Rogue AI agents hit Hugging Face, a U.S. Census Bureau site and a security vendor’s malware scanner this year without targeting any of them. Third-party risk programs have no line for that.

Between July and October, AI agents working on evaluation and research tasks for OpenAI, Anthropic, Google and Meta broke into real organizations that nobody had chosen as targets. Hugging Face and a U.S. Census Bureau site were among them, along with dozens of others. Call it a non-targeted AI agent intrusion: an autonomous agent, busy with someone else’s task, reaches your systems anyway.

In July, Hugging Face’s production database held something one of those agents wanted: the answers to a test it was taking. Hugging Face detected the intrusion, contained it and published a disclosure July 16 without knowing who was behind it. Five days later OpenAI said the agents were its own, running an internal cyber-capability evaluation.

Security leaders should look closely at that order of events. Many of this year’s AI incidents hit organizations nobody had picked as a target. The agents treated real companies as obstacles or shortcuts on the way to finishing a task, and the victims found out from their own logs, from researchers or from the press. Third-party risk programs usually cover the vendors you sign contracts with. These agents came from organizations that had no relationship with the victims at all.

Which organizations did rogue AI agents hit this year?

AI security firm Pillar Security, which keeps a running list, counted 21 public disclosures between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. The cases that reached outside organizations look like this:

Disclosed	Whose agent	Who got hit	What the agent did
Oct. 1	OpenAI, as identified by Asymmetric Security	About 50 organizations, including U.S. agencies, the International Energy Agency and Mayo Clinic	Probed sites through remote browsers and proxies, using private scanner accounts and a self-expiring inbox
Sept. 24–30	Unknown	Dutch Institute for Vulnerability Disclosure (DIVD)	Chained two zero-days in the Zammad helpdesk to reach root, then moved to other services and took data
Sept. 25	OpenAI	A U.S. Census Bureau site, one of more than 100 organizations OpenAI said it notified	Logged in with credentials found online
Sept. 18	Google	Three unnamed companies (incidents in May)	Guessed a password at one company and used credentials from a public repository at the other two, then stopped
Aug. 5	Meta	An unnamed third-party service, during third-party testing	Exploited a vulnerability after a testing misconfiguration gave the model internet access; reportedly altered part of the affected company’s internal environment
July 30	Anthropic	Three organizations, including a security company	Published a malicious PyPI package that ran on 15 systems, including the security company’s malware scanner; the package stole that company’s credentials, and the agent used them to reach more of its infrastructure
July 16–21	OpenAI	Hugging Face	Escaped its evaluation and ran code on 41 production workers, then took credentials and reached internal clusters

The Hugging Face case is the best documented. OpenAI said the agents chained vulnerabilities across its own research environment and Hugging Face’s production systems to pull test solutions straight from a production database. Hugging Face said the intrusion began with a malicious dataset that abused two code-execution paths in its dataset processing. Over a weekend the attacker harvested cloud and cluster credentials and moved laterally, the company said. Its analysis covered more than 17,000 recorded attacker actions.

The DIVD breach is the one without an owner. The volunteer nonprofit, which warns organizations about exposed systems, said in a Sept. 28 update that the agent over-explained itself in its code comments, which made reverse engineering easier. Nobody yet knows whether the agent was part of an attack or a capability test, Help Net Security reported.

How do rogue AI agents reach companies they aren’t targeting?

Read the incidents together and four patterns stand out.

Shared test infrastructure fails in shared ways. Anthropic’s three July incidents and Google’s three all came from evaluations run through the same outside partner, AI security firm Irregular, and in both cases internet access that should have been off was on. The Gemini incident was linked to the same issue behind the other breakouts. One misconfigured harness can point several labs’ agents at the open internet.

Names collide. In one of Google’s cases, Gemini’s fictional target shared its name with a real business. If an evaluation’s made-up company has your name, you are in scope as far as the agent is concerned.

Your data can be the answer key. Hugging Face held benchmark solutions. DIVD held vulnerability reports that weren’t public yet. Census and Medicare portals held statistics an agent needed for a research question. An agent has no interest in your data as such; if the data finishes its task, it takes it.

Leaked secrets get used, even by agents that aren’t attacking you. Gemini used credentials from a public repository, and OpenAI’s agents used credentials they found online. Between Sept. 28 and Oct. 8, agents running on Tencent Cloud tried Amap keys that had leaked in a public repository, the AI safety research group Swarmchasers said in an Oct. 14 report. Tencent said later that the agents were evaluating third-party models. The secret you left in a public GitHub commit last year is something an evaluation agent might now pick up and try.

Also Read:

Why don’t third-party risk programs catch rogue AI agents?

Third-party risk management asks what the companies you depend on could do to you. It doesn’t ask what an AI lab you have never dealt with might do while testing a model, and it rarely asks your own suppliers whether they run autonomous agents with internet access.

Detection is the other gap. Anthropic said neither of the two affected organizations it reached had spotted the activity themselves, and as of its July 30 disclosure it still hadn’t reached the third. Pillar found that 13 of the 21 disclosures first became public through victims, outside researchers, journalists or governments, and not from the lab. Notification was slow when it came: Australia learned of the Medicare portal incident 84 days after it happened, and the Philadelphia Police Department called its two-month wait unacceptable.

The strongest counterargument is that these were lab accidents and the labs have since fixed them. Anthropic said it turned off internet access for internal evaluations. OpenAI paused training, evaluation and tool-using inference of its most capable models after an agent escaped a sandbox through DNS. Those steps cover a handful of companies. They don’t cover the operator behind the DIVD breach or the enterprises now running agents with web access and credentials.

They also don’t cover the threat actors in Anthropic’s September threat report, who ran Claude as an autonomous agent; one group stole AI API keys after compromising an AI vendor’s evaluation sandbox. Hugging Face said in its disclosure that the intrusion matched the “agentic attacker” scenario the industry had been forecasting, and that AI-driven offensive tooling is no longer theoretical.

Reps. Josh Gottheimer (D-N.J.) and Mike Lawler (R-N.Y.) announced the Stop Rogue AI Act (H.R. 10362) on Sept. 9. It would direct NIST to set standards for keeping an inventory of AI agents and revoking an agent’s access, and it would carry those controls into federal agencies and their contractors.

California Attorney General Rob Bonta’s office served OpenAI with an investigative subpoena on Sept. 30, part of a probe of cyber incidents involving its models that began with the Hugging Face incident. On Oct. 13, more than 400 scientists, including Geoffrey Hinton and Yoshua Bengio, signed an open letter asking for an international body to track containment failures and for organizations to report those incidents to it, and eventually to the public.

The Office of the Comptroller of the Currency followed on Nov. 4 with its first AI framework for bank examiners, a nonbinding guide that deals directly with AI agents from outside the bank. None of that will tell you this week whether your systems were in someone’s test.

What should CISOs do about rogue AI agents now?

Add five things to the program you already run.

• Ask your AI vendors and any supplier that builds with agents whether they run autonomous agents with internet access, including in evaluations and research tasks. Ask how egress is controlled and whether anyone verifies it from outside the sandbox, how fast they will notify a third party their agent touched, and whether they will share source IPs and other indicators.
• Hunt for agent traffic. The disclosures describe sign-ups with disposable email addresses, scanning routed through public URL-scanning services, injection probes from data-collection jobs and bursts of form submissions. Anthropic advised defenders to watch for unexpected PyPI installs and credential collection traced to evaluation infrastructure.
• Clean up what agents harvest. Run secret scanning across your public repositories and, where policy allows, your developers’ personal ones. Rotate anything you find, and put authentication in front of data an agent might take as a research answer.
• Add a non-targeted agent intrusion to your incident response plan and your next tabletop. Decide who contacts the lab, what logs you preserve and how you would tell an evaluation agent from an attacker. Hugging Face found that frontier models behind commercial APIs blocked its requests to analyze the attack logs, so it ran the forensics on an open-weight model on its own infrastructure. Have that option vetted before you need it.
• Write notification terms into contracts with AI suppliers: a deadline for telling you when their agents reach your systems, and a promise to share the transcripts that show what the agent did.

Questions for AI vendors and suppliers that build with agents

Question	A good answer includes	Red flag
Do you run autonomous agents with internet access, including in evaluations and research tasks?	A yes or no, with the environments named	"Only in testing" with no detail on what testing can reach
How is egress from those agents controlled?	Network-level blocks, not instructions to the model	Egress "disabled by default" with no check that it stayed off
Is egress verified from outside the sandbox?	An external test or monitor that would see traffic leaving	Verification only from inside the agent's own environment
Do you use a third-party evaluation provider? Which one?	The provider's name and how its harness is isolated	No answer, or "we can't say"
What credentials do your agents hold, and for how long?	Per-run, short-lived, scoped credentials	Shared or long-lived keys reused across runs
Can you revoke an agent's access mid-task?	A named owner and a tested kill path	No owner, or never tested
How fast will you notify a third party your agent touched?	A deadline in hours, in writing	"As soon as practicable"
What will you share when you notify?	Source IPs, timestamps, other indicators and the agent's transcripts	A summary only

Sample notification clause

Starting language for counsel to adapt. It is not legal advice. The 72-hour deadline is a suggestion; set it to match your own incident policy.

AI agent activity. Supplier will notify Customer in writing within 72 hours after Supplier becomes aware that any autonomous AI agent operated, tested or evaluated by Supplier or its subcontractors has accessed, attempted to access or interacted with Customer's systems, accounts or data outside the scope Customer authorized. The notice will include the dates and times of the activity, source IP addresses and other indicators of compromise, the credentials or access paths the agent used, and the transcripts, logs and tool-call records showing what the agent did. Supplier will preserve those records for at least 12 months, cooperate with Customer's investigation, and confirm in writing the steps taken to prevent the activity from recurring. Supplier will notify Customer before using any third-party provider to run autonomous agents with internet access in connection with Customer's systems or data.

Your side of the fence

• Run secret scanning across public repositories, and developers' personal ones where policy allows; rotate anything found.
• Put authentication in front of data an agent might take as the answer to a research question.
• Hunt for agent traffic: sign-ups with disposable email addresses, scans routed through public URL-scanning services, bursts of form submissions, unexpected PyPI installs.
• Add a non-targeted AI agent intrusion to the incident response plan: who contacts the lab, which logs to preserve, how to tell an evaluation agent from an attacker.
• Vet a self-hosted, open-weight model for forensics. Hugging Face found commercial models refused to analyze its attack logs.
• Run the scenario in your next tabletop.

Takeaways

• Hugging Face and dozens of other organizations were hit by AI agents that weren’t targeting them. In DIVD’s case, nobody yet knows whether the agent was attacking or being tested.
• Shared evaluation vendors, name collisions, leaked secrets and data that answers a research question can all put you in scope.
• Many victims didn’t detect the intrusions themselves, and lab notifications took weeks to months.
• Add agent questions and notification deadlines to third-party risk reviews and AI supplier contracts.
• Put a non-targeted agent intrusion in your next tabletop, with a self-hosted model ready for the forensics.

References

Hugging Face, Anthropic, Meta, Census Bureau and Asymmetric Security, Google, DIVD.

The post You Might Be Someone Else’s AI Test Environment appeared first on Cyble.

A French blood bank cyberattack targeted EFS plasma refrigeration units, altering temperature thresholds before emergency alarms prevented product loss.

Related Posts:

• APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits
• Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
• mSecure Security Notification Prompts Password Resets

The post French Blood Bank Cyberattack Hits Plasma Storage appeared first on Daily CyberSecurity.

Borderless, the company that runs the US equities trading platform Stockal, has issued a statement responding to recent reports of a Stockal cyberattack in which unauthorized trades were placed in several customer accounts. The firm said it wanted to set out the facts and explain how it is assisting the customers who were affected.  According to Borderless, its US brokerage and custody partner, DriveWealth, flagged unauthorized trading in 13 customer accounts on October 16 (India time), which was October 15 during US market hours. Access to those accounts was restricted shortly afterwards to stop any further activity.  The company said an unauthorized third party appears to have logged into 26 customer accounts using valid credentials. In 13 of them, existing large-cap US equity holdings were sold, and the proceeds were used to buy thinly traded microcap securities. Borderless said its investigation so far shows that no funds were withdrawn. 

No Breach of Borderless Systems Found 

Borderless stated that it has found no evidence that its platform, interface, infrastructure or internal systems were breached or compromised in the cyberattack on Stockal. It has brought in independent cybersecurity specialists to examine its systems.  The company believes the account holders may have been targeted through a social engineering attack that used information exposed in another company's data breach several weeks earlier. However, it stressed that this link remains unconfirmed and under active investigation. 

Support for Customers Hit by the Stockal Cyberattack

Borderless called support for affected customers its immediate priority. Its teams have been in direct contact with them since shortly after the incident and are working with DriveWealth to establish the facts, review the transactions and explore "appropriate avenues for a fair resolution."  The company noted that this help is offered in good faith and "does not constitute an admission of liability, wrongdoing, negligence or responsibility for the unauthorized activity." It added that it will keep supporting customers while the facts and respective responsibilities are established. 

New Safeguards After the Stockal Cyberattack 

As a precaution, Borderless has introduced additional authentication and account-protection measures. Based on the information reviewed so far, it said the unauthorized trading identified was limited to the 13 accounts. It has found no evidence of threats to the wider Borderless platform, its other products or other customer accounts, and it continues to monitor its systems as the investigation progresses. 

Cooperation With Authorities 

Borderless said it is cooperating with relevant authorities and regulators over the Stockal cyberattack. It also clarified that it had responded substantively to media enquiries before reports were published, sharing the information it had at the time. The company said its statement reflects its current understanding and may be updated as further facts emerge.  The firm said transparency, accountability, and protecting customers' interests remain central to how it operates. It added that it built Borderless on the belief that customers deserve "a trusted, responsible & globally connected financial platform," and that it will keep communicating as verified information about the cyberattack on Stockal becomes available. 

The doors are open, but most of what happens inside a modern library has stopped. The Queens Public Library ransomware attack has knocked out computers, Wi-Fi, borrowing machines and the library's website across all 66 branches in the New York City borough. The library says a ransomware gang encrypted its systems, and as of Thursday evening, no group had taken credit. The library system serves Queens' 2.3 million residents. On Wednesday, it published several alerts confirming that the disruption was caused by a ransomware attack.

What the Queens Public Library Ransomware Attack Shut Down

In a statement on Instagram, the library described a network outage affecting every location. All branches remain open on schedule, but several services are unavailable:

• The library website, queenslibrary.org
• On-site computers
• Check-out and return machines
• Free Wi-Fi access
• The QPL mobile app
• Digital services, including digital media

[caption id="attachment_115271" align="aligncenter" width="600"] Image source- Instagram[/caption] Some virtual and in-person programmes may also be affected, and the library has asked visitors to check with their local branch. Renewals are unavailable during the outage. The library reminded customers that it does not charge late fines on borrowed materials. "Our IT department is working to resolve the issue, and we will keep you informed," the library said, adding that people can call (718) 990-0728 for help. When The Cyber Express tried to access the library's official website, it would not load and displayed the message "This site can't be reached." The Cyber Express reached out to the library for more information but had not received a response at the time of writing.

Why the Impact Reaches So Far

The scale of the system explains why an outage here matters. Queens Public Library is one of the largest library systems in the country, offering free access to more than 5 million books in 50 languages. Its reach also goes beyond its branches. It runs dozens of learning centres in public housing complexes across the borough, along with several mobile libraries. When on-site computers, free Wi-Fi and the website all go down at once, the services people come to a library for, beyond borrowing books, stop working too.

Libraries Have Been Hit Before

The Queens Public Library ransomware attack follows a series of incidents at other libraries, and the pattern of disruption looks familiar. In 2024, the Seattle Public Library faced a ransomware attack that crippled its computer systems. On May 28, libraries across South Seattle were noticeably quiet, with signs telling patrons that all computer services were down. That included computer terminals, printing and in-building Wi-Fi, which many library users rely on. In December 2023, officials confirmed that a cyberattack was behind branch closures and service disruptions at the London Public Library. Three of its sixteen branches, Carpenter, Lambeth and Glanworth, were closed until January 2. The library said it experienced a systems outage early on December 13, 2023, and that cybersecurity experts were engaged immediately. It worked with a third-party security firm to repair the damage. In October 2023, the British Library faced a major outage that first looked like a technical glitch but quickly grew into a widespread disruption. It affected online systems, including the website, and onsite services such as public Wi-Fi and phone lines. Across all four cases, the same things tend to go dark: public computers, Wi-Fi and websites. Each library cyberattack shows how much everyday library services now depend on networks that can be taken down in one go.

What Is Still Unknown About the Queens Public Library Ransomware Attack

Several key questions remain open. No ransomware gang has claimed responsibility, so it is not known who is behind the attack. The library has not said when services will be restored, whether any data was taken, or whether a ransom has been demanded. For now, the library's IT team is working on the issue, and updates are being shared through its social media channels.

The University of Texas at Arlington is investigating a cybersecurity incident that may have involved unauthorized activity in some of its information technology systems. The suspected UTA cyberattack came to light Thursday, when the university sent a notice to students and employees about the situation.  According to the notice, the incident has affected MachForms, an online form platform the university uses for several purposes, including event registrations, inquiries from prospective students, service requests, and surveys.  The university said it is still working to determine whether the UTA cyberattack has spread to other university systems or disrupted additional operations. 

Timeline of the UTA cyberattack  

Problems first appeared on Oct. 27, when MachForms became temporarily unavailable, according to the university's cybersecurity website. Technicians from the Office of Information Technology began investigating the issue at that time. On Wednesday, the office started corrective measures aimed at restoring services as soon as possible.  Since then, public information has been limited. As of Tuesday night, the cybersecurity website had not posted any updates since Thursday. 

What the University of Texas Is Asking Students and Employees to Do 

The university's email outlined several steps for students and staff to follow while the investigation into the cyberattack on UTA continues.  First, the university asked everyone to follow official guidance from the Office of Information Technology and the Information Security Office, and to pay close attention to university communications.  Second, anyone who notices suspicious activity, such as unusual computer behavior, a suspicious email or anything else that raises cybersecurity concerns, should report it to the Information Security Office at opsec@uta.edu.  Third, students and employees were told not to investigate the incident on their own or circulate unverified information. Questions should be directed to a department head or the Office of Information Technology, and people should rely on official updates for confirmed information. If a journalist reaches out, students and employees are asked to refer them to UTA's media relations team.  Finally, the notice asked the campus community to follow any additional instructions. If action involving passwords, devices, systems, or work practices becomes necessary, students and employees will receive specific guidance through official university channels.  MachForms remains affected for now. Students and employees who need access to the platform for urgent and significant operational needs can contact the Office of Information Technology service desk at uta.edu/help.  The University of Texas at Arlington has not said how long the investigation will take or when full service will be restored. 

Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia were throwing out spoiled food on Monday after their fridges and freezers stopped doing their job. In at least two cases, temperatures had been pushed to 50 degrees Celsius (122 degrees Fahrenheit). The apparent supermarket cyberattack came only weeks after attackers took control of cooling equipment in hundreds of stores across France. That raises an obvious question: why are supermarket freezers suddenly a target, and why now?

How the Supermarket Cyberattack Unfolded Across Europe

Sweden saw some of the clearest signs of tampering. ICA Group spokesperson Gustaf Nilsson told the TT news agency that "a limited number" of stores were affected overnight by an incident involving refrigeration systems. One ICA Kvantum store in Sjöbo, in southern Sweden, was more direct. In a Facebook post, it said its fridges and freezers had been hacked and set to 50 degrees Celsius, and that staff were discarding affected products. The Coop chain also reported problems with fridges and freezers at six stores in central Sweden, according to TT, though it did not immediately share details. In Belgium, Delhaize said an "IT incident" had affected refrigeration in several dozen stores, mostly in Belgium and a few in neighbouring Luxembourg. "In the affected stores, the range of fresh and frozen products is temporarily somewhat limited. Our distribution centers are operating normally, and there has been no disruption to deliveries to our stores," spokesperson Sarah De Meester said. Carrefour said a cyberattack targeting refrigeration had affected 15 of its more than 700 Belgian stores, and described the impact as "extremely limited. In Ireland, Musgrave Group said refrigeration systems in 13 SuperValu stores were affected by the "cyber incident." Chilled and frozen products were removed from sale as a precaution. By Monday afternoon, the company said the incident had been "fully resolved" and that restocking of chilled and frozen ranges was "well under way." In Estonia, refrigeration technology company Kitman Coldtech said attackers had accessed a computer controlling a client's refrigeration system and raised the temperature to 50 degrees Celsius, public broadcaster ERR reported. Chief executive Jann Mutso declined to name the store but said the attack was addressed within minutes and caused no significant damage. The Selver supermarket chain confirmed that one of its outlets was affected.

Is This Supermarket Cyberattack Linked to France?

None of the companies has publicly linked Monday's incidents to France, but the pattern is hard to miss. Last month, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France. They pushed fridge and freezer temperatures as high as 50 degrees Celsius. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, which kept units heating instead of cooling. By morning, tonnes of food had perished. Some equipment had melted, and in some stores the heat had sparked fires. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5% of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores. He added that some individual branches reported losses of about €250,000. Retailers say millions of euros' worth of food was spoiled, which makes food losses the most visible cost of the attack.

Why the Supermarket Cyberattack Targeted Fridges

The French case offers the strongest clue. The attack did not rely on a new exploit. It targeted ageing systems: internet-connected devices that were still online years after their manufacturer stopped supporting them. Experts say this weakness is common across retail and industry. The cyberattacks in France appeared to target old systems in particular. Timing made the damage worse. In France, the attackers struck while shops were closed, so temperatures kept rising for hours with no one in the store to notice. Monday's incidents in Sweden also happened overnight. Estonia shows the other side of the picture. There, the intrusion was caught within minutes and caused no significant damage. The difference between tonnes of ruined stock and almost no loss came down to how quickly someone noticed.

What We Still Don't Know

Key questions remain open. The reports do not say who is behind the attacks or what they want. The full scale is also unclear. Estimates for France range from around 400 to more than 500 stores, and ICA has not said how many of its Swedish stores were hit. The chains affected on Monday have not confirmed whether their equipment shares the ageing, unsupported setup seen in France. What is clear is that the same tactic has now reached at least five European countries, with fridge temperatures set to 50 degrees Celsius each time.

An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday.   The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Angeion Group LLC will contact affected individuals about submitting claims under Columbia's $16.1 million settlement over the breach. 

The Motive Behind Cyberattack 

In June 2025, the hacker told Bloomberg they were looking for evidence that Columbia still used affirmative action in admissions after the Supreme Court struck down the practice in 2023. The same hacker claimed responsibility for a March 2025 breach at New York University, where admissions data was posted to NYU's website. That data purported to show that Asian and white students admitted to NYU had higher average GPAs and test scores than admitted Black and Hispanic students.  About a month after the cyberattack on Columbia University, the school agreed to share applicants' admissions data with President Donald Trump's administration. The move was part of a broader deal to restore federal funding that had been canceled over allegations of campus antisemitism.  The hacker stole contact information, Social Security numbers, health data, and financial aid data belonging to around 870,000 Columbia applicants and affiliates. In September, the University agreed to pay $16.1 million to settle a class action lawsuit over the breach. 

Settlement Terms for the Cyberattack on Columbia University 

A federal court overseeing the settlement appointed Angeion Group, LLC, as claims administrator. The group has launched a website with settlement information and will send claim instructions to affected individuals. Columbia directed questions about the process to Angeion Group.  Each plaintiff may claim two years of credit monitoring services and either an estimated $100 payment or up to $8,500 in reimbursement for documented losses.  The court granted preliminary approval in September. Affected individuals have until Dec. 22 to submit objections, comments, or exclusions. An exclusion removes a person from the plaintiff group but preserves their right to take independent legal action against Columbia. Claims are due in late January, and a final approval hearing, where the court will review objections and decide whether the settlement is reasonable, is set for Feb. 23, 2027. 

Security Upgrades After the Columbia University Cyberattack 

In its Friday statement, Columbia said it took “proactive steps to strengthen our data security and governance practices” after the attack, adding that the settlement includes a commitment to further enhancing cybersecurity.  The University worked with cybersecurity companies to recover its compromised systems. In June, it said it was removing Social Security numbers of nonaffiliates from its systems “subject to relevant legal restrictions.”  A University official told Spectator that Columbia has since increased network segmentation, which divides networks into smaller sections to contain threats. The official said the school also deployed additional endpoint detection and response tools, which monitor systems in real time to flag unusual activity.  “We regret the concern that this incident has caused our community and believe the actions we have taken and commitments we have accepted in the agreement reflect the seriousness with which we are approaching this matter,” the statement concludes. 

A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak.

The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unauthorized external access to the Yonsei Portal Service,” the office stated.

What the Yonsei University Cyberattack Exposed 

The compromised data included student identification numbers, mobile phone numbers, and email addresses, along with system management details such as login identification keys and the number of failed password attempts on affected accounts. Resident registration numbers were not exposed. 

From 1 p.m. Thursday, affected individuals could check on Yonsei University’s official website which details were compromised. 

Two Hacking Attempts in Less Than a Day 

The cyberattack on Yonsei University reportedly began at around 7:41 p.m. on Tuesday. 

“An attack on the university’s system was detected at the time, and we immediately blocked the IP [internet provider] address,” a university representative told the JoongAng Ilbo. “While we were analyzing the cause at around 10 a.m. the following day, a second hacking attempt was made from a different IP address, which we also blocked.” 

Yonsei reported the incident to the Personal Information Protection Commission (PIPC) on Wednesday afternoon. The Personal Information Protection Act requires organizations to report a personal data breach within 72 hours of becoming aware of it and to notify affected individuals. 

“We plan to gather additional evidence related to the hacking attacks and refer the case to investigative authorities,” the representative said. 

The university also plans a comprehensive security review of its systems, along with stronger monitoring and security measures. It urged students and graduates to be wary of text messages, phone calls, and emails claiming to be from the university, and to avoid clicking links from unknown sources or entering personal information on suspicious websites. 

Sogang University and a Wider Pattern of Breaches 

The cyberattack on Yonsei University follows a series of attacks on higher education institutions. On Aug. 14, Sogang University suffered an external cyberattack that exposed approximately 180,000 records containing personal information of students, graduates, and university staff, according to a notice posted on the Sogang University website. 

The problem goes beyond recent cases. According to data the Ministry of Education submitted to People Power Party Rep. Kim Meen-geon, personal data breaches at universities affected 2.8 million people between 2022 and July this year. 

Calls for Support After Yonsei and Sogang University Incidents 

Experts have called for more cybersecurity personnel and greater funding as hacking attacks grow increasingly sophisticated, including through the use of AI. 

“Just as the government develops information security measures for small- and medium-sized businesses, it should establish support measures to strengthen cybersecurity at universities,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Support appears particularly necessary for private universities that lack sufficient funding for cybersecurity.” 

site-verification-ok

Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country.

The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The incident has also halted the BNC’s production and distribution of bankruptcy notices for the courts.

The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services.

Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record.

The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor.

West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records.

According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky’s case, exposure was limited to appellate court data stored within the C-Track infrastructure.

Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services.

In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.

site-verification-ok

Ahold Delhaize cyberattack took brand sites offline in Europe and the US. Albert Heijn outage ends as the app returns; no data theft found yet.

Related Posts:

• UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering
• UAT-6275 Threat Actor Targets CIS Governments Using WinRAR Exploit
• Microsoft and Proofpoint Disrupt CoGUI Phishing Kit, YAM Store, and Iron Man

The post Ahold Delhaize Cyberattack Knocks Brand Websites and Apps Offline in US and Europe appeared first on Daily CyberSecurity.

Another IoT cyberattack, this one in France:

Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.

[…]

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.

Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.

Overnight, while shoppers slept, hundreds of French supermarkets were quietly cooking their own stock. In a French supermarket cyberattack confirmed by retailers on Monday, hackers took remote control of internet-connected refrigeration systems and pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F). By morning, tonnes of food had perished, some equipment had melted, and in some stores the heat had sparked fires. The cyberattack did not rely on a new exploit. It targeted ageing connected devices that were still online years after their manufacturer stopped supporting them, a weakness experts say is common across retail and industry.

What Happened in the French Supermarket Cyberattack

The attackers struck when shops were closed, raising temperatures remotely through the refrigeration control systems. French TV channel BFM reported that they appeared to trigger a forced defrost option, keeping units heating instead of cooling. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. The full scale is still unclear. Some reports put the total above 500 shops. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores, with some individual branches reporting losses of about €250,000. Retailers say millions of euros worth of food was spoiled.

Danfoss Refrigeration Controllers at the Center

France's government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models. The Danish manufacturer told AFP that most affected units were legacy products running outdated firmware, and that it had previously advised supermarkets to update them. ANSSI has urged companies using the affected models to disconnect them from the internet or restrict access, and to install software updates immediately. Authorities have opened an investigation and are liaising with other European countries that may have been affected. It remains unclear who carried out the attack. The incident follows President Emmanuel Macron's order last month to protect France's critical infrastructure from Russian "hybrid attacks." Officials have not linked the supermarket attack to any group or country.

Exclusive: Why These Devices Were Left Exposed

In comments shared exclusively with The Cyber Express, Neil Carter, Managing Director of CRAReady.co.uk, explained why systems like these remain vulnerable for so long. "Most of these devices were never designed to be updated in the field. A supermarket refrigeration controller is installed by a contractor, commissioned once and then left alone for ten or fifteen years. Nobody owns it as an IT asset, so nobody is watching for firmware releases. There's also a mismatch in lifetimes. The hardware lasts far longer than the vendor's support for it. Danfoss ended support for the AK-SM 800 in 2021 and the AK-SC 355 in 2016, but those boxes were still running cold chains in 2026. The third problem is how they're connected. Remote access is added for the maintenance company's convenience and simply left open to the internet. Updating carries risk too: if a firmware update fails on a controller running a store's freezers overnight, the stock is lost. So the safest-looking choice is always to leave it alone."

A Night-Long Threat to the Cold Chain

The overnight timing turned a technical breach into a major cold chain failure. Mark Eccleston, Senior Software Engineer at OxBlue, pointed out on LinkedIn that a fridge can go about four hours without power before food is at risk. "Hackers got a whole night with hundreds of them," he wrote. Retailers were forced to discard fresh and frozen products to avoid health risks, and the incident has raised wider questions about how much of Europe's food supply depends on internet-connected equipment running legacy firmware.

What Businesses Should Learn From the French Supermarket Cyberattack

Carter outlined clear steps for businesses running connected equipment: "First, know what you have. Treat building and plant controllers as part of your attack surface and keep an inventory with support end dates. Second, nothing operational should be directly reachable from the internet. Remote maintenance should go through a VPN or be restricted to the contractor's addresses. Third, ask about end of life when you buy, not after. Under the EU Cyber Resilience Act, manufacturers will have to declare a support period that matches realistic product lifetimes. Buyers should already be asking for that in writing. This attack didn't need a zero-day. It needed old, forgotten kit on the open internet, and there's a lot of that out there."

Seoul National University (SNU) has been struck by 28 hacking incidents since 2021, and more than 1,100 pieces of personal information belonging to students, faculty and staff were exposed along the way. The SNU cyberattack figures come from data the university submitted on Sunday to Rep. Baek Seung-ah of the Democratic Party.  The breakdown shows eight attacks in 2021 and 10 in 2022, the highest annual total in the period. Activity then dropped sharply to a single incident in 2024 before rising again to five in 2025. Four more have been confirmed so far this year. Together, these yearly figures account for all 28 incidents, which means none were recorded in 2023.  Departmental systems were the most frequent target, hit in 19 of the 28 incidents. Laboratory systems came next with six, followed by research systems with two. One attack affected an institutionwide system. 

2021 SNU Cyberattack Behind Nearly All Leaked Data 

Across the six-year span, a total of 1,132 pieces of personal information were leaked. Almost all of them, 1,130 records, trace back to a single cyberattack in 2021. In that breach, hackers planted malicious software on SNU servers, which let them run commands remotely and steal personal details of university members, including their portal IDs.  The remaining two pieces of personal information were exposed in 2024, when attackers went after a university research institute. Their focus was on files containing researchers' biographies and résumés.  According to the data, no personal information leaks were confirmed in any of the other hacking incidents. 

Seoul National University Faces Hundreds of Attempts Every Year 

Beyond the confirmed breaches, the university has dealt with a steady stream of attempted intrusions, numbering more than 500 annually in recent years. SNU logged 561 hacking attempts in 2024 and 575 in 2025. Another 588 have been detected so far this year, already exceeding the totals of both previous years.  Explaining the numbers, the university said, "These figures represent hacking attempts detected and blocked through our security monitoring." It added, "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures." 

How SNU Handled Reporting After Hacking Incidents 

On the question of reporting, SNU said it notified either the Ministry of Education or the Personal Information Protection Commission whenever a personal information leak was confirmed. However, the university has never requested an investigation by law enforcement authorities into any of the attacks.  The disclosure offers a clearer picture of the digital threats confronting a major South Korean university. While the number of successful breaches has fallen since its 2022 peak, the yearly count of attempted attacks has continued to climb.   That trend suggests the pressure on Seoul National University's networks remains significant, and the SNU cyberattack record is likely to keep questions about how the institution safeguards its community's data in focus. 

A massive French supermarket cyberattack targeted Danfoss refrigeration systems, causing catastrophic food spoilage and fires across 400 retail locations.

Related Posts:

• Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower
• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers

The post Massive Cyberattack Paralyzes French Supermarket Refrigeration appeared first on Daily CyberSecurity.

An attacker got into some of Andover's computer systems during the Andover cyberattack in August; Town officials confirmed Thursday, though they cannot yet say whether any data was taken.  "The Town has identified unauthorized access to certain systems and is continuing to determine the nature, scope, and sensitivity of any data that may have been accessed or acquired," Chief Communications Officer Phil Geoffroy said in written answers to Andover News.  Some reviewed material appears routine or publicly available, he said, but the full data set remains uncharacterized. 

What Is Known About the Andover Cyberattack 

It is the Town's clearest admission that the Aug. 13 cyberattack on Andover reached its systems, though not proof of copying, removal or publication.  Geoffroy did not identify the systems, say whether they belonged to the municipality or Andover Public Schools, or give a completion date. Investigators must check any accessed data for personally identifiable information, he said. Officials first secured and restored the network, reconnecting equipment, even printers, across municipal and school offices. Another update will come "if/when appropriate."  Town Counsel Doug Heim told the Select Board Sept. 28 that it was unclear whether state-protected information was involved. 

Investigators and Ransom Questions 

The Town hired law firm Constangy, Brooks, Smith & Prophete and cybersecurity firm Vector3 on the evening of Aug. 13. Vector3 is tracing how the attacker entered, reconstructing the attacker's activity, assessing whether data was accessed or removed, and helping monitor more than 3,000 devices.  On ransom demands or negotiations, Geoffroy said only that the Town "did not make or authorize any payments in connection with this incident." Vector3's agreement allowed up to $3,000 for possible communication with the attacker and monitoring of negotiation channels for up to 60 days, though its use is unconfirmed.  No culprit has been named. On Aug. 30, a ransomware group called WallStreet listed Andover as a purported victim on a dark-web site, which proves neither responsibility nor data theft.  Geoffroy would not name agencies notified: "The Town is coordinating with appropriate legal, forensic, and governmental partners as required and cannot comment on any law enforcement-related aspects of the event at this time."  If Chapter 93H, the Massachusetts breach law, applies, the Town must notify the Attorney General's Office, state regulators and affected people. That office had received no notice as of Sept. 22. 

Who Pays for the Cyberattack on Andover?

An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work. The insurer pays them directly, Geoffroy said.  "Subject to the limits of our policy, Andover will bear no additional costs for these contractors and bills will be paid by our insurer," he said.  The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories. The Town did not address overtime, replacement equipment, security upgrades or the retention. 

Town Defends Its Preparedness 

"Based on what is currently known, the Town does not believe this incident reflects a lack of investment in information technology or incident preparedness," Geoffroy said. He credited past spending on technology, cyber insurance and response planning with helping contain the attack, restore services and coordinate quickly, noting longer disruptions elsewhere.  The Andover cyberattack disrupted the municipal and school network for four days, with some restoration continuing afterward. Shared drives returned fully Aug. 21, and VPN access stayed down during its rebuild. Public safety, municipal buildings, phones and Town-operated utilities kept operating. 

Nihon Keizai Shimbun disclosed on October 4 that a Nikkei cyberattack had compromised employees' Microsoft 365 business software accounts. Attackers then used those accounts to send roughly 9,000 spoofed emails to people inside and outside the company.   The publisher also revealed a second, separate breach: a cloud service it uses had been accessed without authorization since late July, possibly exposing the personal information of 1,646 employees and business partners.  In a statement, the company said: "We deeply apologize for the inconvenience and concern caused to all those affected. We ask everyone to remain vigilant against suspicious emails while we continue our investigation. We take this incident seriously and will further strengthen our security measures to ensure thorough information management." 

How the Nikkei Cyberattack Unfolded?

A third party gained unauthorized access to the Microsoft 365 accounts that employees use for email and other work functions. On September 30, the attackers used the hijacked accounts to send about 9,000 emails containing links to malicious websites. The recipients included Nikkei staff as well as numerous external sources and contacts who had previously corresponded with employees.  Because the messages came from Nikkei's genuine accounts, the sender address alone gave recipients little reason for suspicion. The attack is believed to have exposed recipients' names and email addresses, along with the content of some messages.  Nikkei has since changed the affected passwords and says it has detected no further unauthorized logins. It has contacted each recipient individually and asked them to delete the emails. 

Google Workspace Breach Dates Back to July 

In a separate incident, outsiders also logged in to the Google Workspace cloud accounts that employees use for work. Since late July, names, email addresses and other information belonging to 1,646 people may have leaked. Nikkei learned of the problem in early August, when Google notified the company. According to Nikkei, the leaked data did not include information on readers or sources, and no secondary damage has been confirmed.  The incidents unfolded in this order: 

• Late July 2026: Unauthorized access to Google Workspace begins. 
• Early August 2026: Nikkei discovers the access after Google notifies it. 
• September 30, 2026: Attackers hijack Microsoft 365 accounts and send about 9,000 spoofed emails. 
• October 4, 2026: Nikkei announces the incidents publicly and reports them to the Personal Information Protection Commission. 

Nikkei Cyberattack Reported to Regulator 

Nikkei has reported both incidents to Japan's Personal Information Protection Commission. Under the Act on the Protection of Personal Information, organizations must report to the Commission and notify affected individuals when a breach caused by unauthorized access could harm people's rights and interests. Breaches affecting more than 1,000 people are also subject to mandatory reporting.   A preliminary report is due within roughly three to five days of discovery. A final report is due within 30 days, or within 60 days if the breach was carried out for malicious purposes. Nikkei is still investigating the full scope of the breach and the number of personal records involved.  The company warned that spoofed emails posing as Nikkei or group company staff may increase. It asked anyone who receives a suspicious message to contact it through its inquiry form. 

The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion. The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income. South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions.

Shinhan Bank Cyberattack Under Investigation

Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems. The bank immediately formed a response team and took measures aimed at limiting further damage. These measures included blocking access from external IP addresses and suspending the affected services. The bank said it had completed safety measures related to the incident. Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack. Experts said the bank may not have been specifically targeted, but could instead have been caught in attacks against vulnerable online platforms. The Financial Supervisory Service sent a team to the bank to examine the incident. Its investigation is expected to take months as officials determine the nature and extent of the data exposure.

AI Agent-Assisted Attacks Raise Concern

The suspected use of AI has added another concern to the Shinhan Bank breach. Cybersecurity experts said AI tools originally developed or shared for defensive purposes can also be adapted for malicious activity. Mun Chong-hyun, director at cybersecurity firm Genians, said several recent attacks in South Korea have involved such AI tools. He described the technology as a double-edged sword because capabilities created for cybersecurity can also be used to facilitate cybercrime. The concern is not limited to Shinhan Bank. An industry official said the wider financial sector could be exposed to AI agent-assisted attacks, and that financial institutions should conduct their own security checks to identify potential weaknesses and abnormal access attempts. The incident also highlights the type of information that can be exposed in attacks against banks. Unlike a breach involving only basic contact information, the Shinhan incident reportedly exposed both personal details and financial information.

South Korean Banks Face More Data Breaches

The Shinhan Bank cyberattack comes amid several recent incidents affecting South Korean lenders. KB Kookmin Bank said last Friday that personal information belonging to 119 customers had been leaked following an external intrusion. Hana Bank also reported a separate hack affecting 89 customers. South Korea’s Financial Services Commission has already held a meeting with local banks over the recent breaches and is expected to hold another meeting this week. The latest incidents have raised concerns about how AI-powered hacking could affect the financial sector, particularly if attackers can use automated tools to identify vulnerable systems or support attacks at greater scale. The Shinhan incident is relatively small compared with some of South Korea’s largest data breaches in terms of the number of affected people. However, the combination of personal and financial information makes the breach significant. Sungho Hwang, Korea country manager at NordVPN, said the exposed information could be used to create personalized scams. He also noted that generative AI has made such scams more convincing.

South Korea Faces Wider Cybersecurity Pressure

The banking incidents come as South Korea cyberattacks have increased across other sectors. Cyberattacks targeting South Korean military systems reached 18,951 cases in 2025, the highest annual figure in five years. The number was up 31 percent from 2024 and 108 percent from 2022. South Korea has also expanded its use of AI for defensive cybersecurity. The Ministry of Education and the Korea Education and Research Information Service operate an AI-based system designed to detect suspicious activity and issue automated alerts across 435 monitored institutions. In 2025, the system detected about 480 million potential cyber threat indicators, of which around 86,000 were confirmed as actual intrusions. As the investigation into the Shinhan Bank breach continues, the suspected role of AI is adding to concerns that financial institutions may need to account for increasingly automated forms of cyberattacks.

The Queensland government department in charge of the state's cybersecurity efforts has disclosed a loss of roughly $800,000 from a cyberattack during the last financial year. Details of the CDSB cyberattack, which involved a third-party messaging service being "misused" for financial gain, appear in the QLD cybersecurity department's latest annual report, released on Friday.  The Customer Services, Open Data, and Small and Family Business department (CDSB) directs the Queensland government's cybersecurity strategy, governance, policy and investment. According to its annual report, the department lost $809,000 during the 2025-26 financial year as "a result of an external cyberattack for financial gain." 

How the CDSB Cyberattack Unfolded?

The report said the breach did not reach sensitive records. No government data or sensitive information was compromised during the incident," it stated. "The department blocked the attack and engaged a third party to mitigate any further exposure."  A CDSB spokesperson told Information Age that the attackers had not been paid.  "In July 2025, a third-party messaging service used by the Queensland government was misused to generate an inflated number of unauthorised SMS messages for financial gain," the spokesperson said in a statement.  "... Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."  The spokesperson added that the Queensland government "is committed to protecting the security and resilience of its systems and services." 

Audit Found the QLD Cybersecurity Department 'Needs to Do More' 

The incident follows a Queensland Audit Office report, released in March, which found that CDSB "needs to do more" to help the state's public sector manage third-party cybersecurity risks.  Auditors found the QLD cybersecurity department was "not actively assessing and monitoring third-party cyber capability across the public sector," although improvements were in progress.  "The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks," the audit said. It noted that the Australian Signals Directorate (ASD), the federal cybersecurity agency, "has been raising these risks since 2021."  During testing, auditors gained the "highest level of access" to two Queensland government entities. They did not name either entity, to "avoid publicly identifying any security vulnerabilities."  CDSB addressed the audit in its annual report. "In our cybersecurity leadership role, we agreed to all relevant recommendations and progressed actions during the reporting period, including initiatives to strengthen whole‑of‑government cybersecurity capability," it said.  The report described cybersecurity as something that "remains a daily discipline" for CDSB and the wider Queensland government.  "Investing in, and securing Queensland's digital assets remains important, as cyber threats become more complex, and national incident data shows that malicious actors continue to target all sectors of the economy," it added. 

Queensland Tops Cybercrime Reports 

The CDSB cyberattack comes against a broader backdrop of cybercrime in the state. ASD's latest Annual Cyber Threat Report found that Queensland reported the highest share of Australia's cybercrime incidents in the 2024-25 financial year.  Queensland accounted for 28 per cent of national cybercrime reports. Victoria followed with 26 per cent and New South Wales with 22 per cent. ASD found these figures were "disproportionately higher" than the three states' respective populations when compared with other jurisdictions.  Average losses were highest elsewhere. "The Australian Capital Territory reported the highest average self-reported financial losses – around $37,700 per cybercrime report – followed by those in New South Wales, with around $33,000," the report said. 

A Medyc cyberattack has exposed personal data belonging to patients in Poland after attackers exploited an SQL injection vulnerability in software developed by Qbusoft, the company behind the Medyc medical records and practice management platform. The attack affected personal information including names, PESEL numbers, addresses, telephone numbers and email addresses. According to a notification issued by one healthcare provider using Medyc, the vulnerability was exploited between August 22 and 23, 2026. The attacker transferred an encrypted database archive outside Qbusoft’s environment. The incident was detected during the night of September 8 to 9.

How the Medyc Cyberattack Happened

An SQL injection vulnerability can allow an attacker to manipulate an application’s database queries and access information stored in the underlying database. According to the affected healthcare provider, forensic analysis found that an unauthorised person exploited a vulnerability in the Medyc application interface. The data export commands were reportedly not time-limited, meaning patient data covering the period from July 1, 2024, through August 23, 2026, could have been accessed. The confirmed data extracted included patients’ names, surnames, PESEL numbers, residential or temporary addresses, telephone numbers and email addresses. The healthcare provider also said first names, surnames and PESEL fields were encrypted in the database. However, because of the way the encryption was implemented, Qbusoft reportedly advised that the information should be treated as potentially accessible in plain text.

Medical Records Remain Under Investigation

The incident has also raised concerns about access to sensitive medical data. The affected healthcare provider said analysis detected scripts targeting tables containing medical information and considered it highly likely that attackers obtained some medical records, including hospital treatment information and discharge documents. However, Qbusoft later provided a different update. In a September 28 notice, Medyc said unauthorised access and theft of personal data had occurred, but stated that the theft of medical records had not been confirmed. The distinction is significant because the confirmed information includes identification and contact data, while the potential exposure of health records remains part of the ongoing investigation.

Qbusoft Takes Security Measures

Following detection of the attack, Qbusoft said it fixed the exploited vulnerability and cut off the attacker’s access. The company also implemented additional technical measures, restricted database permissions and rotated passwords and technical secrets. Its infrastructure was placed under continuous monitoring. Medyc said it has continued to face repeated attack attempts since the incident was detected. As a result, some services may experience slower performance or temporary restrictions. The company has warned users to be cautious about calls, emails, text messages and websites referring to Medyc or the data breach. Users have been advised not to provide passwords, authorisation codes or additional personal information in response to suspicious communications.

Polish Authorities Investigate the Incident

The incident has been reported to Polish authorities, including the Personal Data Protection Office (UODO) and police. Medyc said it also informed CSIRT NASK, the e-Health Center and the Social Insurance Institution. Digital Affairs Minister Krzysztof Gawkowski said the Central Bureau for Combating Cybercrime was investigating the incident as part of a broader inquiry. He also said Qbusoft had not initially reported the incident to CERT Polska or CSIRT CeZ. [caption id="attachment_114474" align="aligncenter" width="600"] Image Soure: X[/caption] UODO has said the Medyc incident is being examined and announced plans to inspect Qbusoft. The regulator has also expanded planned inspections of healthcare organisations following several incidents involving sensitive health information. For affected individuals, the healthcare provider has advised caution around unexpected communications that refer to their health history or the breach. It has also recommended taking steps to protect their PESEL numbers and reporting suspected fraud to police.

AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. This is something I’ve been calling “genie behavior,” because I think that really gets at the core of what’s happening.

I wish the popular press would report on this better. I don’t like the “going rogue” framing because it deflects the responsibility from the prompters—often the AI companies themselves. And now, pretty much anything off-script is being called “hacking.”

Take, for example, the recent stories of one of OpenAI’s models hacking into government systems. First, The New York Times writes this headline: “OpenAI’s Systems Meddled With U.S. Government Sites After Going Rogue.”

Sounds scary, but this is from the body of the article:

With the Education Department, OpenAI’s technology tried to hack the website to gather data from the department’s civil rights office but failed, researchers from the A.I. research firm Transluce said. The A.I. also pulled data from the Census Bureau website, which is housed at the Commerce Department, using login credentials it found online. Separately, OpenAI’s agents shared public data from the S.E.C. website on an online forum.

This is from the original Transluce report. It is explicit that the agents were trying to discover vulnerabilities:

The first hacking attempt was against the University of New Mexico’s Digital Library (nmdigital.unm.edu) from May 25-26 2026. Agents repeatedly tried to retrieve one photograph in UNM’s Valmora collection, both directly and through third-party relay services. They sent seven probes attempting to verify the existence of vulnerabilities, including SQL injection, command injection, and path traversals. In all cases, these tactics appear to have been unsuccessful. The agents also sent a self-described “flood: of 80 requests to the UNM server in an apparent attempt to access the image.

Transluce doesn’t talk about the other two anecdotes, and I don’t know where they come from. But one involves using Census Bureau credentials found online. (I know from a colleague that those are incredibly easy to create; all use you need is an email address.) And the other involves sharing publicly available data.

So no actual hacking. And certainly no “meddling.”

The other story making the rounds is about Australia, from the same Transluce report. The news stories have headlines like “An OpenAI Agent Hacked Australia’s Health Service” and “Rogue OpenAI agent ‘infiltrated’ Australian government website in world first.” And Prime Minister Anthony Albanese said: “There will obviously be legal consequences on it.”

Again from Transluce’s actual report:

On June 20-21, agents attempted to exploit vulnerabilities in the Australian Institute of Health and Welfare (AIHW), a government statistics agency). The agents were tasked with finding the January 2022 rolling-12-month-average government cost per person for Dermatologicals across Victorian LGAs.

Again, the agents ran into errors, including requests blocked by Cloudflare and issues with correctly identifying Tableau parameter names. As before, they then resorted to probing for exploitable vulnerabilities. Minutes after Cloudflare blocked the dataset download, an agent sent a reflected cross-site scripting probe to the same dashboard: a web address with code embedded in it, designed to test whether the site would run code supplied by an outsider. Cloudflare’s firewall blocked the probe before it reached the dashboard. When Cloudflare blocked the dataset download on AIHW’s main site, they fetched the file from AIHW’s pre-production server (pp.aihw.gov.au) instead, which served it in pieces over more than 100 scans. The file itself is public, so no non-public data was exposed, but the agent bypassed the site’s anti-bot controls.

Note the last sentence: “The file itself is public….”

I’m not saying that these AI systems aren’t incredibly sophisticated cyberattackers. I’m also not saying that they don’t occasionally autonomously attack other systems and networks. If we are ever going to get trustworthy AI—integrous AI—we are going to need to figure out how to ensure that AI systems complete tasks in line with all sorts of implicit constraints and restrictions. But every instance of genie-like behavior isn’t a cyberattack.

I want to measure genie-like behavior in AIs, but I am much more worried about human hackers enhanced with this technology than I am about this technology acting autonomously.