Attackers used a Danish company's lawful access to Denmark's population register to take the names, addresses and ID numbers of 8.8 million people

The rest of the day

23 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   South Korea's leader says AI was used on banks

   South Korea's president, Lee Jae Myung, said on Tuesday that AI programs appear to have been used in recent break-ins at the country's banks. [7] The Financial Services Commission, the country's financial regulator, has confirmed a data breach at Shinhan Bank and attacks on others, including KB Kookmin Bank. [6] Local media report that Shinhan leaked details of 25,000 customers and Kookmin the card details of 119,000. [6] Yonhap, a Korean news agency, says Hana Bank and Woori Bank were also hit, and police have opened a full investigation. [7]

   Shinhan customers' details25,000

   Kookmin customers' card details119,000

   Why it matters — The regulator has told every financial company to check its systems that can be reached from the internet, including ones customers never use. [6] Officials have not said which AI tools were used or who used them. [7]

2. 03

   Exchange flaw let staff read each other's email

   Microsoft released an emergency fix on 2 October for a flaw in Exchange Server, the email software many organisations run on their own computers. [12] Anyone with a login at an organisation could use it to read other people's mailboxes and attachments there, though not mailboxes at other companies. [12] Microsoft says it has seen no attacks using the flaw, but rates an attack as more likely than usual. [12] It fixed its online version, Exchange Online, itself. [12]

   Why it matters — Organisations that run Exchange on their own machines have to install the fix themselves. [12] Microsoft calls it weak authorization: the server checked that a person was logged in, but not whose mailbox they were opening. [12]

3. 04

   Atlassian warns of a serious file flaw

   Atlassian, an Australian company whose Jira and Confluence tools many teams use to plan work and share documents, told customers on Monday to update at once. [13] A flaw rated 9.3 out of 10 lets someone with no login read certain files on the server. [13] It affects the versions companies run on their own machines, including Jira, Confluence and Bitbucket. [13] An attacker must know a file's exact name and place, and Atlassian has already fixed its cloud version. [13]

   Why it matters — Atlassian says some setups keep sensitive files where the flaw can reach them. [13] It tells customers who cannot update quickly to take those servers off the internet. [13]

4. 05

   A claimed escape from software under big clouds

   A researcher, Paulos Yibelo, says he found a flaw that lets a program inside a virtual machine take over the computer running it. [14] A virtual machine is a sealed-off pretend computer, and many of them share one real server. [14] The flaw is in KVM, part of Linux that Amazon's and Google's clouds use to run customers' machines. [14] Vercel, which paid him through its bug reward scheme, confirmed it, but no details are public yet. [14]

   Why it matters — Separately, 404 Media reports that Meta engineers rushed to fix several such escapes in the weeks before launching Muse, its AI assistant. [15] A Meta source says one could have let an ordinary Muse user reach Meta's internal databases. [15]

5. 06

   Accused maker of cash-machine malware arrested

   The US Justice Department says it has arrested Anibal Alexander Canelon Aguirre, 50, who it says wrote Ploutus, malware that makes cash machines empty themselves. [8] In March he became the first person put on the FBI's ten most wanted list for computer crime. [9] Prosecutors say his group stole more than $5.4 million in 117 attacks on US banks and credit unions between 2024 and 2025. [8] He was charged in Nebraska in December 2025 and has now appeared in court. [8]

   Break into the machine

   ↓→

   Load the malware

   ↓→

   Cash pours out

   Why it matters — Prosecutors say the money went to Tren de Aragua, a Venezuelan gang the US calls a terrorist group, so he also faces a terrorism charge. [8] The US Treasury put sanctions on him and seven associates last week. [8][9]

6. 07

   Nikkei staff account sent 9,000 scam emails

   Nikkei, one of Japan's largest business media groups and the owner of the Financial Times, disclosed two break-ins at staff email accounts on Sunday. [10] In one, an attacker took over an employee's Microsoft 365 account and on 30 September sent about 9,000 scam emails, including to journalists' sources. [10] The emails went to people who had written to Nikkei staff before, and linked to harmful websites. [10] In the other, an intruder could reach a staff Google account from late July, possibly exposing details of 1,646 people. [10]

   Why it matters — On Monday Daiwa Securities, Japan's second-largest share-trading firm, said hackers may have taken details of up to 110,000 customers from servers run by an outside supplier. [10] Yamato Transport and Dai-ichi Life are among other Japanese companies to report break-ins in recent weeks. [10]

7. 08

   Two US health firms tell 250,000 of a theft

   Two US health companies are telling more than 250,000 people that their details were stolen. [19] Clover Health, a health insurer in New Jersey, says attackers tricked three staff into giving up their accounts in July, and it reported 138,677 people affected. [19] AngMar Management Services, a Texas firm that runs offices for home-care and hospice providers, reported 126,196. [19] Its stolen files include Social Security numbers, diagnoses and prescriptions, and the Interlock ransomware gang claimed the attack in August. [19]

   Why it matters — Both break-ins happened in July, and the companies told the US health department in September. [19] Clover's stolen data includes insurance and account numbers, and AngMar's includes medical histories. [19]

8. 09

   Ukraine's biggest grocer hit by extortion

   ATB, Ukraine's biggest grocery chain, confirmed a cyberattack on Monday after hackers put a ransom demand on its website. [11] A group calling itself DataSuckers wants $400,000 and claims to hold details of 7.9 million customers, including names, phone numbers and addresses. [11] ATB says no customer data was taken and has taken some online services down. [11] The hackers then posted samples on Telegram and said they would sell the data rather than publish it. [11]

   Why it matters — Nobody outside has checked whether the samples are real. [11] ATB runs more than 1,300 shops and employs over 60,000 people, and the war has already destroyed hundreds of its stores. [11]

9. 10

   Italy fines IQVIA over patient records

   Italy's data protection regulator has fined IQVIA, a large health-data company, 7 million euros, about $7.8 million. [17] IQVIA's Italian arm built a database of about one million patients from the records of 800 family doctors. [17] It replaced names with codes, but the regulator found the codes, with birth year, illnesses, prescriptions and location, could still pick out a patient. [17] It also kept records going back to 2001, and for 3,300 patients it held names and tax numbers. [17]

   A code, not a name

   ++

   Birth year

   ++

   Illnesses and medicines

   ++

   Location

   Why it matters — Patients were never told their records were in the database, which the regulator says broke EU privacy law. [17] IQVIA has 120 days to change its practices and says it may appeal. [17]

10. 11

    US Senate passes a health cyber bill

    The US Senate has passed the Health Care Cybersecurity and Resilience Act, a bill from senators of both main parties, with no senator objecting. [18] It aims to help hospitals and other health bodies stop more attacks. [18] The bill was first brought in 2024 but ran out of time, and was brought back in December 2025. [18] It now goes to the House of Representatives. [18]

    Why it matters — More than 730 breaches of health data hit over 270 million Americans last year, SecurityWeek reports. [18] The 2024 attack on Change Healthcare, which handles medical bills, is believed to have exposed the data of over 190 million people. [18]

11. 12

    Belarusian group spent two years in Russian network

    Solar, a Russian security firm owned by the state telecoms company Rostelecom, says a Belarusian activist group spent almost two years inside a Russian healthcare organisation's network. [16] It blames the Belarusian Cyber Partisans, a group formed after protests against Belarus's disputed 2020 election. [16] Solar found the intrusion in December 2025 and traced it back to early 2024. [16] The hackers reached sensitive medical data but broke nothing. [16]

    Why it matters — Solar says the organisation is linked to many other health bodies, and believes the hackers stayed quiet so they could use those links to reach them. [16] Russia's Supreme Court named the group extremist in July, the first hacking group to get that label. [16]

12. 13

    Amnesty says Morocco spied on journalists

    Amnesty International has published a report saying Morocco's domestic intelligence agency, the DGST, used Pegasus spyware against activists and journalists from 2017 to 2021. [21] Pegasus is phone-hacking software made by NSO Group, an Israeli company. [21] Amnesty says it matched 103 Moroccan phone numbers to likely targets in late 2017, 22 of them journalists or media workers. [21] The report draws on a former agency employee and was made with 14 media organisations. [21]

    Why it matters — Morocco has denied using Pegasus and did not answer Amnesty before the report came out. [21] A Moroccan news site argues that a number on a target list does not prove a phone was hacked. [21]

13. 14

    Pentagon stops using Anthropic's AI

    The US Defense Department told the BBC on Monday that it has stopped using tools from Anthropic, the company that makes the Claude AI. [24] Defense Secretary Pete Hegseth labelled Anthropic a supply-chain risk in February, after it refused to remove safety limits for military use. [24] People familiar with the matter told the BBC that Claude was still in use as late as last week, built into Maven, the US military's main data system. [24] Anthropic is suing to overturn the label. [24]

    Why it matters — The label is usually used for companies based in countries the US sees as a threat. [24] The Defense Department has since signed deals with Google, xAI and OpenAI. [24]

14. 15

    University medical school hit by ransomware

    The University of Illinois Chicago says a ransomware attack, which scrambles files so a gang can demand money, shut some systems at its College of Medicine for a time. [20] The university says the hackers stole some information from the college's servers. [20] The university says all affected systems are back, its main network was not touched and patient care at its hospital went on as normal. [20] A gang called Booba claimed the attack last week and says it took 344 gigabytes. [20]

    Why it matters — The university is checking whether personal, research or study records were taken and will tell anyone affected. [20] Booba appeared in July and has claimed 49 attacks. [20] A researcher at SentinelOne, a security firm, thinks it is an older gang called Frag under a new name. [20]

15. 16

    Texas city asks $2.3m for camera records

    North Richland Hills, a suburb of Fort Worth in Texas, has told a privacy group it must hand over $2.3 million before it releases records on how its police use Flock cameras. [22][23] Flock sells cameras that read the number plate of every passing car. [22] The city says searching about a terabyte of messages would take 14 years of work at $15 an hour. [22] Irving asked $70,000, a Houston TV station was quoted $121,000, and the town of Sealy charged nothing. [23]

    North Richland Hills$2,300k

    Houston TV station's quote$121k

    Irving$70k

    Sealy$0k

    Why it matters — Records like these are how misuse comes to light: an audit caught a Texas officer, Zachary Klein, searching police databases about his former girlfriend. [23] He pleaded guilty on 30 September to 100 felony counts. [23]

16. 17

    Dell warns of a critical update-tool flaw

    Dell has told customers to fix a critical flaw in Dell System Update, a tool IT staff use to push updates onto its PowerEdge business servers. [26] Someone with no login who can reach the server over a network could use it to run commands with full control. [26] The flaw is a path traversal, a mistake in handling file names that US agencies have urged software makers to stamp out since 2024. [26] Dell fixed four other flaws in the same tool on Thursday. [26]

    Why it matters — Owners have to update the tool to version 2.3.0.0 or later. [26] The FBI and CISA, the US cyber-defence agency, say this kind of flaw has been called unforgivable since 2007. [26]

17. 18

    FBI says several held over ShinyHunters hack

    The FBI told The Register on Monday that it and its partners have arrested several people over a September hack linked to ShinyHunters, a gang that steals data and demands money. [31] It would not discuss Saif al-Din Khader, known as Rey, who Reuters reports was detained in Jordan on 29 September and is helping the FBI. [31] The security journalist Brian Krebs has called Khader the technical operator and public face of the gang's wider group. [31]

    Why it matters — Kevin Beaumont, a security researcher, says Khader was among those who broke into Jaguar Land Rover in 2025. [31] That attack stopped the carmaker's factories and left its suppliers with cancelled orders. [31]

18. 19

    Old router flaws feed a new botnet

    Two security firms, Nozomi Networks and Fortinet, describe malware called Cling or ClingSTUN that takes over home routers, video recorders and other small internet devices. [27][28] It joins them into a botnet, a crowd of hijacked machines that one group uses to pass on traffic and flood websites. [27] Nozomi says attempts to break in through an old flaw in Realtek router software jumped from about 5 September. [27] The malware tries about two dozen known flaws and copies itself to new devices. [28]

    Why it matters — Its control messages look like the normal traffic devices send to find each other on the internet. [27] Most of the flaws it uses were fixed years ago, one in 2014, so the devices it reaches are ones nobody updated. [27][28]

19. 20

    Hidden programs pose as email at telecoms firms

    Rapid7, a security firm, says hidden programs on mail-filtering machines at telecoms firms in South Korea and Taiwan disguise their traffic as ordinary email. [29] One, which it calls AVERAT, talks like a mail server, so on a machine whose job is sending mail its traffic looks like normal work. [29] Others named themselves after SpamSniper, a South Korean anti-spam product, to blend in. [29] Rapid7 published the research on 2 October. [29]

    Why it matters — These machines sit at the edge of company networks and must accept mail from outside, so firewall rules let the attackers' trigger messages through. [29] The programs check in about every ten minutes and can open up to ten remote command windows. [29]

20. 21

    AI agents pass hidden orders to each other

    AI agents, programs that carry out tasks on their own, now run inside millions of organisations, Ars Technica reports. [33] Google and four other organisations have admitted flaws in how their agents hand work to each other. [33] A researcher, Syed Anas Mohiuddin, showed that instructions hidden in one agent's input get passed to a second agent, which obeys because it trusts the first. [33] Google's flaw, rated 8 out of 10, could make its database tool send requests to internal addresses. [33]

    Why it matters — Douglas McKee of Rapid7, a security firm, says every piece did exactly what it was built to do, which makes the attack hard to catch. [33] Rapid7 fixed its own flaw last month, and Google now blocks unsafe addresses when its tool starts. [33]

21. 22

    UK school software firm loses sign-in data

    Bromcom, a UK company whose software many schools use for attendance, timetables and staff records, has told customers of a data breach. [30] An outsider reached an old sign-in registration service and took email addresses and which provider, such as Microsoft or Google, people used to log in. [30] Bromcom says no passwords were held there and its main school records system was not reached. [30] The old service was still running because one of Bromcom's internal systems still used it. [30]

    Why it matters — Bromcom found the problem on 6 September after reports of sign-in trouble, and has now switched the old service off. [30] It says the breach did not give access to anyone's Microsoft or Google account. [30]

22. 23

    Debian's Linux update lists 1,313 flaws

    Debian, one of the oldest free versions of Linux, published an update to its kernel, the core of the system, on 29 September. [25] It fixes problems listed under 1,313 separate flaw numbers. [25] Linux's kernel team gives a flaw number to almost every bug fix that reaches its stable versions, so the count says little about how serious each one is. [25] The Register suspects AI bug-hunting tools explain the size of the list. [25]

    Why it matters — Every Debian system owner still has to install it. [25] AI-found bug reports are already flooding the Linux security mailing list, The Register reports. [25]

23. 24

    Pakistan finds fake government login sites

    Pakistan's national cyber emergency team, NCERT, says it found fake websites using the names of key government bodies, still live on Sunday. [32] They include a fake secure login page for Nadra, which runs the national identity database, and sites using the names of the tax board and the FIA, the federal investigation agency. [32] Such pages are built to trick people into typing in passwords and personal details. [32] NCERT says it is watching them. [32]

    Why it matters — NCERT told the public to check that a website is genuine before typing personal details into it. [32] It also warned government offices about staff pasting work data into AI chat tools. [32]