Cybersecurity · Monday, 19 October 2026

01 Briefing what happened

Two ambulance staff may have looked at the records of a man killed by a tiger, and the UK health secretary says NHS staff who snoop should be sacked

Yorkshire Ambulance Service found two staff who may have opened William Chapman's records without a reason, days after Nottingham's hospitals sacked a 15th worker over attack victims' files, and Yvette Cooper called it a disgrace.

ambulance staff under investigation over William Chapman's records

the service's own regular checks found them [3]

11 to 15

Nottingham hospital staff sacked over the attack victims' files, May to now

15 more were given a final written warning [5]

About 40

hospital staff who looked at one injured three-year-old's records

he was hurt in a fall into a crocodile pit in June [6]

The lead story — what happened

Yorkshire Ambulance Service says two of its staff may have looked at, or tried to look at, the medical records of William Chapman without a legitimate reason. [3][4]
Chapman was killed by a tiger at Yorkshire Wildlife Park, near Doncaster, on 10 October. He had climbed over two fences into its enclosure. [2][3]
The ambulance service says its own regular checks found the two cases. [3] It has reported them to the Information Commissioner's Office, Britain's data watchdog. [4]
On Sunday Yvette Cooper, the UK health secretary, called the snooping a disgrace. She said staff who break the rules should be sacked. [1][2]
Cooper said staff should be suspended straight away while an investigation runs, and that she has spoken to the head of NHS England. [1][2]
Two days earlier, Nottingham University Hospitals said it has now sacked 15 staff for opening the records of victims of the 2023 Nottingham attacks. In May the number was 11. [5][6]
The trust also gave 15 final written warnings and two first warnings. Doctors and nurses were among the staff it acted against. [5][6]
In May, dozens of staff at a Liverpool hospital group were found to have looked at the records of victims of the 2024 Southport attack. [6]
About 40 hospital staff looked at the records of a three-year-old boy who was hurt when he fell into a crocodile pit in Cambridgeshire in June. [6]
Last month Sir Jim Mackey, the head of NHS England, told every trust to suspend staff suspected of snooping at once and cut off their access to NHS computers. [6]
Nottingham's trust is testing a new system that alerts it to possible breaches. [5] In May, the police said there was no criminal investigation. [2]
Dr Sanjoy Kumar, whose daughter Grace was killed in the Nottingham attacks, said the families want to meet Cooper and asked when it is going to stop. [2]

Sacked15

Final written warning15

First written warning2

No case to answer2

What Nottingham University Hospitals did about staff who opened the attack victims' records, by number of staff.

Who is involved

Yvette Cooper

the UK health secretary; she said snooping staff should be suspended and sacked
Yorkshire Ambulance Service

the NHS ambulance service for Yorkshire; its checks found two staff who may have looked at Chapman's records
Nottingham University Hospitals

the NHS trust that runs the city's hospitals; it has sacked 15 staff over the attack victims' files
Sir Jim Mackey

the head of NHS England; he ordered trusts to suspend suspected snoopers at once
The Information Commissioner's Office

Britain's data watchdog; both trusts have reported the cases to it

How it unfolded

May Nottingham's trust says it has sacked 11 staff over the victims' files [5]
September NHS England orders immediate suspensions for suspected snooping [6]
10 Oct William Chapman is killed by a tiger at Yorkshire Wildlife Park [2]
16 Oct The ambulance service says two staff may have looked at his records [3]
16 Oct Nottingham's total of sacked staff reaches 15 [5]
18 Oct Cooper says staff who snoop should be sacked [1][2]

Where this points

Watch whether the ambulance service's investigation finds the two staff had no reason to look, and whether the families' request to meet Cooper leads to any rule that stops a look before it happens. [2][3]

What is pushing on the whole day

The bar and the word are our reading of how hard each one is pushing today. The arrow is where it is heading. The evidence is in the stories below.

Checks that come after High→

Yorkshire Ambulance Service found two possible looks at a tiger victim's records through its own regular checks, after the looks had happened. [3] Huntress, a security firm, found the misuse of ConnectWise's key by reading customers' sign-in records. [8] Science, a journal, published and paid for an article under a real writer's name before anyone saw it was fake. [17]

Scams borrowing a trusted name Building↑

The FBI says scammers use US candidates' names and slogans to collect money for fake campaign funds. [11] Fake emails used the name of the Assembly House, a hotel in Norwich, to sell stalls at its Christmas fairs. [16] Someone pitched stories to Nature, a science journal, under the name of a real journalist. [17]

AI on both sides Building↑

Trading standards officers in Britain say criminals use AI to clone voices and build fake shops. [15] Google now uses its Gemini AI to look for scams in texts on Android phones. [18] Job adverts for AI security engineers in the US rose 268% in a year. [19]

The rest of the day

8 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

02
ConnectWise switches off more services

ConnectWise, which sells software that IT firms use to look after their clients' computers, disabled seven of its app identities on Saturday morning. [8] It had already shut its Cloud Backup service after attackers got hold of that service's key to customers' Microsoft 365 accounts. [8] It has now also taken its SaaS Security and Cloud Management services offline. [7][8] Scheduled backups are not running, and customers cannot open or restore their saved copies. [8] The services were still down on Sunday afternoon. [7]

Why it matters — Huntress says a second wave aimed at 16 organisations in policy, national security, trade and critical minerals failed. [8] ConnectWise says it cannot see inside its customers' systems, so each IT firm has to look for keys the attacker added. [8][7]
03
Cloud escape flaw rated 9.3 out of 10

A flaw in Linux that lets a program inside a virtual machine reach the real computer under it now has an official number and a danger rating of 9.3 out of 10. [9][10] A virtual machine is a computer made in software, and clouds put many customers' machines on one real server. [9] The researcher who found it, Paulos Yibelo, calls it PwnEscape. [10] In his own lab, two crafted network packets crashed a host and every sandbox on it. [10] A fix is in Linux and is reaching versions such as Debian, Red Hat and Ubuntu. [9]

Why it matters — Amazon says its EC2 cloud is not at risk, and Google's setup probably is not either. [9] Updating the software inside each virtual machine does not fix the host; only the host's own update does. [10]
04
FBI warns of scams before US midterms

The FBI has warned Americans about four kinds of scam ahead of November's midterm elections. [11] Scammers use candidates' names, pictures and slogans to raise money for fake campaign funds, or to sell goods that never arrive. [11] One fake 'campaign pool' promises donors a payout if the candidate wins, and the FBI says real donations never grow in value. [11] Others send texts falsely saying the reader is not registered to vote. [11] Separately, the FBI and CISA, the US cyber-defence agency, warned election officials about fake messages, audio and video built to steal their logins. [12]

Why it matters — CISA says election officials are targets because they hold voter registration data. [12] Donors to the fake funds lose their money, because none of it reaches a campaign. [11]
05
Ransom gangs threaten staff and families

Semperis, a security company, surveyed 1,200 organisations hit by ransomware, software that locks a company's files until it pays. [13] 17% said attackers made physical threats to force a payment, and 23% said they faced psychological pressure. [13][14] Among those threatened, 37% said the threats were aimed at family or friends. [14] 53% of all those surveyed said attackers carried out a threat. [13] Dark Reading, a security news site, could not find one documented case of violence tied to ransomware, and the answers are not checked. [14]

Faced psychological pressure23%
Faced physical threats17%
Said attackers carried out a threat53%
Answers from 1,200 organisations hit by ransomware, as they reported them. Nobody has checked the answers.

Why it matters — The pressure lands on staff and their relatives, not on the company's computers. [13] FBI complaints about threats of violence in online crime rose to 4,826 in 2025, from 1,360 the year before, Dark Reading reports. [14]
06
UK watchdog lists AI scam tricks

National Trading Standards, which tackles big consumer scams in England and Wales, has drawn up its first watchlist of scams that use AI. [15] It lists polished fake shop websites, cloned voices of relatives asking for money, and romance scams where AI remembers a victim's details. [15] Officers describe fake shops posing as small British family firms, with pictures of a High Street hung with Union Jack flags. [15] The same week, the Assembly House, a hotel in Norwich, warned that fake emails were selling stalls at its Christmas fairs. [16]

Why it matters — Which?, a consumer group, says spelling mistakes can no longer be relied on to spot a scam. [15] The Norwich emails were aimed at small traders and artists who book stalls. [16]
07
A fake writer uses a real journalist's name

Linda Geddes, a science journalist, says someone pitched stories to Nature and Science using her name and an email address that was not hers. [17] An article under her name appeared in the New York Post with quotes lifted from older pieces. [17] The paper removed it and referred the matter to the authorities. [17] Another impersonator got Science to publish an article under the name of Caroline Williams, a former colleague, and was paid about $1,000. [17] Geddes says many of the pitches bear signs of AI writing. [17]

Why it matters — The fake costs the real writer her standing with editors, even when a pitch is turned down. [17] Cifas, a UK fraud-prevention service, called the case unusual, because fraud is normally done at scale. [17]
08
Android gets new scam checks

Google is rolling out new protections against scam texts and calls on Android phones. [18] Google Messages can now send chats with unknown senders to Gemini, Google's AI, to look for signs of fraud, but the feature starts switched off. [18] Android now stops apps from quietly turning on call forwarding, which can send a victim's calls to a thief. [18] Google says its check on calls claiming to come from banks has blocked more than 3 million fake calls for Banco do Brasil and Itau Unibanco since June. [18]

Why it matters — Google says its scam detection already flags more than 5 million suspected scam calls and texts a month. [18] The new cloud checks only help people who turn them on. [18]
09
US security job adverts fall by a quarter

US cybersecurity job adverts fell to 235,786 between January and September, down 26.4% from 320,210 a year earlier. [19] It is the lowest count in four years. [19] The figures come from CyberSN, which sorts adverts by the work asked for, not the job title. [19] Adverts for AI security engineers rose 268.3%. [19] Adverts for penetration testers, people paid to break in and find holes, fell 45.9% to 3,063. [19]

Jan-Sep 2025320,210
Jan-Sep 2026235,786
US cybersecurity job adverts in the first nine months of each year, as counted by CyberSN.

Why it matters — Fewer openings are reaching people looking for general security jobs, while AI skills are in demand. [19] The report counts adverts and does not say why they fell. [19]

02 Lesson why it matters

Hospital files open first, and the check comes afterwards

NHS staff could open the files of patients they never treated, so the only guard was a record of who looked, read after the looking.

The twist

Nothing in the system stopped staff opening the victims' files, and the only guard was a list of who looked, read after the looking.

The picture

File openedFirst

Record checkedLater

Staff punishedLast

In each NHS case in the briefing, the look came first and the check came after it.

How it works

Staff log in to the records system to do their work
The login opens files beyond the patients they treat
Every opening is written into a record
Later, someone reads the record for opens with no reason
The person is found and punished, after the look

The same force, elsewhere today

Where this chain is also running, in today's other stories.

ConnectWise switches off more services

Microsoft 365 let the backup app's key in as the app, and Huntress found the misuse later in the sign-in records.
A fake writer uses a real journalist's name

Science took the pitch on the strength of a real writer's name and paid for it, and the fake was found only after it ran.

Where you've seen this

Self-service tills

the shop lets you scan your own shopping, and spot checks and cameras catch skipped items afterwards

Tax returns

the tax office accepts what you file, and audits pick some returns to check later

Office expense claims

staff are paid back first, and the finance team checks receipts after

The catch

A check that comes afterwards only protects anyone if someone reads the record and the punishment lands, and the police said in May there was no criminal case over the Nottingham files.

And the whole of it

Anyone who has been in hospital is inside this. Their file opens for the staff who treat them and for others too, and they hear about a look only if someone checks the record.

03 Truth what's really going on

What is really going on

NHS staff can open the files of patients they are not treating, and the NHS finds the ones who should not have looked afterwards, by reading records of who opened what. Most fixes named this week work after a look: faster suspensions, sackings, and a Nottingham system that flags a possible breach. The other is a campaign reminding staff of the rules. [1][5][6]

Why it works on us — A sacking is something people can see, so it feels like the problem is being fixed, even though it comes after the file has been read.

Who gains

Firms that sell systems for watching record access — Nottingham University Hospitals is bringing in a new system that alerts it to possible breaches. [5]
Scammers using US candidates' names — Money given to a fake campaign fund goes to them, not to any campaign. [11]
People with AI security skills — US job adverts for AI security engineers rose 268% while adverts overall fell by a quarter. [19]
The impersonator who wrote as Caroline Williams — Science published the article under her name and paid about $1,000 for it. [17]

Who pays

The families of the Nottingham victims — Their relatives' medical files were opened by staff with no reason to look, on top of their loss. [5][2]
William Chapman's family — They have been told his records may have been opened without reason in the days after his death. [3]
IT firms and their clients on ConnectWise — They cannot back up, open or restore their saved copies while the services are off. [7][8]
Small traders booking Christmas fair stalls — Fake emails asked them to pay for stalls at the Assembly House's fairs in Norwich. [16]
Linda Geddes and other real writers — Fake pitches under their names can damage their standing with editors, even when the pitch is turned down. [17]
Penetration testers in the US — Job adverts for people paid to break in and find holes fell 45.9% in a year. [19]

What nobody knows yet

Open questions from across today’s stories — ours included.

01

Whether the two ambulance staff had a reason to look at William Chapman's records.

The service calls them potential breaches and says its investigation is still finding out what happened. [3]
02

How many staff looked at the files of the three people who survived the Nottingham attacks.

The trust says that part of its investigation is still running. [5]
03

Whether any of the snooping will be treated as a crime.

In May the police said there was no criminal investigation, and the data watchdog said only that it would assess the evidence. [2]
04

How ConnectWise's key was stolen.

ConnectWise says it is still working out how the key was exposed and whether a flaw in its own product played a part. [8]
05

How many of ConnectWise's customers still hold keys the attacker added.

ConnectWise says it cannot see inside its customers' systems, and Huntress says added keys keep working until someone removes them. [8]
06

Whether ransomware gangs have actually hurt anyone.

Semperis's figures are what victims said in a survey, and Dark Reading could not find one documented case of violence tied to ransomware. [14]
07

Who is pitching stories under Linda Geddes's name, and how they get paid.

She has traced a pattern of email addresses but not a person, and the New York Post has passed the case to the authorities. [17]
08

Which clouds PwnEscape actually reaches.

Amazon says its EC2 cloud is not at risk and Google probably is not, but the fix is still reaching other products that use the same Linux part. [9]

04 Hope carry this

Google says its check on calls claiming to come from banks has blocked more than 3 million fake calls for Banco do Brasil and Itau Unibanco, two Brazilian banks, since June.

Also true today

The researcher who found PwnEscape, a flaw that lets a cloud machine reach the server under it, reported it privately, and a fix is now in Linux with no known attack.
Huntress says the attacker's second wave, aimed at 16 organisations in policy, national security, trade and critical minerals, failed.
Yorkshire Ambulance Service's own checks found the two possible looks at William Chapman's records within a week of his death.