Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems.   The disclosure adds to a wave of airline cyberattacks that has now hit at least 15 carriers across Asia, Europe and Australia, and it highlights how cyberattacks on airlines reach passengers through shared third-party platforms rather than airlines' own networks. 

What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident 

SIA briefed the media on 3 November 2026. According to the airline, most of the affected records contained passengers' names, booking reference numbers, travel itineraries and booking classes.  A smaller group of about 620 records carried more sensitive details. For these, email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been viewed.  The airline said no bank account or credit card data was exposed and no bookings were altered. SIA also stated that its own IT systems were not breached. It is reaching out directly to affected customers who have upcoming trips so they can change their booking reference numbers. 

Cathay Pacific: 53,000 Bookings Accessed Over Three Years 

Cathay Pacific went public with its own statement on 30 October 2026, updated at 16:11 HKT (GMT+8) that day. The Hong Kong carrier said Amadeus first notified it on 28 October 2026 and shared further details on 29 October.  According to Cathay, an unauthorized party had gained access to travel reservation data in Amadeus's systems "using login credentials assigned to its system account." Data supplied by Amadeus showed that around 53,000 Cathay Pacific bookings were affected, with the unauthorized access running from August 2023 to September 2026.  In most cases, the exposed information covers booking references, passenger names, and flight details. In a smaller subset, email and phone contacts, travel document details, and frequent flyer numbers may also have been accessed. Cathay said there is no evidence that financial or payment data was touched.  The airline said Amadeus has contained the incident, including through a password reset, and has added enhanced monitoring and detection on its systems. Amadeus has so far found no evidence that the data has been misused.  Cathay stressed that the incident "has not impacted and is not impacting" its own systems or operations. It has informed the relevant authorities that they are still analyzing the information from Amadeus and plans to notify affected customers individually once the details are confirmed. "We apologise to our customers for the concern and inconvenience caused by this incident," the airline said. 

Malaysia Airlines Urges Vigilance 

Malaysia Airlines issued its notice on 31 October 2026, describing Amadeus as its third-party airline reservation technology provider. The carrier said some customer information processed through Amadeus between August 2023, and September 2026 may have been affected.  The airline said its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It is working with Amadeus and other relevant parties to investigate and gauge the impact.  As a precaution, Malaysia Airlines asked customers to stay alert to suspicious or unsolicited messages, "particularly those requesting personal or financial information." The carrier said it would share further updates as more information emerges. 

Japanese and Korean Carriers Report Similar Airline Cyberattacks 

Japan Airlines (JAL) reported earlier that Amadeus had informed it of unauthorized access to reservation records for both JAL and Japan Transocean Air flights. About 92,000 customers were affected, making JAL the hardest-hit carrier so far. Names, booking references, and flight information were exposed.  Korean Air and Asiana Airlines also confirmed unauthorized access to data managed by Amadeus. Both said there was no evidence that their internal systems or databases had been breached. 

How Amadeus Explains the Breach 

Amadeus has attributed the exposure to a software glitch that made certain booking-display data accessible. That explanation sits alongside Cathay Pacific's account, which describes an unauthorized party using system account login credentials.  The company said its investigation is continuing and that it has found no evidence of payment or financial information was accessed. Amadeus also said there is no sign that the vulnerability was used for ransomware. It has since rolled out fixes, together with stronger monitoring and detection measures. 

The Full Reach of These Cyberattacks on Airlines 

At least 15 international airlines are either confirmed as directly affected or are investigating possible customer data exposure from the supply-chain attack on the Spanish IT and reservations company. Because the breach hit a centralized booking display environment, it reached flag carriers as well as the regional partners that route reservations through them. 

Major carriers with confirmed exposure 

Airline	Reported impact
Japan Airlines (JAL)	About 92,000 passenger records
Cathay Pacific Airways	About 53,000 passenger bookings
Singapore Airlines (SIA)	About 46,000 booking records
All Nippon Airways (ANA)	Up to 37,800 customer profiles
Malaysia Airlines	Customer data exposed across August 2023 to September 2026
Korean Air	Unauthorised access to customer reservation databases
Asiana Airlines	Passenger booking references exposed through system account credentials
Condor Airlines	Part of the German leisure carrier's international flight data accessed

 

Regional and subsidiary carriers 

Several smaller airlines were drawn in because they share back-end ticketing technology or corporate ties with the larger groups: 

Airline	Link to the breach
Japan Transocean Air (JTA)	Affected through parent company Japan Airlines
Air Do	Affected through shared system pathways with ANA
StarFlyer	Affected through shared system pathways with ANA
Solaseed Air	Affected through shared system pathways with ANA
Ibex Airlines	Still determining the scope of exposure via its ANA integration
Oriental Air Bridge	Still determining the scope of exposure via its ANA integration

Under investigation 

Qantas Airways is formally investigating whether any Australian customer files were compromised. The airline maintains that its internal databases have not been breached. 

What the Amadeus Cybersecurity Incident Means for Travelers? 

With the access window stretching from August 2023 to September 2026, the Amadeus cybersecurity incident spans more than three years and stands out among airline cyberattacks for how many carriers it touched through a single provider. None of the affected carriers has reported misuse of the data so far, and no airline has said payment details were taken.   Even so, names, itineraries and booking references can be enough for convincing phishing attempts. That is why carriers such as Malaysia Airlines and SIA are asking passengers to watch for suspicious messages and, where advised, change their booking references.   As investigations continue, more airlines may update their figures on how far these cyberattacks on airlines have reached. 

Emergency alert app cyberattacks in Russia and Ukraine triggered a series of false warnings, including alerts about air raids, radiation threats, chemical attacks and alleged nuclear strikes. Ukrainian authorities said their air raid warning application had been affected, while Russian officials reported a separate attack on their emergency alert app hours later. The incidents raised concerns about the reliability of digital public warning systems during an ongoing conflict. According to BBC live reporting, Ukraine's air raid app issued false red-level air raid warnings nationwide. Some residents, including people in Kyiv, also received warnings about radiation, chemical attacks and street fighting. Ukrainian authorities cancelled the alerts within an hour and urged residents to disregard suspicious messages. Russia subsequently reported that its emergency alert app had also been targeted. The extent of the false warnings distributed through the Russian application remained unclear.

Emergency Alert App Cyberattacks Trigger False Warnings

Ukraine was the first to report problems with its emergency alert application, which is supported by the country's Ministry of Digital Transformation and provides notifications about the beginning and end of air defence alerts. Following the incident, the Ukrainian Air Force said the application had probably experienced hostile interference. It specifically denied that Kyiv faced the radiation threat indicated by the false alerts and asked residents to remain calm and follow official updates. Ukraine's Centre for Strategic Communications also urged users to disregard strange messages appearing in the application. The centre blamed Russia for the incident in a post on X and highlighted an alert containing a message in Russian about the Oreshnik missile system. The supplied reporting does not establish how the attackers gained access to the application or how the false messages were inserted into the alert system.

Russia's Emergency App Issues False Nuclear Warning

Several hours after Ukraine reported the incident, Russian authorities said their emergency alert application had suffered what they described as a massive cyberattack. One false message reportedly warned Russian residents that nuclear warheads mounted on P1-Suns, identified in the message as a Ukrainian attack drone, had been launched towards all regions of Russia. The alert also instructed people to stock up on food for three weeks and hide. A Ukrainian espionage group claimed that fake nuclear strike warnings had been sent to users in Russia. However, the available reporting did not independently establish who was responsible for the Russian application incident. Russia's emergencies ministry said the mobile application was an additional information service and that the wider public warning system continued to operate normally. The ministry said emergency information was also distributed through sirens, loudspeakers, text messages, television and radio broadcasts. It added that specialists were working to restore the application and described the situation as under control.

Cybersecurity Expert Warns of Further Attacks

Herbert Lin, a senior research scholar specialising in cyber policy and security at Stanford University, described the reported compromise of Ukraine's air raid warning application as concerning. Speaking to the BBC's Newsday programme, Lin said he believed it was the first time an official Ukrainian information application had experienced such an incident. He warned that similar attacks could occur again but stressed that the method used to compromise the application was not yet known. The incident highlights the potential consequences of interference with emergency alert systems, which are designed to deliver time-sensitive information to people facing security threats. False warnings can create uncertainty about whether a reported threat is genuine, particularly when residents rely on mobile applications for immediate updates during military attacks. However, the supplied reporting does not establish the wider impact of the incidents on public behaviour or emergency response operations.

False Alerts Coincide With End of Kherson Ceasefire

The false warnings in Ukraine appeared just minutes before the scheduled end of a localised ceasefire in the frontline Kherson region, according to BBC reporting. The six-day ceasefire involving the area around Oleshky, which has been under Russian occupation since 2022, had enabled hundreds of people to evacuate. The arrangement was brokered with assistance from US First Lady Melania Trump and Pope Leo XIV. Both sides had accused each other of using the ceasefire period to strengthen their frontline positions. Ukrainian officials said the humanitarian operation could provide a basis for further solutions, although the Kremlin viewed such operations as separate from the wider peace process. The timing of the false alerts was reported, but the available information does not establish that the cyber incidents were connected to the ceasefire or its conclusion.

Russia and Ukraine Continue Exchanging Energy Strikes

The reported cyberattacks on Russia and Ukraine occurred amid continued strikes against energy infrastructure on both sides. Russian authorities reported drone strikes against an industrial enterprise east of Moscow, identified by Ukrainian media as the Kstovo oil refinery. Nizhny Novgorod regional governor Gleb Nikitin reported significant damage, possible power outages and reduced hot water supplies. One woman was reportedly injured by falling drone debris. Ukrainian President Volodymyr Zelensky also said Russian strikes had hit energy infrastructure in four Ukrainian regions, leaving hundreds of thousands of homes without power. The emergency application incidents add another layer of concern to the conflict, where digital information services are used to communicate immediate threats to civilians. Investigations into the reported attacks, including who was responsible and how the applications were compromised, remain unresolved in the supplied reporting.

The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and Australia.

The advisory was released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the United States Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency and the UK’s North West Regional Organised Crime Unit. It draws on investigations conducted as recently as August 2026.

How SafePay Ransomware Gains Initial Access

According to the agencies, SafePay actors break into networks by stealing or guessing passwords, running brute force attacks, using phishing and exploiting VPN access. The group uses IP addresses from the VPN provider Mullvad and phished account profiles to exploit two flaws in edge devices: CVE-2020-3259 and CVE-2023-20269.

The actors also use automated scripts to exploit three vulnerabilities in internet-exposed systems: CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

Living Off the Land Inside Victim Networks

Once inside, SafePay actors establish persistence by gaining administrative privileges on existing accounts or creating new ones. They rely on built-in tools such as PsExec, Windows Remote Management and Remote Desktop Protocol to execute commands and move laterally.

To find valuable files, the group has used ShareFinder.ps1 and SharpShares.exe to enumerate network shares. Before moving laterally, the actors commonly disable security software. In some cases, they changed system users’ passwords, locking legitimate users out. The advisory also notes the use of a User Account Control bypass, token impersonation and the credential dumper Mimikatz.

Data Exfiltration Before Encryption

Data exfiltration is a central part of the group’s playbook. SafePay actors compress files using 7-Zip, WinRAR, FileZilla and RClone, then move stolen data out through WinSCP, RClone, OneDrive and the Backblaze command-line tool b2.exe. Remote desktop tools such as AnyDesk and TeamViewer have been installed to transfer ransomware onto victim systems.

To block recovery, the actors halt the Volume Shadow Copy Service and reset network attached storage holding backups to factory settings.

Files are then encrypted using a hybrid scheme combining the ChaCha20 stream cipher with RSA public-key cryptography. Encrypted files carry the .SafePay extension and, according to the advisory, cannot be recovered without the decryption key.

The group typically demands a portion of company revenue in cryptocurrency. A ransom note left on the desktop or root directory directs victims to a TOR chat portal, using a victim ID to log in. A representative also makes phone calls to pressure victims. If payment is refused, stolen data is posted to SafePay’s leak site. The ransomware may delete itself after encryption.

SafePay Ransomware Advisory: Recommended Defenses

To reduce the risk of ransomware attacks from SafePay, the agencies urge organizations to prioritize patching known exploited vulnerabilities, especially on firewalls and other internet-facing systems. They recommend requiring multifactor authentication for webmail, VPNs and accounts that access critical systems.

Other measures include passwords of 15 to 64 characters, account lockouts after failed logins, offline backups that are encrypted and immutable, network segmentation, least privilege access and time-based admin access. The advisory also recommends restricting command-line and scripting permissions.

The advisory lists IP addresses, file names, hashes and hostnames observed between November 2024 and August 2026. The agencies advise verifying these indicators before blocking, as some IP addresses may later be reassigned to benign services.

The authoring agencies do not encourage paying ransom, noting payment does not guarantee file recovery. Incidents can be reported to the FBI’s Internet Crime Complaint Center, a local FBI or Secret Service field office, or CISA. In the UK, victims can report through Report Fraud or their local police force.

site-verification-ok

Morocco’s cybersecurity strategy is placing greater emphasis on proactive threat detection, critical infrastructure protection and artificial intelligence as the country strengthens its defenses against evolving cyber threats. Abdellatif Loudiyi, Minister Delegate to the Head of Government in charge of National Defense Administration, said securing information systems has become a necessity as digital transformation accelerates. Speaking at the opening of National Cybersecurity Week in Rabat on Monday, Loudiyi stressed that cybersecurity must be integrated into institutional governance rather than treated as an additional expense. He called for stronger preparedness, early threat detection and coordinated responses to cyber incidents. The event, organized by the General Directorate of Information Systems Security under the National Defense Administration, runs from October 12 to 14 under the theme “Cybersecurity in the service of digital transformation and development.”

Morocco Cybersecurity Strategy Emphasizes Proactive Defense

Loudiyi said cyberattacks have become a tangible reality affecting countries worldwide, including developed nations. Their consequences have raised awareness among public and private institutions about the importance of cybersecurity in managing risks and protecting operations. He argued that organizations can no longer rely on responding to incidents after they occur. Instead, they need an approach centered on preparedness, vigilance, early detection, and response. According to the minister, these responsibilities must begin at the highest levels of institutional decision-making and extend across organizations, with each component accountable for its role. He also emphasized that cybersecurity resilience requires continuous work. As attackers develop new methods, institutions must regularly review protection measures, assess system readiness, and adapt their defenses to emerging threats.

Five Pillars to Strengthen National Cybersecurity

The minister outlined five interconnected areas supporting Morocco’s efforts to establish a coordinated national cybersecurity framework. These include a clear legal and regulatory framework, the development of human, technical and financial capabilities, greater public awareness and a stronger cybersecurity culture, enhanced monitoring and response capabilities, and regional and international cooperation. Loudiyi stressed that these elements must function together to strengthen national resilience. He also highlighted the shared responsibilities of government authorities and organizations operating information systems. While the General Directorate of Information Systems Security exercises its legally defined powers, individual system owners must protect their systems and allocate the resources required to do so. The minister said this integration of responsibilities is essential to building a cohesive national cybersecurity system.

AI Threats and Critical Infrastructure Protection Take Priority

Looking ahead, Loudiyi identified four priorities for the next phase of Morocco’s cybersecurity efforts: training specialized cybersecurity professionals, supporting national cybersecurity companies, strengthening critical infrastructure protection, and addressing the challenges associated with artificial intelligence. He described artificial intelligence in cybersecurity as a dual-use capability that can benefit both attackers and defenders. While attackers can use AI to support malicious activities, defenders can apply the technology to detect threats earlier and accelerate incident response. The emphasis on specialized training also reflects the need to develop the expertise required to address increasingly complex cybersecurity challenges. Supporting national companies is another priority identified by the minister as part of the broader effort to strengthen the country's capabilities. Loudiyi said these priorities should help Morocco prepare not only for existing threats but also for risks that may emerge as technologies and attack methods evolve.

Morocco Calls for Stronger International Cybersecurity Cooperation

Loudiyi also highlighted the role of cybersecurity cooperation in strengthening national defenses. He said Morocco remains committed to initiatives and mechanisms that promote collaboration between countries, with particular attention to its African and Arab partners. He presented cybersecurity as a shared responsibility requiring coordination, investment in skills and a sustained culture of awareness and vigilance. The minister concluded that a secure digital environment depends on collective efforts to protect information systems and maintain trust as digital transformation advances. National Cybersecurity Week provides a platform for these discussions through roundtables and workshops involving decision-makers, cybersecurity experts and industry professionals. The October 12 to 14 program is intended to encourage dialogue and the exchange of views on key cybersecurity challenges and approaches to addressing them.

The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion. The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income. South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions.

Shinhan Bank Cyberattack Under Investigation

Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems. The bank immediately formed a response team and took measures aimed at limiting further damage. These measures included blocking access from external IP addresses and suspending the affected services. The bank said it had completed safety measures related to the incident. Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack. Experts said the bank may not have been specifically targeted, but could instead have been caught in attacks against vulnerable online platforms. The Financial Supervisory Service sent a team to the bank to examine the incident. Its investigation is expected to take months as officials determine the nature and extent of the data exposure.

AI Agent-Assisted Attacks Raise Concern

The suspected use of AI has added another concern to the Shinhan Bank breach. Cybersecurity experts said AI tools originally developed or shared for defensive purposes can also be adapted for malicious activity. Mun Chong-hyun, director at cybersecurity firm Genians, said several recent attacks in South Korea have involved such AI tools. He described the technology as a double-edged sword because capabilities created for cybersecurity can also be used to facilitate cybercrime. The concern is not limited to Shinhan Bank. An industry official said the wider financial sector could be exposed to AI agent-assisted attacks, and that financial institutions should conduct their own security checks to identify potential weaknesses and abnormal access attempts. The incident also highlights the type of information that can be exposed in attacks against banks. Unlike a breach involving only basic contact information, the Shinhan incident reportedly exposed both personal details and financial information.

South Korean Banks Face More Data Breaches

The Shinhan Bank cyberattack comes amid several recent incidents affecting South Korean lenders. KB Kookmin Bank said last Friday that personal information belonging to 119 customers had been leaked following an external intrusion. Hana Bank also reported a separate hack affecting 89 customers. South Korea’s Financial Services Commission has already held a meeting with local banks over the recent breaches and is expected to hold another meeting this week. The latest incidents have raised concerns about how AI-powered hacking could affect the financial sector, particularly if attackers can use automated tools to identify vulnerable systems or support attacks at greater scale. The Shinhan incident is relatively small compared with some of South Korea’s largest data breaches in terms of the number of affected people. However, the combination of personal and financial information makes the breach significant. Sungho Hwang, Korea country manager at NordVPN, said the exposed information could be used to create personalized scams. He also noted that generative AI has made such scams more convincing.

South Korea Faces Wider Cybersecurity Pressure

The banking incidents come as South Korea cyberattacks have increased across other sectors. Cyberattacks targeting South Korean military systems reached 18,951 cases in 2025, the highest annual figure in five years. The number was up 31 percent from 2024 and 108 percent from 2022. South Korea has also expanded its use of AI for defensive cybersecurity. The Ministry of Education and the Korea Education and Research Information Service operate an AI-based system designed to detect suspicious activity and issue automated alerts across 435 monitored institutions. In 2025, the system detected about 480 million potential cyber threat indicators, of which around 86,000 were confirmed as actual intrusions. As the investigation into the Shinhan Bank breach continues, the suspected role of AI is adding to concerns that financial institutions may need to account for increasingly automated forms of cyberattacks.

Google is limiting access to Gemini 4 Argon, its new artificial intelligence model capable of autonomously finding, validating and patching critical software vulnerabilities, to a vetted group of cybersecurity experts. The restricted rollout is intended to give defenders access to the model's capabilities while Google strengthens safeguards against potential misuse by malicious actors. Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google, announced the model on September 30, 2026. Google is initially distributing it through its Fairwind Program and plans to expand access after gathering feedback from trusted testers and refining its security measures. The decision puts the focus on a central cybersecurity challenge: AI that can help security teams identify and fix weaknesses could also provide capabilities that attackers might misuse to discover and exploit vulnerabilities.

Gemini 4 Argon Discovers Critical Software Vulnerabilities

Google says Gemini 4 Argon can identify, validate and patch vulnerabilities across complex software environments. Its reported capabilities include examining codebases, identifying potential exposures and producing evidence to validate security weaknesses. In an early deployment, cybersecurity company Wiz used Argon through its Scan for Good initiative, which focuses on identifying and remediating high-risk exposures affecting critical public infrastructure. According to Google, the model discovered a critical vulnerability that exposed sensitive personal information in healthcare software used by hospitals worldwide. The company said previous frontier AI models had missed the issue but did not publicly identify the affected software or provide technical details about the flaw. On CWE-bench v1, a benchmark designed to evaluate vulnerability remediation, Argon tied for first place with a score of 68%. Google also reported improvements over its earlier 3.8 Flash Cyber model in internal testing. On Wiz's internal black-box penetration testing benchmark, Argon performed better at identifying attack surfaces, discovering vulnerabilities and generating proof-of-concept evidence to validate its findings. These results are based on Google's and its partners' reported evaluations. They do not establish how reliably the model will identify vulnerabilities across every real-world environment.

Why Google Is Limiting Access to Gemini 4 Argon

Google is taking a phased approach because the model's advanced capabilities require additional safeguards before wider deployment. For defenders, automated vulnerability discovery could help identify weaknesses earlier and reduce the time needed to investigate and remediate them. However, similar capabilities could also be misused to locate weaknesses in systems that attackers want to compromise. Google said trusted cyber defenders and its own internal teams will receive access to Argon without cyber-specific guardrails so they can use its full defensive capabilities. The company is also participating in the US government's voluntary process for pre-release AI model access. Google has not announced a specific date for general availability. It said it will continue evaluating feedback from early testers while strengthening protections against misuse.

Prompt Injection Attacks Among Key Security Concerns

Google has identified several areas where it is strengthening safeguards before expanding access to Gemini 4 Argon. One is prompt injection attacks, in which malicious instructions hidden in external content attempt to manipulate an AI model's behavior. Google said Argon demonstrated improved resilience against indirect prompt injection on Gray Swan's Indirect Prompt Injection benchmark. The company is also testing protections against requests that could facilitate cyberattacks or the development of chemical, biological, radiological and nuclear threats. Google said internal and external red teams assessed these safeguards using manual and automated attack methods. Additional measures monitor the model's reasoning and actions for potential misalignment, with mechanisms designed to stop execution when necessary. Google is also hardening isolated testing environments used for high-risk training and evaluations. These measures are intended to reduce risks, but the announcement does not establish that every possible misuse scenario or security failure has been eliminated.

Gemini 4 Argon Availability and Pricing

Google plans to expand access to Gemini 4 Argon after gathering feedback and continuing its safeguards work. Paid API customers and Google AI Ultra subscribers are expected to be among the first groups to receive broader access. The announced introductory API pricing is $2 per million input tokens and $10 per million output tokens. Cached input tokens receive a 95% discount on the standard input price. For cybersecurity teams, the key issue is whether the model's reported vulnerability discovery capabilities translate into reliable results across production systems. Its wider rollout will also test whether safeguards can keep pace with AI systems capable of supporting both vulnerability remediation and offensive security techniques.

A Burnaby School District cyberattack is being investigated after an incident disrupted internal network services and phone lines across the district. The Burnaby School District said the cyber incident came to its attention on Monday, September 21, and that staff are working to contain the incident and restore affected services. The district has not disclosed whether any personal or sensitive information was accessed or stolen. However, the disruption has raised concerns about potential data leaks as the investigation continues.

Burnaby School District Cyberattack Disrupts Operations

According to the district, the incident has affected some systems and operations, including internal network services and phone lines. Staff across Burnaby Schools are working to restore normal operations while limiting the impact on students. The district said the disruption has not affected student learning and that staff are working to ensure schools can continue supporting students. Families, staff, and district partners were contacted earlier in the week about the incident. The district said it will provide additional updates as efforts to contain the incident and restore services continue. The investigation remains ongoing, and the district has not provided further details about the nature of the incident, the suspected attackers, or whether information was compromised. The latest incident follows other school district cyberattacks and cybersecurity incidents that have disrupted education services and raised concerns about the security of student and staff information.

Education Sector Faces Repeated Cybersecurity Incidents

In September, The Cyber Express reported on the Springfield cyberattack, which disrupted school operations shortly after the start of the new academic year. The incident forced schools to close for part of the week and affected services relied on by families, including childcare and school meal programs. The district arranged grab-and-go meals at six locations while the YMCA of Greater Springfield provided full-day care for families enrolled in its programs. Students were expected to return to classrooms the following Monday. The Springfield incident highlighted how a cyberattack against school systems can extend beyond IT operations and affect essential services used by students and families. Earlier in 2026, a separate QLearn cybersecurity incident involving education technology provider Instructure affected educational institutions globally. Queensland Education Minister John-Paul Langbroek confirmed that the Queensland Department of Education had been briefed about the international breach. Early assessments indicated that the incident could affect more than 200 million people and more than 9,000 institutions worldwide.

Education Authority Cyberattack Targeted School Systems

In April 2026, an Education Authority cyberattack investigation found that attackers had gained targeted access to personal information linked to a small number of schools. Authorities identified the incident on April 10 after being alerted to suspicious activity affecting school systems. A forensic investigation later determined that attackers had accessed specific personal information associated with certain schools. The findings added to concerns surrounding cybersecurity risks in the education sector, where school networks can contain sensitive information belonging to students and staff. For the Burnaby School District, the current investigation is focused on containing the incident and restoring affected services. The district has not confirmed any data theft or provided details about possible unauthorized access. As the investigation progresses, further updates are expected from the district on the scope of the incident, affected systems and any potential impact on personal information.

The U.S. State Department has posted a $10 million reward for Amir Yaryab, a senior Iranian official accused of leading the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) Cyber Operations Command and directing multiple hacking groups targeting critical infrastructure across the United States, Europe and the Middle East. According to the Rewards for Justice program, Yaryab allegedly oversees cyber operations conducted by IRGC-CEC-affiliated groups including CyberAv3ngers, Dadeh Afzar Arman (DAA) and Mehrsam Andisheh Saz Nik (MASN). U.S. officials accuse these groups of using malware and conducting cyber and cyber-enabled information operations against civilian infrastructure worldwide.

$10 Million Reward for Amir Yaryab

The $10 million reward for Amir Yaryab seeks information leading to his identification or location. The offer applies to individuals acting at the direction or under the control of a foreign government who participate in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. [caption id="attachment_113961" align="aligncenter" width="600"] Image Source: https://rewardsforjustice.net/[/caption] Yaryab is also accused of directing Shahid Hemmat and Shahid Shushtari, two groups linked to cyberattacks against U.S. organizations. The sectors allegedly targeted include defense, news, shipping, travel, energy, financial services and telecommunications. The six Iranian officials named in the advisory are linked to Iran's Islamic Revolutionary Guard Corps and its Cyber-Electronic Command.

Iranian Cyberattacks Target PLCs

The allegations also involve attacks against programmable logic controllers (PLCs), highlighting concerns around Iranian cyberattacks targeting industrial systems rather than focusing only on data theft. U.S. officials said Iranian-linked hackers compromised industrial control systems, specifically targeting the Vision series of PLCs manufactured by Israel-based Unitronics. These devices are used across water and wastewater, energy, food and beverage, manufacturing and healthcare sectors. The attackers exploited default credentials on the devices and left anti-Israel messages. Some of the compromises reportedly rendered the PLCs inoperative. The CyberAv3ngers group, which is linked to the IRGC-CEC, claimed responsibility for attacks against Unitronics Vision PLCs in October 2023. Beginning in November 2023, the group compromised default credentials in PLCs across the United States and left messages on the devices' digital screens.

CyberAv3ngers Attacks Critical Infrastructure

CyberAv3ngers has also claimed responsibility for attacks affecting other infrastructure. In October 2023, the group claimed it had breached ORPAK Systems, a provider of gas station solutions in Israel. The group said it had obtained the company's database and intended to publish it through its Telegram channel. The attack was reported to have disconnected 200 gasoline pumps from the system in the occupied Palestinian territories. In December 2023, CyberAv3ngers also claimed to possess and sell 1TB of data allegedly linked to Israel's electricity infrastructure. The group advertised the dataset for 5 Bitcoin, with an initial 100GB portion also offered at the same price.

U.S. Agencies Warn of PLC Cyberattacks

Concerns over critical infrastructure attacks involving PLCs continued into 2026. A joint advisory issued on April 7 by the FBI, CISA, NSA and other agencies warned that Iran-linked threat actors were actively exploiting internet-facing PLCs. The advisory said several organizations had experienced operational disruptions and financial losses after attackers interfered with industrial processes. The developments come amid broader U.S. actions against Iranian-linked cyber activity. The Justice Department accused Iran-connected hackers of breaching employee email accounts associated with the Department of Labor, the Federal Energy Regulatory Commission and multiple United Nations organizations. The Treasury Department also sanctioned Iranian nationals over cyberattacks targeting critical infrastructure. The State Department's reward offer places Amir Yaryab and the alleged activities of IRGC-CEC-linked groups at the center of the U.S. effort to identify individuals responsible for malicious cyber activity targeting critical infrastructure.

Anthropic warned users over the weekend that a threat actor is using widely available infostealer malware to hijack active Claude login sessions from infected computers, then using those sessions to run up victims' paid usage without ever needing a password or a two-factor code.

The company said it identified six malware families in the campaign: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer, known as AMOS, on a smaller number of macOS machines. None are novel or bespoke. All are commodity stealers sold or rented on criminal dark web marketplaces, and all work the same basic way - harvesting locally stored browser credentials, autofill data and authentication cookies from a compromised machine and shipping them to an operator's server.

Claude Session Cookies Heist

What makes the campaign notable is the target rather than the technique. Session cookies represent an already-authenticated state, so an attacker who replays a stolen Claude session token steps past both the account password and multi-factor authentication entirely. This is textbook session hijacking; the new element is that paid AI assistant subscriptions have become worth stealing as a commodity in their own right, alongside the streaming and gaming accounts that stealer log markets have traded for years.

Anthropic told affected users that the tell sign for them was a usage pattern that made no sense. Limits appearing to refill and then drain while the account owner was not using Claude was the biggest red flag.

Also read: Hacker Used Claude AI to Automate Reconnaissance, Harvest Credentials and Penetrate Networks

The company said it is signing affected users out of their sessions, removing saved payment methods from compromised accounts and refunding unauthorized charges identified during its investigation. It also stressed that the malware is not connected to Claude, was not installed through Claude and did not result from anything users did with the product. Infections trace to the usual vectors — pirated software and other illicit downloads.

A Reddit user going by the moniker "WorriedAssociate7029" received the notification from Anthropic and confirmed that he mistakenly installed an infostealer from "a reputable Russian underground forum" while downloading a pirated game. "I got fooled like a rookie by downloading a cracked game," he said.

Intrestingly though, the user claimed of using Claude's Opus model to detect and remove the malware.

"I use the models exclusively in permission-free mode on my entire computer," the Reddit user said.

"Opus was very efficient. It scanned for active processes, then listed my recent downloads. It found the virus almost instantly. My prompt was very simple: "I think I downloaded a virus recently. My login credentials were stolen. Audit the malware and remove it if you find it. Report on the extent of the damage. He deactivated the virus and created a folder on the desktop containing all the relevant information (including the deactivated virus, lol)."

Anthropic has not disclosed how many accounts were affected.

The security implications reach past the billing line. AI assistant accounts increasingly hold conversation histories, uploaded documents, connected data sources and, in developer configurations, API keys and repository access. A hijacked session inherits whatever the account can reach. Organizations that have rolled out AI tools without folding them into identity and access management now have a class of high-value session token sitting in employee browsers, largely outside the monitoring applied to corporate SaaS.

Anthropic's guidance to compromised users is the standard infostealer playbook. Change credentials across every service used on the affected machine, revoke active sessions, and actually remove the malware, since signing out does not clear an infection that will simply harvest the next session.

There is no formal regulatory hook here yet — no confirmed breach of the provider itself and no disclosure obligation triggered on Anthropic's side. But the episode lands as regulators and standards bodies are working out how AI system security fits existing frameworks, and it illustrates a gap those frameworks have barely addressed - the weakest point in an AI deployment may be an unmanaged endpoint rather than the model or the platform.

A Ransom Cartel ransomware leader has been sentenced to 16 years in prison after being convicted of conspiracy to commit offenses against the United States, conspiracy to commit wire fraud, and aggravated identity theft, according to the U.S. Department of Justice. Maksim Silnikau, a 40-year-old Belarusian national, was identified in court documents as the creator and administrator of the Ransom Cartel ransomware strain, which was developed in 2021. Silnikau had been active on Russian-speaking cybercrime forums since at least 2005 and was also a member of the cybercrime website Direct Connection between 2011 and 2016.

Ransom Cartel Ransomware Operation

Beginning in May 2021, Silnikau developed the ransomware scheme and recruited participants through cybercrime forums. He distributed information and tools to participants, including stolen credentials linked to compromised computers and tools designed to encrypt or lock those systems. Silnikau also maintained a hidden website used by himself and his co-conspirators to monitor and control ransomware operations. According to the court documents, the website provided a platform for the group to communicate with one another, interact with victims, send and negotiate ransom demands, and manage the distribution of funds among the conspirators. The operation targeted companies between 2021 and 2023. During that period, Ransom Cartel ransomware conspirators carried out attacks against at least 18 companies around the world, including organizations based in California, New York, Nebraska, and other countries outside the United States.

Ransomware Attacks Targeted Companies Worldwide

The ransomware attacks involved data theft and monetary demands. The attackers sought payment in exchange for providing keys to unlock stolen data or for promises not to publish the information taken from victims. The operation’s growth was disrupted following Silnikau’s arrest in July 2023. He was later extradited from Poland to face prosecution in the Eastern District of Virginia and the District of New Jersey. The sentencing announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia; Acting Special Agent in Charge Andrew Forrest of the U.S. Secret Service Criminal Investigative Division; Chris Ormerod, Special Agent in Charge of the FBI Kansas City Field Office; and Craig L. Tremaroli, Special Agent in Charge of the FBI Albany Field Office.

Maksim Silnikau Sentenced to 16 Years

The Justice Department’s Office of International Affairs provided substantial assistance with Silnikau’s extradition and the collection of evidence. The U.S. Attorney’s Office for the District of New Jersey and the Computer Crime and Intellectual Property section also assisted with the case. Assistant U.S. Attorney Jonathan S. Keim and former Assistant U.S. Attorney Zoe Bedell prosecuted the case. The 16 years in prison sentence follows the disruption of an international ransomware operation that targeted at least 18 companies during its active period. Silnikau’s role, according to court documents, extended across the development and administration of the ransomware strain, recruitment of participants, provision of attack tools, victim communications, and management of funds generated through the operation.

A De Bijenkorf cyberattack involving one of the retailer's external logistics partners has disrupted order processing, returns, and refunds while raising concerns over potential customer data exposure. The Dutch luxury department store chain said the security incident occurred within the systems of a third-party logistics provider, adding that there is currently no evidence that its own infrastructure was compromised.

The Amsterdam-based retailer confirmed that customers can continue placing online orders and stores remain open. However, deliveries, returns, and refunds are expected to take longer than usual as the investigation continues.

De Bijenkorf Confirms Third-Party Security Incident

According to De Bijenkorf, unauthorized individuals gained access to part of its logistics partner's systems. The logistics provider responded by immediately blocking the unauthorized access and implementing additional security measures.

An external investigation is now underway to determine the cause of the incident, its scope, and whether customer information was affected.

As a precaution, De Bijenkorf has informed customers about the incident and submitted a report to the Dutch Data Protection Authority while awaiting the investigation's findings.

What Customer Data Could Be Affected in De Bijenkorf Cyberattack?

The retailer said investigators are still determining whether any personal information has been compromised.

Based on the information currently available, data that may be involved includes:

• Customer names and contact details, including email addresses, postal addresses, and phone numbers.
• Information related to online purchases, such as ordered products, pricing, discounts, delivery details, and the payment method used.
• For business customers, company names and VAT numbers stored in My Account may also be involved.

De Bijenkorf emphasized that sensitive financial information is not part of the incident. The company said payment details, bank account numbers, credit card information, usernames, and passwords were not accessed.

Investigation Continues as Customers Await Confirmation

The retailer said it is still investigating whether individual customers have been affected. Customers whose information is confirmed to be involved will receive direct communication via email from info@debijenkorf.nl.

For those who have not yet received a notification, the company said it cannot currently rule out the possibility that their information was included in the incident until the investigation is completed.

De Bijenkorf also stressed that no login credentials were compromised, meaning unauthorized individuals cannot access customer accounts using stolen usernames or passwords.

Retailer Warns Customers About Phishing Risk

Although the investigation remains ongoing, De Bijenkorf warned customers to stay alert for a possible phishing risk if personal information is ultimately found to have been exposed.

The retailer advised customers not to click on suspicious links or open unexpected attachments. It also reminded customers never to share passwords, payment information, or personal details through email or phone calls.

The company said it will never request credit card details, gift card information, or other sensitive information via email.

Logistics Cyberattacks Continue to Disrupt Supply Chains

The incident adds to a growing list of attacks targeting organizations that support retail operations rather than retailers directly. A logistics cyberattack can interrupt deliveries, returns, and customer service even when the affected retailer's own systems remain operational.

In July 2026, a ransomware attack on Japan's largest refrigerated logistics company disrupted food deliveries across the country, causing supply shortages for restaurant chains, including Kentucky Fried Chicken. The incident demonstrated how cyberattacks on logistics providers can quickly impact downstream retail operations and customer services.

For now, De Bijenkorf said its stores remain open, online ordering continues to operate, and there are no indications that its own systems have been compromised. The retailer said it will provide additional updates as the external investigation establishes whether customer data was affected and the full extent of the incident.

This weekly roundup highlights the growing complexity of digital threats affecting governments, businesses, developers, and consumers. From artificial intelligence being misused for financial fraud to large-scale customer data exposures, malicious software targeting developer ecosystems, and cyberattacks against critical infrastructure, recent incidents demonstrate how attackers are exploiting both emerging technologies and existing security weaknesses.  The latest developments show that cyber risks are expanding beyond traditional network attacks. Threat actors are targeting identities, trusted platforms, software supply chains, and operational technology environments. Organizations must strengthen security controls, improve monitoring capabilities, and adopt proactive measures to protect sensitive data and critical services. 

The Cyber Express Weekly Roundup 

Four Men Admit to $2.2 Million Medicaid Fraud Scheme Using AI 

Four Minnesota men have pleaded guilty in connection with a Medicaid fraud scheme that allegedly generated approximately $2.2 million through fraudulent claims for housing-related services. Prosecutors stated that artificial intelligence tools, including ChatGPT, were used to create false documentation supporting fraudulent billing activity. Read more... 

Tribeca Data Leak Exposes Celebrity-Linked Information 

A reported data leak connected to the Tribeca Film Festival exposed nearly 666,000 records containing personal information associated with attendees, contacts, and individuals linked to the entertainment industry. The exposed data reportedly included names, email addresses, phone numbers, and limited device-related information. Read more... 

Origin Energy Data Breach Impacts Around 900,000 Customers 

Australian energy company Origin Energy confirmed a data breach affecting approximately 900,000 current and former customers. The exposed information may include customer names, contact details, dates of birth, and partial account information. The company is investigating the incident and has advised customers to remain alert for possible scams or suspicious communications. Read more... 

Joyfill npm Packages Found Distributing DEV#POPPER Malware 

Security researchers discovered that two beta versions of Joyfill npm packages were distributing DEV#POPPER, a remote access trojan (RAT) capable of stealing information, executing commands, and compromising developer environments. Read more... 

Student Accused of IIT Website Breaches Offered Technical Assessment 

A student accused of breaching parts of the IIT Kanpur and IIT Madras websites after being rejected from IIT Kanpur’s cybersecurity program will undergo a technical skills assessment rather than facing immediate legal action. The institute stated that admissions for the current session are closed but indicated that future opportunities may be considered if the student demonstrates strong cybersecurity abilities. Read more... 

FBI Warns of PLC Cyberattacks Targeting U.S. Water Utilities 

The FBI and the U.S. Environmental Protection Agency warned that cyberattacks targeting internet-connected programmable logic controllers (PLCs) have disrupted water utilities across multiple U.S. states. Attackers reportedly manipulated PLC settings, affecting monitoring and operational processes. Read more... 

Weekly Cybersecurity Takeaway

This week’s incidents demonstrate how cyber threats continue to evolve across multiple domains, including artificial intelligence abuse, personal data exposure, software supply chain attacks, and critical infrastructure targeting.  A common theme across these events is the exploitation of trust. Attackers are abusing trusted technologies, legitimate software ecosystems, customer databases, and connected infrastructure to achieve their objectives.  Organizations must focus on building cyber resilience through stronger identity protection, secure development practices, continuous monitoring, and effective incident response planning.  As emerging technologies such as artificial intelligence and connected industrial systems become more widespread, cybersecurity strategies must evolve alongside them. Protecting digital assets requires not only stronger technical defenses but also responsible for technology use, awareness, and proactive risk management.