notable events -data breaches
Australia imposed financial sanctions and travel bans on Yu Pu Ung, Sim Hyon Sop, Korea Mangyongdae Computer Technology Company and Chinyong Information Technology Cooperation Company for running or financing fraudulent North Korean IT worker schemes that funnelled revenue to Pyongyang's nuclear and ballistic missile programmes.
Microsoft AI's MAI-DxO orchestrator, which simulates a panel of doctors ordering tests and debating diagnoses, scored 83.2 percent on simulated New England Journal of Medicine cases in a peer-reviewed Science paper, against 36.1 percent for generalist physicians using reference materials.
The Central Bank of Ireland fined Coinbase Ireland 3.25 million euros, after a 30 percent settlement discount, for breaching e-money safeguarding and outsourcing rules. Customer funds were commingled with other Coinbase entities' money for 19 months, and the firm relied on its US parent's infrastructure.
Iranian state-sponsored group Prince of Persia operated command-and-control infrastructure at a US hosting company, the first Iranian group found using US servers in at least 12 years. Its Foudre, Tonnerre and Tornado tools stole documents, screenshots and audio, using Telegram for covert control.
INTERPOL Operation Serengeti III, run from June to August across 21 countries, arrested 1,462 suspects, recovered over 105 million dollars and disrupted 10,909 malicious networks. Investigators identified 65,929 victims with losses above 385 million dollars, including Ugandan investment-fraud call centres and Angolan crypto mines.
China-linked APT41 deployed BlackX, a UEFI bootkit modelled on BlackLotus, against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026. It exploited Baton Drop to bypass Secure Boot on fully patched machines whose vulnerable certificate had never been manually revoked.
EU member states agreed a negotiating mandate on the Digital Omnibus that retained the GDPR definition of personal data, rejecting the Commission's narrower proposal. The text eased cookie consent for audience measurement and security, favoured national incident-reporting entry points and left trilogues pending Parliament's position.
Richmond Public Schools cut internet access across the Virginia district after detecting suspicious activity, disrupting email, Chromebooks and learning platforms. Staff laptops displayed an extortion message threatening to publish data it said was stolen on a leak site, and classes moved to technology-free instruction.
Unauthorized actors accessed Quest Diagnostics' Quanum Lab Services Manager, a platform clients use to order laboratory tests and view results, exposing certain patient records. Quest paused access to the affected system, notified federal law enforcement and disclosed the incident in an SEC filing.
China-based Bronze Sandcastle compromised organisations in the Philippines, Taiwan, Afghanistan and Namibia between August 2025 and August 2026. It sideloaded malicious DLLs beside legitimate Sandboxie executables to load encrypted configurations and run modified Meterpreter-style backdoors largely in memory.
Railway, a developer cloud platform with 4.8 million users, detected unauthorised access to systems storing customer environment variables, some possibly decrypted. It paused all deployments, urged users to rotate API keys and credentials, and linked the intrusion to attacks on AI inference providers.
Judge Francis Mathew imposed a 25 billion dollar civil penalty on Meta, reduced from a possible 220 billion, after a jury found 43.9 million Unfair Practices Act violations tied to Cambridge Analytica. The penalty accrues 15 percent annual interest, and Meta planned to appeal.
Microsoft tied the ConnectWise cloud backup compromise to China-aligned Storm-0940, which used the open-source ARTEX agentic AI pentest framework. Its agents abused hijacked ConnectWise app identities to attempt sign-ins to over 2,250 customer tenants, gaining privileged access in several cases.
Attackers abused the GitHub accounts of three LiteLLM engineers, likely via stolen OAuth tokens, to publish malicious version 1.107.0 to PyPI and Docker registries. The payload harvested cloud, AI-provider and SSH credentials at every Python startup. PyPI quarantined the release after about 100 minutes.
German B2B equipment retailer TAKKT took IT systems offline after a cyberattack hit its Industrial and Packaging division in Europe and Foodservices division in North America. Order processing, customer service and deliveries were significantly restricted, with no recovery timeline or damage estimate.
Your menu type is remembered on this browser. Sign in to choose menu sections.
Menu type