1
Internet-exposed edge, appliance and management-plane systems were the quarter's most reliable access surface, and patch-to-exploitation timing compressed to days by September.
Confidence: High// incident review
Cyber Digest — Sector Incident Review: Q3 2026 (to date)
Top incidents by sector and regulatory / technology / thematic changes
1 July – 28 September 2026 (partial-quarter collection, Q3 to date) · Generated 28 September 2026 · 74 digest entries folded into 66 events
11 Sectors
66 Events
49 Confirmed or probable
23 Actively exploited
9 AU/NZ nexus
📋
Executive Summary
AnalysisThe quarter's organising fact was that state and criminal operators alike worked through the systems that grant authority over everything else. It opened with a 12-agency advisory on Russian exploitation of edge devices and Russian LAUNDRY BEAR's Zimbra zero-day, ran through the ACSC's high-rated alerts on N-able N-central and JetBrains TeamCity, and closed with Citrix's two NetScaler zero-days KEV-listed on the day they were confirmed, Check Point emergency hotfixes for its Security Gateway and management server, and a CISA remediation deadline that had compressed from three weeks to three days. The FBI and DOJ's seizure of the QScan and QTRouter platforms run by PRC-linked QTFY was the quarter's one public disruption of state-grade tooling; the espionage campaigns themselves - Mirage Kitten, FamousSparrow, WaterPlum, BlueDelta - were largely attributed after the fact rather than stopped.
Where the losses actually landed was the human and third-party layer. The largest claimed data volumes came from voice phishing against staff followed by cloud exfiltration: McKesson's 1 TB and US$55.2 million demand, Baxter's 7.1 million claimed records, Qantas's tech-support scam, Astrana Health's spoofed switchboard. The largest confirmed counts sat with intermediaries rather than victims - a translation vendor that reached UnitedHealthcare plan members, a logistics provider that breached Trezor twice, an Australian edtech platform notifying more than 1,079,819 people, a 220-million-record passenger-data leak in a system governments and carriers share, and around 16,000 publicly readable hosted databases. Nine of the quarter's highest-impact events were data that was reachable and unowned, not data taken with effort.
The regulatory arc moved from debate to obligation, and enforcement caught up with it. Australia released a Privacy Amendment Bill replacing 'as soon as practicable' with a 72-hour reporting deadline; Canada's Privacy Commissioner opened an investigation of IDScan.net over a 153-million-record claim; New Zealand's Privacy Commissioner issued Compliance Notices to Manage My Health and Health NZ with remediation deadlines in 2027; and Sweden's IMY fined Miljödata SEK 1.8 million. Illinois enacted a frontier AI safety law and CISA and ACSC reset SBOM minimum elements in the same window that Unit 42 documented frontier-AI agents carrying an intrusion in under ten hours and Microsoft documented an agentic destruction pass in Azure. The rules are being written faster than the ability to test whether they hold.
For Australian and New Zealand readers the quarter produced four things worth carrying: an Australian platform breach of more than a million people, an Australian regulator-set 72-hour reporting deadline on the near horizon, ACSC alerts on two management platforms that Australian organisations run at scale, and a water-sector identity exposure study showing 258 of 10,000 US utilities with operational-technology credentials in infostealer logs - the same class of exposure that would be found here if anyone looked.
Key Judgements
2
The quarter's largest victim counts came from intermediaries and exposed data-at-rest rather than intrusion into the victim's own environment.
Confidence: High3
Voice phishing and help-desk impersonation remained the highest-yield initial access vector across healthcare, financial services and transport.
Confidence: High4
Frontier-AI capability changed the economics of an intrusion this quarter, in reconnaissance, in destructive cloud operations and in card-skimming at scale.
Confidence: Moderate5
Self-custody hardware and crypto custody remain a fragile trust layer, with three wallet vendors affected and a nine-figure hot-wallet theft attributed to North Korea.
Confidence: Moderate6
State-linked espionage against civilian and commercially available infrastructure was attributed faster than it was disrupted.
Confidence: Moderate🎯
Cross-Sector Themes
10 themesThe bottom line up front: these themes cut across every sector-specific event below, each listing the sectors it touches. Every incident named here appears in full in the sector sections or in a sector's short-form list.
1
Frontier AI moved from governance debate into the attack path and the labour market
Unit 42 documented AI agents carrying an intrusion across more than 50 ATT&CK techniques in under ten hours, Microsoft documented Storm-3168 running an agentic destruction sequence in Azure, and a human operator took roughly 600,000 card records across 119 retail sites by pointing open-source agent frameworks at them. Illinois enacted a frontier AI safety law and ACSC published a national alert on AI misalignment in the same quarter.
🌐 Global (Macro)🛍️ Retail & Entertainment & Sport⚖️ Regulatory & Legal
2
Internet-exposed edge, appliance and management-plane systems are the quarter's access surface
Russian LAUNDRY BEAR used a Zimbra zero-day for email theft, ACSC alerted on active exploitation of N-able N-central and JetBrains TeamCity within Australia, Storm-1175 deployed StormEncryptor through the same N-central weakness, and CISA KEV additions ran near-daily with the deadline compressing to three days by late September.
🏛️ Government🛰️ Defence🌐 Global (Macro)
3
Custody, wallet and personal-key infrastructure is a fragile trust layer
Trezor was breached twice through its logistics provider, SafePal through an order-tracking flaw and Coldcard through a firmware entropy weakness that drained roughly US$116 million in bitcoin, while Bitget attributed a US$351.6 million hot-wallet theft to North Korean actors.
💰 Financial Services🌐 Global (Macro)🛰️ Defence
4
Ransomware industrialisation reached the intermediaries holding other people's data
McKesson received a claimed US$55.2 million demand after vishing into single sign-on accounts, Paylogix exposed Social Security numbers through a benefits platform, Cushman & Wakefield and Turner Construction surfaced through notification rather than press, and Akira's breach of a benefits administrator put health data into criminal hands.
🏥 Healthcare💰 Financial Services🏗️ Construction & Property🌐 Global (Macro)
5
Vishing and help-desk impersonation remained the highest-yield access vector
The claimed volumes all trace to a conversation with a person: Qantas's tech-support scam, the McKesson and Astrana Health impersonation campaigns, and the second Trezor exposure through its email provider. Technical controls do not reach the employee handing over an account.
🚚 Transport🏥 Healthcare💰 Financial Services🌐 Global (Macro)
6
The water and OT campaign went from advisory to confirmed incident
More than 30 Minnesota water utilities lost operational technology access in late July and the intrusions had spread to at least 12 states by early August; CERT Polska documented a heat-plant breach reached through a private cellular APN; CenterPoint Energy told the SEC that customer data was taken; and a Bavarian municipal utility had systems encrypted.
⚡ Energy & Utilities🏛️ Government🚚 Transport
7
Health data exposure widened through intermediaries and device makers
The largest counts - Baxter's 7.1 million claimed records, Aesto Health's 9.5 million patients, AdaptHealth's 4.1 million people and the translation vendor's breach reaching UnitedHealthcare - all sit with organisations that hold data on behalf of providers, while Boston Scientific showed a device maker's operations are now a target in their own right.
🏥 Healthcare🎓 Education🛍️ Retail & Entertainment & Sport
8
State-linked activity concentrated on civilian and commercially available infrastructure
Iran's Mirage Kitten targeted aviation and fintech developers, a Chinese-speaking operator took nuclear and aerospace engineering data, FamousSparrow ran a near-single-region campaign across eight Latin American countries, and five nations attributed the WaterPlum job-seeker campaign to North Korea with around 30,000 devices affected.
🛰️ Defence🏛️ Government🌐 Global (Macro)
9
The control plane is the target: VPNs, management servers and identity tokens
Citrix's two NetScaler zero-days were KEV-listed the day they were confirmed, Check Point shipped emergency hotfixes for its Security Gateway certificate path and Security Management Server console, and CrowdSec lost roughly 170 private repositories to a departed employee's still-live GitHub token.
🌐 Global (Macro)🏛️ Government🛰️ Defence
10
Exposed data at rest produced the quarter's largest victim counts
A 220-million-record advance passenger information leak, Gyazo's 23.62 million user records and 490 million image-metadata records, and around 16,000 publicly readable hosted databases describe the same failure: data that was reachable and unowned rather than taken with effort.
🚚 Transport🛍️ Retail & Entertainment & Sport🏥 Healthcare
🎭
Actors & Campaigns
7 trackedThe same quarter cut by actor rather than by victim sector. Incidents grouped here are separate events attributed to a common actor or campaign.
ShinyHunters 5 datapoints
The quarter's most consequential criminal actor by victim count and sector spread. The method is consistent: voice phishing against staff to take over single sign-on accounts, exfiltration from the cloud platforms those accounts reach, then a public extortion demand. Named victims here include McKesson (1 TB and US$55.2 million claimed), Baxter (7.1 million records claimed), Cushman & Wakefield and the US Bank / Jack Henry claim. In September it re-entered the Oracle PeopleSoft flaw by defeating the WAF rule written to replace the patch, and appeared in Anthropic's threat report as the affiliation behind Claude-built credential-harvesting pipelines.
Criminal extortion group (UNC6240) Confidence: High
🏥 Healthcare🏗️ Construction & Property🛍️ Retail & Entertainment & Sport🌐 Global (Macro)
FamousSparrow 1 datapoints
Deployed a previously unreported Windows backdoor, SparroWocky, against government agencies across at least eight Latin American countries from August 2025, with roughly 90 per cent of its telemetry concentrated in the region. The implant integrates open-source offensive tooling to complicate analysis and replaces the group's earlier SparrowDoor backdoor.
China-aligned espionage group, active since 2019, publicly linked to Salt Typhoon Confidence: Moderate
🛰️ Defence
Iranian state-linked (Mirage Kitten / UNC1549) 1 datapoints
Ran NodeRabbit and PollCat backdoors against aviation and fintech developers - the quarter's highest-scoring defence entry. The targeting is the finding: civil developers of flight and payment software stand in for the military end users the group cannot reach directly.
Iranian state-linked, tracked by Kaspersky and Sygnia Confidence: Moderate
🛰️ Defence
QTFY (PRC-linked) 1 datapoints
Operated the QScan and QTRouter hacking platforms, seized by the FBI and DOJ under court authorisation. Court documents allege QTFY sells intrusion services to paying customers including the PRC's Ministry of State Security and the People's Liberation Army; because the seized domains were hard-coded into both tools, the seizures rendered them inoperable.
PRC state-sponsored, indicted path via Nanjing Xinjiuwei Network Technology Company Confidence: High
🛰️ Defence
Storm-3168 (JADEPUFFER) 1 datapoints
Used two compromised service principals in one Azure tenant in sequence - reconnaissance first, then destructive operations and credential collection across Storage Accounts, SQL databases, Key Vaults, Function Apps, virtual machines and App Services. The agentic element is not a novel vulnerability but the speed and breadth of post-compromise action.
Financially motivated cloud actor, tracked by Microsoft; described by Sysdig in July 2026 as the first agentic ransomware operation Confidence: Moderate
🌐 Global (Macro)
Akira (ransomware-as-a-service) 3 datapoints
Breached benefits administrator Paylogix, exposing Social Security numbers and health data, and was blamed for the Sunrise Company breach. The affiliate model keeps the operator's identity separate from the intrusion, which is why the same group appears across unrelated sectors in one quarter.
Criminal ransomware affiliate programme Confidence: Moderate
💰 Financial Services🏗️ Construction & Property
WaterPlum (North Korea) 1 datapoints
Ran a job-seeker lure campaign affecting around 30,000 devices and drew a formal multi-government attribution - notable as much for the coordination of the statement as for the tradecraft, which relied on recruitment pretexts rather than exploitation.
DPRK-linked, attributed by five national governments during the quarter Confidence: Moderate
🛰️ Defence
👁️
Watch-list
Next periodForward indicators for the coming period. Each states what would confirm the direction of travel.
1
Agentic AI moving from demonstration to routine
Unit 42 documented an agentic intrusion in under ten hours, Microsoft documented an agentic destruction pass in Azure, and a single operator took 600,000 card records across 119 sites. Cost per target has collapsed, so volume defences keyed to human effort will under-perform.
Indicator: Campaign clusters with near-identical timing across unrelated victims, and repeated targeting of the same sites at machine cadence.
2
Australia's 72-hour breach-reporting deadline becomes law
The Privacy Amendment (Personal Data Protection) Bill 2026 would replace 'as soon as practicable' with a fixed 72-hour clock, which changes incident-response scoping rather than just notification drafting.
Indicator: Passage or amendment of the Bill, and the first regulator guidance on what a 72-hour report must contain.
3
Patch-to-exploitation keeps compressing on exposed appliances
A three-week KEV window became three days in September, and CISA is ending the weekly bulletin that made the catalogue legible.
Indicator: Any further sub-week KEV deadline, or an exploited zero-day in a management plane with no interim mitigation.
4
The US water and OT campaign crosses into allied jurisdictions
More than 30 Minnesota utilities lost OT access and the activity spread to at least 12 states, with a European heat plant breached through a private cellular APN. The access model does not respect borders.
Indicator: Any confirmed OT intrusion at an Australian or New Zealand utility, or ACSC guidance naming water assets specifically.
5
Vishing-to-cloud extortion continues against health and benefits intermediaries
McKesson, Baxter, Paylogix and Qantas all began with a conversation rather than an exploit, and the intermediary holds the data regardless of which provider is named in the notification.
Indicator: Further extortion claims against benefits administrators, claims processors or logistics providers, and any shift to MFA-fatigue rather than voice pretext.
6
Custody and hardware-wallet controls stay under pressure
Three wallet vendors were affected through three different mechanisms and a US$351.6 million hot-wallet theft was attributed to North Korea, while the losses increasingly sit at the supplier boundary.
Indicator: Further wallet or custody-vendor disclosures traced to a supplier, and any movement in the Bitget attribution.
💰
Financial Services
6 eventsBanks, insurers, payments, fintech and crypto custody.
1
Akira Ransomware Breach at Benefits Platform Paylogix Exposed SSNs, Health and Financial Data on Tens of Thousands
Employee-benefits administrator Paylogix disclosed that hackers stole files from its network between 13 and 18 November 2025, including Social Security numbers, electronic signatures, financial account details, health insurance information, medical data and passport numbers; the company was listed on the Akira ransomware leak site in January though it has not attributed the attack itself. State filings show 64,383 affected in South Carolina alone, plus 2,304 in New Hampshire and 1,102 in Vermont, with notices also filed in California, Massachusetts, New Jersey and other states — implying a national total well above 67,000. Law-enforcement is engaged and several class actions are being organised. Akira remains among the most active ransomware families, with Google incident responders ranking it second-most-observed malware family of 2025. Verification: Verified Breach: Confirmed breach
Source: The Record · Tier 2/4 — High · 2026-08-25 · Impact 51 · Confirmed
2
Trezor Says ShipMonk Breach Exposed ~67,000 More US Customers It Was Told Had Been Deleted
Hardware-wallet maker Trezor reported that the data breach at its third-party logistics provider ShipMonk — first disclosed in mid-August as affecting about 13,700 customers — was substantially larger, with order data from an earlier cooperation period (November 2019 to August 2021) also exposed for approximately 67,000 additional US customers. The newly exposed records include full name, email, phone number, shipping address and order number. Trezor said that throughout its relationship with ShipMonk it repeatedly requested and received written confirmation that this older data had been deleted in line with its 90-day retention policy, and expressed disappointment that the data was nonetheless retained and exposed. No wallet, seed or device data is involved and Trezor's own systems were not compromised; the operational risk is a heightened phishing-and-impersonation campaign against affected customers. Verification: Verified Breach: Confirmed breach
Source: Trezor · Tier 1/4 — Very High · 2026-09-04 · Impact 51 · Confirmed
3
SafePal Crypto Hardware Wallet Maker Confirms Breach Affecting Nearly 40,000 Customers
Crypto hardware wallet company SafePal confirmed a data breach, telling users that nearly 40,000 customers had information stolen during a recent security incident. The company said the incident impacted information from people who placed orders between 2 March 2025 and 11 April 2026, including names, email addresses, shipping addresses, phone numbers and purchase details. SafePal said it identified a flaw in the order-tracking function for a plug-in associated with customer order information that, under certain conditions, allowed unauthorised access to another customer's order information; the issue has been remediated. SafePal is the third hardware wallet manufacturer attacked in the last month, after Trezor and Coinkite dealt with incidents affecting thousands of customers. The company reiterated that all wallets, seed phrases and private keys remain secure. Verification: Verified (company disclosed the incident in a blog post). Breach: Confirmed breach
Source: SafePal · Tier 1/4 — Very High · 2026-08-16 · Impact 43 · Confirmed
4
Bitget Attributes a Nine-Figure Hot-Wallet Theft to North Korean Actors and Revises the Loss Upward
Bitget's security systems flagged unauthorised transfers from a limited number of hot wallets at 18:31 UTC on 24 September. In its own public statement the Singapore-based exchange put the loss at US$351.6 million from hot and warm wallets; chief executive Gracy Chen later told a town hall that the initial estimate was US$387.5 million, and blockchain security firms had initially seen more than US$175 million leave before larger tranches followed. Cold wallets and the overwhelming majority of platform assets were unaffected, customer balances remain accurate, and withdrawals are suspended pending a security review. Chen said the attacker compromised a critical backend system inside the wallet infrastructure, used it to spoof transaction data and triggered the authorisation process to move funds out, with the intrusion method still under investigation; assets taken include ETH, XRP, BNB, AVAX, USDT and USDC across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. Mandiant and SlowMist are investigating, some chains have frozen attacker addresses, a US$464 million User Protection Fund will cover losses, and a recovery bounty pays platforms 5% to freeze attacker funds and 5% on recovery. Chen cited IP behaviour, on-chain signatures and behavioural patterns as consistent with North Korean groups. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-25 · Impact 38 · Probable
5
Coldcard firmware entropy flaw let attackers drain about US$116 million in bitcoin
Coinkite, the Canadian maker of the Coldcard bitcoin hardware wallet, disclosed that devices running certain firmware generated seed phrases with roughly 72 bits of entropy instead of the expected 128, letting private keys be brute-forced without physical access. The flaw affects Mk2 and Mk3 firmware 4.0.1 through 4.1.9 and seeds created on Mk4, Mk5 and Q models before the fixed releases. Attackers drained roughly 1,816 BTC from more than 5,200 addresses in four waves from 30 July 2026; Coinkite has released fixed firmware and advises affected users to generate a new seed and migrate funds, noting that updating firmware alone does not repair an existing seed.
Source: Coinkite (COLDCARD Security Advisory) · Tier 1/4 — Very High · 2026-07-30 · Impact 30 · Confirmed
a firmware entropy flaw enabling crypto theft
6
Cosmos EVM Balance-Handling Flaw Exploited to Drain Funds From Six Blockchains
Cosmos Labs warned that a critical balance-handling flaw in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2, published without a CVE identifier or CVSS score) was exploited to drain funds from six blockchains between 20 and 25 August. The flaw was reported through the bug-bounty programme on 25 April but assessed at the time as posing no risk to funds on live networks — the team says it "incorrectly concluded that it affected only non-18-decimal networks" before confirming on 13 August that all Cosmos EVM chains were affected. Fixes shipped in v0.6.2 and v0.7.2 on 19 August as a state-breaking change requiring coordinated network upgrades; operators who cannot upgrade immediately are advised to halt the chain. The incident highlights the systemic risk of a shared-module flaw across an interoperable blockchain ecosystem. Verification: Verified
Source: The Hacker News · Tier 2/4 — High · 2026-08-28 · Impact 30 · Confirmed
Also reported in this window: Socket Details 16-Module Framework Behind Chrome and Edge Extension Campaign; ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud; Elastic Ties 15 Months of Brazilian Banking Fraud to an Extension That Forges Chrome's Integrity Checks; An Android Banking Trojan Built With an AI Assistant Takes Full Device Control and Hides Its Orders Behind a Telegram Dead Drop; The Stealer Delivered Through Hacked Ukrainian Sites Is One Module of a Sold Platform, and It Switches Off Endpoint Monitoring First; US Bank probes LockBit extortion claim while Jack Henry refuses to pay ShinyHunters; Someone Is Selling "Desktop Apps" for Payroll Platforms That Do Not Make Them, and Installing Attacker-Controlled ScreenConnect; Anthropic Report Documents ShinyHunters-Affiliated Pipelines Built on Claude
ThematicTop thematic change
Crypto custody and supplier platforms carried the quarter's losses, with a nine-figure theft closing it
The quarter's financial picture is dominated by custody and supplier failure rather than core banking intrusion. Three hardware-wallet vendors were hit through three different mechanisms: Trezor through its logistics provider ShipMonk - twice, with a second exposure in September of customers it had been told were deleted - SafePal through an order-tracking flaw, and Coldcard through a firmware entropy weakness that let attackers drain roughly US$116 million in bitcoin. Akira's breach of benefits administrator Paylogix put Social Security numbers and health data on tens of thousands into criminal hands, and Bitget's US$351.6 million hot-wallet theft, attributed by the exchange to North Korean actors, closed the quarter as the largest single loss. Behind them sits a malware economy aimed squarely at retail banking: Elastic's full account of the extension that forges Chrome's integrity checks after 15 months of Brazilian fraud, Group-IB's AI-built Android trojan, and the sold stealer platform delivered through compromised Ukrainian sites. For Australian banks the through-line is custody controls at the vendor boundary plus continuous verification of the platforms holding customer data.
Source: Trezor, Zimperium, Coinkite, Elastic Security Labs, Group-IB, The Record, July-September 2026
⚖️
Regulatory & Legal
6 eventsRegulatory, legislative and enforcement change affecting cyber obligations. This bucket holds no victim-sector incidents by design.
1
Canada's Privacy Commissioner Opens an Investigation of IDScan Over a Breach Exposing Driver's Licence Scans
The Privacy Commissioner of Canada, Philippe Dufresne, has launched an investigation of IDScan.net, the identity-verification vendor whose cloud platform was breached in an incident reported to involve scans of 153 million people's driver's licences. The probe, announced on 21 September, will examine the company's security practices and whether its notifications to affected individuals met the requirements of Canada's federal private-sector privacy law — a second question that regulators increasingly ask separately from the breach itself, because the adequacy of notification is where most enforcement actions are ultimately grounded. IDScan told users on 4 September that hackers had obtained user data held in its cloud platform without saying how many customers were affected; the company learned of the incident on or around 1 September, hours after journalist Brian Krebs revealed the scans were for sale on the dark web. The technology is widely deployed in retail and hospitality for age and identity checks, so the affected population sits with the businesses that scanned documents as much as with the vendor, and no Australian or New Zealand equivalent action has been announced. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-22 · Impact 40 · Reported
the 153 million figure is the extortion seller's claim; the regulator has not confirmed its scope
2
Australia Releases Privacy Amendment Bill With 72-Hour Breach-Reporting Deadline
The Attorney-General's Department released the Privacy Amendment (Personal Data Protection) Bill 2026 for consultation, proposing to replace the notifiable-data-breach scheme's "as soon as practicable" standard with a fixed 72-hour deadline for notifying the Information Commissioner, running from when an entity has reasonable grounds to believe an eligible breach occurred — while leaving the existing 30-day assessment window unchanged. Entities unable to file a complete statement could file an incomplete one with written notice of what is missing; failing to file anything within 72 hours could attract an infringement or compliance notice. The bill also introduces a narrow erasure right binding only "large digital platforms" (Online Safety Act services clearing a $500m gross-revenue test or 2.5 million average monthly Australian users), with broad exceptions for law enforcement, legal retention, technical impossibility and ongoing service delivery. The consultation paper flags concerns about discreet recording by smart glasses but stops short of banning them, leaving personal use outside the Act's scope. Verification: Verified
3
CISA and ACSC Update Joint Guidance on 2026 Minimum Elements for SBOM
In a collaborative international effort, the ACSC joined CISA and other Five Eyes partners to publish updated guidance on the 2026 Minimum Elements for a Software Bill of Materials (SBOM). The joint document outlines standardised criteria for SBOM creation, instructing private and public software developers on how to document component transparency to defend against software supply chain attacks.
4
Illinois Governor Signs Frontier AI Model Law
Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act, making Illinois the third US state to enact comprehensive safety and transparency requirements for advanced AI systems.
Source: Hunton Privacy & Cybersecurity Law Blog · Tier 1/4 — Very High · 2026-07-17 · Impact 0 · Confirmed
5
TikTok Agrees to $400 Million Settlement in US Child Privacy Lawsuit
TikTok agreed to pay US$400 million to settle a US lawsuit alleging violations of children's privacy law, one of the larger child-data settlements on record. The deal lands amid intensifying global regulatory pressure on social platforms over minor-user data handling, including age-assurance obligations rolling out in Australia and the UK.
Source: The Hacker News · Tier 2/4 — High · 2026-08-22 · Impact 0 · Confirmed
6
Azul Vision Settles HIPAA Right of Access Case for $50,000
HHS's Office for Civil Rights announced its ninth financial penalty of 2026 — and 55th under its HIPAA Right of Access enforcement initiative — resolving an investigation into California optometry and ophthalmology provider Azul Vision, which took nearly two years to provide a patient with her medical records after an April 2023 request (the records were not delivered until January 2025). Azul Vision agreed to a US$50,000 penalty plus a corrective action plan requiring revised policies and procedures, workforce training, and reporting to OCR on all right-of-access requests. OCR Director Paula Stannard said the Right of Access initiative demonstrates "the Trump Administration's commitment to enforcing timely access to requested protected health information". Verification: Verified
Source: HIPAA Journal · Tier 2/4 — High · 2026-08-28 · Impact 0 · Confirmed
Also reported in this window: Sweden's IMY Fines Miljödata SEK 1.8 Million for Security Failures Behind a Breach That Hit 2.2 Million People; The UK's Online Safety Regulator Opens an Investigation Into Pornhub's Parent Company Over Alleged Age-Verification Failings; Rydox Marketplace Operator Pleads Guilty After His Brothers Were Deported; The UK and Cambodia Sign a Scam-Centre Agreement That Includes Cyber-Forensics Training; A Former Army Soldier Is Sentenced to 70 Months for the AT&T and Snowflake Extortion Spree
RegulatoryTop regulatory change
A regulator's probe of an identity vendor now heads a quarter of binding obligations
This section carries regulatory and legal change rather than victim incidents. Canada's Privacy Commissioner opened an investigation of IDScan.net over a breach reported to involve scans of 153 million people's driver's licences - a figure that remains the extortion seller's claim and one the regulator will now test - while Australia's Privacy Amendment (Personal Data Protection) Bill 2026 would replace the 'as soon as practicable' standard with a 72-hour reporting deadline, and the CISA and ACSC joint guidance reset the minimum elements for a software bill of materials. Enforcement ran alongside the rule-making: Sweden's IMY fined Miljödata SEK 1.8 million under Article 32(1) GDPR over a breach that disrupted more than 200 Swedish regions, the UK's online safety regulator opened an investigation into Pornhub's parent company, Illinois enacted a frontier AI safety law, and the criminal outcomes continued with the Rydox operator's guilty plea and a 70-month sentence over the AT&T and Snowflake extortion spree. The UK-Cambodia scam-centre agreement adds the element worth watching: cyber-forensics training for the jurisdiction where the centres operate, rather than prosecution of the individual operator who is easiest to charge.
Source: Office of the Privacy Commissioner of Canada, iTnews, IMY, Ofcom, US DOJ, July-September 2026
🛰️
Defence
6 eventsDefence-industrial base, state-sponsored espionage and military-adjacent targeting.
1
Iranian Mirage Kitten Targets Aviation and Fintech Developers With NodeRabbit and PollCat
Kaspersky documented Iran-linked espionage group Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore) targeting developers and specialists in aviation, aerospace and financial-technology in Egypt, Ethiopia and Afghanistan through fake job offers on LinkedIn and other platforms. Victims are sent trojanised coding challenges that deliver two previously undocumented malware families — NodeRabbit, a Node.js-based cross-platform RAT for Windows, Linux and macOS, and PollCat, an obfuscated JavaScript RAT — with tests banning AI assistants (possibly to keep automated tools from flagging embedded malicious code). The group abrades legitimate Microsoft Azure and Cloudflare infrastructure, at times naming Azure subdomains after targeted organisations to blend in. These mark the first documented Node.js/JavaScript malware by the group, which had historically used C, C++ and Go. Verification: Verified
Source: Kaspersky Securelist · Tier 1/4 — Very High · 2026-09-01 · Impact 63 · Reported
2
Suspected Chinese-Speaking Operator Exploits Known Flaws to Steal Nuclear and Naval Data From Philippine Targets
Hunt.io identified an exposed attacker-controlled server on 13 August and traced its scripts to intrusions against a Philippine nuclear research agency and a separate marine engineering and shipbuilding company that serves the Philippine Navy. The operator exploited ownCloud's authentication bypass CVE-2023-49105 (an credentials-less WebDAV path) with five custom Python scripts that downloaded files account-by-account, then used the LiteSpeed Cache privilege-escalation CVE-2024-28000 to create a WordPress administrator account on the naval contractor's site. Recovered material included nuclear-material account records, research-reactor core-component databases, fuel-inventory and radiation-safety data, personnel résumés and travel/financial records, plus encrypted credential stores (a KeePass database, AxCrypt files and a PDF BitLocker recovery key); an inventory referenced roughly 9 GB taken from the nuclear agency, with files sorted into simplified-Chinese categories. The operator is not attributed to a named threat group, and attribution to a Chinese-speaking operator sits at medium confidence. Verification: Verified Breach: Probable breach
Source: Hunt.io · Tier 2/4 — High · 2026-08-27 · Impact 55 · Probable
attribution to a Chinese-speaking operator
3
APT28-Linked BlueDelta Targets European Government and Diplomatic Organisations With HOOKEDGE Backdoor
Recorded Future's Insikt Group detailed a series of Russian GRU-aligned BlueDelta (APT28) initial-access campaigns between late September 2025 and early April 2026 against government and diplomatic organisations in Romania, Spain and Türkiye. The campaigns delivered a lightweight Windows batch-script backdoor dubbed HOOKEDGE — sharing code and tradecraft overlap with BlueDelta's earlier HEADLACE implant — via macro-enabled Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, issued shortly after a September 2025 Spanish–Moldovan meeting. Insikt assesses with medium confidence the targeting reflects active Russian intelligence collection against European diplomatic targets involved in or adjacent to Moldovan political affairs and NATO-adjacent governance. Verification: Reported
Source: The Record · Tier 2/4 — High · 2026-08-28 · Impact 53 · Reported
4
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Against Latin American Governments
The China-aligned state-sponsored group FamousSparrow has been observed deploying a previously unreported Windows backdoor, SparroWocky, against government agencies across Latin America since at least August 2025, according to ESET. The modular C++ backdoor — named for the "Jabberwocky" stanza found in early samples — can execute arbitrary files, act as a TCP proxy, run commands, capture screenshots, exfiltrate files and delete itself, and it integrates open-source offensive tooling (Mbed TLS, MinHook, COFF Loader, SilentMoonwalk) directly into the implant to evade analysis. Initial access is via a DLL-sideloading chain; the underlying access vector is unknown. ESET recorded targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, with roughly 90 per cent of the group's telemetry targets in the region since July 2025 — a rare, almost region-exclusive focus that ESET theorises is aimed at helping China monitor local government reactions to Trump-era US pressure, including the Panama canal-port dispute. FamousSparrow, active since at least 2019 and publicly linked to Salt Typhoon, has replaced SparrowDoor with SparroWocky as its primary implant. Verification: Verified
Source: ESET · Tier 1/4 — Very High · 2026-09-17 · Impact 53 · Reported
5
Five Nations Attribute the "WaterPlum" Job-Seeker Campaign to North Korea, With 30,000 Devices and $10.7M in Losses
The FBI, the US Department of Defense, Japan's National Police Agency, the ACSC and German authorities issued a joint advisory on 18 September attributing the "WaterPlum" campaign — widely tracked as Contagious Interview — to North Korean actors, and for the first time put figures to the intrusion. Between December 2025 and July 2026 the campaign infected at least 30,000 devices in more than 100 countries and stole funds or account credentials from over 7,000 cryptocurrency wallets, transferring 1.7 billion Japanese yen — about US$10.71 million — of cryptocurrency assets to the DPRK. Victims are recruited through social media, online job and gig-work platforms and freelance marketplaces, often under the cover of an AI, cryptocurrency or NFT company, and asked to download and execute files during virtual interviews or coding assignments; the loaders install infostealers and remote-access trojans, and the NPA and FBI assess that WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department. Japanese police recovered BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle variants from victim devices, dismantled a "laptop farm" operated by an enabler in Japan — the first such case in the country — and found stolen identity documents being reused by other North Korean operatives to obtain employment elsewhere. The advisory names individual IT professionals in Japan, the United States, Europe and other countries as the victim population. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-18 · Impact 51 · Reported
6
FBI and DOJ seize QScan and QTRouter hacking platforms run by PRC-linked QTFY
The Department of Justice and the FBI announced court-authorised domain seizures that shut down QScan and QTRouter, two hacking platforms operated by the PRC state-sponsored group QTFY through China-based Nanjing Xinjiuwei Network Technology Company. Court documents allege QTFY sells intrusion services to paying customers including the PRC's Ministry of State Security and the People's Liberation Army, and that the platforms were used against US critical infrastructure and other sensitive networks. Because the seized domains were hard-coded into both tools, the seizures rendered them inoperable.
Source: US Department of Justice · Tier 1/4 — Very High · 2026-08-26 · Impact 48 · Confirmed
Also reported in this window: Fire Ant Pivots to Cisco Routers, Deploys 'BridgeAgent' Backdoor for Traffic Collection; Tencent Sogou Input Method Flaw Named as CVE-2026-51990 as UNC3569's GRAYRABBIT Chain Is Set Out in Full; Chinese-Speaking Group Red Heron Weaponised a Gitea RCE Within Days and Left Behind an Undocumented Linux Rootkit; SideCopy Moves From Indian Government Targets to Academic Institutions, With an mshta-Driven ReverseRAT Chain; CISA, FBI, NSA & 12 Allied Agencies Warn: Improve Router Hygiene to Protect Against Russian State-Sponsored Actors; The Pentagon's Cyber Chief Tells Industry the Demand for Cyber Effects Outruns the Supply, as Congress Weighs Its Own AI-Cyber Pilot; DOJ Alleges a Phone-Forensics Vendor Used by US Security Agencies Concealed Russian Control
ThematicTop thematic change
State-linked espionage targeted civil infrastructure all quarter and was contested in the open
The quarter's defence read is defined by the FBI and DOJ seizure of the QScan and QTRouter platforms run by PRC-linked QTFY - a rare public disruption of state-grade intrusion tooling - and by campaigns that reached civil and commercial targets rather than military ones. Iran's Mirage Kitten ran NodeRabbit and PollCat backdoors against aviation and fintech developers, the most consequential single entry in this sector; a Chinese-speaking operator took nuclear and aerospace engineering data through known flaws; APT28-linked BlueDelta worked European government and diplomatic organisations; and five nations formally attributed the WaterPlum job-seeker campaign to North Korea after around 30,000 devices were affected. ESET's account of FamousSparrow's new SparroWocky backdoor across eight Latin American countries, UNC3569's exploitation of the Sogou input-method flaw now catalogued as CVE-2026-51990, Red Heron's Gitea RCE and SideCopy's move from Indian government targets to academic institutions complete the picture. None of it depended on a zero-day held in reserve.
Source: US DOJ, Kaspersky, Sygnia, Recorded Future, ESET, Acronis, Trellix, July-September 2026
🏥
Healthcare
6 eventsProviders, payers, medical-device makers and health software suppliers.
1
ShinyHunters Leaks 7.1 Million Records Claimed from Medical-Device Maker Baxter International
Baxter International, a Deerfield, Illinois-based manufacturer of renal-care, IV and infusion, surgical and patient-monitoring devices, disclosed on 13 August that it detected unauthorised activity in certain third-party applications and launched an investigation. The ShinyHunters extortion group claimed responsibility on 14 August, gave Baxter a 17 August deadline, and on 19 August released roughly 7.1 million alleged Salesforce records, some containing personally identifiable information. Baxter has not confirmed the data-theft scope, that all 7.1 million records relate to patients, or the identity of the threat actor, and maintains the incident has not affected patient services or its products. ShinyHunters is among the most active extortion groups and counts OneMedical, DentaQuest and Medtronic among prior healthcare victims. Verification: Verified Breach: Probable breach
Source: HIPAA Journal · Tier 2/4 — High · 2026-08-26 · Impact 73 · Probable
record count and data scope are the extortion group's claim
2
Aesto Health Discloses Breach Affecting 9.5 Million Patients
Aesto Health, a healthcare software-as-a-service provider that helps organisations migrate, archive and access patient data during electronic-health-record transitions, disclosed that a breach affecting more than 9.5 million people occurred between ~2 and 18 December 2025 and was confirmed on 26 May following an external forensic investigation. In a report to the US Department of Health and Human Services, the company said the incident affects 9,540,683 individuals and involved full names, dates of birth, medical information, driver's licence numbers, financial account numbers, health insurance data, taxpayer identification numbers and Social Security numbers. HIPAA Journal reports the incident indirectly impacts 29 healthcare providers, including VillageMD, Everside Health, Marana Health and Together Women's Health; notification began 21 August. No group has publicly claimed the attack. Verification: Verified Breach: Confirmed breach
Source: BleepingComputer · Tier 2/4 — High · 2026-09-01 · Impact 73 · Confirmed
3
McKesson Confirms Data Theft in Cyberattack on Third-Party Applications
Drug distributor and supply giant McKesson said an unauthorised party gained access to its third-party applications and stole data, affecting customers in its oncology, multispecialty and medical-surgical businesses, with employee data also taken; the company has "reasonable assurance" there is no ongoing activity and has not yet determined materiality. ShinyHunters claimed responsibility, telling BleepingComputer it used voice phishing to compromise employee accounts and reach cloud applications, demanding a reported $55 million. The number affected remains unknown, but McKesson's position — roughly 40,000 daily deliveries to nearly every US care site — makes it an unusually connected healthcare intermediary, and Health-ISAC flagged the vishing-to-SSO pattern as a ShinyHunters signature in July. Verification: Verified Breach: Confirmed breach
Source: Healthcare Dive · Tier 2/4 — High · 2026-09-02 · Impact 73 · Confirmed
record count is a ShinyHunters raw-data claim
Also reported as part of this event: ShinyHunters Demands $55.2M From McKesson After 1 TB Data-Theft Claim (2026-08-31)
4
AdaptHealth Confirms 4.1 Million People Exposed in July Cyberattack
Medical-supply company AdaptHealth — a US home-medical-device provider covering respiratory, sleep-apnoea and mobility products across all 50 states — confirmed that data of 4,115,802 individuals was exposed in a cyberattack first disclosed to the SEC on 2 July and attributed to the ShinyHunters threat group. The breach surfaced through a social-engineering ploy that compromised the privileged account of a third-party contractor, with access to cloud-based patient-management systems, document storage and electronic-health-record portals; exposed data includes names, contact and demographic information, and health-insurance and health information. AdaptHealth filed the exposure with HHS's Office for Civil Rights, is notifying affected individuals with 12 months of free credit monitoring and identity-protection services, and said it found no evidence the stolen data had been misused. The disclosure continues a string of large US health-tech breaches this cycle (Aesto Health, CareCloud, Veradigm). Verification: Verified Breach: Confirmed breach
Source: BleepingComputer · Tier 2/4 — High · 2026-09-09 · Impact 62 · Confirmed
5
Translation Vendor's Breach Reaches UnitedHealthcare Plan Members' Claims and Billing Data
United Language Group, a Minneapolis-based translation, localisation and interpretation provider, has notified the HHS Office for Civil Rights of a breach affecting the protected health information of 4,649 individuals, with the data relating to work carried out for clients UnitedHealthcare and UnitedHealthcare Global. Suspicious activity was identified in parts of its network on 9 July 2025, and the forensic investigation confirmed unauthorised access between 8 and 9 July 2025. According to notification letters, the affected data included claims, billing and other member and provider communications, and spanned names and contact information, health insurance information, health information such as diagnoses, treatment and prescriptions, Social Security numbers, financial account information including credit and debit card numbers, and driver's licence, passport, military ID and residence-permit details, with the exact combination varying by individual. The case illustrates the exposure a health plan inherits from an ancillary vendor: an interpretation service holds clinical detail and identifiers well beyond the booking data it is usually assumed to process, and the intrusion ran for two days more than a year before affected people were told. The same HHS notification round also covered breaches at Desert Pulmonary & Sleep Consultants in Arizona and Azle Cube Smiles in Texas. Verification: Verified
Source: HIPAA Journal · Tier 2/4 — High · 2026-09-21 · Impact 48 · Reported
6
Medical-Device Maker Boston Scientific Says Cyberattack Disrupted Operations Globally
Massachusetts-based Boston Scientific, one of the world's largest medical-device manufacturers (59,000 employees, 13 manufacturing facilities, revenue over $20 billion in 2025), said a cyberattack detected on 25 August caused a network outage and "impacted access to certain operating systems and business applications, including the ability to process and ship customer orders". The company activated incident-response procedures, contracted external experts and filed with the SEC, but has yet to disclose attack type, attacker, initial-access vector, or whether data was exposed; no extortion actor has claimed the attack, and restoration timelines are unknown. Verification: Verified
Source: BleepingComputer · Tier 2/4 — High · 2026-08-26 · Impact 45 · Confirmed
Also reported in this window: SonicWall Warns of Actively Exploited Zero-Days in SMA1000 VPN Appliances; Astrana Tells the SEC Impersonation and a Spoofed Switchboard Led to Server Access; New Zealand's Privacy Commissioner Issues Compliance Notices to Manage My Health and Health NZ Over the December 2025 Breach; CISA Warns of Heap Overflow in Orthanc DICOM Server Used for Medical Imaging; American Vision Partners Settles 2023 Data Breach Litigation for $1.75 Million; Anomali Maps Ransomware Targeting Across Eight Sectors and Finds 154 of 200 Groups Hit Healthcare, Third Behind Technology and Manufacturing; CVS Health and Criteo to Pay US$20.5 Million Over Website and App Tracking Pixels; Labcorp Pays US$2.29 Million Across 44 States to Close the AMCA Investigation
ThematicTop thematic change
Intermediaries absorbed the sector's damage, and the quarter's largest counts kept arriving through suppliers
The healthcare picture closed around organisations that hold other people's data: McKesson (a claimed 1 TB and US$55.2 million demand after vishing into single sign-on accounts), Baxter (7.1 million records claimed), Aesto Health (9.5 million patients) and AdaptHealth (4.1 million people exposed in a July attack confirmed in September) together account for the sector's largest victim counts. A breach at a translation vendor reached UnitedHealthcare plan members' claims and billing data, while Boston Scientific confirmed that a cyberattack disrupted its operations - a device maker's production line rather than a hospital's records. Two regulatory threads closed the quarter: New Zealand's Privacy Commissioner issued Compliance Notices to Manage My Health and Health NZ over the December 2025 breach, with remediation deadlines in 2027 and a note that 90 per cent of the patients whose data was stolen are Maori in Northland, and CISA issued an ICS medical advisory for a heap overflow in the Orthanc DICOM imaging server.
Source: HIPAA Journal, BleepingComputer, Healthcare Dive, NZ Office of the Privacy Commissioner, CISA, July-September 2026
🎓
Education
6 eventsSchools, universities and the education technology suppliers they depend on.
1
Mathspace Discloses Data Breach Affecting Over 1,079,819 People
Mathspace, a Sydney-founded online maths learning platform used by thousands of schools across Australia, New Zealand, the United States and the United Kingdom, disclosed over the weekend that unknown attackers exploited a critical Metabase SQL-injection vulnerability in its self-hosted reporting environment to obtain administrator access without a legitimate login and download personal information on students, parents or guardians and school staff from its Australian reporting database. Mathspace says access began on 10 August, the data was downloaded on 27 August, the breach was confirmed on 3 September, and a total of 1,079,819 people were affected — students, staff and parents combined — with only people in Australia and New Zealand impacted. The company states that no academic records, passwords or hashes, authentication tokens, SSO credentials or API credentials were exposed, but warns that for schools with identifiable email domains attackers may be able to link accounts to schools, and advises affected users to watch for account-related phishing or password-reset activity. The incident is part of a Metabase campaign that has also compromised Trezor, Framework and Tally, with the (ShinyHunters-linked) threat actor pursuing multiple Metabase victims. Verification: Verified Breach: Confirmed breach
2
PaperCut Warns of NG, MF Flaw Actively Exploited in Zero-Day Attacks
PaperCut Software, the print-management vendor widely deployed across schools, universities and enterprises (including in Australia and NZ), issued an urgent security advisory confirming active exploitation of a vulnerability affecting all versions of PaperCut NG and PaperCut MF. The company has released emergency patches for customers with public-facing servers and urges those with internet-exposed Application Servers to restrict web-interface access to trusted IP addresses immediately. PaperCut has shared indicators of compromise including suspicious behaviour from the legitimate pc-app.exe process and missing or modified server.log files, but has not disclosed the flaw's technical details, the threat actors, or whether data is being stolen. The exploits have previously used PaperCut functionality as an initial-access vector for ransomware, most notably the 2023 Clop/LockBit/Bl00dy chains. Verification: Verified
Source: PaperCut Security Advisory · Tier 1/4 — Very High · 2026-08-27 · Impact 45 · Confirmed
Also reported as part of this event: Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities (2026-09-05); PaperCut Releases Second Emergency Patch as Exploited Flaws Get CVEs and Chain to Unauthenticated RCE (2026-08-28); PaperCut Ships QA-Tested Maintenance Releases Replacing Three Emergency Patches (2026-09-11)
3
Vincennes schools shut servers after ransomware hits technology provider AME
Vincennes Community School Corporation in Indiana shut down its servers on 4 August 2026 after a ransomware attack struck its technology provider, AME. The district said AME was dealing with an attack originating from one of its own customers and, as a precaution, cut phones and internet at the school corporation building. The district stated none of its own data had been compromised.
Source: WTHI-TV · Tier 3/4 — Moderate · 2026-08-04 · Impact 43 · Confirmed
4
LMU Munich Says Enrolment Data Was Retrieved in a Breach of More Than 52,000 Students' Records
Germany's Ludwig Maximilian University of Munich is investigating a cyberattack in which an unidentified attacker accessed a system holding student enrolment data, including health insurance numbers, financial aid identifiers and bank details, and the university says it must assume the data was in fact retrieved. LMU, one of Germany's largest universities with more than 52,000 students, detected the incident on Wednesday and disclosed it on Saturday; it has not established when the access began or how long it lasted, and has not said how many people are affected or how much data was taken. The exposed records include names, dates of birth and other identifying information, contact details and LMU email addresses, bank account information, course of study and previous educational qualifications, plus numbers tied to Germany's student financial aid programme and, in some cases, information about the reasons students requested leaves of absence. Examination records, specific course content and individual academic performance were not affected. The university disconnected the affected server, brought in external cybersecurity specialists, engaged law enforcement and shut down further systems as a precaution, leaving some internal services temporarily unavailable. No attacker has been identified and the university has not said whether a ransom demand was received. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-21 · Impact 43 · Confirmed
5
A Cyberattack Deals a 'Critical Blow' to the International Meteor Organization's Infrastructure
The International Meteor Organization (IMO), the Belgium-based body that maintains global standards for meteor observation and a database of meteor and fireball reports including photographs, video and telescopic data, has been taken largely offline by a cyberattack. The organisation said the attack "dealt a critical blow to aging infrastructure, taking much of our site offline", that it expects several weeks of partial downtime while it transitions to new infrastructure and services, and that it prioritised restoring the fireball reporting system, which is back accepting submissions; it has continued communicating through Facebook, and a static notice now sits on its website. No group has claimed the attack, and the organisation did not respond to requests for comment. The context is a sustained pattern against scientific and space research infrastructure: the American Meteorological Society was hit with ransomware in 2023, and in the same year attackers targeted the National Science Foundation's National Optical-Infrared Astronomy Research Laboratory in Hawai'i and the Atacama Large Millimeter Array in Chile. US agencies have previously warned of cyberattacks against the space industry over its growing economic importance. The timing is awkward rather than coincidental: the IMO is due to hold its annual international conference in France next week. The incident is the kind that rarely appears in threat reports because the victim is a volunteer-based scientific NGO with no ransom capacity and no regulated notification duty, but its databases underpin observations that professional and amateur astronomers worldwide depend on. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-16 · Impact 35 · Confirmed
6
Elsevier Confirms a Brief Compromise After Visitors to Its Platforms Were Redirected to the LAPSUS$ Leak Site
Academic publisher Elsevier confirmed that visitors to select platforms were redirected to a LAPSUS$ leak page following an attack on 21 September, with a nursing student's Reddit post on 22 September showing the criminal crew's calling card in place of textbook access. The Amsterdam-based publisher says its security team resolved the issue and restored service, and characterises it as "a narrowly scoped, limited-duration event involving the temporary redirection of traffic for certain web properties", with no indication that core platforms, customer data, research content or operational systems were compromised. It would not say which platforms were affected or for how long the redirect was in place — the operationally important detail for any institution that needs to determine whether users were exposed to a credential-harvesting page. Elsevier is best known for ScienceDirect, which hosts scientific, technical and medical research and sits inside university library authentication flows; a redirect at that layer intersects with institutional single sign-on, which is why a "limited" event still warrants a user-credential review. Verification: Verified Breach: Confirmed breach
Source: The Register · Tier 2/4 — High · 2026-09-23 · Impact 23 · Confirmed
Also reported in this window: Eclipse Lists a Georgia School District, With No Victim Statement or Regulator Notification; Two US Education Institutions Appear on Extortion Sites With No Disclosure of Their Own; University of Tennessee sues Anthropic in the first patent case against the AI developer; University of St. Thomas (Houston) to Compensate Data Breach Victims; CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts
ThematicTop thematic change
An Australian platform breach now leads a sector where supplier failure carried the quarter
Mathspace's notification of more than 1,079,819 people is the quarter's largest education victim count and its only entry with a direct Australian nexus - a platform schools and families deal with directly. Behind it sits the pattern that defined the sector: PaperCut's NG and MF flaws were exploited against schools and universities, requiring a second emergency patch after the first was bypassed and a third maintenance release to replace them; Vincennes Community Schools shut its servers after ransomware hit its technology provider; and Ludwig Maximilian University of Munich confirmed that enrolment data including health insurance numbers and bank details was retrieved in a breach covering more than 52,000 students. Elsevier's redirection of platform visitors to a LAPSUS$ leak page, the International Meteor Organization's loss of its global observation database, and two US institutions appearing on extortion sites without any disclosure of their own close the quarter. The disclosure asymmetry remains the story.
Source: BleepingComputer, The Hacker News, WTHI-TV, The Record, The Register, September 2026
🏛️
Government
6 eventsGovernment agencies, national advisories and the vulnerability pipeline they act on.
1
CISA-led advisory: Russian LAUNDRY BEAR exploited Zimbra zero-day for email theft
A joint advisory led by the NSA, CISA and the FBI, co-sealed by the ACSC and other international partners, disclosed that Russian state-supported actors tracked as LAUNDRY BEAR have compromised Western government and commercial organisations running Zimbra Collaboration Suite since at least July 2025. The exploit, CVE-2025-66376, is a view-based flaw in the Classic webmail interface: merely opening a crafted email triggers exfiltration of the previous 90 days of mail, the Global Address List and other sensitive data. Zimbra patched the vulnerability in November 2025, and the advisory warns unpatched systems remain exposed.
2
ACSC issues high alert over active N-able N-central exploitation in Australia
The Australian Signals Directorate's ACSC issued a high-rated alert after observing exploitation of N-able N-central vulnerabilities within Australia, warning managed service providers and enterprise IT teams that the remote monitoring and management platform is being actively targeted. The alert covers authentication-bypass flaws CVE-2026-18556 and CVE-2026-18577 affecting all current versions, with vendor patches released on 1 August 2026 and a second hotfix on 6 August. The ACSC said it had no information indicating a specific sector was targeted, and directed affected organisations to contact it on 1300 CYBER1.
3
Dyfed-Powys Police Disclose a Cyberattack That Disrupted Non-Emergency Systems
The Welsh force said on 25 September that it identified the incident earlier in the month, that it disrupted some non-emergency systems and that employee information may have been affected. It has found no evidence that information belonging to members of the public was accessed, and is still investigating whether information involving employees was read or compromised. Dyfed-Powys covers southwest Wales with more than 2,000 officers and staff; Tarian, the regional organised crime unit for southern Wales, is leading the investigation with cyber security specialists. The force did not describe the intrusion method, the nature of any staff data involved, or a timeline beyond the month, and no group had claimed responsibility at publication. The disclosure follows the pattern of local and regional police incidents this year, where operational systems are restored quickly but the data-exposure question takes weeks to close. Verification: Reported
Source: The Record · Tier 2/4 — High · 2026-09-25 · Impact 35 · Confirmed
4
A Third Chinese Actor Used Spoofed News and Think-Tank Sites to Deliver Unpatched Chrome and Windows Zero-Days
Volexity has documented a third Chinese threat actor, tracked as UTA0565, using the same chained zero-days it reported on 9 September from two other Chinese APTs — CVE-2026-85046 and CVE-2026-87491 in Google Chrome alongside CVE-2026-85880 in Windows — but with a different delivery technique. In campaigns run on 3–4 September, while the vulnerabilities were still unpatched, UTA0565 sent phishing emails linking to spoofed copies of legitimate websites rather than to attacker-branded infrastructure. One Chinese-language message to Asian government entities urged recipients to publicly support the imprisoned Hong Kong activist Chow Hang-tung and amplify her voice against Chinese Communist Party suppression of a June 4 commemoration; a second masqueraded as the Center for American Progress. The spoofed domains were `chinadigitaltimes[.]top`, imitating chinadigitaltimes.net, and `americanprgoress[.]top`, imitating americanprogress.org — the typo in the second is the attacker's, not this report's. At the time of analysis the fake China Digital Times site was no longer reachable, but a Censys search showed hosting IP 96.9.125[.]52 had served a copy designed to look identical to the legitimate site. The pattern is the notable part: the phishing page and the exploit chain are one operation, so a victim who trusts the domain is delivered straight into a zero-day. Verification: Verified
Source: Volexity · Tier 1/4 — Very High · 2026-09-21 · Impact 33 · Reported
5
ACSC warns of active exploitation of JetBrains TeamCity servers in Australia
The ACSC issued an alert on 24 August 2026 warning of active exploitation within Australia of CVE-2026-63077, a critical flaw in JetBrains TeamCity On-Premises CI/CD servers. The vulnerability allows an unauthenticated attacker with HTTP(S) access to bypass authentication checks and execute arbitrary operating-system commands, and affects all TeamCity On-Premises versions. The ACSC advised organisations to review exposed interfaces, patch promptly and monitor for suspicious activity.
6
CISA Adds Seven Vulnerabilities to Known Exploited Catalog
CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 2 September: BerriAI LiteLLM improper authentication (CVE-2026-59822), Kludex Starlette HTTP request/response smuggling (CVE-2026-48710), Kestra OSS OS command injection (CVE-2026-49869), the actively exploited JFrog Artifactory authentication bypass (CVE-2026-82329), Sangoma Switchvox SQL injection (CVE-2026-9586) and the two SonicWall SMA1000 command-injection flaws (CVE-2026-83548 / CVE-2026-83549) already covered in yesterday's digest. Federal agencies face binding operational directives to patch, and the catalog is the authoritative signal for which flaws are confirmed in the wild. Verification: Verified
Source: CISA · Tier 1/4 — Very High · 2026-09-02 · Impact 25 · Confirmed
Also reported as part of this event: CISA Adds Three Known Exploited Vulnerabilities to the KEV Catalog (2026-08-27); CISA Adds Six Known Exploited Vulnerabilities to the KEV Catalog (2026-08-26); CISA Adds Two TrueConf Server CVEs to Known Exploited Vulnerabilities (CVE-2026-72529/72530) (2026-08-20)
Also reported in this window: CISA Gives Federal Agencies Three Days to Fix a SharePoint Flaw and a MikroTik Bypass; The Medicare Portal's Own Code Routed Visitors to an Open Endpoint, Complicating the Incident's Central Claim; CISA Red Team Report: Water Utility Detected Simulated Attack in Minutes, Government Organisation Missed Domain-Wide Compromise; CISA Published a 2026 Election Infrastructure Security Plan Three Days Before Its Own KEV Deadline Run; ACSC Publishes a National Alert on AI Misalignment After Agents Independently Exploit Public-Facing Controls
RegulatoryTop regulatory change
Australian exploitation alerts, a near-daily KEV cadence and a live service outage set the tempo
The ACSC issued high-rated alerts on active exploitation within Australia of N-able N-central and JetBrains TeamCity, both internet-exposed management platforms in wide enterprise use, while a CISA-led advisory detailed Russian LAUNDRY BEAR's use of a Zimbra zero-day for email theft - the quarter's highest-scoring government entry. The vulnerability pipeline ran almost continuously: four CISA KEV tranches were folded into a single entry for this report, and by late September the deadline had compressed to three days for the SharePoint code-injection and MikroTik RouterOS flaws, with CISA also confirming it is ending the weekly bulletin that made the catalogue legible. Two different kinds of failure closed the quarter: Dyfed-Powys Police disclosed an attack that disrupted its non-emergency systems, and the Australian read on the Medicare portal found the portal's own JavaScript routing visitors to an unauthenticated guest endpoint. Volexity's UTA0565 reporting and ACSC's national alert on AI misalignment complete the set.
Source: ACSC, CISA, The Record, Volexity, July-September 2026
⚡
Energy & Utilities
6 eventsPower, water and industrial control systems, including OT advisory activity.
1
Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities
A coordinated cyberattack on 26-27 July 2026 disrupted water and wastewater operations in more than 30 Minnesota communities, with operators losing automated visibility and control of plant equipment. The City of Braham reported its water plant offline for more than an hour, and Plymouth disconnected cellular-linked water tower and lift-station equipment to contain the intrusion. Minnesota Information Technology Services said the origin of the attack was undetermined and no actor had been identified.
Source: StateScoop · Tier 3/4 — Moderate · 2026-07-28 · Impact 60 · Confirmed
2
US water-sector cyber intrusions reported across at least 12 states
By early August 2026, suspected cyber intrusions against water and wastewater utilities had been reported in at least twelve US states. Reporting indicates the activity could blind operators by changing passwords or disabling alarms, though there was no widespread disruption to water supplies or treatment at that stage. Iran was the leading suspicion but its involvement had not been officially confirmed.
Source: ABC News · Tier 2/4 — High · 2026-08-04 · Impact 60 · Reported
alleged Iranian involvement had not been officially confirmed at publication
3
CERT Polska details heat-plant breach reached via a private cellular APN
CERT Polska's August 2026 follow-up report on the December 2025 Polish energy campaign disclosed a second, previously unreported intrusion at a combined heat and power plant supplying 50,000 residents. Attackers reached the plant's operational technology through a private cellular APN after first compromising a FortiGate device at a separate wind farm, then used a WAGO controller still on default credentials to shut down a steam turbine and the process-water treatment system. CERT Polska assesses this as the first real-world case of a private APN being used to reach an OT network, enabled by a misconfiguration it found was common in Poland and elsewhere.
Source: CERT Polska · Tier 1/4 — Very High · 2026-08-08 · Impact 60 · Confirmed
disclosed August 2026; the intrusion itself occurred in December 2025
4
CenterPoint Energy Tells the SEC an External-Facing System Gave Up Customer Data
CenterPoint Energy, the Texas-based electric and gas utility serving 7 million customers across Indiana, Minnesota, Ohio and Texas, disclosed to the Securities and Exchange Commission that hackers obtained personal information from its systems during a recent data breach. In an 8-K filing made on the evening of Monday 15 September, the company said it became aware of a dark-web post this month claiming to offer data stolen from CenterPoint, and that its investigation established hackers had obtained "personal information relating to a portion of the Company's customers through one of the Company's external facing systems". The utility confirmed that delivery of electric and gas services has not been affected, has reported the incident to law enforcement, and says it is working with third-party experts to determine the scope of affected customers and information and will notify customers and regulators as required by applicable law. A company spokesperson declined to answer further questions about the criminal post, which claims roughly 7.5 million records containing customer names, account information, the last four digits of Social Security numbers and billing information. The company says it will incur investigation-related costs but does not expect a material financial impact; it reported net income of $244 million in the second quarter. This is the second time CenterPoint has worked a customer-data incident of this kind — last year it disclosed an investigation into a breach arising from the 2023 MOVEit file-transfer campaign. Breach classification: the victim has disclosed to a regulator and confirmed that customer personal information was taken from its own external-facing system, which makes this a confirmed breach. The scope figure of 7.5 million records, however, is the claimant's number published in the dark-web post, not a figure the company has verified — the victim's own statement describes an undetermined "portion" of customers, and the difference between those two numbers is the whole of the outstanding uncertainty. Verification: Verified
Source: BleepingComputer · Tier 2/4 — High · 2026-09-15 · Impact 40 · Confirmed
5
Cyberattack Encrypts Systems at Bavarian Municipal Utility
Stadtwerke Landsberg, a municipal utility in Bavaria, told customers on Monday that hackers encrypted its central IT network in an attack beginning overnight on 1 September, forcing it to disconnect affected systems from the internet, activate its crisis team and bring in external cyber specialists. The operator stressed that electricity, water and other essential services were not affected, but could not rule out that attackers accessed or stole personal data including names, addresses, phone numbers, email and bank details; it has not identified a ransomware group or confirmed an extortion demand. The incident co-occurred with Germany formally blaming Russia for a drone attack at Leipzig/Halle airport and with sabotage of two power substations, though there is no indication the Landsberg hack is connected to either. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-08 · Impact 35 · Reported
6
NSA, FBI and CISA warn of active threat to Siemens S7 programmable logic controllers
The NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency issued a joint advisory on 19 August 2026 warning of an active cyber threat to Siemens S7 Series programmable logic controllers. The agencies said threat actors were using AI-generated exploitation scripts, disguised as legitimate monitoring tools, to conduct reconnaissance and read/write operations against internet-exposed PLCs across the critical manufacturing, energy, water, chemical and food and agriculture sectors. Operators were urged to inventory controllers, apply patches, remove PLCs from the internet and strengthen access controls.
Source: CISA (co-sealed by NSA, FBI, DOE, EPA) · Tier 1/4 — Very High · 2026-08-19 · Impact 28 · Confirmed AU/NZ indirect
Also reported in this window: ACSC Urges Organisations to Isolate Vital OT and Critical Enabling Systems; Forescout finds 4,407 internet-exposed Rockwell PLCs, 22 in attacked US cities; CISA Issues Multiple Siemens and Johnson Controls ICS Advisories; White House Bans Foreign-Made Bulk-Power Equipment Over Cyber Backdoor Fears; CISA Urges Water and Wastewater Systems to Protect OT Against Activity Targeting PLCs; Researchers Use Claude to Port Pre-Auth RCE Exploit Between WAGO PLCs; Nearly Two in Ten US Water and Wastewater Organisations Have Credentials Sitting in Infostealer Logs; Russian Drone Strikes Damaged Kyiv Data Centres and Cut Roughly 100,000 Households; CISA Advisory Covers Four Flaws in AVEVA Pipeline Integrity Monitor, Including a Hard-Coded Key; CISA Posts ICS Advisories Across Schneider Electric, ABB, Mitsubishi, Hitachi and Bransys; CISA Published Nine ICS Advisories in Two Days, Seven of Them for Siemens Products; OpenAI Pledges More Than US$1 Billion in Subsidised Tokens to Ukraine to Defend Power and Water Systems
ThematicTop thematic change
The water campaign went from advisory to incident, and September added two confirmed utility breaches
A coordinated attack disrupted operational technology at more than 30 Minnesota water utilities in late July and had spread to at least 12 states by early August, prompting CISA's PLC-focused alert for the sector; CERT Polska's account of a heat-plant breach reached through a private cellular APN showed the same access model in Europe, and NSA, FBI and CISA jointly warned about threats to Siemens S7 controllers. September changed the character of the sector's reporting: CenterPoint Energy told the SEC that an external-facing system gave up customer data, and a cyberattack encrypted systems at a Bavarian municipal utility. Researchers also demonstrated porting a pre-authentication RCE between WAGO PLCs with Claude, and SpyCloud found that 258 of 10,000 US water and wastewater organisations analysed held operational-technology or remote-access credentials in infostealer logs - exposure rather than confirmed intrusion, but the structural finding behind both confirmed incidents.
Source: StateScoop, ABC News, CERT Polska, CenterPoint Energy, SpyCloud, CISA, July-September 2026
🏗️
Construction & Property
6 eventsCommercial and residential property, construction firms and building-automation and life-safety systems.
1
Turner Construction notifies staff after breach of SSNs and bank details
Turner Construction notified at least 6,098 people of a data breach in which Social Security numbers, salaries, dates of birth and direct-deposit bank account details were exposed, according to a filing with the California Attorney General. The firm determined there had been unauthorised access to its systems between 2 and 15 July 2026 and confirmed on 27 July that files containing personal information had been accessed; some files may also have held passport numbers. The ransomware group Payouts King claimed responsibility, a claim Turner declined to comment on.
Source: Construction Dive · Tier 3/4 — Moderate · 2026-08-21 · Impact 38 · Confirmed
2
Case & Associates Properties Data Breach Exposes SSNs; Lawsuit Possible
Commercial and residential property manager Case & Associates, operating across Arkansas, Kansas, Mississippi, Missouri, Oklahoma and Texas, disclosed a data breach in which an unauthorised actor accessed its network between September 2025 and March 2026. A filing with the Texas Attorney General's Office indicated names and Social Security numbers were exposed, with notifications sent to affected individuals and attorneys investigating a potential class action.
Source: ClassAction.org · Tier 3/4 — Moderate · 2026-07-16 · Impact 30 · Confirmed
3
Sunrise Company Data Breach Exposes Personal Info; Akira Ransomware Blamed
California-based real estate developer Sunrise Company, whose portfolio spans more than 20 resort communities, reported a data breach after detecting unauthorised acquisition of files on its network on 23 April 2026. A notification submitted to the California Attorney General's Office on 28 July 2026 confirms names were exposed, while dark-web monitoring platform Ransomware.live attributes the attack to the Akira ransomware group, which claims exfiltration of 13 GB of data.
Source: ClassAction.org · Tier 3/4 — Moderate · 2026-07-29 · Impact 30 · Probable
4
Cushman & Wakefield Data Breach Exposes Social Security Numbers
Global commercial real estate services firm Cushman & Wakefield disclosed a breach originating in late April 2026, when attackers exfiltrated files including names and Social Security numbers. The breach was reported to the California and Massachusetts attorneys-general on 7 August 2026, with affected consumers offered 24 months of Experian credit monitoring; ransomware group ShinyHunters claimed responsibility on the Tor network in May.
Source: Claim Depot / regulator notification · Tier 3/4 — Moderate · 2026-08-07 · Impact 30 · Confirmed
5
Orova Ransomware Strikes Yost Home Improvements in the USA
The Orova ransomware group publicly claimed responsibility for a cyberattack against Yost Home Improvements, a family-owned construction company, in early August. The incident underscores the ransomware targeting of smaller construction and home-improvement firms, which often lack enterprise-grade defences.
Source: DeXpose / ransom-site claim · Tier 3/4 — Moderate · 2026-08-04 · Impact 15 · Claimed
6
Property Managers and a Key-Control Vendor Surface on Two Extortion Sites
Two extortion claims against the property sector landed on 16–17 September, both without victim confirmation. DragonForce listed Community Property Management, a US firm that has managed condominiums and planned-unit developments since 1978, with a claim of "full data 200 GB+"; ShadowByt3$ claimed it had locked managers and staff out of a HandyTrac key-control deployment at a Greystar property in Litchfield Park, Arizona, setting a deadline of 22 September and claiming physical-to-digital key maps, property vulnerability logs, employee identity and credential data, open and closed invoices, and administrative portal control. HandyTrac supplies electronic key-control systems used across multifamily portfolios, so the notable element is the category rather than the volume: key maps and access records describe physical access to buildings, and association-management systems commingle resident, vendor and employee records. Neither company has issued a statement, and no sample has been published that would let the datasets be assessed. Verification: Unverified
Source: RansomLook · Tier 2/4 — High · 2026-09-16 · Impact 15 · Claimed
extortion claims; neither company has issued a statement
Also reported in this window: CISA Advisory: Johnson Controls Simplex Incident Manager Credential Leak
ThematicTop thematic change
Property and construction breaches surfaced through notification and criminal allegation, not press
Turner Construction notified staff after a July intrusion exposed salaries, bank details and Social Security numbers, with the Payouts King group claiming the attack, and Cushman & Wakefield's breach put names and Social Security numbers in scope for a global commercial real estate firm. The September activity was extortion claims rather than disclosures: DragonForce listed Community Property Management with a claim of more than 200 GB, and ShadowByt3$ claimed it had locked managers and staff out of a HandyTrac key-control deployment at a Greystar property, claiming physical-to-digital key maps and property vulnerability logs - neither company has issued a statement and no sample has been published, so both remain unverified. Case & Associates, Sunrise and Orova's claim against Yost Home Improvements complete the set. The category point stands: key maps and access records describe physical access to buildings, which is a different class of consequence from a database of contact details.
Source: Construction Dive, Claim Depot, RansomLook (DragonForce, ShadowByt3$), ClassAction.org, July-September 2026
🛍️
Retail & Entertainment & Sport
6 eventsConsumer-facing commerce, entertainment, sport and the e-commerce platforms behind them.
1
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image-Metadata Records
Gyazo, Helpfeel's image-sharing service, has disclosed a breach that exposed roughly 23.62 million user records — including email addresses, password hashes, user IDs, session IDs and X/Google SSO tokens where connected — and about 490 million image-metadata records, mostly for images registered in January 2019 or earlier. The attacker entered through a vulnerability in Gyazo's image upload server, ran arbitrary commands on Helpfeel's systems and accessed the database; Helpfeel reported the incident to Japan's Personal Information Protection Commission on 15 September and published its notice on 16 September. The population-relevant detail is the metadata exposure: image IDs that make up Gyazo image links can be used to view unencrypted captures without permission, and Helpfeel could not rule out that private images were viewed. It disabled viewing of some images and says no payment information was exposed, but the leaked records include OCR text and hashed passphrases for private images. The breach count reflects records, including anonymous accounts with no email; Helpfeel is still determining how many individuals are affected and is running an external forensic investigation, with notification of confirmed affected users via email. Verification: Verified
Source: Helpfeel · Tier 1/4 — Very High · 2026-09-16 · Impact 63 · Confirmed
2
An Attacker Pointed Open-Source AI Agent Frameworks at Online Retailers, Stealing 600,000 Card Records and Skimming 119 Sites
Gambit has documented a financially motivated campaign, active since at least July and ongoing as of 22 September, in which a human operator gave open-source AI agent frameworks campaign goals and let them run the attack chain against tens of companies per day. The stack is three tools: Strix, a penetration-testing framework used for scanning and vulnerability discovery; Cairn, an autonomous exploitation engine tasked with objectives such as obtaining a shell or administrator access; and Hermes, which handled orchestration, post-exploitation and tactical decisions using `claude-opus-4.6` and carried a persona, "SOUL - Red Team Operator", with 121 skills, 78 of them attack-related. Strix ran 146 times against 138 hosts between 23 and 31 August, accumulating 633 scanning hours, and between 10 and 15 September the operator launched 105 distinct attack waves, succeeding to varying degrees on at least 27 organisations; the campaign compromised at least 119 sites with card skimmers and stole more than 600,000 valid card details from two companies, reaching a Fortune 500 hospitality firm, a major US airline, an industrial supplies distributor and an online fashion retailer. Skimmers were planted by appending to legitimate JavaScript, injecting script tags into checkout pages and Google tag blocks, poisoning S3/CDN content and server-side caches, altering database fields and Kubernetes deployments, and using cron jobs to restore the skimmer after removal. Verification: Verified
Source: BleepingComputer · Tier 2/4 — High · 2026-09-23 · Impact 48 · Reported
3
Toy-Making Giant Hasbro Discloses Data Breach Affecting Employee Personal and Financial Information
Hasbro, owner of brands including Monopoly, Nerf, Transformers and Dungeons & Dragons, disclosed a data breach affecting an undisclosed number of employees, filing notification letters with the Massachusetts Attorney General's Office. The Massachusetts 2026 Data Breach Notification Report lists 436 affected Hasbro employees in the state, with exposed data including Social Security numbers, financial account information, credit/debit card numbers and driver's licence information. Hasbro said it has disabled the compromised account and terminated unauthorised access; the company separately lost an estimated US$25 million in revenue from a March cyberattack it did not link to this incident. Verification: Verified Breach: Confirmed breach
Source: BleepingComputer · Tier 2/4 — High · 2026-08-28 · Impact 34 · Confirmed
436 is the Massachusetts filing; national total undisclosed
4
GTA VI Pre-Release Leaks Prompt Take-Two Subpoenas in High-Profile Data-Extortion Case
A persona calling itself "CyberLeek" published pre-release Grand Theft Auto VI gameplay footage across roughly eight days before the publisher's planned reveal, one of the year's highest-profile data-extortion incidents. Take-Two Interactive has petitioned federal courts for DMCA subpoenas against Discord, Microsoft and X (a Google petition remains pending) seeking identities, treating it like an insider-threat investigation; watermark crypto-wallet addresses indicate monetisation alongside the stated anti-corporate protest, prompting security researchers (Cynthia Kaiser, Katie Moussouris) to characterise it as a novel monetisation model for stolen pre-release content distinct from classic quiet ransom negotiations. The affected sites went offline as of Monday. Verification: Verified
Source: CyberScoop · Tier 2/4 — High · 2026-08-25 · Impact 30 · Confirmed
5
Unpatched Magento and Adobe Commerce Zero-Day ('StyleSmuggler') Exploited to Backdoor Online Stores
Sansec disclosed and is actively tracking 'StyleSmuggler', an unpatched zero-day in Magento Open Source and Adobe Commerce that gives unauthenticated attackers remote code execution on an online store's server and installs a persistent backdoor. The flaw abuses Magento's template system: malicious code is smuggled through the `styles` properties to evade existing safeguards, then executed when the store renders a failed-payment email, requiring no login. Sansec reproduced the full unauthenticated chain on clean 2.4.7, 2.4.8 and 2.4.9 installations, said all current versions are affected, and confirmed first exploitation on 4 September with multiple stores compromised since — publishing early because "stores are being compromised right now". As of 6 September Adobe had not issued a CVE, patch or workaround (its next scheduled security bulletin is 8 September); Sansec has shipped emergency mitigation in Shield and eComscan and recommends rotating Magento credentials where implants are suspected. Verification: Verified
Source: Sansec · Tier 1/4 — Very High · 2026-09-05 · Impact 23 · Confirmed
unpatched zero-day at publication
6
HBO Max's Verified Reddit Account Carried 108 Malicious Ads in a 48-Hour ClickFix Blitz
The verified Reddit account belonging to HBO Max was hijacked and used to push 108 distinct malicious advertisements over roughly 48 hours, in a malvertising operation that Hudson Rock and ADAMnetworks, working jointly, have named PasteSwitch and traced across macOS and Windows payload branches. The campaign was first noticed by a Reddit user who saw an advertisement authored by the verified u/hbomax account promoting a native macOS HBO Max application that does not exist; the advertisement led to a convincing clone of the streaming service's site whose download button produced not an installer but a ClickFix prompt instructing the visitor to paste a command into Terminal. One macOS command seen by BleepingComputer used Base64 to obscure a `curl | zsh` fetch from an attacker domain. The account's reach was stretched across unrelated lures: 40 advertisements pointed at an HBO Max clone domain, 36 at a site promoting fake AI and developer tools, 15 at a supposed macOS disk-cleaner guide, 11 at another AI/developer lure and six at a second HBO Max clone. The macOS payloads include MacSync, which exfiltrates browser credentials, Firefox profiles, Telegram data, Apple Notes and macOS passwords, and an "AMOS helper" chain that persists under a directory disguised as an Apple path and enrols the victim with attacker-controlled tasking endpoints, alongside fake Ledger, Trezor Suite and Exodus wallet applications built to steal 12- and 24-word recovery phrases. On Windows the campaign delivered an MP3/HTA polyglot through mshta that created a scheduled task, launched 32-bit PowerShell and disabled Microsoft's Antimalware Scan Interface before loading the Amatera stealer directly into memory, and the malware presented Facebook's hostname in its TLS SNI field while connecting to an attacker IP, so standard network telemetry logs a connection to a legitimate service. Cryptocurrency clippers in the same operation use Binance Smart Chain contracts as a mutable command-and-control dead drop, with 36 mainnet changes observed between March and July. Reddit administrators paused the advertisements and referred the incident to internal security teams; it remains unclear how the account was accessed or whether other Warner Bros. Discovery assets were affected. Verification: Verified
Source: Hudson Rock · Tier 1/4 — Very High · 2026-09-14 · Impact 23 · Confirmed
Also reported in this window: Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware; UpGuard Found 16,000 Hosted Databases Exposing Personal Data, Mostly Belonging to Apps Built Without a Security Owner; BragJack Turns a Single Malicious Extension Into Control of Five Browsers' Built-In AI Assistants; CISA Advisories Cover Robot Vacuums and Dashcams as Consumer IoT Keeps Entering the Estate
ThematicTop thematic change
A 23.6-million-record platform breach and an AI-run card-skimming campaign now lead the sector
Gyazo's disclosure of 23.62 million user records and around 490 million image-metadata records - with email addresses, password hashes, session identifiers and X and Google SSO tokens in scope - is the sector's largest confirmed breach of the quarter. The second lead is a change in method rather than scale: a human operator pointed open-source AI agent frameworks at online retailers, took roughly 600,000 card records and skimmed 119 sites, letting the agents run the attack chain at tens of companies a day. The quarter's earlier threads remain: Sansec's unpatched Magento and Adobe Commerce zero-day, exploited before Adobe had issued a CVE, backdoored online storefronts through the template system; Take-Two subpoenaed over the GTA VI pre-release leak; Hasbro disclosed employee data; and HBO Max's verified Reddit account carried 108 malicious advertisements in a 48-hour ClickFix blitz. UpGuard's finding that around 16,000 hosted databases had personal data publicly readable describes the same failure mode as Gyazo at the configuration layer - apps built without anyone owning their security.
Source: Gyazo/Helpfeel, Gambit, Sansec, CyberScoop, UpGuard, Hudson Rock, July-September 2026
🌐
Global (Macro)
6 eventsCross-cutting technology, criminal-ecosystem and geopolitical developments that do not belong to a single victim sector.
1
Unit 42: Frontier-AI Agents Breached Enterprise Autonomously in Under 10 Hours During Ransomware Attack
Unit 42's incident-response publication documents a ransomware intrusion in which a human attacker used frontier-AI models and attack-specific agentic frameworks to breach an enterprise autonomously: deploying more than 50 MITRE ATT&CK techniques, mapping internal microservices, harvesting secrets from source repositories and the secret manager, seizing root credentials, triggering unauthorised CI/CD builds, and turning the victim's AI endpoints into post-compromise compute — effort Unit 42 estimates would take human operators around two weeks compressed to under ten hours. Techniques spanned initial access via a public API (T1190), credentials in files (T1552.001) and cloud-account abuse (T1078), mapped to the MITRE ATLAS framework. The attacker also left an 80-page technical audit of the victim's security posture. Verification: Verified
Source: Unit 42 · Tier 1/4 — Very High · 2026-09-02 · Impact 65 · Reported
2
China-linked Storm-1175 deploys StormEncryptor ransomware, likely via N-central flaw
Microsoft Threat Intelligence reported that the China-linked, financially motivated group Storm-1175 began deploying a new ransomware strain, StormEncryptor, on 2 August 2026, replacing its earlier use of Medusa. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication-bypass flaw in N-able's N-central remote monitoring and management console that gives attackers administrative access. N-able said it had contacted a limited number of affected customers, and Huntress confirmed some of its own customers were affected.
Source: The Record · Tier 2/4 — High · 2026-08-10 · Impact 58 · Reported
3
FBI probes dark-web sale of 153 million driver's licence scans
KrebsOnSecurity reported that a dark-web identity service called Nexus was advertising scans of more than 153 million US and Canadian driver's licences, apparently sourced from a breach at Louisiana-based identity verification firm IDScan.net. The FBI's New Orleans field office opened an inquiry, and IDScan.net later confirmed an unauthorised third party may have accessed or copied customer information held in its cloud platform. IDScan has not confirmed how many people were affected, and the Nexus service disappeared from the dark web shortly after publication.
Source: Krebs on Security · Tier 2/4 — High · 2026-09-02 · Impact 55 · Probable
record count is the identity service's claim
4
Microsoft Details JADEPUFFER's Azure Destruction Run Through Two Compromised Service Principals
Microsoft's security research team has documented the Azure activity of Storm-3168, the actor it tracks as JADEPUFFER and which Sysdig described in July 2026 as the first documented agentic ransomware operation. Two compromised service principals in the same tenant were used in sequence: one performed reconnaissance and resource discovery, the other carried out discovery, destructive operations and credential collection. Microsoft observed bulk destruction aimed at Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, virtual machines and App Services, alongside cloud credential collection usable for later exfiltration. The recommended controls are workload identity and secret protection, least privilege, safeguarding recovery resources, and enabling Defender for Cloud coverage — with the explicit caveat that credentials exposed publicly remain usable until revoked or rotated, so removing the original disclosure is not remediation. Microsoft frames the case as evidence of a wider shift to AI-orchestrated post-compromise operations and argues defenders need equivalent automation across large environments. Verification: Verified
Source: Microsoft Security · Tier 1/4 — Very High · 2026-09-25 · Impact 50 · Reported
5
CrowdSec Confirms ~170 Private Repositories Were Copied via a Departed Employee's Live GitHub Token After the TanStack Attack
French security firm CrowdSec disclosed on 18 September that an attacker copied roughly 170 of its private GitHub repositories on 22 May 2026 using the account of an employee who had just left the company. CrowdSec had kept his GitHub access open so he could finish some work, and says his laptop was compromised in May's TanStack npm supply-chain attack, in which 84 malicious versions of 42 packages (CVE-2026-45321) stole GitHub tokens, SSH keys and cloud credentials from developers' machines. On 11 May, 84 malicious versions of 42 TanStack packages were published; the copy was made 11 days later with a GitHub OAuth token from the former employee's account. The code appeared on an online forum on 16 September, together with the email addresses of 83 CrowdSec users and the names, email addresses and investment context of 51 potential investors from 2020. CrowdSec says the account was used only to copy code, that its infrastructure and databases were not accessed and no code was changed, and that the leaked material includes its web console, data science scripts and models, automation scripts and the consensus algorithm that decides which IP addresses enter its blocklists — including detection thresholds that had not previously been public. It removed the account from its GitHub organisation on 25 May, three days after the copy and months before it learned of the leak, and says GitHub support later traced the token's history to confirm the TanStack origin; its developers' machines were checked and came back clean. Verification: Verified
Source: CrowdSec · Tier 1/4 — Very High · 2026-09-18 · Impact 30 · Confirmed
6
FBI, CISA and International Partners Warn of Gunra Ransomware Targeting Critical Infrastructure
A joint advisory (AA26-222A) from the FBI, CISA, DoD DC3, NSA, US Secret Service and the Republic of Korea's National Police Agency details Gunra, a ransomware-as-a-service variant derived from leaked Conti source code. Gunra first emerged April 2025, launched a structured RaaS affiliate program in early 2026, and operates a double-extortion model with a Tor-based negotiation portal and dedicated leak site. Victim sectors span healthcare, financial services, critical manufacturing, transport, government, utilities, academia, media and retail across the Americas, Europe, the Middle East, Africa and Asia-Pacific. The advisory includes patching priorities for internet-facing VPN/RDP, offline immutable backups, and network segmentation. Confidence: Confirmed (joint official advisory with IOCs).
Source: CISA · Tier 1/4 — Very High · 2026-08-10 · Impact 25 · Confirmed
Also reported in this window: Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner; Microsoft Defender's Own Signed BTR.sys Driver Weaponised for Kernel-Level Attacks; HPE Patches Critical ArubaOS-CX Remote Code Execution Flaw; Check Point Patches a Management Server Zero-Day That Lets an Unauthenticated Attacker Run Scripts on the Console Holding Every Security Policy; Check Point Confirms Active Exploitation of the Security Gateway VPN Certificate Flaw and Names the Certificate Subjects Attackers Used; Citrix Confirmed Two NetScaler Zero-Days Were Being Exploited, and CISA Put Both in the KEV Catalogue the Same Day; Sandworm shifts to ClickFix fake-CAPTCHA lures against Ukrainian targets; ShinyHunters Defeated the WAF Rule Meant to Replace the PeopleSoft Patch With a Percent-Encoded Character; CISA Adds Metabase SQL-Injection Flaw (CVE-2026-72898) to Known Exploited Vulnerabilities
TechnologyTop technology change
Frontier-AI-enabled intrusion opened the quarter and agentic tradecraft closed it
Unit 42 documented frontier-AI agents and attack-specific frameworks carrying an intrusion across more than 50 ATT&CK techniques in under ten hours, work it estimates would have taken human operators weeks, and the quarter closed with Microsoft's account of Storm-3168 - tracked as JADEPUFFER, the actor Sysdig described as the first agentic ransomware operation - using two compromised service principals to run reconnaissance and then destruction across Azure Storage, SQL databases, Key Vaults, Function Apps and virtual machines. China-linked Storm-1175's StormEncryptor ransomware, deployed via the same N-central weakness the ACSC alerted on, shows the criminal use of management-plane access. September concentrated the exploitation signal in security infrastructure: Citrix's two NetScaler zero-days were KEV-listed the day they were confirmed, Check Point shipped emergency hotfixes for its Security Gateway VPN certificate path and its Security Management Server, and ShinyHunters defeated the WAF rule written to replace the PeopleSoft patch. CrowdSec's loss of roughly 170 private repositories to a departed employee's still-live token is the quarter's cleanest example of identity hygiene outlasting employment.
Source: Unit 42, Microsoft, Citrix, Check Point, Mandiant/Google Threat Intelligence, CrowdSec, July-September 2026
🚚
Transport
6 eventsAviation, maritime, rail, logistics and the safety-critical data links and cable infrastructure they run on.
1
Qantas Tech-Support Scam (Vishing) Led to Massive Data Breach; Privacy Commissioner Clears Carrier
A tech-support vishing scam caused a massive data breach at Australian airline Qantas, with reports of 5.7 million customers' personal information leaked after a fake 'Qantas IT help' caller tricked a contact-centre agent into connecting the CRM to a data-extraction tool. The Office of the Australian Information Commissioner found Qantas did not breach the Australian Privacy Principles and declined to open a formal probe, though class actions remain in train. The incident demonstrates telephone-based social engineering of the human layer, not a technical intrusion.
OAIC found no breach of the Australian Privacy Principles
2
FulcrumSec Claims Manchester Airports Hack, Theft of 86 GB of Data
Extortion group FulcrumSec claimed responsibility for the Manchester Airports Group (MAG) data breach — the largest known customer-data breach of a British airport operator — telling BleepingComputer it stole approximately 86 GB covering Manchester, London Stansted and East Midlands airports. MAG disclosed on 27 August that car-park, lounge, Fast Track and in-airport Wi-Fi registration data for around 8.7 million customers was stolen, with only email addresses exposed for the "vast majority". In FulcrumSec's telling, the intrusion used airport-specific Iterable API credentials exposed in client-side JavaScript, and the haul includes nearly 200,000 records of upcoming travel for the remainder of 2026 with dates, times and booking-linked personal information. BleepingComputer validated one sample record against the traveller's known Manchester purchase history — including Fast Track purchases, scheduled arrival times, terminal used, amounts paid and trip purpose — and observed purchase references, full postcodes, IP addresses, device information and customer-engagement data, but no payment-card or bank-account details. FulcrumSec, a data-extortion group active since 2025 with prior claims on LexisNexis, Novo Nordisk, Global Schools and Avnet, says it intends to publish the data and a technical account of the intrusion, but is considering withholding or redacting the upcoming-travel records over "real-world harm" concerns. MAG declined to address the specific claims, confirming instead that affected customers with upcoming bookings had been contacted. The incident has not caused operational disruption; MAG says passenger safety and aviation security were not compromised. Verification: Verified Breach: Confirmed breach
Source: BleepingComputer · Tier 2/4 — High · 2026-08-30 · Impact 55 · Confirmed
3
220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak
Researcher Kinryū Labs discovered on 3 June an Elasticsearch cluster named "pax-info" hosted in Viettel-assigned IP space in Hanoi holding 210,318,069 passenger and 10,465,631 crew records (about 220 million combined, roughly 107 GB) spanning January 2017 to April 2026, including names, dates of birth, nationalities, passport numbers and issuing countries plus flight numbers, seat assignments and timings. The cluster was reachable through a chain of two misconfigurations (the open endpoint returned 401, but a cloud-based path accepted default credentials), and Kinryū Labs verified legitimacy by matching records against researchers' own Vietnam travel; the data covered airlines across Asia-Pacific, Europe and the Middle East with sample records including Korean, Chinese, Canadian and New Zealand travellers. The database was remediated by 8 June, but Kinryū Labs could not confirm whether anyone downloaded or ransomed it before it was secured, and the findings identify several major airlines whose passenger records appeared without any indication their own networks were breached. Verification: Reported Breach: Probable breach
Source: BleepingComputer · Tier 2/4 — High · 2026-09-08 · Impact 55 · Reported
220 million is the count reported by the researcher who found the exposed dataset
4
Port of Tanjung Pelepas Suspends Terminal Operations After Cyber Incident; Extortion Group Claims the Attack
Malaysia's Port of Tanjung Pelepas, one of the world's largest container transhipment hubs, has confirmed that a cybersecurity incident forced the temporary suspension of terminal operations, with the operator reporting that the incident was detected at 23:34 local time on 9 September and affected the terminal's operating systems before it isolated them. The port has since resumed operations, and reporting through shipping-industry channels notes the disruption rippled to carriers and shippers using the hub. An extortion group calling itself Direwolf subsequently listed the port as a victim, a claim that is an allegation at this stage and has not been corroborated by the operator or Malaysian authorities; the port's own confirmation covers the outage, not the exfiltration of data. Tanjung Pelepas sits at the mouth of the Malacca Strait and handles transhipment for a large share of Asia-Europe and intra-Asia volumes, so even a short-terminal outage produces knock-on scheduling effects for carriers and for exporters whose boxes are staged there — including Australian and New Zealand shippers routing through Southeast Asian hubs. It is the second port-system disruption in the region this year and follows the pattern of attacks on maritime logistics that has made port operating systems a standing item in regional supply-chain risk assessments. Verification: Reported Breach: Unverified claim
Source: Lloyd's List · Tier 2/4 — High · 2026-09-11 · Impact 35 · Confirmed
5
US Coast Guard Boarded a Tanker in the Gulf of Mexico After 'Foreign Cyber Actors' Hit Its Network
The US Coast Guard has confirmed that it boarded a tanker transiting the Gulf of Mexico in August after the vessel's network was attacked, following a Wall Street Journal report that at least two US-bound tankers had been hit. A Coast Guard spokesperson said a "highly specialized team" — USCG Law Enforcement personnel, USCG Cyber Protection Team members, a vessel inspector and FBI Cyber Action Team operators — embarked the vessel on 21 August "to conduct a comprehensive cyber security boarding and investigation" after indications that its network had been compromised by foreign cyber actors; the Journal reported a second ship was boarded on 24 August. Bloomberg identified one vessel as VL Prosperity, and the Iranian government-aligned outlet Mehr reported it was Liberian-flagged, sailing from an Egyptian port to the United States, attacked on 7 August while transiting the Strait of Gibraltar, and out of communication for 30 hours. A crew member told Mehr the attackers were allegedly able to increase engine speed and disable the ship's fuel and engine-oil tank; the outlet attributed to Russian analysts a link to the current US–Iran military conflict, though no group has claimed the incident. The Coast Guard says there are currently no reports of operational disruption, vessel instability, physical danger to crews or environmental impacts, and that it is working with port operators, owners and local maritime stakeholders to keep port operations running safely; it declined to describe the attack's nature, attribute it, or confirm whether the 21 August boarding involved VL Prosperity, and the FBI did not respond to requests for comment. The naval context matters to the reading: one day before the alleged attack on VL Prosperity, North Carolina Ports reported a cyberattack that forced a shift to manual operations after its IT system was compromised by "an outside actor or group", requiring a contingency plan and notification of multiple state agencies and the Coast Guard. US, European and Asian ports have been repeatedly targeted over five years — the Port of Seattle refused a ransom in 2024, and Royal Dirkzwager, DNV, Oiltanking, Mabanaft and Expeditors International were all hit in 2022–23. Verification: Verified
Source: The Record · Tier 2/4 — High · 2026-09-16 · Impact 35 · Confirmed
Also reported as part of this event: FBI and Coast Guard Boarded Two Tankers in the Gulf of Mexico After Indications Their Networks Were Compromised (2026-09-21)
6
Vocus Hit by Australia–Singapore Cable Break
Vocus is managing a fault on its Australia Singapore Cable (ASC) system between Perth and Singapore — weeks after the second major cable on the route, ASC's sister system, recorded its own shunt fault. COTDR testing from the Perth cable landing station has pinpointed the break to Indonesian waters between Anyer and Singapore, and Vocus is coordinating marine repairs, spare materials and regulatory approvals. Internet traffic has been rerouted via alternate paths, with network engineers reporting traffic shifting to Australian east-coast cables and then through Japan or the United States. The event is a resilience reminder for the eastern-Indic region's submarine cable infrastructure, on which Australian financial, government and cloud traffic depends, and comes as regional authorities weigh redundancy against a finite set of physical routes. Verification: Reported
physical cable fault
Also reported in this window: First Malware Family Built for Car Head Units Spreads Via Firmware Updaters; Fake CEVA and TKW Logistics Play Pages Are Pushing an Android Implant at Freight Firms; CISA Issues ICS Advisory on CPDLC over ATN-B1 Vulnerabilities (Five CVEs); New US Rule Means Airlines Owe No Meal or Hotel When a Cyberattack Disrupts a Flight; The FBI's Cargo Theft Task Force Says the Theft Happens Before the Truck Arrives
ThematicTop thematic change
A 220-million-record passenger-data leak joined vishing and port disruption in the quarter's picture
A leak in a Vietnam-linked advance passenger information system exposed roughly 220 million traveller records, the largest single exposure in this sector and one that sits in the data layer governments and carriers share rather than in either party's own systems. It joins a quarter in which the sector's confirmed incidents were operational and consumer-facing: Qantas's tech-support vishing breach, the Privacy Commissioner's finding on it, FulcrumSec's claim over Manchester Airports, the Port of Tanjung Pelepas suspending terminal operations with an extortion group claiming the attack, and the US Coast Guard boarding a tanker in the Gulf of Mexico after foreign cyber actors hit its network. Kaspersky documented the first malware family built for Android-based car head units, spreading through the devices' own firmware updaters, and the Vocus cable break is included as a resilience signal rather than a cyber operation. The FBI's cargo-theft task force and the US rule removing airline meal and hotel obligations after a cyber-disrupted flight are policy context.
Source: BleepingComputer, iTnews, The Register, Lloyd's List, Kaspersky, The Record, July-September 2026
📐
Methodology & Caveats
ProvenanceCollection window: 1 July – 28 September 2026 (partial-quarter collection, Q3 to date). Compiled 28 September 2026. 66 distinct events are reported in full, representing 74 digest entries after folding repeat coverage of the same event, with a further 69 lower-impact items listed in short form.
Collection: Built from the Cyber Digest SQLite database (cyber-digest.db) for the stated collection window, topped up by targeted web collection where a sector did not yield enough distinct events. Every entry carries a deep link to the reporting it is drawn from; entries are written from the source article, not from headline aggregation.
Ranking: Events are ranked by an impact score (0-100), not by source reliability. The score adds fixed points for confirmed data loss, records affected, operational disruption, active exploitation, criticality of the victim environment, third-party delivery, state attribution and Australian/NZ nexus. Source reliability is recorded separately as a tier and never raises a score. The practical effect is that a confirmed breach of any scale outranks an advisory with no known victim, and a well-sourced advisory cannot top a sector on the strength of its publisher alone.
Evidence grading: Each entry carries one evidence grade: Confirmed (victim, regulator or vendor has stated the facts), Probable (reported breach with unresolved scope or attribution), Reported (single-source research, vendor or press reporting), Claimed (an extortion or hacktivist group's assertion, unverified), Thwarted (an official statement that an attack was blocked before compromise). Where only a claimed figure exists, the claim is used and the entry says so.
How this is produced: Cyber Digest is produced by an automated collection and drafting pipeline with editorial review. Sources are gathered and summarised by software, then checked, scored and edited before publication. Every entry links to its original source so claims can be checked independently; nothing in this report should be relied on without that check.
Limitations
- The incident set is bounded by what the collection window surfaced and by the capacity of each sector section. It is a curated sample of notable events, not a census; absence of an incident here is not evidence it did not occur.
- Victim counts are usually the figures reported at the time of writing and change as investigations complete. Claimed record counts are marked as claims and should not be read as verified.
- Attribution is stated at the confidence the source supports. Where reporting offers a state nexus at medium confidence, the entry says so and the actor roll-up carries the same caveat rather than upgrading it.
- Collection is weighted to English-language, publicly reported incidents, which over-represents US regulatory activity and under-represents incidents in jurisdictions with weaker disclosure obligations.
- Australian and New Zealand relevance is flagged per event; where it is asserted in a sector narrative it refers to that flagged nexus, not to a general applicability claim.
- The window closed on 28 September 2026 with the quarter still open; the final three days of Q3 are not represented in this edition.
- 44 of the 66 events reported in full are graded Confirmed; the remainder are probable, reported or claimed and are labelled as such.