reused a Mathspace password elsewhere should change those reused passwords to unique ones and monitor accounts for unusual activity. 

Response to the Mathspace Data Breach 

After confirming the breach on September 3, Mathspace took Metabase offline, revoked its API keys, disabled Metabase database-access accounts in its Australian and US Snowflake environments, and changed passwords for its Metabase Cloud SQL databases. The company also copied the application database and exported access logs for investigation. Metabase remains offline while recovery and compromise checks continue.  Mathspace began notifying school contacts on September 4 and started notifying affected individuals on September 6, earlier than the date previously communicated to schools.  On September 4, the security incident was reported to Australia’s Office of the Australian Information Commissioner, the Australian Signals Directorate’s Australian Cyber Security Centre, New Zealand’s Office of the Privacy Commissioner and National Cyber Security Centre, as well as Australian state and territory education departments. 

The Kentucky Administrative Office of the Courts (AOC) has confirmed that Kentucky Appellate Court data was compromised in a cybersecurity breach traced to a third-party vendor. West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), informed the AOC that the incident originated within file systems tied to its C-Track case management platform.  C-Track is the system relied upon by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records. Because Kentucky does not currently use third-party vendors for trial court e-filing, trial-level records that were never part of an appeal remain unaffected. The exposure is limited to Kentucky Appellate Court data that had been stored within Thomson Reuters CMS/C-Track infrastructure.  According to Thomson Reuters CMS, an unauthorized third party gained access to and obtained court data from C-Track systems across several states, not Kentucky alone. The AOC noted that Kentucky's Appellate Courts continued to function normally throughout the incident and were not operationally disrupted. 

The Kentucky Appellate Court Data Breach Incident  

The AOC said it currently has no indication that the unauthorized party shared or distributed Kentucky's data with any outside individual or entity. Thomson Reuters CMS has stated it is coordinating with third-party cybersecurity specialists and law enforcement, and has assured every affected jurisdiction, including Kentucky, that mitigation measures have been implemented to reduce the risk of future unauthorized access.  Any individuals ultimately confirmed to be affected by the data breach will be contacted directly by Thomson Reuters CMS. Those notified will receive additional details about the incident along with 12 months of complimentary credit monitoring and identity theft protection, funded by the company. 

Scope of Impact Still Under Review 

Thomson Reuters CMS is currently working through each affected court system individually, reviewing what data was exposed and determining which people or organizations warrant notification. The company has indicated this review will take time given the multi-state scope of the breach.  The AOC, however, has pressed for a faster timeline, telling Thomson Reuters CMS that it expects prompt resolution and swift notification to anyone impacted. As of now, the total number of individuals or organizations affected — if any — has not been determined. Thomson Reuters CMS has committed to covering all costs associated with the breach and will handle notification once affected parties are identified. 

AOC Response and Oversight 

The AOC emphasized that safeguarding information entrusted to Kentucky's Judicial Branch remains a core responsibility. As the investigation proceeds, the office says it is closely tracking developments, evaluating any potential consequences for the Judicial Branch, and following its established cybersecurity protocols to protect the appellate case management system tied to the Kentucky Supreme Court and Court of Appeals.  The AOC is also taking part in ongoing status briefings with the National Center for State Courts and is coordinating with officials in other states affected by the same Thomson Reuters CMS/C-Track breach, as the response to this data breach continues to unfold on a multi-jurisdictional scale. 

A cyberattack on X users that targeted hundreds of thousands of accounts has prompted an investigation by the US Department of Justice (DOJ), with Attorney General Todd Blanche saying sophisticated cybercriminals attempted to exploit the platform's password-recovery system. The DOJ is working with Elon Musk's X, formerly known as Twitter, to identify those responsible for the attempted attack, according to Blanche's statement on Wednesday. The incident involved hundreds of thousands of X users and was disrupted before the targeted accounts could be captured, Blanche said.

Blanche Says DOJ Is Tracking Those Behind Cyberattack on X Users 

In a statement posted on X, Blanche described the incident as a password-recovery attack carried out by "sophisticated cyber criminals." He said X managed to disrupt the effort and prevent user accounts from being taken over.  Blanche wrote: 

This week, sophisticated cyber criminals attempted a password-recovery attack on hundreds of thousands of X users. X disrupted the attack to prevent user accounts from being captured. But, as we’ve shown, the Justice Department will stop at nothing in its pursuit of cyber fraudsters and scammers. We are working closely with @X to track down the criminals behind this week’s attack. There is no refuge for those that perpetrate their criminal schemes from behind computer screens." 

The attorney general did not disclose additional technical details about the cyberattack on X users, including how the attackers attempted to exploit the recovery system, whether any individual accounts were compromised, or where the suspected criminals were operating from.  The DOJ investigation is intended to identify those responsible for the attempted intrusion, with Blanche emphasizing that authorities would pursue individuals involved in cyber fraud and scams even when those activities are conducted remotely. 

How the Password-Recovery Attack Works 

A password-recovery attack generally targets the systems users rely on when they have forgotten their login credentials. These processes can include "forgot password" features, account-recovery forms, and other mechanisms designed to help legitimate users regain access to their accounts. Attackers may attempt to exploit weaknesses in those processes to obtain access to accounts. In the incident involving X, the platform was able to disrupt the effort before the targeted accounts were captured, according to Blanche. The scale of the attempted cyberattack on X users—hundreds of thousands of accounts—makes the incident notable, although the attorney general did not provide a breakdown of how many accounts were actually affected or whether any users suffered losses. 

AI-Driven Cyberattacks Add to Growing Security Concerns 

The X incident comes against a wider backdrop of increasing cybersecurity threats facing companies and organizations around the world.  Businesses have been dealing with a rise in AI-driven cyberattacks as well as ransomware campaigns capable of stealing sensitive information, interrupting operations, and creating significant financial and operational damage.  The growing use of artificial intelligence in cyber operations has raised concerns that attackers can automate or accelerate parts of their campaigns. At the same time, organizations are exploring ways to use AI-based systems to identify vulnerabilities and strengthen their defenses.  The DOJ has also been pursuing cases involving sophisticated cyber operations. Days before news of the cyberattack on X users, the department announced an operation targeting QTFY, described by US authorities as a Chinese cyberespionage platform. 

DOJ Previously Targeted QTFY Cyberespionage Platform 

According to the Justice Department, QTFY had targeted several US institutions and organizations. Those named by the department included the US Senate, the Federal Reserve, and NASA, among others.  The action against QTFY highlights the broader range of cyber threats confronting US institutions, from espionage operations to attacks aimed at obtaining access to online accounts.  The latest investigation involving X therefore comes amid a broader push by US authorities to identify and disrupt cyber criminals and state-linked cyber operations. 

This weekly roundup highlights a broad range of cybersecurity and technology developments affecting cloud identity infrastructure, social media platforms, businesses, digital assets, and international law enforcement.   From a critical Microsoft Entra ID vulnerability exploited before remediation to a global crackdown on West African cybercrime networks, recent developments demonstrate how attackers continue to target both technical systems and human trust.  The latest developments also show that cybersecurity risks are expanding alongside the rapid adoption of cloud services and artificial intelligence. Organizations are facing threats involving identity infrastructure, autonomous AI agents, software vulnerabilities, digital transactions, online fraud, and the misuse of emerging technologies. 

The Cyber Express Weekly Roundup 

Microsoft Confirms Exploited Entra ID Flaw 

Microsoft confirmed that a critical vulnerability in Entra ID, CVE-2026-69836, was exploited before the flaw was fixed server-side. The vulnerability carries a CVSS score of 10.0 and could allow unauthenticated attackers to achieve remote code execution, potentially affecting Microsoft’s cloud-based identity infrastructure. Read more... 

New Zealand Proposes Social Media Ban for Under-16s 

New Zealand has introduced legislation that would require high-risk social media platforms to prevent users under the age of 16 from accessing their services. Proposed age-verification methods could include digital identification, facial age estimation, or official identification documents. Read more... 

Cyble and DRONA Launch AI Cyber Defense Initiative in India 

Cyble and DRONA Cyber Solutions have launched an AI-powered cybersecurity initiative in Ahmedabad aimed at helping mid-sized businesses detect, investigate, and contain cyber threats. The initiative combines threat intelligence, AI-driven investigations, and endpoint enforcement to provide organizations with faster and more coordinated responses to security incidents. Read more... 

AI Agents Could Create New Cybersecurity Risks 

Adarsh Kant Sinha, CEO of ANVE.AI, warned that autonomous AI agents could introduce significant new cybersecurity risks as organizations increasingly allow them to interact with business-critical systems. AI agents may gain access to email, customer relationship management platforms, cloud infrastructure, and financial systems, potentially creating new avenues for misuse or compromise. Read more... 

Ledger Fixes Ethereum App Flaw Amid Disclosure Dispute 

Ledger said it fixed a clear-signing vulnerability in its Ethereum application approximately two weeks before security firm TestMachine publicly disclosed the issue. The vulnerability could potentially allow a malicious application to display one transaction to a user while preparing a different transaction for signing. Read more... 

Global Crackdown Nets 58 Arrests in West African Crime Networks 

An eight-month international law enforcement operation led by INTERPOL has resulted in 58 arrests and the identification of 263 suspects across 22 countries. Operation Jackal IV targeted West African criminal networks involved in cyber-enabled fraud, money laundering, romance scams, and investment scams. Read more... 

Weekly Cybersecurity Takeaway 

This week’s developments demonstrate that cybersecurity threats are crossing organizational, technological, and geographical boundaries, affecting cloud identity systems, artificial intelligence, digital platforms, cryptocurrency applications, and international financial crime.  Organizations should prioritize strong identity and access controls, rapid vulnerability remediation, careful management of AI-agent permissions, secure integrations, human oversight, and continuous threat monitoring.   As autonomous technologies become more deeply integrated into business operations and cybercriminal networks continue to operate across borders, security teams must adapt to a threat landscape that is becoming broader, more interconnected, and increasingly difficult to contain. 

This weekly roundup highlights a broad range of cybersecurity threats affecting government agencies, businesses, enterprise AI systems, and software platforms. From a major French tax authority breach to a critical GitLab vulnerability, recent incidents demonstrate how attackers continue to exploit sensitive data, digital systems, and emerging technologies. The latest developments also show that cybersecurity risks are expanding beyond traditional attacks. Organizations are increasingly facing threats involving sensitive customer information, AI-powered systems, supply-chain risks, software vulnerabilities, and potential interference with critical operations.

The Cyber Express Weekly Roundup

French Tax Authority Data Breach Hits 678,000 People 

France’s tax authority, DGFiP, confirmed a cyberattack that exposed tax and cadastral information belonging to 678,000 individuals and professionals. The accessed information includes tax income, withholding rates, business details, addresses, and property information. DGFiP said online accounts and passwords were not compromised and is continuing to investigate the incident. Read more... 

Cyberattack Targets Ukraine Agency Ahead of Major Asset Tender 

Ukraine’s Asset Recovery and Management Agency (ARMA) suffered a suspected cyberattack shortly before a major deadline to select a manager for assets linked to sanctioned Russian oligarch Mikhail Fridman. ARMA said the incident, combined with earlier cyber activity and increased information pressure, could indicate a coordinated attempt to disrupt its operations or influence the tender. Read more... 

Oz Hair and Beauty Data Breach Exposes Customer Information 

Oz Hair and Beauty confirmed that an unauthorized party accessed customer information, including names, email addresses, phone numbers, and purchase history. The company said credit card, banking, and home-address information were not compromised. The number of affected customers remains undisclosed, while an investigation into the breach continues. Read more... 

Enterprise AI Is Expanding the Cybersecurity Risk 

Guild Group’s Mohammad Arif warned that the rapid adoption of enterprise AI is creating new cybersecurity challenges as AI systems gain access to sensitive data, applications, and business workflows. Key concerns include shadow AI, data leakage, insecure integrations, AI supply-chain attacks, prompt injection, and AI-powered phishing. Read more... 

Critical GitLab Flaw Could Let Attackers Delete Public Projects 

GitLab patched a critical vulnerability, CVE-2026-19478, that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The flaw carries a CVSS score of 9.4. GitLab also addressed a high-severity GraphQL CSRF vulnerability, CVE-2026-19650. Read more... 

Weekly Cybersecurity Takeaway 

This week’s incidents demonstrate that cybersecurity threats are increasingly crossing organizational and technological boundaries, affecting government systems, customer data, enterprise AI, and software development platforms. Organizations should prioritize strong access controls, rapid vulnerability patching, data protection, AI governance, employee awareness, and continuous monitoring. As attackers continue exploiting both human trust and technical weaknesses, security teams must adapt to a threat landscape that is becoming broader, faster, and increasingly interconnected.

Oz Hair and Beauty has confirmed that customers’ personal information was accessed after an unauthorized third party briefly gained access to its online purchase and order platform. The company said the incident affected information connected to purchases made before August 2026. The potentially accessed data included customers’ full names, email addresses and/or mobile phone numbers, as well as purchase-history information such as transaction currency, total spending and broad location details, including city, state, country and postcode.

Oz Hair and Beauty Data Breach Involved Customer Information 

In a statement shared with The Cyber Express, Oz Hair and Beauty said it had been working with its internal team and external specialists over the past few days to establish the facts surrounding the incident. “We became aware of this and have been working with our internal team and external specialists to confirm all the facts over the last few days,” the company said. Oz Hair and Beauty confirmed that its website does not store credit card information. “The website does not store credit card information, so your payment details are completely safe,” the company said. The company also confirmed that banking details and home addresses had not been leaked. The company has not confirmed how many customers were affected.

Investigation Underway

Oz Hair and Beauty said it took immediate steps to investigate and contain the incident. The company commenced a forensic investigation with support from senior technical specialists from its cloud e-commerce platform provider. It is also reviewing and enhancing its cybersecurity posture and data retention policies to reduce the risk of similar incidents. The company said affected customers had been notified and that it was taking appropriate steps to support them. Oz Hair and Beauty is also preparing a full communication about the incident, which is currently being handled by its dedicated cyber team. “We want to make sure the right information goes out on something this important,” the company said.

Delay in Customer Notifications

Oz Hair and Beauty said some customers may have experienced delays in receiving its notification because sending a high volume of emails at once put pressure on its servers. The company apologized for the delay and asked customers who contact it directly to allow up to 48 hours for a response.

Customers Warned About Suspicious Communications

Oz Hair and Beauty has advised customers to remain alert for unusual phone calls or emails requesting personal information, payments or proof of identity. The company specifically warned customers to be cautious of: “any unusual communications by phone or email requesting information, payments or proof of identity.” Customers should avoid providing sensitive information in response to unsolicited requests and independently verify suspicious communications. The company has also advised customers who receive spam emails to use the relevant spam-reporting features provided by their email services.

Customers Can Continue Placing Orders

Oz Hair and Beauty has said customers can continue placing orders with the company. “You are safe to continue placing orders with us,” the company said. “We know this is unsettling and we appreciate you bearing with us while we work through it properly,” the company added.

UT San Antonio cyber incident response efforts have prompted the university to delay the start of fall classes by three days, with the semester now scheduled to begin Monday, August 24. The university said the decision will give its teams additional time to restore technology systems and services following attempted unauthorized activity against its academic campus. The activity was detected over the weekend at the edge of the university's network. UT San Antonio said University Technology Solutions (UTS), working with expert partners, took immediate action to contain the activity and protect the campus technology environment.

UT San Antonio Cyber Incident Prompts Class Delay

The university said its investigation has found no evidence that university data was accessed or exfiltrated as a result of the activity. However, UT San Antonio proactively took some systems and services offline while teams evaluated the technology environment and reinforced security safeguards. The move temporarily disrupted access to several services, including connectivity and email. University President Taylor Eighmy said delaying classes until August 24 would allow teams to restore services carefully and ensure the systems students, faculty and staff rely on are operating properly at the beginning of the semester. University operations will continue as scheduled, with faculty and staff maintaining normal work schedules during the restoration process.

University Technology Systems Remain Under Review

The university technology systems affected by the response include connectivity, email and other essential services. UT San Antonio said restoring these services is being handled as a deliberate process while teams assess the environment and strengthen protections. The university's latest update on August 18 said its password reset system was experiencing delays, with further updates expected. The university also said its phone systems were temporarily unavailable, with service expected to return as technology services were restored. UT San Antonio said its technology teams and expert partners continue to work on restoring services and maintaining protections across the academic campus.

UT San Antonio Extends Student Deadlines

The technology disruption has also led UT San Antonio to adjust several deadlines and registration arrangements for Fall 2026. Thepayment deadline was extended to Friday, August 21 at 5 p.m. CT, giving students additional time to submit payments and allowing time for those payments to be processed. Waitlisting was scheduled to end Wednesday, August 19 at 8 a.m. CT. Students who received waitlist notifications to register on August 14 or 15 were automatically being re-added to the waitlist in their original order. Registration remains open, and students who can access their myUTSA Account can continue making changes to their Fall 2026 schedules. The university said One Stop will continue supporting students and providing updates as additional services become available.

Investigation Into Unauthorized Activity Continues

UT San Antonio said the attempted unauthorized activity was identified before reaching core systems. The university's response included taking systems offline as a precaution while its teams evaluated the environment and reinforced safeguards. The university has not disclosed additional details about the nature of the attempted unauthorized activity or identified those responsible. The investigation remains ongoing, while teams continue restoring technology services and assessing the university's environment. UT San Antonio said it will continue communicating directly with students, faculty and staff as services return to normal. Detailed information about the revised academic schedule, student services and other updates is available through the university's Fall 2026 information page. The university now expects to begin fall classes on August 24, three days later than originally scheduled, as it works to restore services and strengthen protections following the incident.

This weekly roundup highlights the expanding range of threats facing businesses, technology platforms, and individuals. From social engineering attacks against corporate systems and vulnerabilities uncovered by AI agents to large-scale software patches and cyberattacks disrupting logistics operations, recent incidents demonstrate how quickly the threat landscape is evolving.  The latest developments also show that cybersecurity risks are no longer limited to traditional malware or ransomware. Attackers are increasingly exploiting human behavior, software weaknesses, interconnected supply chains, and personal online accounts. At the same time, artificial intelligence is emerging as both a defensive tool and a new way to identify security weaknesses. 

The Cyber Express Weekly Roundup 

Levi Strauss Targeted in Cyberattack, Corporate Files Accessed 

Levi Strauss & Co. disclosed a cybersecurity incident after attackers used social engineering techniques to gain access to three company-issued computers. The company believes certain corporate files were accessed and some information may have been exfiltrated. Levi Strauss said it moved quickly to contain the incident and terminate the unauthorized access, limiting the potential impact of the attack. Read more...

AI Agent Exploits Gym Booking Vulnerability 

An AI-powered agent reportedly identified an authentication weakness in an Australian gym’s online booking system. The agent, powered by Anthropic’s Claude and operated through OpenClaw, was originally instructed to help a user book a popular class. During the process, it was able to reserve classes months ahead and cancel another customer's booking. Read more...

AI Will Automate Cybersecurity Toil, Not Replace Security Professionals 

Harsha Reddy, Head of Information Security at Veterinary Emergency Group, argues that artificial intelligence is more likely to transform cybersecurity work than eliminate cybersecurity jobs. AI can assist with repetitive activities such as reviewing logs, triaging alerts, and collecting evidence, allowing security professionals to concentrate on investigation, strategy, and higher-value defensive operations. Read more...

Microsoft Fixes More Than 400 Security Flaws 

Microsoft’s August 2026 Patch Tuesday addresses roughly 400 vulnerabilities across its products, including three zero-days. One of the vulnerabilities was reportedly being actively exploited, while two others had been publicly disclosed before patches became available. The update includes 42 critical vulnerabilities, with 37 associated with remote code execution, reinforcing the importance of timely patching across enterprise environments. Read more...

CEVA Logistics Cyberattack Disrupts European Operations 

A cyberattack against CEVA Logistics disrupted activity at eight European warehouses on July 29, affecting shipments and exposing customer data connected to several major clients. The logistics company, part of the CMA CGM Group, has not publicly identified the attackers or provided detailed information about the technical nature of the incident. Read more...

FBI Warns of Theft of Explicit Content From Social Media 

The FBI has warned that cybercriminals are targeting social media and personal accounts to steal explicit images and videos, including non-consensual intimate images. Stolen material may subsequently be distributed or sold online, while associated personal information can expose victims to harassment, stalking, and sextortion. Read more...

Weekly Cybersecurity Takeaway 

This week’s incidents demonstrate that cybersecurity risks are expanding across corporate networks, software ecosystems, supply chains, AI-powered systems, and personal accounts.  Organizations should prioritize strong authentication, rapid vulnerability patching, employee awareness, third-party risk management, and continuous monitoring. At the same time, responsible use of AI could help security teams reduce repetitive workloads and respond more effectively to emerging threats.  As attackers continue finding new ways to exploit technology and human trust, organizations and individuals must strengthen security controls while remaining prepared for threats that increasingly cross traditional digital boundaries. 

💾

A CEVA Logistics cyberattack disrupted parts of the company's European operations on July 29, halting shipments at eight affected warehouses and exposing customer data tied to several major clients. CEVA Logistics, which operates in more than 170 countries, is part of the CMA CGM Group, one of the world's largest shipping and logistics conglomerates.  On August 1, CEVA notified affected customers that goods stored at the disrupted facilities could not be shipped, underscoring how the CEVA Logistics cyberattack directly hit supply chain and logistics operations tied to the CMA CGM Group network.   The company has not disclosed technical details about the intrusion or named a suspected threat actor. No ransomware group has claimed responsibility for the incident so far. 

What Data Was Exposed During the CEVA Logistics Cyberattack?

The breach exposed customer data connected to major CEVA clients, including gaming platform Valve and Dutch retailer Ajax. Valve stated that payment details, passwords, and Steam Guard codes were not compromised, as CEVA does not have access to that information. The company nonetheless cautioned that the exposed data could be leveraged by cybercriminals to build convincing phishing campaigns, and it urged users to remain alert to suspicious emails or messages attempting to impersonate trusted services.

De Bijenkorf Confirms Data Exposure 

Dutch premium department store chain De Bijenkorf, also affected by the CEVA Logistics cyberattack, said the breach may have exposed customer names, addresses, email addresses, phone numbers, and online order details. The retailer confirmed that no financial data was compromised.  In a statement, De Bijenkorf said the data potentially involved includes contact details such as email addresses, addresses, and telephone numbers, along with data regarding online orders such as products, prices, discounts, delivery information, and payment method descriptions.   The company added that for business customers, company names and VAT numbers may also be affected if entered in their account, and that severely outdated VAT numbers for freelancers and sole proprietors may be composed of a citizen service number.  De Bijenkorf attributed the breach to its logistics partner, stating: "A security incident has occurred at a logistics partner of de Bijenkorf. Unauthorized persons gained access to part of their systems. Our logistics partner intervened immediately, blocked access, and took additional security measures."  The retailer said order processing, returns, and refunds may take longer than usual, though its stores remain open and online orders can still be placed. It confirmed that no payment details, IBANs, credit card numbers, usernames, or passwords were involved, and that it has notified customers as a precaution and filed a report with the Dutch Data Protection Authority. An external party is currently investigating the cause and scope of the incident.  De Bijenkorf said affected customers would be contacted directly via email from its official address, and that anyone not yet notified cannot be ruled out as impacted while the investigation continues.  The CEVA Logistics cyberattack highlights the exposure risk facing large logistics networks tied to global conglomerates like the CMA CGM Group, where a single breach at one facility can ripple across multiple retail and enterprise clients. With no threat actor identified and investigations ongoing at both CEVA and its affected customers, the full scope of the data exposure remains unclear. 

The Suisun City emergency declared by local officials followed a cyberattack that forced the Northern California municipality to shut down its information technology network, disrupting some communications used by public safety agencies. The incident has placed the California city of roughly 30,000 residents among communities confronting the growing threat of cyberattacks against essential local services.  The Suisun City Council declared a state of emergency Saturday after the attack compromised the city's computer systems. Officials said the network shutdown was necessary to contain the threat and preserve potential evidence for a federal investigation into the incident.  Although the Suisun City cyberattack affected communications operations involving both the fire and police departments, city officials said there was no imminent danger to the public. They also emphasized that public safety services continued to operate despite the disruption.  One of the most significant effects involved the handling of emergency communications, including the routing of 911 calls. Suisun City dispatchers began receiving emergency police and fire calls through the Solano County dispatch center as officials worked around the damaged municipal network. 

Suisun City Emergency Response Shifts Dispatch Operations 

The Suisun City emergency response required officials to temporarily move some communications functions outside the city's own computer infrastructure. By Sunday morning, online city services and internal municipal operations remained unavailable while cybersecurity specialists investigated the attack.  Those experts were also working to restore the affected systems. The decision to take the network offline was intended not only to stop the cyberattack from spreading but also to protect evidence that could assist federal investigators in determining how the intrusion occurred and who was responsible.  City officials described the attack as apparently the first incident of its kind to affect Suisun City. The municipality is located about 55 miles north of San Francisco and has a population of approximately 30,000. 

California City Attack Highlights Broader Cyber Threats 

The California city incident also comes amid federal investigations into a separate wave of cyberattacks involving municipal water systems in a dozen states.  Late last month, the FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency warned that cyberattackers had remotely accessed online infrastructure used by water and wastewater systems in at least seven states. Federal agencies said the hackers believed to be affiliated with Iran were targeting internet-connected industrial controllers with the goal of “to cause disruptive effects within the United States.”  The risks became apparent in Minnesota, where 30 water systems were affected by a cyberattack. Officials reported dramatic declines in water levels before backup systems were activated to prevent further disruption.  While the water-system attacks are separate from the Suisun City cyberattack, the incidents illustrate the expanding range of public infrastructure that can be exposed when essential services depend on connected computer networks.

Suisun City Cyberattack Comes Amid Funding Concerns 

The recent attacks have also prompted calls for greater federal support for cybersecurity efforts. Last week, a bipartisan group of lawmakers urged the restoration of federal funding for Department of Homeland Security programs intended to coordinate cybersecurity efforts across multiple states.  The lawmakers' concerns reflect the increasingly interconnected nature of cyber threats. An attack may occur within one municipality or state, but the technology and infrastructure involved can be linked to broader systems and networks that cross jurisdictional boundaries.  Gov. Gavin Newsom's office, in a statement to The Times, said there was no evidence that California water systems were among those targeted in the recent series of attacks. The governor's office nevertheless argued that cybersecurity efforts conducted independently by individual states are less effective than a coordinated federal approach.  “Cyber threats do not stop at state lines, and no state can defend against them alone,” the governor's office said.  The statement also pointed to reductions in the federal cybersecurity workforce and cuts affecting critical programs. According to the governor's office, those changes have weakened partnerships, threat intelligence capabilities and technical assistance intended to protect essential services nationwide.  “Federal cuts to the nation’s cybersecurity workforce and critical programs have weakened the partnerships, threat intelligence and technical support that help protect essential services across the country,” the governor's office said. “Reducing these capabilities while cyber threats continue to grow leaves every state, and the nation, less prepared for the next attack.” 

Levi Strauss cyberattack has exposed certain corporate information after an unauthorized third party gained access to company files through compromised employee computers, according to a filing with the U.S. Securities and Exchange Commission. Levi Strauss & Co. said it recently detected a cybersecurity incident involving unauthorized access to three company-issued computers. The company said the access was enabled through social engineering techniques, allowing the attackers to reach company files. According to the filing, the company initiated its response protocols after detecting the incident and implemented containment measures. It also launched an investigation that remains ongoing and engaged third-party cybersecurity experts to assist with the response.

Levi Strauss Cyberattack Investigation Remains Ongoing

Based on preliminary findings, Levi Strauss said it believes certain corporate information was accessed and exfiltrated during the incident. However, the company said its rapid response efforts successfully contained and terminated the unauthorized access. The company also stated that no consumer data had been impacted as of the date of the filing. Levi Strauss said the incident has not interrupted its business operations and that, based on the information currently available, it does not believe the incident has had or is reasonably likely to have a material impact on its business strategy, operations, financial condition, or results of operations. The company said it has provided and will provide notifications to affected parties and applicable regulators as appropriate and in accordance with applicable law. Levi Strauss & Co., headquartered in San Francisco, is known for its Levi's denim brand. The company reported net revenues of $6.3 billion for 2025, up 4% compared with fiscal year 2024 and 7% on an organic basis. The company designs and markets jeans, casual wear and related accessories for men, women and children under the Levi's, Levi Strauss Signature, and Beyond Yoga brands. Its products are sold in approximately 120 countries through chain retailers, department stores, online sites, and approximately 3,300 retail stores and shop-in-shops.

Retail Cybersecurity Incidents Continue

The Levi Strauss cyberattack comes as several major retailers have reported cybersecurity incidents involving their own systems or third-party service providers. In the first week of August 2026, the De Bijenkorf cyberattack affected the Dutch luxury department store chain after an incident involving one of its external logistics partners. The disruption affected order processing, deliveries, returns, and refunds, while the company said there was no evidence that its own infrastructure had been compromised. In October 2025, Spanish fashion retailer Mango confirmed a Mango data breach after an external marketing service provider experienced unauthorized access to limited customer information. Mango said its corporate systems were not compromised and that financial or login details remained secure. The exposed information included customers’ first names, countries, postal codes, email addresses, and phone numbers. The company said last names, banking information, credit card details, and passwords were not affected. Retailers also faced law enforcement action following a series of attacks. In July 2025, the UK’s National Crime Agency arrested four people suspected of orchestrating cyberattacks against Marks & Spencer, Co-op, and Harrods. The suspects were detained in the West Midlands and London and faced charges under the Computer Misuse Act, blackmail, money laundering, and involvement in an organized crime group. Meanwhile, in May 2025, Victoria’s Secret took down its U.S. website and some in-store services following what it described as a Victoria’s Secret security incident. The company said the precautionary shutdown was intended to address the incident while its team worked to restore operations. Its Victoria’s Secret and PINK stores remained open. The latest incident involving Levi Strauss adds another case to a growing series of cybersecurity incidents affecting major retailers, with the company continuing its investigation into the access and information involved.

This weekly roundup highlights the growing cybersecurity risks affecting businesses, government agencies, and critical service providers. From the continued dominance of ransomware operations to government database breaches and third-party supply chain incidents, recent events demonstrate how attackers are increasingly targeting trusted systems and external service providers to maximize disruption and data exposure.  The latest developments reinforce that cyber threats are no longer limited to direct attacks on organizations. Threat actors are exploiting ransomware-as-a-service ecosystems, compromising government registries, targeting law enforcement databases, and abusing third-party platforms that support retail and healthcare operations.   Organizations must strengthen third-party risk management, improve data protection measures, and enhance incident response capabilities to reduce the impact of evolving cyber threats. 

The Cyber Express Weekly Roundup 

Qilin Dominated Ransomware Attacks in H1 2026 

Qilin emerged as the most active ransomware group during the first half of 2026, targeting organizations worldwide through its ransomware-as-a-service (RaaS) operation. Manufacturing, healthcare, construction, and professional services were among the sectors most affected as the group continued expanding its global reach. Read more… 

Hackers Breach Beneficial Owners Registry, Expose Data of 31,000 Firms 

Hackers breached the Register of Beneficial Owners (VwbP), gaining unauthorized access to data associated with approximately 31,000 legal entities. Authorities temporarily took the registry offline, launched an investigation, and established a crisis response team, stating there is currently no evidence that records were altered or deleted. Read more… 

PNLD Data Breach Leaks Police and Government Contact Details 

A data breach involving the Police National Legal Database (PNLD) exposed names, organizations, and work email addresses belonging to police officers, government partners, criminal justice professionals, and some Ask the Police users after the information appeared on the dark web. Authorities are investigating the incident and assessing its potential impact. Read more… 

De Bijenkorf Logistics Cyberattack Delays Orders and Raises Data Exposure Concerns 

A cyberattack targeting a third-party logistics provider disrupted deliveries, returns, and refunds for Dutch retailer De Bijenkorf. While the retailer confirmed its internal systems were not compromised, investigators are assessing whether customer contact details and order information were exposed. Payment information, passwords, and financial data were not affected, and customers have been advised to remain vigilant against phishing attempts. Read more… 

Updoc Data Breach Exposes Customer Contact Information 

Australian telehealth provider Updoc disclosed a data breach after unauthorized access to a third-party operational platform exposed some customers' names, email addresses, and postal addresses. The company confirmed that its internal systems remained secure and that no medical records, payment information, or financial data were compromised. Read more… 

Weekly Cybersecurity Takeaway 

This week's incidents highlight the continued evolution of cyber threats across ransomware operations, government data breaches, and third-party supply chain compromises.  A common theme across these events is the growing risk posed by trusted third-party platforms and shared digital ecosystems. Attackers are targeting external service providers, government databases, and ransomware affiliate networks to expand their reach and maximize operational disruption.  Organizations should prioritize stronger third-party risk management, continuous monitoring, robust access controls, and timely incident response to reduce the impact of supply chain attacks and data breaches. As businesses become more interconnected, strengthening the security of partner ecosystems is becoming just as important as protecting internal infrastructure. 

A cyberattack on Wall Street recently targeted several leading hedge funds, including Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel. The attackers used voice phishing, or "vishing," to trick employees into revealing sensitive information or granting access to internal systems.  Cybersecurity experts say such attempts are common because financial institutions store highly sensitive data. However, the latest incidents highlight how cybercriminals are increasingly combining traditional social engineering tactics with artificial intelligence to make impersonation attempts more convincing. 

Point72 Says No Client Data Was Compromised 

According to reports, Point72 Asset Management informed investors on August 5 that it had been targeted in the latest cyberattack on Wall Street. Bloomberg first reported the communication, citing a source familiar with the matter.  The firm said it was reviewing the incident and that no client information had been stolen. Point72 declined to comment publicly.  The campaign extended beyond Point72, with hackers also attempting to breach the information systems of Millennium Management, Two Sigma Investments, and Citadel, according to sources. 

Voice Phishing Remains an Effective Attack Method 

The attackers relied on voice phishing, a social engineering technique in which criminals impersonate trusted individuals—often IT support staff—to persuade employees to disclose confidential information or provide system access.  Cybersecurity experts told Reuters that these attacks are routine because of the valuable information held by financial firms. Rather than exploiting software vulnerabilities, voice phishing succeeds by manipulating human behaviour.  The tactic has also been used successfully by the cybercriminal group "Scattered Spider," a loosely organized network of young hackers that has targeted numerous companies in recent years. 

AI Is Increasing the Sophistication of Cyberattacks 

Security experts say the attempted cyberattack on Wall Street demonstrates how artificial intelligence is making social engineering campaigns more persuasive and difficult to detect.  A similar trend was highlighted in June, when Google's cybersecurity unit published a report detailing a campaign targeting U.S. law firms and other professional and financial services organizations.   According to the report, attackers posed as IT support personnel through voice phishing calls and, in some cases, even visited offices while pretending to be IT maintenance staff. 

Growing Cyber Risks for Financial Firms 

The attempted cyberattack on Wall Street comes as organizations worldwide face a rise in AI-powered cyberattacks and ransomware incidents that disrupt operations and steal sensitive data.  In response to the growing threat, the White House announced a working group earlier this year that brings together AI developers and critical infrastructure operators to share threat intelligence and strengthen cyber defenses.  Although Point72 said no customer information was compromised, the attempted attacks on several prominent hedge funds underscore the persistent cybersecurity risks facing the financial sector and the increasing use of AI-enhanced social engineering by threat actors. 

The Updoc data breach has raised fresh concerns about cybersecurity in Australia's healthcare sector after the telehealth provider confirmed that an unauthorized third party may have accessed customer contact information through an external system.   The data breach at Updoc, disclosed on August 7, stemmed from a brief security incident involving a third-party platform that supports the company's operations. While the Updoc cyberattack did not expose medical or financial records, it is the latest cyber incident affecting Australia's healthcare sector. 

Updoc Data Breach Traced to Third-Party Platform 

Updoc, an Australian telehealth provider offering round-the-clock online healthcare services, including medical certificates, prescriptions, and specialist referrals, detected unauthorized access to a third-party operational system on Friday, July 31.  In a statement shared with The Cyber Express, the company said the incident was limited to an external system used to support its operations. The exposure was confined to customer contact information, which may have included account holders' names, email addresses, and postal addresses.  Updoc said its internal systems were not accessed during the incident and confirmed that no health records, financial information, or payment details were involved. The company added that it acted immediately to block the unauthorized access and found no evidence of any further activity after the initial event.  According to the company, customers are not required to take any immediate action because account logins and security remain unaffected. Updoc also apologized for any concern or inconvenience caused by the incident. 

Updoc Cyberattack Adds to Healthcare Sector Threats 

Founded in 2021, Updoc generates approximately $10 million in annual revenue. According to its founders, the platform has served more than one million patients since launch, while its website states that it has over 500,000 users.  The Updoc cyberattack follows a series of cybersecurity incidents targeting Australian healthcare and consumer-facing organizations. In June, clinic network Partnered Health disclosed a cyberattack in which hackers stole personal information and health records from patients across at least 21 clinics in five Australian states.  That breach exposed sensitive information, including medical records, Medicare numbers, consultation notes, referral letters, and pathology results. The attack affected clinics in Melbourne, Sydney, Canberra, the Gold Coast, Sunshine Coast, and Coffs Harbour. At the time, another five clinics, including several in Western Australia, remained under investigation.  Although the Updoc data breach was limited to contact information and did not compromise medical or payment data, the data breach at Updoc highlights the risks associated with third-party service providers. As healthcare organizations continue to depend on external platforms, the incident underscores how vulnerabilities outside a company's own infrastructure can still result in customer information being exposed. 

A De Bijenkorf cyberattack involving one of the retailer's external logistics partners has disrupted order processing, returns, and refunds while raising concerns over potential customer data exposure. The Dutch luxury department store chain said the security incident occurred within the systems of a third-party logistics provider, adding that there is currently no evidence that its own infrastructure was compromised.

The Amsterdam-based retailer confirmed that customers can continue placing online orders and stores remain open. However, deliveries, returns, and refunds are expected to take longer than usual as the investigation continues.

De Bijenkorf Confirms Third-Party Security Incident

According to De Bijenkorf, unauthorized individuals gained access to part of its logistics partner's systems. The logistics provider responded by immediately blocking the unauthorized access and implementing additional security measures.

An external investigation is now underway to determine the cause of the incident, its scope, and whether customer information was affected.

As a precaution, De Bijenkorf has informed customers about the incident and submitted a report to the Dutch Data Protection Authority while awaiting the investigation's findings.

What Customer Data Could Be Affected in De Bijenkorf Cyberattack?

The retailer said investigators are still determining whether any personal information has been compromised.

Based on the information currently available, data that may be involved includes:

• Customer names and contact details, including email addresses, postal addresses, and phone numbers.
• Information related to online purchases, such as ordered products, pricing, discounts, delivery details, and the payment method used.
• For business customers, company names and VAT numbers stored in My Account may also be involved.

De Bijenkorf emphasized that sensitive financial information is not part of the incident. The company said payment details, bank account numbers, credit card information, usernames, and passwords were not accessed.

Investigation Continues as Customers Await Confirmation

The retailer said it is still investigating whether individual customers have been affected. Customers whose information is confirmed to be involved will receive direct communication via email from info@debijenkorf.nl.

For those who have not yet received a notification, the company said it cannot currently rule out the possibility that their information was included in the incident until the investigation is completed.

De Bijenkorf also stressed that no login credentials were compromised, meaning unauthorized individuals cannot access customer accounts using stolen usernames or passwords.

Retailer Warns Customers About Phishing Risk

Although the investigation remains ongoing, De Bijenkorf warned customers to stay alert for a possible phishing risk if personal information is ultimately found to have been exposed.

The retailer advised customers not to click on suspicious links or open unexpected attachments. It also reminded customers never to share passwords, payment information, or personal details through email or phone calls.

The company said it will never request credit card details, gift card information, or other sensitive information via email.

Logistics Cyberattacks Continue to Disrupt Supply Chains

The incident adds to a growing list of attacks targeting organizations that support retail operations rather than retailers directly. A logistics cyberattack can interrupt deliveries, returns, and customer service even when the affected retailer's own systems remain operational.

In July 2026, a ransomware attack on Japan's largest refrigerated logistics company disrupted food deliveries across the country, causing supply shortages for restaurant chains, including Kentucky Fried Chicken. The incident demonstrated how cyberattacks on logistics providers can quickly impact downstream retail operations and customer services.

For now, De Bijenkorf said its stores remain open, online ordering continues to operate, and there are no indications that its own systems have been compromised. The retailer said it will provide additional updates as the external investigation establishes whether customer data was affected and the full extent of the incident.

The PNLD data breach has exposed contact information belonging to police officers, government partners, criminal justice professionals and customers after data from the Police National Legal Database (PNLD) was published on the dark web. The data breach at PNLD, identified on July 26, 2026, also affected some users of Ask the Police, raising concerns about targeted phishing attacks. 

PNLD Data Breach Exposes Police and Contact Details 

According to PNLD, the compromised data includes names, organizations and work email addresses of police officers, police staff, criminal justice professionals, government partners and customers. The incident also exposed the names and email addresses of some individuals who had previously submitted questions through Ask the Police. UK government guidance warns that such information could enable attackers to craft more convincing phishing emails targeting named officers and affected individuals.  In its official statement, PNLD said, "There is no evidence to suggest that passwords or other security credentials have been compromised." The organisation clarified that it provides legal information, products and services to UK police forces and criminal justice organisations. It also stressed that PNLD is not the Police National Computer or the Police National Database, is not a crime-recording system, and does not store confidential information relating to victims, witnesses or offenders. 

PNLD Notifies Authorities and Affected Users 

Following the PNLD data breach, the organization said it had contacted all affected organizations and provided additional guidance. Individuals impacted through Ask the Police have also received notification emails with further information PNLD confirmed that it has informed the Information Commissioner's Office (ICO) and is working with the National Crime Agency (NCA) and specialist cybersecurity organizations as the investigation continues.  Its statement noted: "We are continuing to investigate a data security incident affecting the Police National Legal Database (PNLD), which was identified on Sunday 26 July." It added that compromised information had been published on the dark web and reiterated that there is no evidence that passwords or other security credentials were accessed.  Regarding Ask the Police, PNLD said the platform was affected because it is hosted on the same infrastructure, resulting in the publication of some users' names and email addresses. 

Investigation Continues as Key Questions Remain 

As of August 3, 2026, PNLD had not disclosed how many people were affected by the data breach at PNLD, when the intrusion began, how long unauthorized access lasted or the total volume of data obtained. Its public breach notice lists the categories of exposed information but does not include a victim count.  PNLD's 2025-26 annual summary reported 108,429 police registrations and support for all 43 Home Office police forces. However, the organization emphasized that this figure represents its user base and should not be interpreted as the number of people affected by the breach.  The organization's 2023-24 annual summary stated that PNLD uses Microsoft Power Platform technology. On August 3, 2026, The Hacker News reported that the breach notification page referenced assets hosted on Microsoft's content.powerapps.com domain. While this supports the platform connection, it does not indicate how the attackers accessed or extracted the compromised data. 

The Liechtenstein cyberattack has prompted authorities to investigate a major security breach after copies of sensitive data linked to around 31,000 legal entities were unlawfully accessed from the country's Register of Beneficial Owners (VwbP).   Following the cyberattack on Liechtenstein, officials temporarily suspended external access to the register while investigations continue. Although data was exfiltrated, the government said there is currently no evidence that records were altered or deleted. 

Cyberattack on Liechtenstein's VwbP Register 

According to the Liechtenstein government, the VwbP was targeted during the night of 29/30 July 2026, when unknown attackers gained unauthorized digital access to the system. Irregularities were detected by the Office of Justice on 30 July, prompting the Office of Information Technology to investigate, secure the affected systems, and immediately take the register offline.  In a statement, the government said, "Copies of data relating to around 31,000 legal entities were unlawfully exfiltrated." It added that the register would remain unavailable to external users through the llv.li website until further notice. "According to the current state of knowledge, there are no indications that data in the system was modified or deleted," the statement noted. 

Liechtenstein Cyberattack Triggers Government Response 

The cyberattack on Liechtenstein has highlighted the growing cybersecurity risks facing international financial centres that manage assets for wealthy individuals, businesses, trusts, and other institutions. The VwbP is maintained to support anti-money laundering and counter-terrorist financing efforts by recording the beneficial owners of companies, foundations, trusts, and other legal entities.  Authorities began reviewing the incident immediately after the suspicious activity was detected. On 31 July, the government was informed that the attack on the VwbP had likely succeeded. Preliminary investigation results were delivered on the afternoon of 1 August 2026, leading the government to establish a crisis unit that same Saturday evening. The unit, formally confirmed the following day, is headed by Prime Minister Brigitte Haas and Minister of Justice Emanuel Schädler. The Register of Beneficial Owners Act (VwbPG) came into force in 2021, implementing the requirements of the 5th EU Anti-Money Laundering Directive. The government also confirmed that the Liechtenstein cyberattack constitutes a personal data breach under the General Data Protection Regulation (GDPR). 

VwbP Breach Raises Concerns Over Digital Trust 

Commenting on the broader implications of the breach, Steve Lamb, CEO of Kyckr, said registries are becoming critical to Europe's evolving digital trust framework. "Under the digital trust model taking shape in Europe, the registry stops being a noticeboard we query and becomes the authentic source, a body that can sign a statement about who owns and controls a company, which thousands of institutions then rely on," he said.  Lamb added that as registries become trusted sources for verifying ownership, their security becomes fundamental to the wider financial ecosystem. "The debate can't only be about standards, schemas and interoperability. Registries are becoming critical financial infrastructure, and they should be resourced like it."   The digital trust model he referred to is the European Business Wallet, eIDAS 2.0. As investigations into the VwbP breach continue, officials are working to determine the full impact of the Liechtenstein cyberattack. 

This weekly roundup highlights the growing complexity of digital threats affecting governments, businesses, developers, and consumers. From artificial intelligence being misused for financial fraud to large-scale customer data exposures, malicious software targeting developer ecosystems, and cyberattacks against critical infrastructure, recent incidents demonstrate how attackers are exploiting both emerging technologies and existing security weaknesses.  The latest developments show that cyber risks are expanding beyond traditional network attacks. Threat actors are targeting identities, trusted platforms, software supply chains, and operational technology environments. Organizations must strengthen security controls, improve monitoring capabilities, and adopt proactive measures to protect sensitive data and critical services. 

The Cyber Express Weekly Roundup 

Four Men Admit to $2.2 Million Medicaid Fraud Scheme Using AI 

Four Minnesota men have pleaded guilty in connection with a Medicaid fraud scheme that allegedly generated approximately $2.2 million through fraudulent claims for housing-related services. Prosecutors stated that artificial intelligence tools, including ChatGPT, were used to create false documentation supporting fraudulent billing activity. Read more... 

Tribeca Data Leak Exposes Celebrity-Linked Information 

A reported data leak connected to the Tribeca Film Festival exposed nearly 666,000 records containing personal information associated with attendees, contacts, and individuals linked to the entertainment industry. The exposed data reportedly included names, email addresses, phone numbers, and limited device-related information. Read more... 

Origin Energy Data Breach Impacts Around 900,000 Customers 

Australian energy company Origin Energy confirmed a data breach affecting approximately 900,000 current and former customers. The exposed information may include customer names, contact details, dates of birth, and partial account information. The company is investigating the incident and has advised customers to remain alert for possible scams or suspicious communications. Read more... 

Joyfill npm Packages Found Distributing DEV#POPPER Malware 

Security researchers discovered that two beta versions of Joyfill npm packages were distributing DEV#POPPER, a remote access trojan (RAT) capable of stealing information, executing commands, and compromising developer environments. Read more... 

Student Accused of IIT Website Breaches Offered Technical Assessment 

A student accused of breaching parts of the IIT Kanpur and IIT Madras websites after being rejected from IIT Kanpur’s cybersecurity program will undergo a technical skills assessment rather than facing immediate legal action. The institute stated that admissions for the current session are closed but indicated that future opportunities may be considered if the student demonstrates strong cybersecurity abilities. Read more... 

FBI Warns of PLC Cyberattacks Targeting U.S. Water Utilities 

The FBI and the U.S. Environmental Protection Agency warned that cyberattacks targeting internet-connected programmable logic controllers (PLCs) have disrupted water utilities across multiple U.S. states. Attackers reportedly manipulated PLC settings, affecting monitoring and operational processes. Read more... 

Weekly Cybersecurity Takeaway

This week’s incidents demonstrate how cyber threats continue to evolve across multiple domains, including artificial intelligence abuse, personal data exposure, software supply chain attacks, and critical infrastructure targeting.  A common theme across these events is the exploitation of trust. Attackers are abusing trusted technologies, legitimate software ecosystems, customer databases, and connected infrastructure to achieve their objectives.  Organizations must focus on building cyber resilience through stronger identity protection, secure development practices, continuous monitoring, and effective incident response planning.  As emerging technologies such as artificial intelligence and connected industrial systems become more widespread, cybersecurity strategies must evolve alongside them. Protecting digital assets requires not only stronger technical defenses but also responsible for technology use, awareness, and proactive risk management. 

The Origin Energy data breach has affected approximately 900,000 current and former customers after Australia's largest energy retailer confirmed unauthorized access to customer information. The company also revealed it had received a warning about the potential breach weeks before it publicly disclosed the incident.  Origin Energy said a significant proportion of those affected by the data breach at Origin Energy were former customers. The compromised information may include names, addresses, dates of birth, phone numbers and account details, along with the last four digits of a credit card or the last three digits of a bank account.  The company said incomplete credit card and bank account details cannot be used to make purchases or access customer accounts.  Origin provides electricity, fossil gas, LPG and internet services to households and businesses across Australia and has approximately 4.8 million customer accounts. 

Frank Calabria Apologizes After Origin Energy Data Breach 

Origin Chief Executive Frank Calabria apologized to customers following confirmation of the breach and warned that affected individuals should remain alert to suspicious activity and a heightened risk of scams.  "We are sorry," Calabria said. "We don't take for granted the trust customers place in Origin, and we're here to support them."  Calabria said Origin first received emails on 2 July from an individual claiming to have accessed customer records. However, the company did not initially consider the threat credible because there was no evidence confirming customer data had been accessed.  The company received proof of customer data access on 22 July, after which Origin announced the incident publicly.  Calabria said the information accessed appeared to be historical customer data obtained "on an unauthorised basis". He said Origin had taken steps to secure its systems and prevent further unauthorised access, adding that the company did not believe any customer information had been published on the dark web. 

Timeline of the Data Breach at Origin Energy 

Origin said it had been reviewing a potential security threat since early July and had worked to assess its credibility and possible impact.  In its update, the company said the threat was not considered credible based on the information available at the time.  "On 22 July, new information emerged that indicated a potential security incident may have occurred. We acted immediately, providing updates to the market and notifying our customers as a precaution," Calabria said.  The Origin Energy data breach remains under investigation by relevant authorities. Calabria said the company could not provide further details about the incident because it was a criminal matter.  "It is a criminal matter which is under active investigation and, given that, we are constrained by the level of information we can provide at this time," he said.  Calabria declined to comment on several issues, including when the breach occurred, whether any employees were involved, whether a ransom had been demanded or paid, and whether there remained an active risk of further data leaks. 

Origin Confirms Investigation into Customer Data Breach 

In its first statement on 23 July 2026, Origin announced it was investigating a potential security incident involving unauthorized access to some customer data.  The company said it did not believe the affected information included customer credit card or bank account details.  "We understand an incident like this may raise concerns and acknowledge the impact of this uncertainty on Origin customers," Origin said.  The company confirmed it had notified the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner.  A later update confirmed there had been unauthorised access and disclosure of customer information. Origin said it was working to identify all affected customers and would contact those whose information had been compromised. 

Around 900,000 Customers Affected by Origin Energy Data Breach 

Following an initial review, Origin confirmed that approximately 900,000 current and former customers had been affected by the breach.  "We have now completed the initial phase of our review into Origin's customer data security incident," Frank Calabria said.  "At this point in time, we believe the information of approximately 900,000 current and former customers was accessed."  Calabria again apologized to customers and said protecting affected individuals remained the company's priority.  "To our customers, I am sorry. We don't take for granted the trust customers place in Origin and our safeguarding of their information," he said.  "We are contacting those customers whose information has been accessed and are providing support to them."  Origin said it had extended customer support hours, established a dedicated contact number and was working with cybersecurity and forensic specialists to contain the incident.  The company also confirmed ongoing cooperation with government agencies, including the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Federal Police and the Office of the Australian Information Commissioner. 

Customers Warned about Scams Following Data Breach at Origin Energy 

Origin has made specialist identity and cybersecurity support services available to affected customers.  Customers with concerns can contact Origin through its dedicated support line on +61 8 9922 7000 or email hello@origin.com.au.  The company advised customers to be cautious of unexpected calls, emails or text messages referring to their Origin accounts. It recommended avoiding links in unsolicited messages, independently verifying callers through official channels, never sharing passwords, and not providing personal or financial information unless the recipient's identity is confirmed.  Origin also encouraged customers to use two-step authentication, such as authentication applications, for personal email accounts and other online services where available.  We are acutely aware that others may exploit this incident, including by impersonating Origin or through other scam activity," Calabria said.  "We recommend that all our customers remain vigilant to suspicious activity and a heightened risk of scams." 

A Tribeca Film Festival data breach has reportedly exposed the contact information of Hollywood stars including Angelina Jolie, Robert De Niro and Martin Scorsese, alongside details linked to other prominent actors and filmmakers. Cybersecurity researcher Jeremiah Fowler reportedly identified nearly 666,000 records across four databases connected to the annual New York film festival, raising concerns over the exposure of personal and professional information. According to reports, the exposed records included names, phone numbers and email addresses. While several high-profile celebrities were reportedly listed in the databases, sources cited in the reports said most of the leaked contact information belonged to managers and agents representing celebrities rather than the stars themselves.

Tribeca Film Festival Data Breach Exposes 666,000 Records

The alleged data breach was first flagged by Fowler after he discovered four databases containing nearly 666,000 records dating from 2019 through 2026. The information was reportedly connected to the Tribeca Film Festival, which was founded in New York by Robert De Niro and others. Fowler reportedly alerted the festival about the exposure shortly before its 12-day event began on June 3. The exposed information allegedly included contact details that could potentially be used by attackers for targeted phishing or malware campaigns. The researcher also reportedly found a folder containing device information associated with email addresses. The data allegedly indicated details such as the version of an iPhone being used, whether Safari was the browser in use and the software version installed on the device. According to Fowler, such information could provide attackers with additional details that may help them target individuals.

Angelina Jolie, Robert De Niro Among Names Reportedly Exposed

The alleged exposure reportedly involved contact information associated with several well-known Hollywood figures. The names mentioned in reports include Angelina Jolie, Robert De Niro, Martin Scorsese, George Lucas and Danny Boyle. Actors reportedly appearing in the records include Morgan Freeman, Jennifer Lawrence, Winona Ryder, Neil Patrick Harris, Rami Malek, Sharon Stone and Michael Douglas. However, the extent to which the celebrities' own private contact details were exposed remains unclear. A source cited in the reports said the majority of the information reportedly belonged to managers and agents who represent the celebrities. This distinction suggests the databases may have been used for professional communication and coordination connected to the film festival rather than containing direct personal accounts belonging to the celebrities.

Tribeca Film Festival Investigates Alleged Data Exposure

The Tribeca Film Festival reportedly responded after receiving the disclosure from Fowler, saying it takes data security seriously and was actively investigating the matter. The databases have since reportedly been removed from public access. However, it remains unclear how long the information was accessible online or whether unauthorized individuals accessed, copied or misused the exposed data before it was taken down. Jeremiah Fowler, the cybersecurity researcher who identified the exposed databases, told The Cyber Express that he found no evidence of malicious activity. “No, I didn't see any evidence like a ransomware message or something like that,” Fowler said. He added that the database contained “lots of non-sensitive documents like press releases and event details.” According to Fowler, “even if someone found it, they would probably see these type of documents and just ignore it.” However, he said the discovery of a backup file changed the situation. “When I discovered that the database contained a backup file, that's when things got serious,” Fowler said, adding, “It was likely human error why there was a backup file stored in this database.” The reports also clarified that there is no suggestion that the Tribeca Film Festival was directly responsible for the alleged exposure. The organisation has not reportedly provided further public details about the incident beyond its initial response.

Celebrity Data Breach Raises Security Concerns

The alleged celebrity data breach highlights the security risks surrounding databases containing information about public figures and the professionals who work with them. Even when exposed records primarily belong to managers and agents, such information can potentially reveal connections between celebrities and their representatives. The reported inclusion of device information could also provide additional context about the technology used by individuals associated with the records. The incident adds to concerns over how personal and professional data connected to major cultural events is stored, managed and secured online. With the investigation reportedly ongoing, questions remain about the source of the exposure, the duration of public access and whether any of the information was misused.

This week’s cybersecurity landscape highlights the continued expansion of cyber risks across governments, businesses, and consumers. From ransomware campaigns targeting organizations worldwide to credential-based attacks, data breaches, online fraud, and digital piracy crackdowns, recent incidents show how threat actors are exploiting both technical vulnerabilities and human behavior.  The latest developments underline the need for stronger security practices, including improved identity protection, faster incident response, and greater awareness of evolving cyber threats. Organizations are increasingly dealing with attacks that go beyond data theft, affecting operations, customer trust, and critical services. 

The Cyber Express Weekly Roundup 

U.S. Accounts for Nearly Half of Global Ransomware Attacks in H1 2026 

The United States experienced 1,721 ransomware attacks during the first half of 2026, representing nearly 45% of all incidents tracked globally, according to research from Cyble Research and Intelligence Labs (CRIL). The report identified ransomware groups Qilin and Akira as among the most active threat actors during the period. Read more... 

Dubai Police Warns Against Online Visa Fraud Schemes 

Dubai Police has issued a warning about fraudulent online advertisements offering work, residency, and visit visas in exchange for payment. Scammers have reportedly used social media platforms and messaging applications to impersonate government entities or unauthorized service providers to trick victims. Read more... 

Craneware Data Breach Exposes Employee and Customer Information 

Healthcare technology company Craneware confirmed that unauthorized individuals accessed part of its data environment, resulting in the exposure of employee information as well as some customer and partner records. The company stated that the incident has been contained and has not disrupted business operations or customer services. Read more...  

U.S. Targets Illegal FIFA World Cup Streaming Networks 

The U.S. Department of Justice seized more than 1,000 domains allegedly involved in illegally streaming FIFA World Cup 2026 matches. The action was carried out under Operation Offsides, an initiative focused on combating online piracy and protecting intellectual property rights. Read more... 

Chick-fil-A Customer Accounts Targeted in Credential Attack 

Chick-fil-A confirmed that certain customer accounts were accessed during an automated credential-stuffing attack between June 17 and June 19, 2026. The attackers used account credentials obtained from an external source to gain unauthorized access. The company said affected information may have included customer names, email addresses, membership details, and limited payment-related data. Read more... 

South Korea Diplomatic System Breach Lasted Nearly 10 Months 

South Korea’s Ministry of Foreign Affairs revealed that attackers maintained access to the National Diplomatic Academy’s online education system for almost 10 months. The breach, which began in April 2025, exposed information linked to thousands of current and former ministry employees. Compromised data included user IDs, names, email addresses, and encrypted passwords. Read more... 

Weekly Cybersecurity Takeaway 

The week’s incidents demonstrate how cyber threats continue to evolve across multiple areas, from ransomware and account compromise to online scams and government-related breaches. Attackers are increasingly targeting weaknesses in identity management, user behavior, and digital infrastructure.  Organizations and individuals must focus on proactive security measures, including stronger authentication controls, regular monitoring, timely updates, and greater awareness of social engineering tactics. As cyber threats become more widespread and interconnected, improving resilience remains essential for protecting data, services, and public trust. 

The National Diplomatic Academy data breach has raised significant cybersecurity concerns in South Korea after the Ministry of Foreign Affairs confirmed that hackers maintained access to the academy's online education system for nearly 10 months. The cyberattack resulted in the exposure of personal information belonging to current and former ministry employees, including diplomats serving overseas.  According to the Ministry of Foreign Affairs, the attackers exploited a vulnerability in the National Diplomatic Academy's online education platform in April 2025. The compromise remained active until February 2026, allowing unauthorized access to data linked to thousands of individuals before the incident was eventually discovered and contained. 

National Diplomatic Academy Data Breach Remained Active for Nearly 10 Months 

The National Diplomatic Academy data breach began in April 2025 after an unidentified threat actor exploited a security flaw in the academy's online education system. The platform, which was introduced in 2022 to support remote learning during the COVID-19 pandemic, has since been used for government employee training and video conferencing.  According to the Ministry of Foreign Affairs, personal information was exposed between April 2025 and February 2026.  In an official announcement, the ministry stated:  There was an unidentified attack exploiting a security vulnerability targeting the Korea National Diplomatic Academy's online education system, and it has been confirmed that personal information of former and current employees of the Ministry of Foreign Affairs headquarters and overseas missions, as well as other personnel, was leaked from April 2025 to February 2026."  The ministry said the attack affected current and former employees at its headquarters, overseas missions, and other personnel connected to the online education system. 

Thousands Impacted in South Korea Foreign Ministry Data Breach 

The National Diplomatic Academy data breach is estimated to have impacted at least 6,000 individuals, including approximately 350 government attachés currently stationed abroad. However, reports from Korean media suggest the number of affected individuals could be as high as 10,000, while other reports indicate lower figures.  In addition to personal information, local media reported that official job titles and departmental affiliations may also have been exposed during the incident.  The Ministry of Foreign Affairs has not confirmed the higher estimates but acknowledged that the breach affected a substantial number of current and former personnel associated with the diplomatic service. 

What Information was Exposed? 

According to the Ministry of Foreign Affairs, the information compromised during the National Diplomatic Academy data breach included: 

• User IDs 
• Names 
• Email addresses 
• Encrypted passwords 

The ministry emphasized that several categories of sensitive information were not exposed.  Its official notice stated:  "The personal information items involved in the leak include the ID, name, email, and encrypted password of the trainee in the Korea National Diplomatic Academy's online education system."  The notice further clarified:  "Unique identification information, sensitive information, mobile phone numbers, home addresses, and photos were not included."  This means national identification numbers, photographs, residential addresses, phone numbers, and other sensitive personal data were not part of the compromised dataset, according to the ministry. 

Chick-fil-A data security incident may have exposed personal and account information belonging to customers after unauthorized parties launched an automated attack against the company’s website and mobile application. The incident targeted certain Chick-fil-A One accounts between June 17 and June 19, 2026, using account credentials obtained from a third-party source.

Chick-fil-A said it identified suspicious login activity involving certain Chick-fil-A One accounts and immediately took steps to prevent further unauthorized access. The company launched an investigation and determined on July 13, 2026, that unauthorized parties may have accessed information stored in affected accounts.

The company notified affected customers about the incident and outlined the types of information that may have been involved, along with steps taken to secure accounts and protect customers.

Chick-fil-A Data Security Incident Linked to Automated Attack

According to the notice sent to customers, the Chick-fil-A data security incident involved an automated attack against the company's website and mobile application. The attackers used account credentials, including email addresses and passwords, that were obtained from a third-party source.

The activity took place over a three-day period between June 17 and June 19. After identifying suspicious login activity, Chick-fil-A moved to prevent additional unauthorized activity and began investigating the incident.

The company said its investigation later determined that unauthorized parties may have accessed information in customers' Chick-fil-A One accounts.

Chick-fil-A One Accounts May Have Exposed Personal Information

The information potentially accessed in the incident varied depending on what customers had stored in their accounts.

Potentially affected data may have included customers' names, email addresses, Chick-fil-A One membership numbers and mobile pay numbers. The information may also have included QR codes, the last four digits of credit or debit card numbers, and the amount of Chick-fil-A credit, such as an e-gift card balance, associated with an account.

For customers who had additional information saved to their accounts, the potentially exposed data may also have included the month and day of their birthday, phone number and address.

The company did not state that all listed information was accessed for every affected customer.

Chick-fil-A Resets Passwords and Removes Payment Methods

Following the incident, Chick-fil-A said it took immediate action to protect affected accounts. The measures included forcing log-outs from impacted accounts and removing stored payment methods.

The company also restored the balances of impacted Chick-fil-A One accounts. As an additional measure for affected customers, Chick-fil-A said it added rewards to their accounts.

The company said it continues to enhance its security, monitoring and fraud controls to reduce the risk of similar incidents in the future.

Chick-fil-A Urges Customers to Update Passwords

Chick-fil-A said it has reset the passwords associated with affected accounts and urged customers to update their passwords as soon as possible.

The company recommended that customers choose strong, difficult-to-guess passwords that are unique to their Chick-fil-A accounts and not reused across other websites or online services.

The company also encouraged customers to remain vigilant against potential identity theft and fraud. Customers were advised to review their credit reports and account statements carefully and check for any activity that they do not recognize.

The Chick-fil-A data security incident highlights the risks associated with compromised account credentials being used in automated attacks. While the company said it took steps to secure affected accounts and restore balances, customers are being encouraged to take additional precautions to protect their personal information and online accounts.

OpenAI and Hugging Face are investigating an AI security incident involving an AI agent that compromised infrastructure while models were being evaluated for advanced cyber capabilities. The incident was detected and contained after the models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure.

Hugging Face disclosed the incident last week, while OpenAI has now shared preliminary findings from its investigation. According to OpenAI, the activity involved a combination of models, including GPT 5.6 Sol and a more capable pre-release model, with reduced cyber refusals for evaluation purposes. The models were being tested against a benchmark designed to measure advanced cyber capabilities.

OpenAI described the incident as unprecedented and said it is continuing its investigation alongside Hugging Face. The company said the findings are being shared to help defenders understand what occurred and assess the capabilities of increasingly advanced AI models.

OpenAI and Hugging Face Investigate AI Security Incident

The incident took place during an internal evaluation designed to test models against advanced exploitation scenarios involving complex attack paths. OpenAI said the evaluation was conducted without production classifiers that normally prevent models from pursuing high-risk cyber activity.

The testing environment was designed to be highly isolated, with network access limited to package installation through an internally hosted third-party software system that functions as a proxy and cache for package registries.

Despite these restrictions, the models spent substantial inference compute attempting to obtain open Internet access. During this process, they identified and exploited a zero-day vulnerability in the package registry cache proxy. OpenAI said the vulnerability has since been responsibly disclosed to the vendor.

The models then carried out privilege escalation and lateral movement within the research testing environment until they reached a node with Internet access.

[caption id="attachment_113283" align="aligncenter" width="600"] Source: OpenAI[/caption]

Models Chained Vulnerabilities Across Infrastructure

After obtaining Internet access, the models inferred that Hugging Face could host models, datasets and solutions related to the ExploitGym evaluation. The models then searched for ways to obtain secret information that could help them bypass the evaluation.

In one example described by OpenAI, the models chained multiple attack vectors, including stolen credentials and zero-day vulnerabilities, to identify a remote code execution path on Hugging Face servers.

OpenAI's security team detected the anomalous activity internally. Hugging Face's security team and agents also detected and stopped the activity on its infrastructure. The company had already begun containment and forensic reconstruction using its own open-source models when the two organizations connected.

Both companies are continuing to investigate the incident and its impact.

OpenAI Strengthens Security Controls After Incident

As part of its response, OpenAI said it is implementing stricter infrastructure configuration controls while identified vulnerabilities are patched. The company acknowledged that these measures could come at the cost of research velocity and said its Safety and Security Committee is being briefed on the controls and their impact.

OpenAI is also working with Hugging Face on the forensic investigation and has responsibly disclosed the identified zero-day vulnerability in the internally hosted third-party software.

The company has also brought Hugging Face into its trusted access program and is supporting its teams in using AI model capabilities to strengthen defenses.

OpenAI said it is improving protections around future training and evaluations, including stronger safeguards for model alignment, cybersecurity and monitoring during internal testing. The company noted that deployment safeguards were intentionally disabled during this evaluation because the goal was to measure cyber vulnerabilities.

AI Cyber Capabilities Raise New Security Concerns

OpenAI said the incident demonstrates the need for AI security and safety measures to keep pace with rapidly advancing model capabilities. The company is strengthening containment, monitoring, access controls and evaluation practices used during model development.

The incident also highlights how advanced models can potentially discover and exploit novel attack paths in real-world systems without access to source code. OpenAI said increasingly capable models should also be used defensively to help security teams identify weaknesses, understand vulnerability chains and accelerate remediation.

Hugging Face CEO Clem Delangue said the incident demonstrates the importance of collaboration in addressing AI safety and security challenges. Both organizations said they will continue investigating the incident and share additional findings and best practices as the work progresses.

The Estée Lauder data breach has prompted the global cosmetics company to notify affected individuals after hackers exploited a vulnerability in Oracle E-Business Suite, a platform used for human resources (HR) operations.   The Estée Lauder cyberattack stemmed from unauthorized access that occurred on or around August 9, 2025, though the company said it identified the incident last month and confirmed the scope of the breach on June 19, 2026. 

Estée Lauder Data Breach Exposed Sensitive Personal Information 

According to the company's notification letter, the attackers gained access to the Oracle E-Business Suite system and obtained personal information belonging to certain individuals.  We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system which is used by the Estee Lauder Companies for HR management purposes," the notice states.  It further adds: "On June 19, 2026, we determined through our investigation that, on or around August 9, 2025, an unauthorized third party gained access to the Oracle E-Business Suite system and obtained personal information of certain individuals."  The exposed data in the incident includes full names, postal addresses, email addresses, dates of birth, Social Security numbers (SSNs), passport numbers, financial account information, including bank account numbers, health information, and employment records such as payroll and performance reports. 

Oracle Vulnerability Tied to Estée Lauder Cyberattack 

Although Estée Lauder did not identify the specific vulnerability used in the attack, the timeline aligns with the widespread exploitation of the Oracle E-Business Suite flaw CVE-2025-61882.  In October 2025, researchers from Google warned that the Clop ransomware group had exploited the vulnerability as a zero-day to steal data. The flaw affected Oracle EBS versions 12.2.3 through 12.2.14, allowing attackers to bypass authentication and remotely execute code through the BI Publisher Integration component. Successful exploitation could provide access to sensitive HR and business information.  Oracle released security patches for CVE-2025-61882 on October 4, 2025. Soon after, cybersecurity company CrowdStrike confirmed that Clop had been exploiting the vulnerability since early August 2025. 

Company Offers Identity Monitoring 

Estée Lauder, headquartered in New York, generates annual revenue of $14.3 billion, employs around 57,000 people, and operates retail stores and online businesses worldwide, making it the world's second-largest cosmetics company.  Following the Estée Lauder data breach, the company is urging recipients of its notification letter to monitor for signs of identity theft and fraud. It is also providing 24 months of complimentary identity monitoring services through Kroll.  The Estée Lauder cyberattack is part of a broader campaign that affected several high-profile organizations, including Harvard, the University of Pennsylvania, Dartmouth, the University of Phoenix, The Washington Post, Logitech, GlobalLogic, Cox Enterprises, and American Airlines subsidiary Envoy Air.  This is not the first time the company has been impacted by Clop. In 2023, Estée Lauder was also compromised after the ransomware group exploited a separate zero-day vulnerability in the MOVEit Transfer platform, one of the company's internal software tools. 

Craneware plc has disclosed a Craneware data breach after detecting unauthorized access to a portion of its data environment. The company confirmed on 20 July 2026 that it is investigating the incident with the support of external cybersecurity and forensic experts.  Although the cyberattack on Craneware resulted in data being viewed and exfiltrated, the company said the incident has been contained and has not disrupted customer services or business operations. 

Craneware Cyberattack Contained, Investigation Underway 

According to the company's official notice, the Craneware cyberattack prompted the activation of its incident response plan immediately after the unauthorized access was identified. The Board appointed external cybersecurity and forensic specialists, who are working alongside Craneware's internal IT team and retained security providers to determine the full scope of the incident.  The company stated that investigators have found no remaining indicators of compromise within its systems. Despite the data breach at Craneware, normal operations have continued without interruption. 

Data Breach at Craneware Exposed Employee and Customer Records 

Initial findings indicate that attackers viewed and exfiltrated a significant volume of file names. Craneware's current assessment suggests that much of the affected information consists of non-sensitive or publicly available regulatory data. However, the investigation has also confirmed that a percentage of employee data, along with a subset of customer and partner records, was accessed and exfiltrated during the Craneware data breach.  The organization is continuing to examine the precise nature and extent of the compromised data. It is also working with advisers to identify affected individuals and organizations, prepare notifications where necessary, and meet all applicable regulatory obligations. Craneware added that it will provide further updates to the market as additional information becomes available.  As part of its response to the data breach at Craneware, the company has notified relevant regulators and law enforcement agencies. These include the UK's Information Commissioner's Office (ICO) and the US Federal Bureau of Investigation (FBI). 

Craneware to Notify Affected Parties as Assessment Continues 

In its official announcement, Craneware said: "The incident has been contained, and there has been no disruption to customer services or to the Company's operations. The external specialists have confirmed that there are no residual indicators of compromise arising from the cybersecurity incident in the Company's systems."  The company further stated: "Investigations so far have established that a significant volume of file names were viewed and exfiltrated. The current assessment is that a large element of the data involved is non-sensitive or already public regulatory data. A percentage of Craneware employee data as well as a subset of customer and partner records, have been accessed and exfiltrated."  The notice also stated: "This announcement contains inside information as stipulated under the UK version of the Market Abuse Regulation No 596/2014, which is part of English Law by virtue of the European (Withdrawal) Act 2018, as amended. On publication of this announcement via a Regulatory Information Service, this information is considered to be in the public domain."  While the investigation into the cyberattack on Craneware remains ongoing, the company said it will continue assessing the impact of the cyberattack and issue further updates as appropriate.