This weekly roundup covers the FBI's attribution of the $6 billion Binance hack to North Korea, a spreading wave of refrigeration attacks that has now reached France's blood supply, rapid exploitation of a freshly patched WordPress flaw, a Europol takedown of a fake trading platform supplier, and unauthorized trades in Stockal customer accounts.  Two threads run through this week's stories. First, attackers are increasingly coming in through someone else's door: a third-party refrigeration supplier, a scam platform provider, or data leaked by another company. Second, speed decides the outcome. Attackers moved on WordPress within two days of a patch, while fast alarms saved France's blood stocks from the fate of supermarket food. 

The Cyber Express Weekly Roundup 

FBI Blames North Korea for $6B Binance Hack 

The FBI has attributed the theft of more than $6 billion from Binance, which took place around October 29, to North Korean hackers it tracks as "TraderTraitor." The stolen funds are being converted mainly into Ethereum, and the agency has urged crypto firms to block transactions linked to the attackers. Read more… 

Hackers Heat Supermarket Freezers Across Europe 

Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia threw out spoiled food after hackers took control of refrigeration systems, in some cases setting them to 50°C. The attacks follow a similar campaign against around 400 stores in France last month that exploited outdated, internet-connected cooling equipment. Who is responsible remains unknown. Read more… 

Hackers Target WordPress Flaw Days After Patch 

Attackers began exploiting a critical WordPress flaw within 48 hours of its October 28 fix in version 7.1.4, with Wordfence blocking nearly 63,000 attempts in a single day. The bug affects versions 4.7 through 7.1.3 and can let hackers run code on a site during a core update. With no workaround available, site owners are urged to update immediately. Read more… 

Europol Busts Supplier of Fake Trading Platforms 

Authorities in seven countries seized more than 100 servers and arrested seven suspects on November 3 in an operation against a company accused of supplying fake trading platforms to scam call centres. Victims were lured with promises of quick profits, shown fake gains to draw in more money, and then blocked from withdrawing. Losses are estimated at over €4 million, with potential victims in more than 50 countries. Read more… 

Freezer Hackers Hit France's Blood Supply 

France's national blood service, EFS, said hackers raised temperatures in cold storage rooms at three sites by going through a third-party refrigeration supplier. Alarms caught the changes quickly, and no blood products were lost. It is the first healthcare organisation hit in a wave of refrigeration attacks now reported in at least 11 countries. No one has claimed responsibility. Read more… 

Stockal Confirms Unauthorized Trades in 13 Accounts 

Borderless, which runs US equities platform Stockal, said attackers logged into 26 customer accounts using valid credentials and, in 13 of them, sold large-cap stocks to buy obscure microcap shares. No funds were withdrawn. The company says its systems were not breached and suspects social engineering using data leaked in another firm's breach. Read more… 

Weekly Cybersecurity Takeaway

Several of this week's incidents show that an organization's security is only as strong as the partners and data around it. Supermarkets and France's blood service were reached through refrigeration suppliers; Stockal customers were likely targeted with data stolen elsewhere, and the Europol case exposed a business that built scam platforms for others to run.  Speed is the other lesson. Attackers turned the WordPress fix into a roadmap within 48 hours, while the EFS avoided losses because its monitoring flagged the problem right away.  Organizations should review the remote access their suppliers have to critical systems, retire or isolate unsupported internet-connected devices, and make sure alarms on physical equipment reach someone around the clock. They should also patch critical flaws without delay, strengthen account authentication, and, for crypto firms, block addresses linked to the Binance attackers. 

This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision to let search engines index messages from its public servers.  Two threads run through this week’s stories. First, attackers are getting more out of less: one compromised laptop put billions of dollars in crypto at risk, and AI tools let a small, self-taught crew scale its attacks to dozens of victims. Second, the fallout from a breach lasts far longer than the breach itself, as lawsuits, prison sentences, and bounties land years after the original attacks, while a simple default setting can create new exposure. 

The Cyber Express Weekly Roundup 

Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen 

Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more... 

South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies 

Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more... 

Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach 

Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more... 

Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses 

Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more... 

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns 

Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more... 

Weekly Cybersecurity Takeaway 

Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team.  The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward.  Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use. 

A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests. 

This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security. 

Here are the stories that shaped the week. 

The Cyber Express Weekly Roundup 

PHP2Shell Flaws Knock Wikipedia and Government Sites Offline 

Two critical vulnerabilities in PHP, the scripting language that powers a large share of the web, have triggered urgent patching warnings from agencies around the world. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have already been linked to outages at Wikipedia and a number of government websites. Read more… 

INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa 

An INTERPOL-coordinated crackdown spanning 21 countries has ended in 1,462 arrests. Operation Serengeti III ran from June to August 2026 and targeted fraud, ransomware, business email compromise and online scams. Investigators disrupted 10,909 malicious networks and recovered more than USD 105 million. The operation also identified nearly 66,000 victims, linked to combined losses of more than USD 385 million. Read more… 

ASD Essentials Replaces the Essential Eight 

The Australian Signals Directorate has launched ASD Essentials, a broader successor to the Essential Eight, the security baseline Australian organizations have long been measured against. Where the Essential Eight centered on a fixed set of mitigation strategies, the new framework extends its scope to enterprise IT, operational technology and cloud environments. Read more… 

Dubai Police Bust AED 10,000 Fake Driving License Scheme 

Dubai Police have arrested an eight-member gang that sold driving licenses for AED 10,000 each. Customers received licenses issued in a neighboring country without ever travelling there, taking a lesson or sitting a test. The gang then helped buyers convert those licenses into UAE licenses by exploiting legitimate license exchange agreements between the two countries. Read more… 

Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk 

Fintech firms vet their commercial vendors closely, but the open-source libraries, container images and third-party components inside their systems often arrive with far less scrutiny. That mismatch leaves a blind spot in how financial technology companies manage risk. Vijendra Katiyar of CleanStart points to examples such as a widely used Redis image that carried 185 known CVEs, and the Shai-Hulud worm, which spread through malicious npm packages. Read more… 

Conclusion 

Taken together, this week’s stories show how much of today’s risk comes from what organizations already trust: decade-old code, inherited software components, official exchange agreements and security checklists that measure effort rather than results. Follow The Cyber Express for next week’s weekly cybersecurity roundup and ongoing coverage of these stories. 

site-verification-ok

site-verification-ok

Singapore opened SICW 2026 with a blunt message: no government, company or country can see the full picture of today's cyber threats, and artificial intelligence is now raising the stakes for defenders and attackers alike. Speaking at the opening ceremony of the 11th Singapore International Cyber Week on 13 October 2026, Gwenda Fong, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency of Singapore (CSA), called for stronger international cooperation as threats grow more complex. Her address came a day after Josephine Teo, Minister for Digital Development and Information and Minister-in-charge of Cybersecurity and Smart Nation, warned that trust in digital systems is becoming harder to sustain. This year's theme is "Cyber at a Crossroads: Shaping the New Cyber Order.

SICW 2026 Opens With a Warning

Fong, attending her first SICW as CSA chief, said Singapore's success has been built on being open and connected. That leaves its economy and society dependent on digital infrastructure, platforms and supply chains that extend well beyond its shores. Governments, infrastructure operators, cloud providers and cybersecurity firms each see part of the threat landscape, she said, but none sees all of it. "What appears to be an isolated incident to one organisation may in fact be part of a much larger campaign," Fong said. Assembling the picture is only half the challenge, she added. It must be done quickly enough to act before the adversary does.

AI Cuts Both Ways at SICW 2026

Fong said Singapore cannot simply keep adding analysts as threats grow in volume and sophistication. Instead, it wants AI to help defenders "see more, understand faster and to act more effectively." But adversaries can harness AI too, operating at greater speed and scale. The real test of AI cybersecurity, she said, is making sure the technology strengthens defences rather than tilting the advantage towards attackers. She also flagged a newer risk. As agentic AI systems gain access to data, applications and tools, they create new dependencies and vulnerabilities. "For years, cybersecurity has required us to understand what is connected to what. In an increasingly agentic world, we must also understand what can act on what," Fong said, pointing to questions of permissions and consequences.

SICW 2026 Puts AI Risks Into Practice

Rather than only discussing what AI could mean for security, CSA is testing it in practice this year. CSA is partnering with Google on an agentic AI cyber scenario exercise for international partners. It is working with the Singapore AI Safety Hub on a frontier AI governance workshop for officials from ASEAN and the wider Asia-Pacific. With Cloudflare, it is running hands-on training in AI-enabled cyber defence for critical infrastructure operators. Fong pointed to the ASEAN CERT Incident Drill, held since 2006, as proof that practising together builds the habits that matter in a real crisis.

The Trust Deficit Behind SICW 2026

On 12 October, Teo described what she called a paradox. At precisely the time when more trust is needed, trust is becoming harder to sustain. AI systems can make mistakes, be manipulated or behave in unintended ways, she said, and their capabilities are advancing faster than our understanding of the risks. Teo cited UNC3886's campaign against Singapore's telecommunications sector as a recent example of sophisticated actors targeting critical infrastructure. Ransomware and cybercrime remain pervasive, while strategic competition is forcing harder choices on technologies, suppliers, standards and interoperability. "We are willing to interact more, but find ourselves willing to trust less," she said. Without trust, Teo warned, businesses will hesitate to digitalise, citizens will be wary of new technologies, and countries will be less willing to stay open and connected.

"Accountability Cannot Be Outsourced"

Teo said industry must be a partner in securing the digital ecosystem, since it builds and operates much of the infrastructure economies depend on. That means shared standards, threat intelligence sharing, incident reporting and testing new technologies before deployment. On increasingly autonomous AI, she said human judgement, oversight or control must be retained where necessary. "Ultimately, accountability cannot be outsourced. Least of all, to machines," she said. She outlined steps already under way. CSA released its Securing Agentic AI Addendum earlier this year to guide organisations on securing autonomous AI systems. The agency is also working with industry to prepare critical infrastructure for the transition to quantum-safe systems. In addition, leading operational technology manufacturers and technology providers have committed to attain Singapore's Cyber Trust Mark.

What Comes Next

Teo said Senior Minister K Shanmugam would launch the Singapore Cybersecurity Strategy 2026, the country's updated national strategy, the following day, with partnerships remaining central to it. That approach will also carry into 2027, when Singapore assumes the ASEAN Chairmanship. Teo said Singapore will work with the bloc's 11 member states to strengthen collective cyber resilience, deepen practical cooperation and capacity building, and work more closely with industry. Estonia's Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, also joined the week's proceedings for a fireside chat with Fong. Both leaders acknowledged that geopolitical competition is making cooperation harder. "Disagreement need not prevent dialogue, and competition need not preclude practical cooperation," Fong said. Teo put it simply: trust is not built through declarations, but through candid exchanges, competence and consistent action. Fong closed with a challenge to every delegate in the room: look beyond your own vantage point and find the people who can help you see the rest.

Morocco’s cybersecurity strategy is placing greater emphasis on proactive threat detection, critical infrastructure protection and artificial intelligence as the country strengthens its defenses against evolving cyber threats. Abdellatif Loudiyi, Minister Delegate to the Head of Government in charge of National Defense Administration, said securing information systems has become a necessity as digital transformation accelerates. Speaking at the opening of National Cybersecurity Week in Rabat on Monday, Loudiyi stressed that cybersecurity must be integrated into institutional governance rather than treated as an additional expense. He called for stronger preparedness, early threat detection and coordinated responses to cyber incidents. The event, organized by the General Directorate of Information Systems Security under the National Defense Administration, runs from October 12 to 14 under the theme “Cybersecurity in the service of digital transformation and development.”

Morocco Cybersecurity Strategy Emphasizes Proactive Defense

Loudiyi said cyberattacks have become a tangible reality affecting countries worldwide, including developed nations. Their consequences have raised awareness among public and private institutions about the importance of cybersecurity in managing risks and protecting operations. He argued that organizations can no longer rely on responding to incidents after they occur. Instead, they need an approach centered on preparedness, vigilance, early detection, and response. According to the minister, these responsibilities must begin at the highest levels of institutional decision-making and extend across organizations, with each component accountable for its role. He also emphasized that cybersecurity resilience requires continuous work. As attackers develop new methods, institutions must regularly review protection measures, assess system readiness, and adapt their defenses to emerging threats.

Five Pillars to Strengthen National Cybersecurity

The minister outlined five interconnected areas supporting Morocco’s efforts to establish a coordinated national cybersecurity framework. These include a clear legal and regulatory framework, the development of human, technical and financial capabilities, greater public awareness and a stronger cybersecurity culture, enhanced monitoring and response capabilities, and regional and international cooperation. Loudiyi stressed that these elements must function together to strengthen national resilience. He also highlighted the shared responsibilities of government authorities and organizations operating information systems. While the General Directorate of Information Systems Security exercises its legally defined powers, individual system owners must protect their systems and allocate the resources required to do so. The minister said this integration of responsibilities is essential to building a cohesive national cybersecurity system.

AI Threats and Critical Infrastructure Protection Take Priority

Looking ahead, Loudiyi identified four priorities for the next phase of Morocco’s cybersecurity efforts: training specialized cybersecurity professionals, supporting national cybersecurity companies, strengthening critical infrastructure protection, and addressing the challenges associated with artificial intelligence. He described artificial intelligence in cybersecurity as a dual-use capability that can benefit both attackers and defenders. While attackers can use AI to support malicious activities, defenders can apply the technology to detect threats earlier and accelerate incident response. The emphasis on specialized training also reflects the need to develop the expertise required to address increasingly complex cybersecurity challenges. Supporting national companies is another priority identified by the minister as part of the broader effort to strengthen the country's capabilities. Loudiyi said these priorities should help Morocco prepare not only for existing threats but also for risks that may emerge as technologies and attack methods evolve.

Morocco Calls for Stronger International Cybersecurity Cooperation

Loudiyi also highlighted the role of cybersecurity cooperation in strengthening national defenses. He said Morocco remains committed to initiatives and mechanisms that promote collaboration between countries, with particular attention to its African and Arab partners. He presented cybersecurity as a shared responsibility requiring coordination, investment in skills and a sustained culture of awareness and vigilance. The minister concluded that a secure digital environment depends on collective efforts to protect information systems and maintain trust as digital transformation advances. National Cybersecurity Week provides a platform for these discussions through roundtables and workshops involving decision-makers, cybersecurity experts and industry professionals. The October 12 to 14 program is intended to encourage dialogue and the exchange of views on key cybersecurity challenges and approaches to addressing them.

This weekly roundup covers a customer data breach at Spain's national rail operator, an Australian government warning about attackers hijacking corporate AI services, a patient data theft from a Polish medical software platform, phishing campaigns that turn legitimate remote management tools against their victims, and a gathering of Europe's police leaders focused on how AI is reshaping crime.  Two threads run through this week's stories. Artificial intelligence is now both a target and a tool for attackers: stolen API keys are draining company budgets, and AI is reportedly being used in intrusions. Meanwhile, attackers keep exploiting trusted software, from a medical records platform to legitimate IT administration tools, to stay hidden for days or weeks. 

The Cyber Express Weekly Roundup 

Renfe Confirms Data Breach Through Compromised Adif Servers 

Spanish rail operator Renfe confirmed on September 25 that hackers had accessed customer names and email addresses. The intrusion came through compromised servers belonging to Adif, the state-owned manager of Spain's rail infrastructure. Renfe said no financial data was exposed and train services were not disrupted. Read more… 

Australia Warns of Stolen AI Keys as Hijacked Access Costs Firms Up to $600,000 

The Australian Signals Directorate (ASD) has warned that attackers are taking over organizations' AI services. They get in through exposed API keys, stolen sessions, and compromised suppliers. Once inside, they burn through paid credits and generate harmful content. Where AI agents are deployed, they also use that access to reach connected systems and data. Read more… 

Polish Patient Data Stolen in Cyberattack on Medyc Medical Software 

Attackers exploited an SQL injection vulnerability in Medyc, a medical records platform developed by Polish vendor Qbusoft, on August 22–23. They stole patient names, PESEL national identification numbers, addresses, phone numbers, and email addresses going back to July 2024. The breach went unnoticed until September 8–9, more than two weeks later. Read more… 

Phishing Campaigns Abuse MSP360 Remote Management Tool to Install ScreenConnect 

Microsoft has tracked phishing campaigns that tricked victims across several industries into installing MSP360, a legitimate remote management tool. The installers were disguised as Zoom downloads, Adobe updates, invitations, and delivery notices. After gaining a foothold, the attackers installed ConnectWise ScreenConnect as a backup access channel. Read more… 

Europe's Police Chiefs Warn AI Is Making Crime Faster and Larger in Scale 

More than 500 police leaders from 59 countries gathered at Europol's headquarters from September 28 to 30 to discuss how AI is changing crime. Europol warned that criminals are using generative AI, deepfakes, and autonomous agents to expand fraud, cybercrime, migrant smuggling, and child exploitation. It also pointed to AI's potential to speed up police investigations. Read more… 

Weekly Cybersecurity Takeaway 

Artificial intelligence features in several of this week's stories, in different roles. In Australia, AI services are the target: attackers hijack them to steal paid credits and to reach connected systems through AI agents. At Europol's gathering, police leaders described AI as a force multiplier that lets criminal groups run fraud and exploitation at greater speed and scale. In the Renfe case, AI was reportedly used in the attack, though that remains unconfirmed.  The other common thread is how attackers abuse what organizations already trust. In Poland, an injection flaw in widely used medical software exposed sensitive patient identifiers and went undetected for more than two weeks. Microsoft's findings show attackers installing two legitimate remote management tools so their activity looks like ordinary IT work.   The Renfe breach, which reached customers through a partner organization's servers, is a reminder that an organization's exposure extends to its suppliers and infrastructure partners.  Together, these developments call for practical steps. Organizations should treat AI credentials as carefully as any other privileged secret. They should watch for unexpected remote access software even when it is legitimate, and they should hold the vendors who handle their data to the same security standards they apply internally. 

The Queensland government department in charge of the state's cybersecurity efforts has disclosed a loss of roughly $800,000 from a cyberattack during the last financial year. Details of the CDSB cyberattack, which involved a third-party messaging service being "misused" for financial gain, appear in the QLD cybersecurity department's latest annual report, released on Friday.  The Customer Services, Open Data, and Small and Family Business department (CDSB) directs the Queensland government's cybersecurity strategy, governance, policy and investment. According to its annual report, the department lost $809,000 during the 2025-26 financial year as "a result of an external cyberattack for financial gain." 

How the CDSB Cyberattack Unfolded?

The report said the breach did not reach sensitive records. No government data or sensitive information was compromised during the incident," it stated. "The department blocked the attack and engaged a third party to mitigate any further exposure."  A CDSB spokesperson told Information Age that the attackers had not been paid.  "In July 2025, a third-party messaging service used by the Queensland government was misused to generate an inflated number of unauthorised SMS messages for financial gain," the spokesperson said in a statement.  "... Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."  The spokesperson added that the Queensland government "is committed to protecting the security and resilience of its systems and services." 

Audit Found the QLD Cybersecurity Department 'Needs to Do More' 

The incident follows a Queensland Audit Office report, released in March, which found that CDSB "needs to do more" to help the state's public sector manage third-party cybersecurity risks.  Auditors found the QLD cybersecurity department was "not actively assessing and monitoring third-party cyber capability across the public sector," although improvements were in progress.  "The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks," the audit said. It noted that the Australian Signals Directorate (ASD), the federal cybersecurity agency, "has been raising these risks since 2021."  During testing, auditors gained the "highest level of access" to two Queensland government entities. They did not name either entity, to "avoid publicly identifying any security vulnerabilities."  CDSB addressed the audit in its annual report. "In our cybersecurity leadership role, we agreed to all relevant recommendations and progressed actions during the reporting period, including initiatives to strengthen whole‑of‑government cybersecurity capability," it said.  The report described cybersecurity as something that "remains a daily discipline" for CDSB and the wider Queensland government.  "Investing in, and securing Queensland's digital assets remains important, as cyber threats become more complex, and national incident data shows that malicious actors continue to target all sectors of the economy," it added. 

Queensland Tops Cybercrime Reports 

The CDSB cyberattack comes against a broader backdrop of cybercrime in the state. ASD's latest Annual Cyber Threat Report found that Queensland reported the highest share of Australia's cybercrime incidents in the 2024-25 financial year.  Queensland accounted for 28 per cent of national cybercrime reports. Victoria followed with 26 per cent and New South Wales with 22 per cent. ASD found these figures were "disproportionately higher" than the three states' respective populations when compared with other jurisdictions.  Average losses were highest elsewhere. "The Australian Capital Territory reported the highest average self-reported financial losses – around $37,700 per cybercrime report – followed by those in New South Wales, with around $33,000," the report said. 

This weekly roundup covers a brazen breach claim against the FBI's recruitment portal, a multinational advisory exposing North Korea's fake-recruiter malware operation, a sweeping EU proposal to reshape children's access to social media, a conversation on application security in the age of AI agents, a short-lived Discord ban in the Philippines, and a multimillion-dollar hot-wallet heist at a crypto casino.  From federal law enforcement to individual job seekers, this week's developments show that no target is too prominent or too small. Cybercriminals are openly taunting the agencies that pursue them, state-backed actors are turning the hiring process into an attack vector, and governments are testing how far they can push platforms on child safety, sometimes reversing course within hours. 

The Cyber Express Weekly Roundup 

Shiny Hunters Claims FBI Breach, Says FBIjobs Agent Data Exposed 

The FBI is investigating an apparent breach after the cybercriminal group Shiny Hunters claimed to have stolen personal data belonging to thousands of federal agents, with the probe centering on the bureau's FBIjobs recruitment website. Read more... 

WaterPlum Hackers Steal $10.7M in Crypto From IT Workers 

A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries while stealing cryptocurrency from IT professionals worldwide. Read more... 

EU KIDS Act Sets New Social Media Rules for Children 

The European Commission adopted the proposal on September 18, setting out rules that would prevent children under 13 from accessing social media and establish 15 as the minimum age for minors to open accounts independently. Users aged 13 to under 15 could instead access parent-managed mini accounts with limits on social contacts and up to 60 minutes of screen time per day, while platforms would bear the responsibility of proving their services are safe for children. Read more… 

Harness' Rahul Sood: AppSec in the Agentic Era Is About More Than Code. It's About Authority 

In this conversation, The Cyber Express spoke with Rahul Sood, the General Manager for Application Security at Harness, who leads the company's AppSec portfolio and focuses on building security for the AI era, integrated directly into modern DevOps workflows. The conversation centers on a shift in how security teams must think about AI agents: the risk no longer lies only in the code being shipped, but in what authority autonomous agents are granted once they operate inside production systems. Read more… 

Ban on Discord Lifted After Platform Commits to Work With DICT and CICC 

The Philippine government has lifted its ban on Discord after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC), with the restriction removed on Thursday, Sept. 24. Read more... 

Duelbits Hit by $7 Million Hack as Crypto Stolen Across Four Blockchains 

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets, with the stolen assets moved across four blockchains and mostly converted into Ether. The company says funds held in user accounts have not been affected, but it has not explained how the attackers got in or when the site will return. Read more... 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk, from a criminal group openly retaliating against the FBI over a public advisory, to a state-backed operation weaponizing job interviews against developers, to a crypto platform losing millions from the very hot wallets that keep it running.  Meanwhile, the policy response is moving on multiple fronts: the EU is flipping the burden of proof onto platforms to demonstrate child safety by design, and the Philippines has shown how quickly a government can block, and then restore, a major platform in exchange for enforcement commitments. At the same time, security leaders are warning that AI agents are introducing an entirely new question of who, or what, holds authority inside enterprise systems.  Taken together, the stories point to an increasingly confrontational threat landscape, where attackers are bolder, trust-based processes like hiring are being exploited at scale, and institutions are experimenting with more aggressive levers to hold platforms and adversaries accountable. 

Artificial intelligence systems are becoming more capable and autonomous, raising new questions about how they can be monitored, controlled and secured. Speaking before the United Nations Security Council, OpenAI CEO Sam Altman warned that the rapid pace of AI development could create significant AI security risks, particularly if systems advance faster than institutions can respond. Altman highlighted concerns ranging from human control and autonomous AI to emerging vulnerabilities, concentrated technological power and the need for international incident reporting. He also called for stronger cooperation between governments, critical infrastructure operators and technical experts to address emerging AI threats.

Here are six key AI security risks highlighted in his remarks.

1. Losing Human Control Over Advanced AI

One of Altman’s central concerns was the possibility that humans could lose control over increasingly capable AI systems. He warned that AI could move so quickly that people may no longer be able to understand what systems are doing or intervene when necessary. He argued that developers should not train systems unless they can make a strong case that those systems can remain under human control. The concern becomes more significant as AI systems become capable of handling increasingly complex tasks and making decisions with less direct human involvement.

2. AI Systems Becoming More Autonomous

The growing autonomy of AI systems presents another challenge for AI cybersecurity. Altman pointed to the possibility of AI systems improving themselves and future versions of themselves, describing this as recursive self-improvement. As the process of developing AI becomes more automated, the pace of progress could accelerate. For security teams and policymakers, increasingly autonomous systems could make monitoring, testing and intervention more difficult.

3. Emerging Vulnerabilities and New Threats

More capable AI systems could also introduce vulnerabilities and threats that organizations and governments may not yet fully understand. Altman called for secure channels between governments, critical infrastructure operators and technical experts to share information about emerging vulnerabilities and threats. The remarks place information sharing at the center of preparing for AI vulnerabilities, particularly as AI becomes increasingly integrated into important systems and infrastructure.

4. AI Power Concentrating in Too Few Hands

Altman also warned about the concentration of advanced AI capabilities among a small number of companies, individuals or countries. He argued that no single company or country should be able to use the most powerful AI systems to impose its worldview on others. From a security perspective, concentrated control over highly capable AI could create systemic risks if a limited number of actors have disproportionate access to powerful technology.

5. The Need for Global AI Incident Reporting and Threat Sharing

Altman called for accurate and speedy AI incident reporting, including classification and reporting protocols that would allow countries to learn from failures before they become larger problems. He also called for common standards covering AI capabilities, risk assessments, safeguards and human oversight. Such standards, he said, could help countries compare evidence and establish a shared understanding of what effective safeguards and oversight should look like.

6. AI Development Could Outpace Existing Safety Measures

The speed of AI development itself could become a security challenge. Altman warned that rapid progress could move faster than institutions are prepared to handle. He argued that competition between companies should not become a reason to accept excessive technological risk. He also stressed the importance of alignment, monitoring and safety guarantees as AI systems become more capable. For AI safety, this means ensuring that security measures and oversight develop alongside increasingly powerful systems rather than being added only after problems emerge.

AI Security Moves Into a Global Conversation

Altman’s remarks put AI security risks alongside broader questions about international cooperation, human oversight and technological governance. His proposed approach includes global standards for measuring AI capabilities and risks, incident reporting mechanisms, and secure communication between governments, critical infrastructure operators and technical experts. As AI systems become more autonomous and capable, the challenge will not only be what these systems can do, but whether organizations and governments can monitor, understand and respond to the risks they create.

The European Union’s ability to detect and respond to EU cybersecurity incidents faces significant gaps, particularly in information-sharing and coordination between national and EU-level bodies, according to a new report by the European Court of Auditors (ECA). The auditors said the EU has made progress in developing a cybersecurity cooperation framework, but several measures needed to support an effective response to significant and large-scale incidents are still incomplete. Cybersecurity incidents can disrupt public services, businesses, critical infrastructure and the EU’s internal market. While member states remain primarily responsible for responding to such incidents, the EU has a role when attacks cause major disruption, significant financial losses or substantial harm, or when incidents affect several countries and exceed the response capacity of a single member state.

EU Cybersecurity Incidents Face Information-Sharing Gaps

The ECA identified insufficient information exchange as a major weakness in the EU’s cybersecurity response system. The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises. However, the cooperation between two key EU cyber networks has not yet been formally defined. The auditors said this affects cooperation between the CSIRTs network, which brings together national teams responsible for handling cyber incidents, and EU-CyCLONe, which supports cooperation during EU-level cyber crises. Information-sharing is also affected by differences in national security laws and the ongoing implementation of updated EU cybersecurity rules, including the NIS 2 Directive. According to the auditors, these factors can make it harder for EU networks to identify threats early and coordinate an effective response. “The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” said George-Marius Hyzler, the ECA Member responsible for the audit. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”

European Cybersecurity Alert System Still Delayed

The audit also found that the European Cybersecurity Alert System was not operational at the time of the assessment. Two hubs examined by the auditors, ATHENA and ENSOC, had not started operating because of procurement delays. The system also lacked several elements needed for operation, including cooperation agreements, a common classification system and technical standards. The findings come as the EU continues to invest in cybersecurity. Under the 2021-2027 EU budget, €1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU’s main source of cybersecurity funding.

Overlap Among EU Cybersecurity Bodies

The ECA also identified overlapping responsibilities among some EU bodies involved in monitoring cybersecurity threats. The European Commission’s cyber situation centre, established in 2022 and largely supported by external providers, carries out work that the auditors said partly duplicates existing capabilities at the European Union Agency for Cybersecurity (ENISA). These capabilities include monitoring threats and developing cybersecurity situational awareness. The auditors called for better coordination to reduce duplication and strengthen the overall effectiveness of the EU’s cybersecurity framework.

Funding Checks Raise Security Concerns

The report also highlighted weaknesses in checks on some organisations receiving EU cybersecurity funding. These checks are intended to reduce risks linked to intrusion or influence by non-EU states and prevent sensitive security information from being shared with non-EU authorities. However, while grant beneficiaries are responsible for assessing the ownership and control of third parties receiving financial support, the European Cybersecurity Competence Centre does not verify those assessments. The ECA warned that this could expose sensitive infrastructure, operational data and security-critical technologies to security risks. The audit covered the period from 2022 to 2025 and assessed whether EU actions effectively supported the detection of and response to significant and large-scale cybersecurity incidents. Audit missions were conducted in Ireland, Greece and Italy.

This weekly roundup covers a bounty offer targeting an alleged Iranian cyber official, a massive data-exposure incident affecting airline travelers, a breach of an education platform used by students, a flaw exposing ChatGPT users' Gmail data, and a new EU compliance deadline for connected-product manufacturers.  From nation-state attribution efforts to AI-model exploitation and airline record exposure, this week's developments show how identity data, cloud misconfigurations, and AI infrastructure all remain prime attack surfaces — while regulators tighten disclosure timelines. 

The Cyber Express Weekly Roundup 

US Offers $10 Million for Alleged Iranian Cyber Chief 

The State Department is offering $10 million for information on Amir Yaryab, accused of directing the IRGC-CEC's Cyber Operations Command and overseeing groups including CyberAv3ngers, which has previously claimed attacks on industrial control systems and critical infrastructure in the US, Israel, and elsewhere, including exploitation of default credentials on Unitronics PLCs. Read more… 

Mathspace Breach Exposes Data on Over 1 Million Users 

A vulnerability in a self-hosted Metabase reporting tool let attackers gain administrator access without logging in, exposing names, emails, and account metadata for more than 1 million students, parents, and teachers in Australia and New Zealand. Passwords and authentication tokens were not affected, and Mathspace has notified regulators in both countries. Read more… 

220 Million Airline Passenger and Crew Records Exposed 

A misconfigured, inconsistently secured Elasticsearch cluster left roughly 220.8 million passenger and crew records — including passport numbers and full itineraries spanning nine years — reachable over the internet before researchers helped get it secured in June. The server's origin remains unconfirmed, though it was linked to Vietnamese IP space. Read more… 

ChatGPT Sandbox Flaw Let Attackers Read Victims' Gmail 

Check Point Research found that a shared internal package-caching system let separate ChatGPT sessions pass messages to each other, allowing a planted prompt to instruct a victim's session to fetch Gmail data and hand it to an attacker's account — without any visible confirmation step. OpenAI has since decommissioned the affected instance. Read more… 

EU's 24-Hour Vulnerability Reporting Rules Take Effect 

Manufacturers of connected products sold in the EU must now report actively exploited vulnerabilities within 24 hours under the Cyber Resilience Act, more than a year ahead of the law's full 2027 rollout. Non-compliance can draw fines up to €15 million or 2.5% of global revenue. Read more… 

AI Just Broke Crypto: What's Next for Defenders and Attackers Alike

https://www.youtube.com/watch?v=BXtwaaxnq_0

Weekly Cybersecurity Takeaway 

This week's developments show attackers and regulators converging on the same weak points: identity data sitting in exposed or under-secured systems, and AI platforms whose infrastructure — not their models — created the exploitable gap. The Mathspace and airline incidents both trace back to unpatched or misconfigured backend systems rather than sophisticated intrusion techniques, while the ChatGPT flaw shows that shared infrastructure underlying AI services can become a cross-account attack surface even when the model itself behaves correctly.  Meanwhile, the Yaryab bounty and the EU's new reporting clock reflect a parallel push on the policy side — attribution efforts aimed at raising the cost of state-linked attacks, and regulation aimed at compressing how long vulnerabilities can sit unreported. Organizations should treat backend admin tools and internal caching layers with the same scrutiny as customer-facing systems, and multinational manufacturers should confirm their incident-response playbooks account for the new EU timelines now in effect. 

💾

This weekly roundup highlights a range of cybersecurity developments affecting artificial intelligence platforms, enterprise software, healthcare organizations, social media accounts, and internet-facing infrastructure.  From stolen Claude sessions and bypassed PaperCut security fixes to an attempted attack targeting hundreds of thousands of X users, recent incidents demonstrate how attackers continue to exploit both software vulnerabilities and active user sessions.  The latest developments also show that organizations face growing risks across AI services, on-premises systems, enterprise edge devices, and account recovery infrastructure. Security teams are being urged to respond quickly as attackers increasingly target exposed systems and authentication mechanisms. 

The Cyber Express Weekly Roundup 

Anthropic Warns of Claude Session Hijacking 

Anthropic has warned that common infostealer malware is being used to steal active Claude sessions, potentially allowing attackers to bypass passwords and two-factor authentication. The campaign involves malware such as Vidar, LummaC2, RedLine, and Atomic Stealer, which is often distributed through pirated software and illicit downloads. Attackers may also consume victims’ paid AI usage. Read more… 

PaperCut Releases Second Emergency Patch After First Fix Is Bypassed 

PaperCut has released a second emergency patch for two actively exploited vulnerabilities affecting its NG and MF print management servers. Researchers discovered ways to bypass the initial security fix, potentially allowing attackers to chain the flaws and achieve pre-authentication remote code execution on exposed systems. Read more… 

Boston Scientific Cyberattack Limited to Certain On-Premises Systems 

Boston Scientific says its ongoing cybersecurity incident is limited to certain on-premises systems, with no impact identified on its cloud-based applications. The company has also reported no confirmed data breach or evidence of unauthorized activity since August 25, as its investigation into the incident continues. Read more… 

DOJ Investigates Attempted Cyberattack on Hundreds of Thousands of X Users 

The U.S. Department of Justice is investigating a large-scale cyberattack targeting hundreds of thousands of X accounts through the platform’s password-recovery system. Attorney General Todd Blanche said X detected and disrupted the campaign before the targeted accounts could be captured, preventing the attempted account takeover operation from succeeding. Read more… 

Two Citrix NetScaler Flaws Put Enterprise Edge Devices at Risk 

Two vulnerabilities in Citrix NetScaler ADC and Gateway have prompted an urgent patching warning from Australia’s cybersecurity agency. CVE-2026-19489, a memory overflow flaw, and CVE-2026-19490, an authentication bypass, can affect systems with specific configurations involving SIP ALG, SAML, or VPN gateway functionality. Read more… 

Weekly Cybersecurity Takeaway 

This week’s developments demonstrate that cybersecurity threats are increasingly targeting authentication systems, active user sessions, exposed enterprise infrastructure, and critical business applications. AI platforms, print management servers, healthcare environments, social media accounts, and network edge devices all remain potential targets for attackers.  Organizations should prioritize rapid security patching, protection of active sessions, strong authentication controls, careful monitoring of exposed infrastructure, and timely investigation of suspicious activity. Security teams should also review systems that rely on password-recovery mechanisms and identify enterprise devices operating with vulnerable configurations.  As businesses continue to rely on cloud services, AI platforms, remote access technologies, and internet-facing enterprise systems, attackers are finding new opportunities to exploit trusted sessions and security weaknesses. Organizations must maintain continuous monitoring and rapid response capabilities to reduce the impact of increasingly targeted cyberattacks. 

This weekly roundup highlights a broad range of cybersecurity and technology developments affecting cloud identity infrastructure, social media platforms, businesses, digital assets, and international law enforcement.   From a critical Microsoft Entra ID vulnerability exploited before remediation to a global crackdown on West African cybercrime networks, recent developments demonstrate how attackers continue to target both technical systems and human trust.  The latest developments also show that cybersecurity risks are expanding alongside the rapid adoption of cloud services and artificial intelligence. Organizations are facing threats involving identity infrastructure, autonomous AI agents, software vulnerabilities, digital transactions, online fraud, and the misuse of emerging technologies. 

The Cyber Express Weekly Roundup 

Microsoft Confirms Exploited Entra ID Flaw 

Microsoft confirmed that a critical vulnerability in Entra ID, CVE-2026-69836, was exploited before the flaw was fixed server-side. The vulnerability carries a CVSS score of 10.0 and could allow unauthenticated attackers to achieve remote code execution, potentially affecting Microsoft’s cloud-based identity infrastructure. Read more... 

New Zealand Proposes Social Media Ban for Under-16s 

New Zealand has introduced legislation that would require high-risk social media platforms to prevent users under the age of 16 from accessing their services. Proposed age-verification methods could include digital identification, facial age estimation, or official identification documents. Read more... 

Cyble and DRONA Launch AI Cyber Defense Initiative in India 

Cyble and DRONA Cyber Solutions have launched an AI-powered cybersecurity initiative in Ahmedabad aimed at helping mid-sized businesses detect, investigate, and contain cyber threats. The initiative combines threat intelligence, AI-driven investigations, and endpoint enforcement to provide organizations with faster and more coordinated responses to security incidents. Read more... 

AI Agents Could Create New Cybersecurity Risks 

Adarsh Kant Sinha, CEO of ANVE.AI, warned that autonomous AI agents could introduce significant new cybersecurity risks as organizations increasingly allow them to interact with business-critical systems. AI agents may gain access to email, customer relationship management platforms, cloud infrastructure, and financial systems, potentially creating new avenues for misuse or compromise. Read more... 

Ledger Fixes Ethereum App Flaw Amid Disclosure Dispute 

Ledger said it fixed a clear-signing vulnerability in its Ethereum application approximately two weeks before security firm TestMachine publicly disclosed the issue. The vulnerability could potentially allow a malicious application to display one transaction to a user while preparing a different transaction for signing. Read more... 

Global Crackdown Nets 58 Arrests in West African Crime Networks 

An eight-month international law enforcement operation led by INTERPOL has resulted in 58 arrests and the identification of 263 suspects across 22 countries. Operation Jackal IV targeted West African criminal networks involved in cyber-enabled fraud, money laundering, romance scams, and investment scams. Read more... 

Weekly Cybersecurity Takeaway 

This week’s developments demonstrate that cybersecurity threats are crossing organizational, technological, and geographical boundaries, affecting cloud identity systems, artificial intelligence, digital platforms, cryptocurrency applications, and international financial crime.  Organizations should prioritize strong identity and access controls, rapid vulnerability remediation, careful management of AI-agent permissions, secure integrations, human oversight, and continuous threat monitoring.   As autonomous technologies become more deeply integrated into business operations and cybercriminal networks continue to operate across borders, security teams must adapt to a threat landscape that is becoming broader, more interconnected, and increasingly difficult to contain. 

This weekly roundup highlights a broad range of cybersecurity threats affecting government agencies, businesses, enterprise AI systems, and software platforms. From a major French tax authority breach to a critical GitLab vulnerability, recent incidents demonstrate how attackers continue to exploit sensitive data, digital systems, and emerging technologies. The latest developments also show that cybersecurity risks are expanding beyond traditional attacks. Organizations are increasingly facing threats involving sensitive customer information, AI-powered systems, supply-chain risks, software vulnerabilities, and potential interference with critical operations.

The Cyber Express Weekly Roundup

French Tax Authority Data Breach Hits 678,000 People 

France’s tax authority, DGFiP, confirmed a cyberattack that exposed tax and cadastral information belonging to 678,000 individuals and professionals. The accessed information includes tax income, withholding rates, business details, addresses, and property information. DGFiP said online accounts and passwords were not compromised and is continuing to investigate the incident. Read more... 

Cyberattack Targets Ukraine Agency Ahead of Major Asset Tender 

Ukraine’s Asset Recovery and Management Agency (ARMA) suffered a suspected cyberattack shortly before a major deadline to select a manager for assets linked to sanctioned Russian oligarch Mikhail Fridman. ARMA said the incident, combined with earlier cyber activity and increased information pressure, could indicate a coordinated attempt to disrupt its operations or influence the tender. Read more... 

Oz Hair and Beauty Data Breach Exposes Customer Information 

Oz Hair and Beauty confirmed that an unauthorized party accessed customer information, including names, email addresses, phone numbers, and purchase history. The company said credit card, banking, and home-address information were not compromised. The number of affected customers remains undisclosed, while an investigation into the breach continues. Read more... 

Enterprise AI Is Expanding the Cybersecurity Risk 

Guild Group’s Mohammad Arif warned that the rapid adoption of enterprise AI is creating new cybersecurity challenges as AI systems gain access to sensitive data, applications, and business workflows. Key concerns include shadow AI, data leakage, insecure integrations, AI supply-chain attacks, prompt injection, and AI-powered phishing. Read more... 

Critical GitLab Flaw Could Let Attackers Delete Public Projects 

GitLab patched a critical vulnerability, CVE-2026-19478, that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The flaw carries a CVSS score of 9.4. GitLab also addressed a high-severity GraphQL CSRF vulnerability, CVE-2026-19650. Read more... 

Weekly Cybersecurity Takeaway 

This week’s incidents demonstrate that cybersecurity threats are increasingly crossing organizational and technological boundaries, affecting government systems, customer data, enterprise AI, and software development platforms. Organizations should prioritize strong access controls, rapid vulnerability patching, data protection, AI governance, employee awareness, and continuous monitoring. As attackers continue exploiting both human trust and technical weaknesses, security teams must adapt to a threat landscape that is becoming broader, faster, and increasingly interconnected.

This weekly roundup highlights the expanding range of threats facing businesses, technology platforms, and individuals. From social engineering attacks against corporate systems and vulnerabilities uncovered by AI agents to large-scale software patches and cyberattacks disrupting logistics operations, recent incidents demonstrate how quickly the threat landscape is evolving.  The latest developments also show that cybersecurity risks are no longer limited to traditional malware or ransomware. Attackers are increasingly exploiting human behavior, software weaknesses, interconnected supply chains, and personal online accounts. At the same time, artificial intelligence is emerging as both a defensive tool and a new way to identify security weaknesses. 

The Cyber Express Weekly Roundup 

Levi Strauss Targeted in Cyberattack, Corporate Files Accessed 

Levi Strauss & Co. disclosed a cybersecurity incident after attackers used social engineering techniques to gain access to three company-issued computers. The company believes certain corporate files were accessed and some information may have been exfiltrated. Levi Strauss said it moved quickly to contain the incident and terminate the unauthorized access, limiting the potential impact of the attack. Read more...

AI Agent Exploits Gym Booking Vulnerability 

An AI-powered agent reportedly identified an authentication weakness in an Australian gym’s online booking system. The agent, powered by Anthropic’s Claude and operated through OpenClaw, was originally instructed to help a user book a popular class. During the process, it was able to reserve classes months ahead and cancel another customer's booking. Read more...

AI Will Automate Cybersecurity Toil, Not Replace Security Professionals 

Harsha Reddy, Head of Information Security at Veterinary Emergency Group, argues that artificial intelligence is more likely to transform cybersecurity work than eliminate cybersecurity jobs. AI can assist with repetitive activities such as reviewing logs, triaging alerts, and collecting evidence, allowing security professionals to concentrate on investigation, strategy, and higher-value defensive operations. Read more...

Microsoft Fixes More Than 400 Security Flaws 

Microsoft’s August 2026 Patch Tuesday addresses roughly 400 vulnerabilities across its products, including three zero-days. One of the vulnerabilities was reportedly being actively exploited, while two others had been publicly disclosed before patches became available. The update includes 42 critical vulnerabilities, with 37 associated with remote code execution, reinforcing the importance of timely patching across enterprise environments. Read more...

CEVA Logistics Cyberattack Disrupts European Operations 

A cyberattack against CEVA Logistics disrupted activity at eight European warehouses on July 29, affecting shipments and exposing customer data connected to several major clients. The logistics company, part of the CMA CGM Group, has not publicly identified the attackers or provided detailed information about the technical nature of the incident. Read more...

FBI Warns of Theft of Explicit Content From Social Media 

The FBI has warned that cybercriminals are targeting social media and personal accounts to steal explicit images and videos, including non-consensual intimate images. Stolen material may subsequently be distributed or sold online, while associated personal information can expose victims to harassment, stalking, and sextortion. Read more...

Weekly Cybersecurity Takeaway 

This week’s incidents demonstrate that cybersecurity risks are expanding across corporate networks, software ecosystems, supply chains, AI-powered systems, and personal accounts.  Organizations should prioritize strong authentication, rapid vulnerability patching, employee awareness, third-party risk management, and continuous monitoring. At the same time, responsible use of AI could help security teams reduce repetitive workloads and respond more effectively to emerging threats.  As attackers continue finding new ways to exploit technology and human trust, organizations and individuals must strengthen security controls while remaining prepared for threats that increasingly cross traditional digital boundaries. 

💾

This weekly roundup highlights the growing cybersecurity risks affecting businesses, government agencies, and critical service providers. From the continued dominance of ransomware operations to government database breaches and third-party supply chain incidents, recent events demonstrate how attackers are increasingly targeting trusted systems and external service providers to maximize disruption and data exposure.  The latest developments reinforce that cyber threats are no longer limited to direct attacks on organizations. Threat actors are exploiting ransomware-as-a-service ecosystems, compromising government registries, targeting law enforcement databases, and abusing third-party platforms that support retail and healthcare operations.   Organizations must strengthen third-party risk management, improve data protection measures, and enhance incident response capabilities to reduce the impact of evolving cyber threats. 

The Cyber Express Weekly Roundup 

Qilin Dominated Ransomware Attacks in H1 2026 

Qilin emerged as the most active ransomware group during the first half of 2026, targeting organizations worldwide through its ransomware-as-a-service (RaaS) operation. Manufacturing, healthcare, construction, and professional services were among the sectors most affected as the group continued expanding its global reach. Read more… 

Hackers Breach Beneficial Owners Registry, Expose Data of 31,000 Firms 

Hackers breached the Register of Beneficial Owners (VwbP), gaining unauthorized access to data associated with approximately 31,000 legal entities. Authorities temporarily took the registry offline, launched an investigation, and established a crisis response team, stating there is currently no evidence that records were altered or deleted. Read more… 

PNLD Data Breach Leaks Police and Government Contact Details 

A data breach involving the Police National Legal Database (PNLD) exposed names, organizations, and work email addresses belonging to police officers, government partners, criminal justice professionals, and some Ask the Police users after the information appeared on the dark web. Authorities are investigating the incident and assessing its potential impact. Read more… 

De Bijenkorf Logistics Cyberattack Delays Orders and Raises Data Exposure Concerns 

A cyberattack targeting a third-party logistics provider disrupted deliveries, returns, and refunds for Dutch retailer De Bijenkorf. While the retailer confirmed its internal systems were not compromised, investigators are assessing whether customer contact details and order information were exposed. Payment information, passwords, and financial data were not affected, and customers have been advised to remain vigilant against phishing attempts. Read more… 

Updoc Data Breach Exposes Customer Contact Information 

Australian telehealth provider Updoc disclosed a data breach after unauthorized access to a third-party operational platform exposed some customers' names, email addresses, and postal addresses. The company confirmed that its internal systems remained secure and that no medical records, payment information, or financial data were compromised. Read more… 

Weekly Cybersecurity Takeaway 

This week's incidents highlight the continued evolution of cyber threats across ransomware operations, government data breaches, and third-party supply chain compromises.  A common theme across these events is the growing risk posed by trusted third-party platforms and shared digital ecosystems. Attackers are targeting external service providers, government databases, and ransomware affiliate networks to expand their reach and maximize operational disruption.  Organizations should prioritize stronger third-party risk management, continuous monitoring, robust access controls, and timely incident response to reduce the impact of supply chain attacks and data breaches. As businesses become more interconnected, strengthening the security of partner ecosystems is becoming just as important as protecting internal infrastructure. 

The Updoc data breach has raised fresh concerns about cybersecurity in Australia's healthcare sector after the telehealth provider confirmed that an unauthorized third party may have accessed customer contact information through an external system.   The data breach at Updoc, disclosed on August 7, stemmed from a brief security incident involving a third-party platform that supports the company's operations. While the Updoc cyberattack did not expose medical or financial records, it is the latest cyber incident affecting Australia's healthcare sector. 

Updoc Data Breach Traced to Third-Party Platform 

Updoc, an Australian telehealth provider offering round-the-clock online healthcare services, including medical certificates, prescriptions, and specialist referrals, detected unauthorized access to a third-party operational system on Friday, July 31.  In a statement shared with The Cyber Express, the company said the incident was limited to an external system used to support its operations. The exposure was confined to customer contact information, which may have included account holders' names, email addresses, and postal addresses.  Updoc said its internal systems were not accessed during the incident and confirmed that no health records, financial information, or payment details were involved. The company added that it acted immediately to block the unauthorized access and found no evidence of any further activity after the initial event.  According to the company, customers are not required to take any immediate action because account logins and security remain unaffected. Updoc also apologized for any concern or inconvenience caused by the incident. 

Updoc Cyberattack Adds to Healthcare Sector Threats 

Founded in 2021, Updoc generates approximately $10 million in annual revenue. According to its founders, the platform has served more than one million patients since launch, while its website states that it has over 500,000 users.  The Updoc cyberattack follows a series of cybersecurity incidents targeting Australian healthcare and consumer-facing organizations. In June, clinic network Partnered Health disclosed a cyberattack in which hackers stole personal information and health records from patients across at least 21 clinics in five Australian states.  That breach exposed sensitive information, including medical records, Medicare numbers, consultation notes, referral letters, and pathology results. The attack affected clinics in Melbourne, Sydney, Canberra, the Gold Coast, Sunshine Coast, and Coffs Harbour. At the time, another five clinics, including several in Western Australia, remained under investigation.  Although the Updoc data breach was limited to contact information and did not compromise medical or payment data, the data breach at Updoc highlights the risks associated with third-party service providers. As healthcare organizations continue to depend on external platforms, the incident underscores how vulnerabilities outside a company's own infrastructure can still result in customer information being exposed.