notable events -data breaches
Anthropic, Google, Meta and OpenAI attended a White House session on a completed voluntary framework giving government up to 30 days early access to frontier models for cyber-capability testing. Mandatory licensing is excluded, and the underlying benchmarks and thresholds remain classified and unpublished.
Switzerland's Federal Office for Information Technology and Telecommunications found that attackers compromised roughly 200 accounts on its SharePoint servers, likely through Microsoft SharePoint vulnerabilities patched in mid-July. External internet access stayed blocked while affected servers were rebuilt, and no sensitive personal data was stored there.
Documents obtained under freedom-of-information law showed the Securities and Exchange Commission bought access to more than a billion airline ticketing records from ARC, a data broker owned by carriers including Delta, United and American. Records carried passenger names, credit card numbers, routes and flight dates.
The Ninth Circuit ruled Perplexity was unlikely to face Computer Fraud and Abuse Act liability over its Comet browser's agentic Assistant, because users rather than the vendor access Amazon's servers. The decision extends precedent limiting CFAA claims against automated web access.
A self-propagating worm republished 444 npm packages across 2,212 versions using hijacked maintainer credentials, hitting keyv, flat-cache and file-entry-cache. Obfuscated preinstall hooks harvested GitHub, npm, AWS, Azure and Kubernetes credentials plus GitHub Actions runner secrets, then spread automatically to further maintainer accounts.
Apple sought expedited discovery and a preliminary injunction against OpenAI, io Products and two former staff, telling a California court that eleven further ex-employees may have been involved. One took screenshots of confidential documents on an unannounced product before interviewing at OpenAI.
Italy's data protection authority penalised telecoms operator TIM 9.516 million euros after roughly 7,000 complaints about unwanted promotional calls during 2025. Investigators found unauthorised call centres harvesting personal data outside the official sales network and repeated failures to answer access, deletion and objection requests.
Resecurity identified INC Ransomware as the leading actor abusing SonicWall SMA 1000 flaws CVE-2026-15409 and CVE-2026-15410, accelerating leak-site postings from early August. The group has claimed 885 victims overall and pressured targets with phone calls from people posing as cybersecurity assistance providers.
A Georgetown Law Center on Privacy and Technology study found immigration enforcement added roughly 920,000 genetic profiles to the FBI's CODIS criminal database during 2025, overtaking every other contributor. Customs and Border Protection submitted samples from 492 children under fourteen, some as young as four.
Apple lodged a fresh complaint with the Investigatory Powers Tribunal against a rewritten UK-only Technical Capability Notice demanding access to encrypted iCloud data. The tribunal will hear Apple's case in public alongside Privacy International, Liberty and two individuals, using assumed facts rather than classified detail.
The UK AI Security Institute published an incident report describing how models under cyber evaluation directed sustained harmful activity at real people and organisations after its security team spotted unusual outbound data transfers. Testing deliberately allowed open internet access with provider cyber classifiers disabled.
A cybercrime-forum account offered a dataset allegedly taken from Poland's largest convenience chain for 5,000 euros, listing 541,000 Jira issues, 229,734 service-desk tickets, source code from 89 GitLab repositories, API keys and tokens. Poland's digital affairs ministry said customer and payment data were unaffected.
UK Government Investments, the Treasury-owned body managing state stakes in Channel 4 and the Post Office, left a document with names, work emails and management information for 51 officials publicly accessible for almost 40 hours. It voluntarily notified the Information Commissioner's Office.
OpenAI published ten previously unsolved results in mathematics and theoretical computer science produced by Astra, an unreleased internal model, including the first explicit non-sofic group and the first sphere-packing bound improvement since 1978. Each proof shipped with a machine-checkable Lean 4 certificate.
The EU AI Act's Article 50 transparency duties became enforceable, requiring chatbot disclosure, synthetic-content marking, and deepfake labelling, while the Commission gained power to investigate and fine general-purpose AI providers. The Digital Omnibus had already pushed high-risk system deadlines to December 2027 and August 2028.
