Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Healthcare 4 stories
Biotech Giant Amgen Says Patient Data Stolen from Third-Party Cloud Systems
Amgen Inc., the Thousand Oaks-based biopharmaceutical company, confirmed that patient data was stolen from third-party cloud systems in a cyberattack. The company develops pharmaceutical products for oncological, haematological, and cardiovascular diseases. The breach raises concerns about the security of pharmaceutical supply chains and cloud-based clinical data storage.
CareCloud Notifies More Than 345,000 Patients About Cyberattack Data Theft
CareCloud Inc., a New Jersey-based provider of cloud-based and AI-powered EHR, RCM, PM, and clinical documentation solutions, began notifying over 345,000 patients that their data was compromised in a cyberattack. The incident underscores the concentration risk in healthcare IT vendors — a single compromise cascades across multiple provider organisations.
Patients Warned About AnMed Communications After Cyberattack Closes 83 Facilities
The Anderson, South Carolina-based nonprofit health system AnMed said it is continuing to make progress restoring its systems after a cyberattack forced the closure of 83 facilities. The operational disruption demonstrates the real-world impact of healthcare cyberattacks on patient access to care.
Health-ISAC Warns of Increasing ShinyHunters Healthcare Data Theft Attacks
Health sector organisations have been warned about an increase in successful attacks by the ShinyHunters threat group, which has been increasingly targeting healthcare data. The ISAC alert underscores the persistent targeting of health sector data by cybercriminal groups.
Legal Services 3 stories
EDPB Requests Review of EU-US Data Privacy Framework Following Trump v. Slaughter
The European Data Protection Board has requested a review of the EU-US Data Privacy Framework following the US Supreme Court's Trump v. Slaughter ruling. The decision potentially affects the constitutional underpinnings of the DPF, which was negotiated as a replacement for the invalidated Privacy Shield. A review could lead to suspension or renegotiation of the framework, creating significant uncertainty for thousands of organisations that rely on DPF certifications for transatlantic data transfers.
China Proposes Significant Amendments to National Standard on Personal Information Protection
China has proposed major amendments to its national standard on personal information protection, potentially tightening requirements for cross-border data transfers, consent mechanisms, and data localisation. The amendments have implications for multinational organisations operating in China, including Australian and NZ companies with Chinese supply chains or operations.
Hackers Steal 31,000 Records Identifying People Behind Liechtenstein Companies
Threat actors compromised systems holding registry data for Liechtenstein-based companies and foundations, stealing approximately 31,000 records containing identifying information of beneficial owners and company officers. The breach exposes the privacy vulnerabilities of jurisdictions marketed for financial discretion.
Education 1 story
University of Tennessee Sues Anthropic Over AI Research Patent Infringement
The University of Tennessee has filed a patent suit against Anthropic, challenging the technology's core architecture and testing what universities are owed for AI research. The case could set a precedent for other institutions asserting IP rights over AI model training data and research outputs. The lawsuit tests whether universities are entitled to compensation when their research underpins commercial AI systems.
Government 2 stories
PNLD Breach Exposes UK Police and Government Contact Details on Dark Web
The Police National Legal Database (PNLD) confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, and government partners. The exposure could make phishing messages targeting named officers appear more convincing. PNLD is not the Police National Computer or the Police National Database, and does not hold confidential intelligence or investigation data.
Singapore Launches AI Training Data Guidelines, Expands PETs Resources
Singapore published guidelines on AI training data governance and expanded privacy-enhancing technologies resources, providing a regional benchmark for AU/NZ AI governance frameworks as both countries develop their own approaches.
Energy & Utilities 1 story
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
CISA issued an urgent alert urging the Water and Wastewater Systems Sector to protect OT environments against activity targeting PLCs, following the coordinated cyberattack disabling OT at 30+ Minnesota water systems. The alert is directly relevant to Australian water utilities regulated under the SOCI Act and the ACSC's CI Fortify guidance, and to NZ water infrastructure under the NCSC's critical infrastructure framework.
Retail & Entertainment & Sport 1 story
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites Bitcoin, Ethereum, and Tron addresses on any site carrying the affected script. Anyone who visited an affected site on July 27 may have pasted a different address. Adform removed the malicious code and notified authorities. The script also rewrites addresses entered directly into form fields (not just clipboard).
Global (Macro) 6 stories
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator. Pass-ta-key silently obtains a valid authentication assertion without user verification; Silver Pass-ta-key installs an attacker-controlled user-verification key; Golden Pass-ta-key extracts the 32-byte Security Domain Secret (SDS) used to decrypt all synced passkey private keys. Malware running as an ordinary user on Windows can sign into a victim's passkey-protected accounts without a fingerprint, PIN, or anything appearing on screen.
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws
Resecurity reports the INC Ransomware operation has become the dominant threat actor exploiting CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA 1000 series VPN appliances. The group has claimed 885 victims to date, with activity accelerating since the beginning of August 2026. The CVEs were patched in mid-July 2026 and assessed to have been weaponised as zero-days. Risky.Biz additionally notes a non-profit has offered a $22,000 bounty for information on the INC ransomware group.
N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete
N-able disclosed that attackers exploited an authentication bypass in N-central (CVE-2026-18577) to gain remote administrative access and reach customer systems managed through those servers. Its first fix was incomplete — build 2026.3.1.7 (shipped August 2) is the first unaffected version. After compromising an N-central server, attackers used Take Control to reach managed endpoints and registered Cloudflare tunnels as services on the devices, surviving a reboot. Nothing in the disclosure suggests Cloudflare was compromised.
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
Researchers discovered malicious npm packages targeting users of Alibaba developer tools with a cross-platform RAT. The package "lib-mtop" was an unscoped package sharing the same name as a private Alibaba package under the @ali scope, first published November 2023 with three malicious versions uploaded in March–April 2026. The loader fetches a remote JavaScript payload via curl and executes it.
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
An unknown Chinese-speaking threat actor is running a campaign targeting iOS devices using a publicly leaked version of the DarkSword exploit kit. Censys identified the actor running more than 100 web properties — mostly fake AWS sign-in pages on a domain hosting the exploit toolkit. Hosting concentrates in Hong Kong but reaches Japan, the US, and Europe. DarkSword is a full-chain exploit kit previously used by commercial surveillance vendors and suspected state-sponsored actors since November 2025.
Indicators of compromise · GHOSTBLADE — 3 shown
0d066f4a16eb2463dc340e84c2cba87ea848ab3fdb40ef693e12aed87c75a9ba8490b683504ae8653fd74a97e2dd19cf436dc7aeef57e1c40c1d2394552e43c0c48d63f1
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Hugging Face Diffusers Flaws (FaceHugger) Could Let Model Repositories Execute Arbitrary Code
Three high-severity security flaws disclosed in Hugging Face's Diffusers library could allow crafted model repositories to stealthily execute arbitrary code on machines that load it. Named FaceHugger, the vulnerabilities bypass trust_remote_code, the safeguard designed to stop unreviewed code from running. With Hugging Face becoming the "GitHub of the AI era", these flaws pose significant supply chain risk to AI/ML pipelines.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →