This weekly roundup covers the FBI's attribution of the $6 billion Binance hack to North Korea, a spreading wave of refrigeration attacks that has now reached France's blood supply, rapid exploitation of a freshly patched WordPress flaw, a Europol takedown of a fake trading platform supplier, and unauthorized trades in Stockal customer accounts.  Two threads run through this week's stories. First, attackers are increasingly coming in through someone else's door: a third-party refrigeration supplier, a scam platform provider, or data leaked by another company. Second, speed decides the outcome. Attackers moved on WordPress within two days of a patch, while fast alarms saved France's blood stocks from the fate of supermarket food. 

The Cyber Express Weekly Roundup 

FBI Blames North Korea for $6B Binance Hack 

The FBI has attributed the theft of more than $6 billion from Binance, which took place around October 29, to North Korean hackers it tracks as "TraderTraitor." The stolen funds are being converted mainly into Ethereum, and the agency has urged crypto firms to block transactions linked to the attackers. Read more… 

Hackers Heat Supermarket Freezers Across Europe 

Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia threw out spoiled food after hackers took control of refrigeration systems, in some cases setting them to 50°C. The attacks follow a similar campaign against around 400 stores in France last month that exploited outdated, internet-connected cooling equipment. Who is responsible remains unknown. Read more… 

Hackers Target WordPress Flaw Days After Patch 

Attackers began exploiting a critical WordPress flaw within 48 hours of its October 28 fix in version 7.1.4, with Wordfence blocking nearly 63,000 attempts in a single day. The bug affects versions 4.7 through 7.1.3 and can let hackers run code on a site during a core update. With no workaround available, site owners are urged to update immediately. Read more… 

Europol Busts Supplier of Fake Trading Platforms 

Authorities in seven countries seized more than 100 servers and arrested seven suspects on November 3 in an operation against a company accused of supplying fake trading platforms to scam call centres. Victims were lured with promises of quick profits, shown fake gains to draw in more money, and then blocked from withdrawing. Losses are estimated at over €4 million, with potential victims in more than 50 countries. Read more… 

Freezer Hackers Hit France's Blood Supply 

France's national blood service, EFS, said hackers raised temperatures in cold storage rooms at three sites by going through a third-party refrigeration supplier. Alarms caught the changes quickly, and no blood products were lost. It is the first healthcare organisation hit in a wave of refrigeration attacks now reported in at least 11 countries. No one has claimed responsibility. Read more… 

Stockal Confirms Unauthorized Trades in 13 Accounts 

Borderless, which runs US equities platform Stockal, said attackers logged into 26 customer accounts using valid credentials and, in 13 of them, sold large-cap stocks to buy obscure microcap shares. No funds were withdrawn. The company says its systems were not breached and suspects social engineering using data leaked in another firm's breach. Read more… 

Weekly Cybersecurity Takeaway

Several of this week's incidents show that an organization's security is only as strong as the partners and data around it. Supermarkets and France's blood service were reached through refrigeration suppliers; Stockal customers were likely targeted with data stolen elsewhere, and the Europol case exposed a business that built scam platforms for others to run.  Speed is the other lesson. Attackers turned the WordPress fix into a roadmap within 48 hours, while the EFS avoided losses because its monitoring flagged the problem right away.  Organizations should review the remote access their suppliers have to critical systems, retire or isolate unsupported internet-connected devices, and make sure alarms on physical equipment reach someone around the clock. They should also patch critical flaws without delay, strengthen account authentication, and, for crypto firms, block addresses linked to the Binance attackers. 

This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision to let search engines index messages from its public servers.  Two threads run through this week’s stories. First, attackers are getting more out of less: one compromised laptop put billions of dollars in crypto at risk, and AI tools let a small, self-taught crew scale its attacks to dozens of victims. Second, the fallout from a breach lasts far longer than the breach itself, as lawsuits, prison sentences, and bounties land years after the original attacks, while a simple default setting can create new exposure. 

The Cyber Express Weekly Roundup 

Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen 

Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more... 

South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies 

Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more... 

Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach 

Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more... 

Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses 

Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more... 

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns 

Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more... 

Weekly Cybersecurity Takeaway 

Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team.  The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward.  Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use. 

A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests. 

This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security. 

Here are the stories that shaped the week. 

The Cyber Express Weekly Roundup 

PHP2Shell Flaws Knock Wikipedia and Government Sites Offline 

Two critical vulnerabilities in PHP, the scripting language that powers a large share of the web, have triggered urgent patching warnings from agencies around the world. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have already been linked to outages at Wikipedia and a number of government websites. Read more… 

INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa 

An INTERPOL-coordinated crackdown spanning 21 countries has ended in 1,462 arrests. Operation Serengeti III ran from June to August 2026 and targeted fraud, ransomware, business email compromise and online scams. Investigators disrupted 10,909 malicious networks and recovered more than USD 105 million. The operation also identified nearly 66,000 victims, linked to combined losses of more than USD 385 million. Read more… 

ASD Essentials Replaces the Essential Eight 

The Australian Signals Directorate has launched ASD Essentials, a broader successor to the Essential Eight, the security baseline Australian organizations have long been measured against. Where the Essential Eight centered on a fixed set of mitigation strategies, the new framework extends its scope to enterprise IT, operational technology and cloud environments. Read more… 

Dubai Police Bust AED 10,000 Fake Driving License Scheme 

Dubai Police have arrested an eight-member gang that sold driving licenses for AED 10,000 each. Customers received licenses issued in a neighboring country without ever travelling there, taking a lesson or sitting a test. The gang then helped buyers convert those licenses into UAE licenses by exploiting legitimate license exchange agreements between the two countries. Read more… 

Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk 

Fintech firms vet their commercial vendors closely, but the open-source libraries, container images and third-party components inside their systems often arrive with far less scrutiny. That mismatch leaves a blind spot in how financial technology companies manage risk. Vijendra Katiyar of CleanStart points to examples such as a widely used Redis image that carried 185 known CVEs, and the Shai-Hulud worm, which spread through malicious npm packages. Read more… 

Conclusion 

Taken together, this week’s stories show how much of today’s risk comes from what organizations already trust: decade-old code, inherited software components, official exchange agreements and security checklists that measure effort rather than results. Follow The Cyber Express for next week’s weekly cybersecurity roundup and ongoing coverage of these stories. 

site-verification-ok

site-verification-ok

Singapore opened SICW 2026 with a blunt message: no government, company or country can see the full picture of today's cyber threats, and artificial intelligence is now raising the stakes for defenders and attackers alike. Speaking at the opening ceremony of the 11th Singapore International Cyber Week on 13 October 2026, Gwenda Fong, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency of Singapore (CSA), called for stronger international cooperation as threats grow more complex. Her address came a day after Josephine Teo, Minister for Digital Development and Information and Minister-in-charge of Cybersecurity and Smart Nation, warned that trust in digital systems is becoming harder to sustain. This year's theme is "Cyber at a Crossroads: Shaping the New Cyber Order.

SICW 2026 Opens With a Warning

Fong, attending her first SICW as CSA chief, said Singapore's success has been built on being open and connected. That leaves its economy and society dependent on digital infrastructure, platforms and supply chains that extend well beyond its shores. Governments, infrastructure operators, cloud providers and cybersecurity firms each see part of the threat landscape, she said, but none sees all of it. "What appears to be an isolated incident to one organisation may in fact be part of a much larger campaign," Fong said. Assembling the picture is only half the challenge, she added. It must be done quickly enough to act before the adversary does.

AI Cuts Both Ways at SICW 2026

Fong said Singapore cannot simply keep adding analysts as threats grow in volume and sophistication. Instead, it wants AI to help defenders "see more, understand faster and to act more effectively." But adversaries can harness AI too, operating at greater speed and scale. The real test of AI cybersecurity, she said, is making sure the technology strengthens defences rather than tilting the advantage towards attackers. She also flagged a newer risk. As agentic AI systems gain access to data, applications and tools, they create new dependencies and vulnerabilities. "For years, cybersecurity has required us to understand what is connected to what. In an increasingly agentic world, we must also understand what can act on what," Fong said, pointing to questions of permissions and consequences.

SICW 2026 Puts AI Risks Into Practice

Rather than only discussing what AI could mean for security, CSA is testing it in practice this year. CSA is partnering with Google on an agentic AI cyber scenario exercise for international partners. It is working with the Singapore AI Safety Hub on a frontier AI governance workshop for officials from ASEAN and the wider Asia-Pacific. With Cloudflare, it is running hands-on training in AI-enabled cyber defence for critical infrastructure operators. Fong pointed to the ASEAN CERT Incident Drill, held since 2006, as proof that practising together builds the habits that matter in a real crisis.

The Trust Deficit Behind SICW 2026

On 12 October, Teo described what she called a paradox. At precisely the time when more trust is needed, trust is becoming harder to sustain. AI systems can make mistakes, be manipulated or behave in unintended ways, she said, and their capabilities are advancing faster than our understanding of the risks. Teo cited UNC3886's campaign against Singapore's telecommunications sector as a recent example of sophisticated actors targeting critical infrastructure. Ransomware and cybercrime remain pervasive, while strategic competition is forcing harder choices on technologies, suppliers, standards and interoperability. "We are willing to interact more, but find ourselves willing to trust less," she said. Without trust, Teo warned, businesses will hesitate to digitalise, citizens will be wary of new technologies, and countries will be less willing to stay open and connected.

"Accountability Cannot Be Outsourced"

Teo said industry must be a partner in securing the digital ecosystem, since it builds and operates much of the infrastructure economies depend on. That means shared standards, threat intelligence sharing, incident reporting and testing new technologies before deployment. On increasingly autonomous AI, she said human judgement, oversight or control must be retained where necessary. "Ultimately, accountability cannot be outsourced. Least of all, to machines," she said. She outlined steps already under way. CSA released its Securing Agentic AI Addendum earlier this year to guide organisations on securing autonomous AI systems. The agency is also working with industry to prepare critical infrastructure for the transition to quantum-safe systems. In addition, leading operational technology manufacturers and technology providers have committed to attain Singapore's Cyber Trust Mark.

What Comes Next

Teo said Senior Minister K Shanmugam would launch the Singapore Cybersecurity Strategy 2026, the country's updated national strategy, the following day, with partnerships remaining central to it. That approach will also carry into 2027, when Singapore assumes the ASEAN Chairmanship. Teo said Singapore will work with the bloc's 11 member states to strengthen collective cyber resilience, deepen practical cooperation and capacity building, and work more closely with industry. Estonia's Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, also joined the week's proceedings for a fireside chat with Fong. Both leaders acknowledged that geopolitical competition is making cooperation harder. "Disagreement need not prevent dialogue, and competition need not preclude practical cooperation," Fong said. Teo put it simply: trust is not built through declarations, but through candid exchanges, competence and consistent action. Fong closed with a challenge to every delegate in the room: look beyond your own vantage point and find the people who can help you see the rest.

Morocco’s cybersecurity strategy is placing greater emphasis on proactive threat detection, critical infrastructure protection and artificial intelligence as the country strengthens its defenses against evolving cyber threats. Abdellatif Loudiyi, Minister Delegate to the Head of Government in charge of National Defense Administration, said securing information systems has become a necessity as digital transformation accelerates. Speaking at the opening of National Cybersecurity Week in Rabat on Monday, Loudiyi stressed that cybersecurity must be integrated into institutional governance rather than treated as an additional expense. He called for stronger preparedness, early threat detection and coordinated responses to cyber incidents. The event, organized by the General Directorate of Information Systems Security under the National Defense Administration, runs from October 12 to 14 under the theme “Cybersecurity in the service of digital transformation and development.”

Morocco Cybersecurity Strategy Emphasizes Proactive Defense

Loudiyi said cyberattacks have become a tangible reality affecting countries worldwide, including developed nations. Their consequences have raised awareness among public and private institutions about the importance of cybersecurity in managing risks and protecting operations. He argued that organizations can no longer rely on responding to incidents after they occur. Instead, they need an approach centered on preparedness, vigilance, early detection, and response. According to the minister, these responsibilities must begin at the highest levels of institutional decision-making and extend across organizations, with each component accountable for its role. He also emphasized that cybersecurity resilience requires continuous work. As attackers develop new methods, institutions must regularly review protection measures, assess system readiness, and adapt their defenses to emerging threats.

Five Pillars to Strengthen National Cybersecurity

The minister outlined five interconnected areas supporting Morocco’s efforts to establish a coordinated national cybersecurity framework. These include a clear legal and regulatory framework, the development of human, technical and financial capabilities, greater public awareness and a stronger cybersecurity culture, enhanced monitoring and response capabilities, and regional and international cooperation. Loudiyi stressed that these elements must function together to strengthen national resilience. He also highlighted the shared responsibilities of government authorities and organizations operating information systems. While the General Directorate of Information Systems Security exercises its legally defined powers, individual system owners must protect their systems and allocate the resources required to do so. The minister said this integration of responsibilities is essential to building a cohesive national cybersecurity system.

AI Threats and Critical Infrastructure Protection Take Priority

Looking ahead, Loudiyi identified four priorities for the next phase of Morocco’s cybersecurity efforts: training specialized cybersecurity professionals, supporting national cybersecurity companies, strengthening critical infrastructure protection, and addressing the challenges associated with artificial intelligence. He described artificial intelligence in cybersecurity as a dual-use capability that can benefit both attackers and defenders. While attackers can use AI to support malicious activities, defenders can apply the technology to detect threats earlier and accelerate incident response. The emphasis on specialized training also reflects the need to develop the expertise required to address increasingly complex cybersecurity challenges. Supporting national companies is another priority identified by the minister as part of the broader effort to strengthen the country's capabilities. Loudiyi said these priorities should help Morocco prepare not only for existing threats but also for risks that may emerge as technologies and attack methods evolve.

Morocco Calls for Stronger International Cybersecurity Cooperation

Loudiyi also highlighted the role of cybersecurity cooperation in strengthening national defenses. He said Morocco remains committed to initiatives and mechanisms that promote collaboration between countries, with particular attention to its African and Arab partners. He presented cybersecurity as a shared responsibility requiring coordination, investment in skills and a sustained culture of awareness and vigilance. The minister concluded that a secure digital environment depends on collective efforts to protect information systems and maintain trust as digital transformation advances. National Cybersecurity Week provides a platform for these discussions through roundtables and workshops involving decision-makers, cybersecurity experts and industry professionals. The October 12 to 14 program is intended to encourage dialogue and the exchange of views on key cybersecurity challenges and approaches to addressing them.

The U.S. Department of State's Rewards for Justice (RFJ) program is offering up to $10 million for information on Zhang Yu, a Chinese national accused of hacking COVID-19 research at U.S. universities on behalf of China's Ministry of State Security (MSS). U.S. officials also describe Zhang as a key figure in the HAFNIUM hacking campaign, which compromised thousands of computers worldwide.

His alleged partner, Xu Zewei, was arrested in Italy in July 2025 and extradited to the United States in April 2026. Zhang remains at large.

Who Is Zhang Yu

Zhang is a director at Shanghai Firetech Information Science and Technology Company, Ltd. U.S. officials say he worked at the direction of the MSS Shanghai State Security Bureau (SSSB). According to RFJ, the MSS and SSSB are Chinese intelligence services responsible for domestic counterintelligence, non-military foreign intelligence, and parts of the country's political and domestic security.

[caption id="attachment_114641" align="aligncenter" width="600"] Image Source: Rewards for Justice[/caption]

The reward covers information leading to the identification or location of anyone who, while acting under the direction or control of a foreign government, takes part in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. The State Department says Zhang's cyberattacks violated that law.

Zhang Yu and the COVID-19 Research Intrusions

Starting in early 2020, Zhang and Xu allegedly gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists in order to steal sensitive information. At the time, Xu was a general manager at Shanghai Powerock Network Co. Ltd.

Prosecutors say the two men carried out the hacks at the behest of the MSS and SSSB and reported back to supervising officers at the SSSB. In one instance, Xu allegedly confirmed to his handlers that he had compromised the network of a research university in the Southern District of Texas.

The HAFNIUM Campaign Linked to Zhang Yu

In 2021, Zhang and Xu allegedly exploited vulnerabilities in computers running Microsoft Exchange Server, software used to store and retrieve emails. These intrusions were part of the mass hacking campaign publicly known as HAFNIUM. Victims included a university and a law firm, both based in the United States.

A nine-count indictment unveiled by the Justice Department in 2025 accused both men of computer intrusions between February 2020 and June 2021, including the HAFNIUM campaign, which prosecutors described as indiscriminate.

The scale of the campaign was significant. Brett Leatherman, assistant director of the FBI's Cyber Division, said in 2025 that through HAFNIUM, the Chinese Communist Party targeted more than 60,000 U.S. entities and successfully victimized more than 12,700 of them to steal sensitive information.

Zhang Yu Remains at Large as Partner Faces U.S. Charges

Xu was arrested by Italian authorities in July 2025 while on vacation in Milan. He was extradited to the United States in April 2026, while Zhang has not been apprehended.

According to RFJ, China uses an extensive network of private companies and contractors to hack and steal information in a way that hides the government's involvement. Both men worked for private Shanghai firms while allegedly acting on behalf of state intelligence services.

RFJ is asking anyone with information on Zhang, his associates, or their malicious cyber activities to submit a tip through its Tor-based tip line. Rewards of up to $10 million are available for information that meets the program's criteria.

This weekly roundup covers a customer data breach at Spain's national rail operator, an Australian government warning about attackers hijacking corporate AI services, a patient data theft from a Polish medical software platform, phishing campaigns that turn legitimate remote management tools against their victims, and a gathering of Europe's police leaders focused on how AI is reshaping crime.  Two threads run through this week's stories. Artificial intelligence is now both a target and a tool for attackers: stolen API keys are draining company budgets, and AI is reportedly being used in intrusions. Meanwhile, attackers keep exploiting trusted software, from a medical records platform to legitimate IT administration tools, to stay hidden for days or weeks. 

The Cyber Express Weekly Roundup 

Renfe Confirms Data Breach Through Compromised Adif Servers 

Spanish rail operator Renfe confirmed on September 25 that hackers had accessed customer names and email addresses. The intrusion came through compromised servers belonging to Adif, the state-owned manager of Spain's rail infrastructure. Renfe said no financial data was exposed and train services were not disrupted. Read more… 

Australia Warns of Stolen AI Keys as Hijacked Access Costs Firms Up to $600,000 

The Australian Signals Directorate (ASD) has warned that attackers are taking over organizations' AI services. They get in through exposed API keys, stolen sessions, and compromised suppliers. Once inside, they burn through paid credits and generate harmful content. Where AI agents are deployed, they also use that access to reach connected systems and data. Read more… 

Polish Patient Data Stolen in Cyberattack on Medyc Medical Software 

Attackers exploited an SQL injection vulnerability in Medyc, a medical records platform developed by Polish vendor Qbusoft, on August 22–23. They stole patient names, PESEL national identification numbers, addresses, phone numbers, and email addresses going back to July 2024. The breach went unnoticed until September 8–9, more than two weeks later. Read more… 

Phishing Campaigns Abuse MSP360 Remote Management Tool to Install ScreenConnect 

Microsoft has tracked phishing campaigns that tricked victims across several industries into installing MSP360, a legitimate remote management tool. The installers were disguised as Zoom downloads, Adobe updates, invitations, and delivery notices. After gaining a foothold, the attackers installed ConnectWise ScreenConnect as a backup access channel. Read more… 

Europe's Police Chiefs Warn AI Is Making Crime Faster and Larger in Scale 

More than 500 police leaders from 59 countries gathered at Europol's headquarters from September 28 to 30 to discuss how AI is changing crime. Europol warned that criminals are using generative AI, deepfakes, and autonomous agents to expand fraud, cybercrime, migrant smuggling, and child exploitation. It also pointed to AI's potential to speed up police investigations. Read more… 

Weekly Cybersecurity Takeaway 

Artificial intelligence features in several of this week's stories, in different roles. In Australia, AI services are the target: attackers hijack them to steal paid credits and to reach connected systems through AI agents. At Europol's gathering, police leaders described AI as a force multiplier that lets criminal groups run fraud and exploitation at greater speed and scale. In the Renfe case, AI was reportedly used in the attack, though that remains unconfirmed.  The other common thread is how attackers abuse what organizations already trust. In Poland, an injection flaw in widely used medical software exposed sensitive patient identifiers and went undetected for more than two weeks. Microsoft's findings show attackers installing two legitimate remote management tools so their activity looks like ordinary IT work.   The Renfe breach, which reached customers through a partner organization's servers, is a reminder that an organization's exposure extends to its suppliers and infrastructure partners.  Together, these developments call for practical steps. Organizations should treat AI credentials as carefully as any other privileged secret. They should watch for unexpected remote access software even when it is legitimate, and they should hold the vendors who handle their data to the same security standards they apply internally. 

The Queensland government department in charge of the state's cybersecurity efforts has disclosed a loss of roughly $800,000 from a cyberattack during the last financial year. Details of the CDSB cyberattack, which involved a third-party messaging service being "misused" for financial gain, appear in the QLD cybersecurity department's latest annual report, released on Friday.  The Customer Services, Open Data, and Small and Family Business department (CDSB) directs the Queensland government's cybersecurity strategy, governance, policy and investment. According to its annual report, the department lost $809,000 during the 2025-26 financial year as "a result of an external cyberattack for financial gain." 

How the CDSB Cyberattack Unfolded?

The report said the breach did not reach sensitive records. No government data or sensitive information was compromised during the incident," it stated. "The department blocked the attack and engaged a third party to mitigate any further exposure."  A CDSB spokesperson told Information Age that the attackers had not been paid.  "In July 2025, a third-party messaging service used by the Queensland government was misused to generate an inflated number of unauthorised SMS messages for financial gain," the spokesperson said in a statement.  "... Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."  The spokesperson added that the Queensland government "is committed to protecting the security and resilience of its systems and services." 

Audit Found the QLD Cybersecurity Department 'Needs to Do More' 

The incident follows a Queensland Audit Office report, released in March, which found that CDSB "needs to do more" to help the state's public sector manage third-party cybersecurity risks.  Auditors found the QLD cybersecurity department was "not actively assessing and monitoring third-party cyber capability across the public sector," although improvements were in progress.  "The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks," the audit said. It noted that the Australian Signals Directorate (ASD), the federal cybersecurity agency, "has been raising these risks since 2021."  During testing, auditors gained the "highest level of access" to two Queensland government entities. They did not name either entity, to "avoid publicly identifying any security vulnerabilities."  CDSB addressed the audit in its annual report. "In our cybersecurity leadership role, we agreed to all relevant recommendations and progressed actions during the reporting period, including initiatives to strengthen whole‑of‑government cybersecurity capability," it said.  The report described cybersecurity as something that "remains a daily discipline" for CDSB and the wider Queensland government.  "Investing in, and securing Queensland's digital assets remains important, as cyber threats become more complex, and national incident data shows that malicious actors continue to target all sectors of the economy," it added. 

Queensland Tops Cybercrime Reports 

The CDSB cyberattack comes against a broader backdrop of cybercrime in the state. ASD's latest Annual Cyber Threat Report found that Queensland reported the highest share of Australia's cybercrime incidents in the 2024-25 financial year.  Queensland accounted for 28 per cent of national cybercrime reports. Victoria followed with 26 per cent and New South Wales with 22 per cent. ASD found these figures were "disproportionately higher" than the three states' respective populations when compared with other jurisdictions.  Average losses were highest elsewhere. "The Australian Capital Territory reported the highest average self-reported financial losses – around $37,700 per cybercrime report – followed by those in New South Wales, with around $33,000," the report said. 

This weekly roundup covers a brazen breach claim against the FBI's recruitment portal, a multinational advisory exposing North Korea's fake-recruiter malware operation, a sweeping EU proposal to reshape children's access to social media, a conversation on application security in the age of AI agents, a short-lived Discord ban in the Philippines, and a multimillion-dollar hot-wallet heist at a crypto casino.  From federal law enforcement to individual job seekers, this week's developments show that no target is too prominent or too small. Cybercriminals are openly taunting the agencies that pursue them, state-backed actors are turning the hiring process into an attack vector, and governments are testing how far they can push platforms on child safety, sometimes reversing course within hours. 

The Cyber Express Weekly Roundup 

Shiny Hunters Claims FBI Breach, Says FBIjobs Agent Data Exposed 

The FBI is investigating an apparent breach after the cybercriminal group Shiny Hunters claimed to have stolen personal data belonging to thousands of federal agents, with the probe centering on the bureau's FBIjobs recruitment website. Read more... 

WaterPlum Hackers Steal $10.7M in Crypto From IT Workers 

A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries while stealing cryptocurrency from IT professionals worldwide. Read more... 

EU KIDS Act Sets New Social Media Rules for Children 

The European Commission adopted the proposal on September 18, setting out rules that would prevent children under 13 from accessing social media and establish 15 as the minimum age for minors to open accounts independently. Users aged 13 to under 15 could instead access parent-managed mini accounts with limits on social contacts and up to 60 minutes of screen time per day, while platforms would bear the responsibility of proving their services are safe for children. Read more… 

Harness' Rahul Sood: AppSec in the Agentic Era Is About More Than Code. It's About Authority 

In this conversation, The Cyber Express spoke with Rahul Sood, the General Manager for Application Security at Harness, who leads the company's AppSec portfolio and focuses on building security for the AI era, integrated directly into modern DevOps workflows. The conversation centers on a shift in how security teams must think about AI agents: the risk no longer lies only in the code being shipped, but in what authority autonomous agents are granted once they operate inside production systems. Read more… 

Ban on Discord Lifted After Platform Commits to Work With DICT and CICC 

The Philippine government has lifted its ban on Discord after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC), with the restriction removed on Thursday, Sept. 24. Read more... 

Duelbits Hit by $7 Million Hack as Crypto Stolen Across Four Blockchains 

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets, with the stolen assets moved across four blockchains and mostly converted into Ether. The company says funds held in user accounts have not been affected, but it has not explained how the attackers got in or when the site will return. Read more... 

Weekly Cybersecurity Takeaway 

This week's developments span the full spectrum of cyber risk, from a criminal group openly retaliating against the FBI over a public advisory, to a state-backed operation weaponizing job interviews against developers, to a crypto platform losing millions from the very hot wallets that keep it running.  Meanwhile, the policy response is moving on multiple fronts: the EU is flipping the burden of proof onto platforms to demonstrate child safety by design, and the Philippines has shown how quickly a government can block, and then restore, a major platform in exchange for enforcement commitments. At the same time, security leaders are warning that AI agents are introducing an entirely new question of who, or what, holds authority inside enterprise systems.  Taken together, the stories point to an increasingly confrontational threat landscape, where attackers are bolder, trust-based processes like hiring are being exploited at scale, and institutions are experimenting with more aggressive levers to hold platforms and adversaries accountable. 

Artificial intelligence systems are becoming more capable and autonomous, raising new questions about how they can be monitored, controlled and secured. Speaking before the United Nations Security Council, OpenAI CEO Sam Altman warned that the rapid pace of AI development could create significant AI security risks, particularly if systems advance faster than institutions can respond. Altman highlighted concerns ranging from human control and autonomous AI to emerging vulnerabilities, concentrated technological power and the need for international incident reporting. He also called for stronger cooperation between governments, critical infrastructure operators and technical experts to address emerging AI threats.

Here are six key AI security risks highlighted in his remarks.

1. Losing Human Control Over Advanced AI

One of Altman’s central concerns was the possibility that humans could lose control over increasingly capable AI systems. He warned that AI could move so quickly that people may no longer be able to understand what systems are doing or intervene when necessary. He argued that developers should not train systems unless they can make a strong case that those systems can remain under human control. The concern becomes more significant as AI systems become capable of handling increasingly complex tasks and making decisions with less direct human involvement.

2. AI Systems Becoming More Autonomous

The growing autonomy of AI systems presents another challenge for AI cybersecurity. Altman pointed to the possibility of AI systems improving themselves and future versions of themselves, describing this as recursive self-improvement. As the process of developing AI becomes more automated, the pace of progress could accelerate. For security teams and policymakers, increasingly autonomous systems could make monitoring, testing and intervention more difficult.

3. Emerging Vulnerabilities and New Threats

More capable AI systems could also introduce vulnerabilities and threats that organizations and governments may not yet fully understand. Altman called for secure channels between governments, critical infrastructure operators and technical experts to share information about emerging vulnerabilities and threats. The remarks place information sharing at the center of preparing for AI vulnerabilities, particularly as AI becomes increasingly integrated into important systems and infrastructure.

4. AI Power Concentrating in Too Few Hands

Altman also warned about the concentration of advanced AI capabilities among a small number of companies, individuals or countries. He argued that no single company or country should be able to use the most powerful AI systems to impose its worldview on others. From a security perspective, concentrated control over highly capable AI could create systemic risks if a limited number of actors have disproportionate access to powerful technology.

5. The Need for Global AI Incident Reporting and Threat Sharing

Altman called for accurate and speedy AI incident reporting, including classification and reporting protocols that would allow countries to learn from failures before they become larger problems. He also called for common standards covering AI capabilities, risk assessments, safeguards and human oversight. Such standards, he said, could help countries compare evidence and establish a shared understanding of what effective safeguards and oversight should look like.

6. AI Development Could Outpace Existing Safety Measures

The speed of AI development itself could become a security challenge. Altman warned that rapid progress could move faster than institutions are prepared to handle. He argued that competition between companies should not become a reason to accept excessive technological risk. He also stressed the importance of alignment, monitoring and safety guarantees as AI systems become more capable. For AI safety, this means ensuring that security measures and oversight develop alongside increasingly powerful systems rather than being added only after problems emerge.

AI Security Moves Into a Global Conversation

Altman’s remarks put AI security risks alongside broader questions about international cooperation, human oversight and technological governance. His proposed approach includes global standards for measuring AI capabilities and risks, incident reporting mechanisms, and secure communication between governments, critical infrastructure operators and technical experts. As AI systems become more autonomous and capable, the challenge will not only be what these systems can do, but whether organizations and governments can monitor, understand and respond to the risks they create.

AI is changing how software is built, tested, and secured, but the speed of development is also creating new challenges for application security teams. As AI coding tools and autonomous agents increase the volume and pace of software development, security teams are facing a growing gap between vulnerability detection, prioritisation, and remediation. In this interview with Rahul Sood, GM, Application Security at Harness, we explore how AI application security is evolving as developers increasingly rely on AI-assisted coding and software agents. Sood discusses why traditional checkpoint-based security processes are struggling to keep pace, how organisations can bring security controls closer to the point where code is created, and why automated vulnerability remediation could become increasingly important. The conversation also examines the security risks associated with AI agents that can access repositories, APIs, infrastructure and production environments. Sood explains why identity, least-privilege access, observability and human oversight will become increasingly important as software gains greater autonomy, and why application security will need to address not only what software contains, but also what autonomous systems are authorised to do. Read the full interview below for Rahul Sood’s perspective on the changing application security landscape and the security challenges emerging as AI takes a more active role in software development.

The Cyber Express: What is the biggest change AI is bringing to the application security landscape?

Rahul Sood: The biggest change is speed. We have spent years making software development faster, and AI has accelerated that dramatically. Security processes, however, haven't accelerated at the same rate. Most security scanning is still triggered at fixed checkpoints - a pull request, merge, or nightly build - designed for a world where a developer produces a handful of meaningful commits a day. LLM-based scanning can potentially find 10x more vulnerabilities vs. traditional scanning tools. That sounds great, but it also means the discovery side of the pipeline is now outpacing triage and remediation even more than it already was. That's where AI agents also become part of the answer, not just part of the problem. An agent can identify something and begin acting on it in close to the same motion, which is exactly the kind of compression this gap needs. The challenge is making sure that speed is matched with the right judgment and oversight.

The Cyber Express: AI coding assistants can introduce insecure code at scale. What should teams be doing differently?

Rahul Sood: The instinct is to assume AI-generated code is introducing more vulnerabilities because AI is somehow worse at writing secure code. I don't think that's the real story. Even if AI wrote code exactly as securely as a person does, the sheer volume of code now being produced would still overwhelm the way most organisations scan for issues today. Scanning at the commit is already struggling to keep pace, as we discussed. The next step is pushing security further left than that, into the coding tool or agent itself, so secrets detection, dependency checks, and application security testing happen as the code is being written, and those same controls continue through build and deployment rather than starting over at each stage. You need both: controls at the point of creation to cut volume, and a verification layer that confirms what's really going out the door. I expect the industry to move from automated detection towards much more automated resolution. Systems will increasingly identify an issue, establish whether it is actually exploitable, create a potential fix, verify that fix and then bring a developer in where judgement or approval is required. Human oversight remains important, but it should be concentrated on decisions where human judgement adds value rather than every mechanical step surrounding them.

The Cyber Express: What new security challenges emerge when AI agents can make decisions and take actions?

Rahul Sood: A coding assistant can suggest something insecure, but there are usually other controls between that suggestion and production. An agent with access to APIs, repositories or infrastructure is different. It has been given authority to act. That makes identity, permissions and the scope of that authority fundamental security questions. One principle I think will become increasingly important is that autonomy should be proportional to the consequence of the action. The more consequential and difficult an action is to reverse, the stronger the controls around it should be. More broadly, enterprises will need a security architecture for non-human actors: distinct identities, least-privilege access, short-lived credentials, complete auditability and clear boundaries around which decisions an agent can make independently. The important question isn't how autonomous an agent is. It's what we've given it the authority to do, where the boundaries are, and what happens when it gets a decision wrong.

The Cyber Express: What becomes harder to secure when applications behave dynamically?

Rahul Sood: AI-native applications introduce another layer because some risks only become visible through behaviour. The security question is no longer limited to whether the underlying code contains a known vulnerability. You also need to understand what the system is doing at runtime. One of the more concerning findings in the AI-native application security research we conducted last year was how basic the visibility problem still was. Many security practitioners told us they didn't have a reliable way of identifying all of the LLMs operating within their environment. That's a significant problem because you cannot meaningfully govern something you don't know exists. As applications become more dynamic, understanding behaviour becomes just as important as understanding what's in the code.

The Cyber Express: Is shift-left still enough?

Rahul Sood: Shift-left was an important correction because security was happening far too late. But moving security earlier in development doesn't solve the entire problem on its own, since risk doesn't only enter through code. It can come through a dependency, an API, a model interaction, a deployment configuration, or the way an application behaves once it's actually running. There is also a growing mismatch between how quickly vulnerabilities can be exploited and how long organisations take to remediate them. The 2026 Edgescan Vulnerability Statistics Report puts the average time to close high and critical vulnerabilities at roughly 55 days. At the other end of that equation, exploitation of newly disclosed vulnerabilities can now begin within hours. Finding a vulnerability earlier is useful, but the more consequential metric is the period between discovery and protection. The next phase of application security is less about moving a scanner to an earlier point in the lifecycle and more about compressing the entire exposure window, from discovery to protection.

The Cyber Express: How can teams identify which risks actually matter?

Rahul Sood: Security teams don't have an alert problem as much as they have a context problem. A vulnerability can have a severe technical rating and still present relatively little immediate risk if the affected component isn't reachable or exposed. Another vulnerability with a lower score could sit in an internet-facing, business-critical application and deserve immediate attention. So prioritisation has to move beyond severity. That means combining technical severity with signals like EPSS scores for real-world exploit probability, static reachability analysis to confirm whether a vulnerable path can actually be called, and false-positive reduction to cut out findings that never posed real risk in the first place. The goal shouldn't be to help a security team process 10,000 alerts faster. It should be to make sure they don't have to treat 10,000 alerts as equally important in the first place.

The Cyber Express: What does a healthy developer–security relationship look like?

Rahul Sood: The healthiest organisations I've seen don't treat security as a handoff between two teams. Developers understand that security is part of building good software, while security teams take responsibility for making the secure path practical. If following security policy means leaving the developer workflow, opening a ticket, waiting several days and then interpreting a scanner report, people will inevitably look for ways around the process. That's an operating-model problem, not simply a developer behaviour problem. We saw how wide that gap had become in research we conducted last year. Seventy-four percent of security professionals surveyed said developers viewed security as a blocker to AI innovation. Security teams should define acceptable risk, policies and guardrails. Engineering teams should then be able to work within those boundaries without constantly asking for permission. That is ultimately what a mature DevSecOps model should achieve. Security becomes part of the engineering system rather than another team standing beside it.

The Cyber Express: What one assumption should organisations rethink today?

Rahul Sood: One assumption I would rethink is that knowing what software contains is enough to understand its security posture. Application security has traditionally been very good at analysing components: the code, libraries, dependencies, APIs and vulnerabilities that make up an application. But with autonomous software, knowing what it's made of is only part of the picture. We also need to understand the authority we've given it. An agent may be built from approved components and have no obvious vulnerability in its code, yet still create significant risk because it can access the wrong data, has excessive permissions or can take an action that was never anticipated when those permissions were granted. We have spent decades building security around software that executes instructions written by people. We are now introducing software that can interpret a goal, decide how to pursue it and interact with other systems along the way. The security architecture for that world cannot rely only on finding vulnerabilities. It also has to govern delegated authority. I think that will become one of the defining application security problems of the agentic era.

Want to Be Part of Security Pill?

Are you a cybersecurity professional, researcher, CISO or industry expert with insights to share? The Cyber Express is always looking to bring new voices and perspectives to the cybersecurity community.

If you would like to be featured on Security Pill or discuss a potential podcast collaboration, reach out to us at [samiksha.jain@thecyberexpress.com].

Have a story, expertise, or perspective to share? Let’s start the conversation.

The European Union’s ability to detect and respond to EU cybersecurity incidents faces significant gaps, particularly in information-sharing and coordination between national and EU-level bodies, according to a new report by the European Court of Auditors (ECA). The auditors said the EU has made progress in developing a cybersecurity cooperation framework, but several measures needed to support an effective response to significant and large-scale incidents are still incomplete. Cybersecurity incidents can disrupt public services, businesses, critical infrastructure and the EU’s internal market. While member states remain primarily responsible for responding to such incidents, the EU has a role when attacks cause major disruption, significant financial losses or substantial harm, or when incidents affect several countries and exceed the response capacity of a single member state.

EU Cybersecurity Incidents Face Information-Sharing Gaps

The ECA identified insufficient information exchange as a major weakness in the EU’s cybersecurity response system. The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises. However, the cooperation between two key EU cyber networks has not yet been formally defined. The auditors said this affects cooperation between the CSIRTs network, which brings together national teams responsible for handling cyber incidents, and EU-CyCLONe, which supports cooperation during EU-level cyber crises. Information-sharing is also affected by differences in national security laws and the ongoing implementation of updated EU cybersecurity rules, including the NIS 2 Directive. According to the auditors, these factors can make it harder for EU networks to identify threats early and coordinate an effective response. “The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” said George-Marius Hyzler, the ECA Member responsible for the audit. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”

European Cybersecurity Alert System Still Delayed

The audit also found that the European Cybersecurity Alert System was not operational at the time of the assessment. Two hubs examined by the auditors, ATHENA and ENSOC, had not started operating because of procurement delays. The system also lacked several elements needed for operation, including cooperation agreements, a common classification system and technical standards. The findings come as the EU continues to invest in cybersecurity. Under the 2021-2027 EU budget, €1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU’s main source of cybersecurity funding.

Overlap Among EU Cybersecurity Bodies

The ECA also identified overlapping responsibilities among some EU bodies involved in monitoring cybersecurity threats. The European Commission’s cyber situation centre, established in 2022 and largely supported by external providers, carries out work that the auditors said partly duplicates existing capabilities at the European Union Agency for Cybersecurity (ENISA). These capabilities include monitoring threats and developing cybersecurity situational awareness. The auditors called for better coordination to reduce duplication and strengthen the overall effectiveness of the EU’s cybersecurity framework.

Funding Checks Raise Security Concerns

The report also highlighted weaknesses in checks on some organisations receiving EU cybersecurity funding. These checks are intended to reduce risks linked to intrusion or influence by non-EU states and prevent sensitive security information from being shared with non-EU authorities. However, while grant beneficiaries are responsible for assessing the ownership and control of third parties receiving financial support, the European Cybersecurity Competence Centre does not verify those assessments. The ECA warned that this could expose sensitive infrastructure, operational data and security-critical technologies to security risks. The audit covered the period from 2022 to 2025 and assessed whether EU actions effectively supported the detection of and response to significant and large-scale cybersecurity incidents. Audit missions were conducted in Ireland, Greece and Italy.

This weekly roundup covers a bounty offer targeting an alleged Iranian cyber official, a massive data-exposure incident affecting airline travelers, a breach of an education platform used by students, a flaw exposing ChatGPT users' Gmail data, and a new EU compliance deadline for connected-product manufacturers.  From nation-state attribution efforts to AI-model exploitation and airline record exposure, this week's developments show how identity data, cloud misconfigurations, and AI infrastructure all remain prime attack surfaces — while regulators tighten disclosure timelines. 

The Cyber Express Weekly Roundup 

US Offers $10 Million for Alleged Iranian Cyber Chief 

The State Department is offering $10 million for information on Amir Yaryab, accused of directing the IRGC-CEC's Cyber Operations Command and overseeing groups including CyberAv3ngers, which has previously claimed attacks on industrial control systems and critical infrastructure in the US, Israel, and elsewhere, including exploitation of default credentials on Unitronics PLCs. Read more… 

Mathspace Breach Exposes Data on Over 1 Million Users 

A vulnerability in a self-hosted Metabase reporting tool let attackers gain administrator access without logging in, exposing names, emails, and account metadata for more than 1 million students, parents, and teachers in Australia and New Zealand. Passwords and authentication tokens were not affected, and Mathspace has notified regulators in both countries. Read more… 

220 Million Airline Passenger and Crew Records Exposed 

A misconfigured, inconsistently secured Elasticsearch cluster left roughly 220.8 million passenger and crew records — including passport numbers and full itineraries spanning nine years — reachable over the internet before researchers helped get it secured in June. The server's origin remains unconfirmed, though it was linked to Vietnamese IP space. Read more… 

ChatGPT Sandbox Flaw Let Attackers Read Victims' Gmail 

Check Point Research found that a shared internal package-caching system let separate ChatGPT sessions pass messages to each other, allowing a planted prompt to instruct a victim's session to fetch Gmail data and hand it to an attacker's account — without any visible confirmation step. OpenAI has since decommissioned the affected instance. Read more… 

EU's 24-Hour Vulnerability Reporting Rules Take Effect 

Manufacturers of connected products sold in the EU must now report actively exploited vulnerabilities within 24 hours under the Cyber Resilience Act, more than a year ahead of the law's full 2027 rollout. Non-compliance can draw fines up to €15 million or 2.5% of global revenue. Read more… 

AI Just Broke Crypto: What's Next for Defenders and Attackers Alike

https://www.youtube.com/watch?v=BXtwaaxnq_0

Weekly Cybersecurity Takeaway 

This week's developments show attackers and regulators converging on the same weak points: identity data sitting in exposed or under-secured systems, and AI platforms whose infrastructure — not their models — created the exploitable gap. The Mathspace and airline incidents both trace back to unpatched or misconfigured backend systems rather than sophisticated intrusion techniques, while the ChatGPT flaw shows that shared infrastructure underlying AI services can become a cross-account attack surface even when the model itself behaves correctly.  Meanwhile, the Yaryab bounty and the EU's new reporting clock reflect a parallel push on the policy side — attribution efforts aimed at raising the cost of state-linked attacks, and regulation aimed at compressing how long vulnerabilities can sit unreported. Organizations should treat backend admin tools and internal caching layers with the same scrutiny as customer-facing systems, and multinational manufacturers should confirm their incident-response playbooks account for the new EU timelines now in effect. 

💾

This weekly roundup highlights a range of cybersecurity developments affecting artificial intelligence platforms, enterprise software, healthcare organizations, social media accounts, and internet-facing infrastructure.  From stolen Claude sessions and bypassed PaperCut security fixes to an attempted attack targeting hundreds of thousands of X users, recent incidents demonstrate how attackers continue to exploit both software vulnerabilities and active user sessions.  The latest developments also show that organizations face growing risks across AI services, on-premises systems, enterprise edge devices, and account recovery infrastructure. Security teams are being urged to respond quickly as attackers increasingly target exposed systems and authentication mechanisms. 

The Cyber Express Weekly Roundup 

Anthropic Warns of Claude Session Hijacking 

Anthropic has warned that common infostealer malware is being used to steal active Claude sessions, potentially allowing attackers to bypass passwords and two-factor authentication. The campaign involves malware such as Vidar, LummaC2, RedLine, and Atomic Stealer, which is often distributed through pirated software and illicit downloads. Attackers may also consume victims’ paid AI usage. Read more… 

PaperCut Releases Second Emergency Patch After First Fix Is Bypassed 

PaperCut has released a second emergency patch for two actively exploited vulnerabilities affecting its NG and MF print management servers. Researchers discovered ways to bypass the initial security fix, potentially allowing attackers to chain the flaws and achieve pre-authentication remote code execution on exposed systems. Read more… 

Boston Scientific Cyberattack Limited to Certain On-Premises Systems 

Boston Scientific says its ongoing cybersecurity incident is limited to certain on-premises systems, with no impact identified on its cloud-based applications. The company has also reported no confirmed data breach or evidence of unauthorized activity since August 25, as its investigation into the incident continues. Read more… 

DOJ Investigates Attempted Cyberattack on Hundreds of Thousands of X Users 

The U.S. Department of Justice is investigating a large-scale cyberattack targeting hundreds of thousands of X accounts through the platform’s password-recovery system. Attorney General Todd Blanche said X detected and disrupted the campaign before the targeted accounts could be captured, preventing the attempted account takeover operation from succeeding. Read more… 

Two Citrix NetScaler Flaws Put Enterprise Edge Devices at Risk 

Two vulnerabilities in Citrix NetScaler ADC and Gateway have prompted an urgent patching warning from Australia’s cybersecurity agency. CVE-2026-19489, a memory overflow flaw, and CVE-2026-19490, an authentication bypass, can affect systems with specific configurations involving SIP ALG, SAML, or VPN gateway functionality. Read more… 

Weekly Cybersecurity Takeaway 

This week’s developments demonstrate that cybersecurity threats are increasingly targeting authentication systems, active user sessions, exposed enterprise infrastructure, and critical business applications. AI platforms, print management servers, healthcare environments, social media accounts, and network edge devices all remain potential targets for attackers.  Organizations should prioritize rapid security patching, protection of active sessions, strong authentication controls, careful monitoring of exposed infrastructure, and timely investigation of suspicious activity. Security teams should also review systems that rely on password-recovery mechanisms and identify enterprise devices operating with vulnerable configurations.  As businesses continue to rely on cloud services, AI platforms, remote access technologies, and internet-facing enterprise systems, attackers are finding new opportunities to exploit trusted sessions and security weaknesses. Organizations must maintain continuous monitoring and rapid response capabilities to reduce the impact of increasingly targeted cyberattacks. 

This weekly roundup highlights a broad range of cybersecurity and technology developments affecting cloud identity infrastructure, social media platforms, businesses, digital assets, and international law enforcement.   From a critical Microsoft Entra ID vulnerability exploited before remediation to a global crackdown on West African cybercrime networks, recent developments demonstrate how attackers continue to target both technical systems and human trust.  The latest developments also show that cybersecurity risks are expanding alongside the rapid adoption of cloud services and artificial intelligence. Organizations are facing threats involving identity infrastructure, autonomous AI agents, software vulnerabilities, digital transactions, online fraud, and the misuse of emerging technologies. 

The Cyber Express Weekly Roundup 

Microsoft Confirms Exploited Entra ID Flaw 

Microsoft confirmed that a critical vulnerability in Entra ID, CVE-2026-69836, was exploited before the flaw was fixed server-side. The vulnerability carries a CVSS score of 10.0 and could allow unauthenticated attackers to achieve remote code execution, potentially affecting Microsoft’s cloud-based identity infrastructure. Read more... 

New Zealand Proposes Social Media Ban for Under-16s 

New Zealand has introduced legislation that would require high-risk social media platforms to prevent users under the age of 16 from accessing their services. Proposed age-verification methods could include digital identification, facial age estimation, or official identification documents. Read more... 

Cyble and DRONA Launch AI Cyber Defense Initiative in India 

Cyble and DRONA Cyber Solutions have launched an AI-powered cybersecurity initiative in Ahmedabad aimed at helping mid-sized businesses detect, investigate, and contain cyber threats. The initiative combines threat intelligence, AI-driven investigations, and endpoint enforcement to provide organizations with faster and more coordinated responses to security incidents. Read more... 

AI Agents Could Create New Cybersecurity Risks 

Adarsh Kant Sinha, CEO of ANVE.AI, warned that autonomous AI agents could introduce significant new cybersecurity risks as organizations increasingly allow them to interact with business-critical systems. AI agents may gain access to email, customer relationship management platforms, cloud infrastructure, and financial systems, potentially creating new avenues for misuse or compromise. Read more... 

Ledger Fixes Ethereum App Flaw Amid Disclosure Dispute 

Ledger said it fixed a clear-signing vulnerability in its Ethereum application approximately two weeks before security firm TestMachine publicly disclosed the issue. The vulnerability could potentially allow a malicious application to display one transaction to a user while preparing a different transaction for signing. Read more... 

Global Crackdown Nets 58 Arrests in West African Crime Networks 

An eight-month international law enforcement operation led by INTERPOL has resulted in 58 arrests and the identification of 263 suspects across 22 countries. Operation Jackal IV targeted West African criminal networks involved in cyber-enabled fraud, money laundering, romance scams, and investment scams. Read more... 

Weekly Cybersecurity Takeaway 

This week’s developments demonstrate that cybersecurity threats are crossing organizational, technological, and geographical boundaries, affecting cloud identity systems, artificial intelligence, digital platforms, cryptocurrency applications, and international financial crime.  Organizations should prioritize strong identity and access controls, rapid vulnerability remediation, careful management of AI-agent permissions, secure integrations, human oversight, and continuous threat monitoring.   As autonomous technologies become more deeply integrated into business operations and cybercriminal networks continue to operate across borders, security teams must adapt to a threat landscape that is becoming broader, more interconnected, and increasingly difficult to contain. 

This weekly roundup highlights a broad range of cybersecurity threats affecting government agencies, businesses, enterprise AI systems, and software platforms. From a major French tax authority breach to a critical GitLab vulnerability, recent incidents demonstrate how attackers continue to exploit sensitive data, digital systems, and emerging technologies. The latest developments also show that cybersecurity risks are expanding beyond traditional attacks. Organizations are increasingly facing threats involving sensitive customer information, AI-powered systems, supply-chain risks, software vulnerabilities, and potential interference with critical operations.

The Cyber Express Weekly Roundup

French Tax Authority Data Breach Hits 678,000 People 

France’s tax authority, DGFiP, confirmed a cyberattack that exposed tax and cadastral information belonging to 678,000 individuals and professionals. The accessed information includes tax income, withholding rates, business details, addresses, and property information. DGFiP said online accounts and passwords were not compromised and is continuing to investigate the incident. Read more... 

Cyberattack Targets Ukraine Agency Ahead of Major Asset Tender 

Ukraine’s Asset Recovery and Management Agency (ARMA) suffered a suspected cyberattack shortly before a major deadline to select a manager for assets linked to sanctioned Russian oligarch Mikhail Fridman. ARMA said the incident, combined with earlier cyber activity and increased information pressure, could indicate a coordinated attempt to disrupt its operations or influence the tender. Read more... 

Oz Hair and Beauty Data Breach Exposes Customer Information 

Oz Hair and Beauty confirmed that an unauthorized party accessed customer information, including names, email addresses, phone numbers, and purchase history. The company said credit card, banking, and home-address information were not compromised. The number of affected customers remains undisclosed, while an investigation into the breach continues. Read more... 

Enterprise AI Is Expanding the Cybersecurity Risk 

Guild Group’s Mohammad Arif warned that the rapid adoption of enterprise AI is creating new cybersecurity challenges as AI systems gain access to sensitive data, applications, and business workflows. Key concerns include shadow AI, data leakage, insecure integrations, AI supply-chain attacks, prompt injection, and AI-powered phishing. Read more... 

Critical GitLab Flaw Could Let Attackers Delete Public Projects 

GitLab patched a critical vulnerability, CVE-2026-19478, that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The flaw carries a CVSS score of 9.4. GitLab also addressed a high-severity GraphQL CSRF vulnerability, CVE-2026-19650. Read more... 

Weekly Cybersecurity Takeaway 

This week’s incidents demonstrate that cybersecurity threats are increasingly crossing organizational and technological boundaries, affecting government systems, customer data, enterprise AI, and software development platforms. Organizations should prioritize strong access controls, rapid vulnerability patching, data protection, AI governance, employee awareness, and continuous monitoring. As attackers continue exploiting both human trust and technical weaknesses, security teams must adapt to a threat landscape that is becoming broader, faster, and increasingly interconnected.

Every enterprise wants the upside of AI — faster workflows, sharper decisions, leaner teams. Far fewer have asked the harder question: what happens when the same systems delivering that upside are also quietly rewriting who, or what, has access to the crown jewels? Autonomous agents are now reading contracts, touching customer data, writing production code, and triggering workflows once reserved for trusted employees. The attack surface hasn't just grown — it's changed shape entirely. Mohammad Arif, Head of Information Security at Guild Group, has been on the front line of that shift, helping enterprise leaders separate genuine AI-driven cyber risk from the noise around it. In this interview with The Cyber Express, he makes the case that AI security isn't a niche technical concern to be handed off to a working group — it's a boardroom issue, sitting at the intersection of data protection, vendor risk, identity, and human accountability. His warning is blunt: organisations still treating AI security as tomorrow's problem are already behind, and the cost of catching up only rises from here.

The Cyber Expres: Everyone is talking about AI productivity. From a security leadership perspective, what is the biggest shift AI is creating for enterprises?

From a security leadership perspective, the biggest shift is that AI is changing the enterprise trust model. It is no longer only about protecting systems, networks, and users. Organisations now need to consider what AI can access, what data it can process, what decisions it may influence, and what actions it may trigger. AI can significantly improve productivity, cyber defence, and business decision-making. But the risk increases when adoption moves faster than governance. If AI tools are connected to sensitive data, enterprise workflows, identity systems, APIs, or business processes without clear controls, the risk is no longer just a technology issue. It becomes a data, privacy, operational resilience, and trust issue. So the real shift is this: AI is not just another productivity tool. It is becoming part of the enterprise operating model, and therefore it needs to be governed and secured like any other critical capability.

The Cyber Express: What worries you most about the current pace of AI adoption across organisations?

What worries me most is the gap between the speed of AI adoption and the maturity of AI governance. Many organisations are moving quickly to unlock productivity benefits, but they may not yet have clear rules around approved use cases, sensitive data handling, vendor assurance, retention of information, model outputs, and human accountability. The immediate risk is uncontrolled or "shadow" AI adoption, where employees or teams use public or unapproved AI tools without understanding what data is being entered, how that data may be retained, or whether it could be used to improve external models. This can create confidentiality, privacy, intellectual property, and regulatory risks. The challenge for enterprises is not to slow down innovation unnecessarily. The challenge is to enable AI safely — giving employees approved pathways to use AI, while putting the right controls around data protection, access, monitoring, and risk-based governance.

The Cyber Express: At what point does AI stop being just a productivity tool and become a real enterprise security challenge?

AI becomes a real enterprise security challenge when it moves from simply generating content to being connected to enterprise data, identity, applications, APIs, tools, and workflows. A standalone AI assistant used for drafting general content has a different risk profile from an AI agent that can access customer information, analyse internal documents, write code, trigger workflows, or make recommendations that people rely on. The risk increases further when AI has autonomy, can call external tools, or can operate across multiple systems. This is where agentic AI becomes important. The question is no longer only "what can the model say?" It becomes "what can the AI access, what can it do, and who is accountable for the outcome?" That is the point where traditional security controls need to extend into AI governance, identity, permissions, logging, monitoring, and human oversight.

The Cyber Express: Do you think most organisations are prepared for AI-driven cyber threats, or are many still treating AI security as a future problem?

Preparedness varies significantly. Some organisations are taking AI security seriously and are building governance, security review, data protection, and monitoring into their AI adoption programs. But many are still treating AI security as a future problem, even though AI is already inside the enterprise through productivity tools, SaaS platforms, coding assistants, analytics tools, third-party services, and employee-led experimentation. The issue is that AI adoption is often decentralised. It may start in business teams, technology teams, vendors, or individual users before the organisation has a complete view of the risks. That means security leaders need to shift from reactive control to proactive enablement. AI security readiness should include clear acceptable-use guidance, approved tools, data classification, vendor due diligence, secure development practices, incident response scenarios, awareness training, and monitoring. Without those foundations, organisations may not know where AI is being used, what data is exposed, or where the risk is accumulating.

The Cyber Express: What AI-related security incidents do you realistically expect enterprises to face over the next 12 months?

Over the next 12 months, I expect most enterprises to see AI-related incidents in a few practical areas. The first is AI-assisted social engineering. Phishing, impersonation, business email compromise, and executive fraud will become more convincing because AI allows attackers to generate personalised and credible content at scale. The second is sensitive data leakage into AI tools, which may happen when employees enter confidential business information, customer data, source code, contracts, security information, or internal documents into tools that have not been approved or assessed. The third is insecure AI integration. As teams connect AI to internal knowledge bases, applications, plugins, and workflows, weaknesses such as prompt injection, excessive permissions, poor output validation, or weak monitoring may create new attack paths. The fourth is AI supply-chain risk. Organisations increasingly rely on third-party models, APIs, datasets, plugins, open-source components, and AI-enabled SaaS platforms — each introducing dependencies that need to be assessed and monitored. So the threat is not one single scenario. It is an expanded attack surface across people, data, applications, vendors, and business processes.

The Cyber Express: AI-generated phishing and deepfakes are receiving significant attention. Have these threats become genuinely dangerous, or are they still more hype than reality?

They are genuinely dangerous, but the risk needs to be understood properly. The concern is not only that AI can create fake emails, voices, images, or videos. The bigger issue is that AI reduces the effort required to create believable, personalised, and scalable deception. Traditional phishing often had indicators such as poor grammar, generic wording, or obvious formatting issues. AI reduces those indicators. Attackers can tailor messages to specific roles, business processes, recent events, or organisational language. Deepfakes also create risk where organisations rely heavily on voice, video, or informal executive instructions for approvals or sensitive actions. This does not mean every organisation will face sophisticated deepfake attacks immediately. But it does mean that trust-based processes need to be strengthened. Payment approvals, changes to bank details, privileged access requests, sensitive data transfers, and executive instructions should have strong verification controls that do not rely on one communication channel alone.

The Cyber Express: Do enterprises fully understand the risks of feeding sensitive data, business context, or internal information into frontier AI systems?

Not always. Many organisations understand the general concern, but they may not fully understand the practical ways sensitive information can be exposed through AI usage. The risk is broader than simply entering customer data into a public tool. Employees may enter internal strategies, contracts, security designs, source code, incident information, board papers, commercial terms, or confidential business context. Even if the data is not used for model training, there may still be risks around retention, access, logging, jurisdiction, vendor terms, and downstream use. Enterprises need to apply the same discipline to AI that they apply to other sensitive platforms — understanding what data is allowed, which tools are approved, whether enterprise-grade privacy and security settings are enabled, how data is retained, and whether the vendor's contractual terms align with the organisation's obligations. The practical starting point is data classification. If organisations do not know what data is sensitive, they cannot consistently govern how that data should or should not be used with AI.

The Cyber Express: We have seen supply-chain attacks target software and open-source ecosystems. Could AI models, tools, plugins, agents, datasets, and integrations become the next major supply-chain risk?

Yes, AI supply-chain risk is likely to become a major area of focus. In traditional technology environments, organisations already assess software vendors, cloud providers, managed service providers, open-source libraries, and third-party integrations. AI expands that supply chain. The AI supply chain can include foundation models, fine-tuned models, datasets, model providers, APIs, plugins, orchestration platforms, vector databases, prompt libraries, AI coding tools, agent frameworks, and embedded AI features in SaaS products. A weakness or compromise in any of these areas can affect the confidentiality, integrity, or reliability of AI-enabled systems. A poorly governed dataset could introduce bias or inaccurate outputs. A vulnerable plugin could expose data. A compromised package could affect an AI-enabled application. An over-permissioned AI agent could access more information than it needs. These are not only technical risks; they are third-party, operational, and governance risks. Enterprises should therefore treat AI supply-chain assurance as part of broader cyber risk and vendor risk management, including due diligence, contractual controls, security testing, data protection review, monitoring, and clear accountability between the organisation and its providers.

The Cyber Express: How should security leaders rethink traditional cybersecurity strategies in a world where AI can write code, analyse vulnerabilities, automate tasks, and support attackers as well as defenders?

Security leaders should not abandon traditional cybersecurity principles. Instead, they need to extend them into AI-enabled environments. Identity and access management remains critical, but now we need to consider identities and permissions associated with AI agents, service accounts, APIs, and automated workflows. Data protection remains critical, but now we need to monitor prompts, outputs, embeddings, and knowledge retrieval systems. Secure development remains critical, but now we need to assess AI-generated code, model behaviour, prompt injection risks, and third-party AI components. The same applies to monitoring and incident response. Security teams need visibility into AI usage, unusual activity, sensitive data exposure, misuse of AI tools, and unexpected agent behaviour. Incident response plans also need to consider AI-specific scenarios such as data leakage through AI platforms, compromise of AI integrations, prompt injection, poisoned data, or misuse of AI-generated code. The key point is that AI security should not sit outside the cybersecurity operating model. It should be integrated into governance, architecture, procurement, engineering, monitoring, awareness, and incident response.

The Cyber Express: Are existing cybersecurity teams equipped to handle AI-era threats, or does the industry need new skills and operating models?

Existing cybersecurity skills remain highly relevant, but they need to be expanded. The fundamentals still matter: identity, data protection, secure architecture, vulnerability management, incident response, third-party risk, and governance. However, AI introduces new concepts that security teams need to understand. Security professionals now need AI literacy — how large language models work at a practical level, how AI applications are integrated, how prompts and outputs can be manipulated, how retrieval-augmented generation works, how AI agents interact with tools, and how AI supply chains are structured. The operating model also needs to evolve. AI security cannot be owned by security alone. It requires collaboration between cybersecurity, technology, data, privacy, legal, risk, procurement, HR, and business teams. In many organisations, the most effective model will be a cross-functional AI governance group supported by security-by-design processes. So yes, the industry needs new skills, but not at the expense of existing cybersecurity disciplines. The future is a combination of traditional cyber expertise, AI literacy, risk management, and business enablement.

The Cyber Express: AI vendors promise speed, scale, and automation. Where should organisations avoid over-relying on AI in cybersecurity and business decision-making?

Organisations should avoid over-relying on AI in areas where decisions are high-impact, sensitive, difficult to reverse, or require strong judgement. AI can assist, but accountability should remain human. In cybersecurity, this includes incident severity decisions, containment actions, identity and privileged access approvals, regulatory interpretation, legal assessments, and decisions that could materially affect customers, employees, or critical operations. AI can help summarise information, detect patterns, prioritise alerts, and recommend actions, but those recommendations should be validated by qualified people. There is also a risk of automation bias, where people trust AI outputs because they appear confident or well-structured. That can be dangerous if the output is incomplete, inaccurate, or based on weak context. Organisations need clear rules for where AI can automate, where it can recommend, and where human approval is mandatory. A practical principle is this: the greater the potential impact, the stronger the need for human oversight, auditability, and accountability.

The Cyber Express: If you were advising enterprise leaders today, what are the first three things they should do to prepare for the security impact of frontier AI models?

The first priority is to establish AI governance. Organisations need clear policies on approved use cases, acceptable tools, data handling, human oversight, and accountability. Governance should not be theoretical — it needs to be embedded into procurement, technology delivery, data management, security review, and business processes. The second priority is to protect sensitive data before scaling AI adoption. This means strengthening data classification, access controls, data-loss prevention, retention rules, and monitoring. Enterprises should know what data can be used with AI, under what conditions, and through which approved platforms. The third priority is to integrate AI into the cyber risk management operating model — including third-party risk assessments, threat modelling, secure development, incident response, employee awareness, logging, monitoring, and assurance activities. Security teams should also start preparing for AI-specific risks such as prompt injection, insecure integrations, sensitive data exposure, excessive agency, and AI supply-chain compromise. AI can create significant value, but only if organisations adopt it with discipline. The organisations that treat AI security as a future issue may already be behind.

"AI adoption without governance is not innovation — it is unmanaged risk. The next phase of enterprise security is about controlling what AI can access, what it can do, and who remains accountable." — Mohammad Arif, Head of Information Security, Guild Group

This weekly roundup highlights the expanding range of threats facing businesses, technology platforms, and individuals. From social engineering attacks against corporate systems and vulnerabilities uncovered by AI agents to large-scale software patches and cyberattacks disrupting logistics operations, recent incidents demonstrate how quickly the threat landscape is evolving.  The latest developments also show that cybersecurity risks are no longer limited to traditional malware or ransomware. Attackers are increasingly exploiting human behavior, software weaknesses, interconnected supply chains, and personal online accounts. At the same time, artificial intelligence is emerging as both a defensive tool and a new way to identify security weaknesses. 

The Cyber Express Weekly Roundup 

Levi Strauss Targeted in Cyberattack, Corporate Files Accessed 

Levi Strauss & Co. disclosed a cybersecurity incident after attackers used social engineering techniques to gain access to three company-issued computers. The company believes certain corporate files were accessed and some information may have been exfiltrated. Levi Strauss said it moved quickly to contain the incident and terminate the unauthorized access, limiting the potential impact of the attack. Read more...

AI Agent Exploits Gym Booking Vulnerability 

An AI-powered agent reportedly identified an authentication weakness in an Australian gym’s online booking system. The agent, powered by Anthropic’s Claude and operated through OpenClaw, was originally instructed to help a user book a popular class. During the process, it was able to reserve classes months ahead and cancel another customer's booking. Read more...

AI Will Automate Cybersecurity Toil, Not Replace Security Professionals 

Harsha Reddy, Head of Information Security at Veterinary Emergency Group, argues that artificial intelligence is more likely to transform cybersecurity work than eliminate cybersecurity jobs. AI can assist with repetitive activities such as reviewing logs, triaging alerts, and collecting evidence, allowing security professionals to concentrate on investigation, strategy, and higher-value defensive operations. Read more...

Microsoft Fixes More Than 400 Security Flaws 

Microsoft’s August 2026 Patch Tuesday addresses roughly 400 vulnerabilities across its products, including three zero-days. One of the vulnerabilities was reportedly being actively exploited, while two others had been publicly disclosed before patches became available. The update includes 42 critical vulnerabilities, with 37 associated with remote code execution, reinforcing the importance of timely patching across enterprise environments. Read more...

CEVA Logistics Cyberattack Disrupts European Operations 

A cyberattack against CEVA Logistics disrupted activity at eight European warehouses on July 29, affecting shipments and exposing customer data connected to several major clients. The logistics company, part of the CMA CGM Group, has not publicly identified the attackers or provided detailed information about the technical nature of the incident. Read more...

FBI Warns of Theft of Explicit Content From Social Media 

The FBI has warned that cybercriminals are targeting social media and personal accounts to steal explicit images and videos, including non-consensual intimate images. Stolen material may subsequently be distributed or sold online, while associated personal information can expose victims to harassment, stalking, and sextortion. Read more...

Weekly Cybersecurity Takeaway 

This week’s incidents demonstrate that cybersecurity risks are expanding across corporate networks, software ecosystems, supply chains, AI-powered systems, and personal accounts.  Organizations should prioritize strong authentication, rapid vulnerability patching, employee awareness, third-party risk management, and continuous monitoring. At the same time, responsible use of AI could help security teams reduce repetitive workloads and respond more effectively to emerging threats.  As attackers continue finding new ways to exploit technology and human trust, organizations and individuals must strengthen security controls while remaining prepared for threats that increasingly cross traditional digital boundaries. 

💾

This weekly roundup highlights the growing cybersecurity risks affecting businesses, government agencies, and critical service providers. From the continued dominance of ransomware operations to government database breaches and third-party supply chain incidents, recent events demonstrate how attackers are increasingly targeting trusted systems and external service providers to maximize disruption and data exposure.  The latest developments reinforce that cyber threats are no longer limited to direct attacks on organizations. Threat actors are exploiting ransomware-as-a-service ecosystems, compromising government registries, targeting law enforcement databases, and abusing third-party platforms that support retail and healthcare operations.   Organizations must strengthen third-party risk management, improve data protection measures, and enhance incident response capabilities to reduce the impact of evolving cyber threats. 

The Cyber Express Weekly Roundup 

Qilin Dominated Ransomware Attacks in H1 2026 

Qilin emerged as the most active ransomware group during the first half of 2026, targeting organizations worldwide through its ransomware-as-a-service (RaaS) operation. Manufacturing, healthcare, construction, and professional services were among the sectors most affected as the group continued expanding its global reach. Read more… 

Hackers Breach Beneficial Owners Registry, Expose Data of 31,000 Firms 

Hackers breached the Register of Beneficial Owners (VwbP), gaining unauthorized access to data associated with approximately 31,000 legal entities. Authorities temporarily took the registry offline, launched an investigation, and established a crisis response team, stating there is currently no evidence that records were altered or deleted. Read more… 

PNLD Data Breach Leaks Police and Government Contact Details 

A data breach involving the Police National Legal Database (PNLD) exposed names, organizations, and work email addresses belonging to police officers, government partners, criminal justice professionals, and some Ask the Police users after the information appeared on the dark web. Authorities are investigating the incident and assessing its potential impact. Read more… 

De Bijenkorf Logistics Cyberattack Delays Orders and Raises Data Exposure Concerns 

A cyberattack targeting a third-party logistics provider disrupted deliveries, returns, and refunds for Dutch retailer De Bijenkorf. While the retailer confirmed its internal systems were not compromised, investigators are assessing whether customer contact details and order information were exposed. Payment information, passwords, and financial data were not affected, and customers have been advised to remain vigilant against phishing attempts. Read more… 

Updoc Data Breach Exposes Customer Contact Information 

Australian telehealth provider Updoc disclosed a data breach after unauthorized access to a third-party operational platform exposed some customers' names, email addresses, and postal addresses. The company confirmed that its internal systems remained secure and that no medical records, payment information, or financial data were compromised. Read more… 

Weekly Cybersecurity Takeaway 

This week's incidents highlight the continued evolution of cyber threats across ransomware operations, government data breaches, and third-party supply chain compromises.  A common theme across these events is the growing risk posed by trusted third-party platforms and shared digital ecosystems. Attackers are targeting external service providers, government databases, and ransomware affiliate networks to expand their reach and maximize operational disruption.  Organizations should prioritize stronger third-party risk management, continuous monitoring, robust access controls, and timely incident response to reduce the impact of supply chain attacks and data breaches. As businesses become more interconnected, strengthening the security of partner ecosystems is becoming just as important as protecting internal infrastructure. 

The Updoc data breach has raised fresh concerns about cybersecurity in Australia's healthcare sector after the telehealth provider confirmed that an unauthorized third party may have accessed customer contact information through an external system.   The data breach at Updoc, disclosed on August 7, stemmed from a brief security incident involving a third-party platform that supports the company's operations. While the Updoc cyberattack did not expose medical or financial records, it is the latest cyber incident affecting Australia's healthcare sector. 

Updoc Data Breach Traced to Third-Party Platform 

Updoc, an Australian telehealth provider offering round-the-clock online healthcare services, including medical certificates, prescriptions, and specialist referrals, detected unauthorized access to a third-party operational system on Friday, July 31.  In a statement shared with The Cyber Express, the company said the incident was limited to an external system used to support its operations. The exposure was confined to customer contact information, which may have included account holders' names, email addresses, and postal addresses.  Updoc said its internal systems were not accessed during the incident and confirmed that no health records, financial information, or payment details were involved. The company added that it acted immediately to block the unauthorized access and found no evidence of any further activity after the initial event.  According to the company, customers are not required to take any immediate action because account logins and security remain unaffected. Updoc also apologized for any concern or inconvenience caused by the incident. 

Updoc Cyberattack Adds to Healthcare Sector Threats 

Founded in 2021, Updoc generates approximately $10 million in annual revenue. According to its founders, the platform has served more than one million patients since launch, while its website states that it has over 500,000 users.  The Updoc cyberattack follows a series of cybersecurity incidents targeting Australian healthcare and consumer-facing organizations. In June, clinic network Partnered Health disclosed a cyberattack in which hackers stole personal information and health records from patients across at least 21 clinics in five Australian states.  That breach exposed sensitive information, including medical records, Medicare numbers, consultation notes, referral letters, and pathology results. The attack affected clinics in Melbourne, Sydney, Canberra, the Gold Coast, Sunshine Coast, and Coffs Harbour. At the time, another five clinics, including several in Western Australia, remained under investigation.  Although the Updoc data breach was limited to contact information and did not compromise medical or payment data, the data breach at Updoc highlights the risks associated with third-party service providers. As healthcare organizations continue to depend on external platforms, the incident underscores how vulnerabilities outside a company's own infrastructure can still result in customer information being exposed.