notable events -data breaches
India's telecom regulator finalised anti-spam rules that stop call-management apps such as Truecaller from blanket-blocking the 140 and 1600 number series, while adding AI-based flagging and charges for application-to-person calls. Compliance duties shift toward telecom operators.
ShinyHunters exploited an unauthenticated upload flaw in Grav CMS to deface Clop's Tor leak site, claiming full server access plus theft of source code, plugins, logs and the onion service private keys. The crew gave Clop 72 hours before threatened extortion.
Russian authorities reported multiple attacks against electronic voting systems and communication lines as voters went to the polls in a three-day parliamentary election. Officials said the attempts were repelled without altering results, offering no attribution or technical detail.
An event invitation sent by the National Cancer Centre Singapore placed recipients in a visible address field, revealing the identities of patients to one another. The disclosure prompted privacy complaints over the handling of health-related contact lists.
CrowdSec disclosed that an attacker used the account of a recently departed employee to copy about 170 of the French security company's private GitHub repositories in May, following the TanStack npm package compromise. Offboarding gaps kept the access alive.
Researchers found 13 npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer built to harvest Chrome extension storage. The targeting of extension data put wallet and session material from developer machines within the operator's reach.
The FBI, Defense Department and partners in Japan, Australia and Germany described WaterPlum, a North Korean crew that infected at least 30,000 devices across 100 countries between December 2025 and July 2026. Operators drained about 7,000 wallets via fake job interviews.
An investigation into the Navigate360 breach found roughly 94,000 unclassified but sensitive tips submitted through US military P3 Global Intel apps and portals left accessible. Reporters found no evidence that affected submitters had been notified.
A United Nations follow-up report found Vietnam, Laos, Pakistan and Argentina had taken meaningful steps against North Korean IT worker networks flagged in an earlier study. The assessment marked the first measurable state response to the sanctions-evasion scheme.
An official UK security assessment concluded that large volumes of sensitive police data stored on a Microsoft cloud platform sat at potential risk of compromise by hostile hackers and by US government access demands. The finding reopened data sovereignty questions for policing.
Pakistan-aligned Transparent Tribe, also tracked as APT36, targeted Indian government and defence entities with a new Rust backdoor that used private GitHub repositories as its command channel. Routing traffic through a trusted developer platform blunted network detection.
Huntress detailed Settra, a newly identified ransomware variant deployed in two separate intrusions against retail and manufacturing organisations. The analysis documented post-compromise tradecraft including credential harvesting, lateral movement and defence evasion carried out well before the encryption stage.
An insider removed 1,894 internal records from Raon, South Korea's heavy ion accelerator project built with a 1.5 trillion won state budget, and the exfiltration went unnoticed for four years. The lapse exposed weak monitoring around a flagship national research programme.
A shared zero-click remote code execution weakness let repository owners swap pinned plugin code across four major AI coding agents, giving an attacker the agent's full reach into developer environments. Two of the four affected products remained unpatched at disclosure.
California Governor Gavin Newsom signed an executive order directing an expert group to deliver a plan within two months for stronger state AI safety law, including independent third-party safety plans for frontier developers and a possible emergency model shutdown mechanism.
