Cyber, in brief

Operation Jackal IV involved law enforcement from 22 countries across six continents, arresting 58 suspects and identifying 263 more. [1][2]

It ran from November 2025 to June 2026 - seven months of following money rather than chasing individual scams. [1]

In Argentina, 17 people were arrested and 196 were linked to a single crime-as-a-service network that supplied web domains and money-laundering support to West African groups. [1][3]

An Interpol director described following the financial flows across borders to what he called 'the very lifeblood of organized crime'. [1]

In South Africa, seven raids in Johannesburg hit a syndicate running romance and investment scams against elderly people in English-speaking countries: 39 arrests, 257 bank accounts blocked, about $2.67m seized. [1][3]

Romanian police arrested 11 people connected to a call centre baiting victims with promised returns on shares and cryptocurrency. [3]

Italian authorities identified a suspect tied to a pan-European laundering network moving money through shell companies, remittance services and cash withdrawals. [3]

Singapore arrested six, five of them Chinese nationals believed to be part of the same global syndicate. [4]

The named target throughout is Black Axe, a transnational network of Nigerian origin that law enforcement has been trying to dismantle for more than five years. [1][2]

Interpol says groups like it account for a significant share of the world's cyber-enabled financial fraud - romance scams, investment and cryptocurrency scams, and business email fraud. [1][2]

This is the fourth operation in the series. Jackal III ended in 2024 with hundreds of arrests and about $3m seized; the first two produced roughly 200 arrests between them. [2]

Four rounds in, the pattern of what gets caught has shifted from the people running scams toward the people selling them the means. [1][2]

Why it matters. The number worth watching is not arrests but whether the Argentine service network is replaced within months: a fraud crew rebuilds in weeks, and an infrastructure supplier with banking relationships does not.

A leaked Carhartt dataset was claimed at around 24.8 million people. Analysis found large amounts of generated test data - email domains that were random strings, more customers registered in Montenegro than in the US, and an implausible number of birth dates in the early 1900s. Stripping it out left 12,933,413 genuine accounts, of which 83% had already appeared in earlier breaches. [6]

Why it matters. The size of a breach is announced by the party with the strongest reason to inflate it, and almost nobody checks. Here somebody did, and the number halved.

CareFirst BlueCross BlueShield disclosed a breach affecting 1.1 million people. Nutex Health told regulators data was stolen. Canada's SickKids children's hospital was hit again, this time through its careers site, exposing employee and job-applicant details - though not clinical systems or patient records. [7][8][9][10][11][12] Apollo Global separately disclosed exposure of personal information. [13]

Why it matters. A job application portal holds full names, addresses, phone numbers and employment history, which is why it is worth attacking even though nobody thinks of it as a medical system. [11]

Boston Scientific disclosed that a cyberattack has disrupted its global operations and shipment processes, with investors told restoration may take weeks. No group has claimed it. Johnson Controls, which runs building systems for hospitals, airports and stadiums, was separately disrupted. [14][15][16]

Why it matters. Last month Medtronic notified more than 3.8 million people of exposure, and Stryker's attack earlier this year had knock-on effects on US hospitals. The pattern is not data theft - it is stopping the supply of physical things hospitals need. [15]

The FBI disrupted proxy infrastructure used for mass hacking, run by a Nanjing-based company and used primarily by China's Ministry of State Security and the People's Liberation Army. [17][18]

Why it matters. Same shape as the Interpol operation: the target was the shared infrastructure rather than the operators using it. A separate analysis this week argued China is pre-positioning inside civilian infrastructure rather than stealing from it. [19]

A widely shared argument this week: when a vendor patches a flaw silently - no advisory, no identifier, a vague changelog line - the binary on disk still changes, and anyone with a disassembler can compare versions and find what moved. [20]

Why it matters. The people that keeps in the dark are the defenders, the detection engineers and the administrators deciding what to patch tonight. The people already capable of weaponising it are unaffected.

A Zimbra flaw allowing remote code execution without login was being exploited with federal agencies given until Monday to fix it, and a critical GitLab flaw was exploited shortly after disclosure. Microsoft patched an Entra ID flaw already under attack. [22][25][24]

Why it matters. The gap between a fix existing and a fix being needed is now measured in days, which is shorter than most organisations' change-approval process.

Chrome shipped fixes for over 300 vulnerabilities. Atlassian and Splunk patched dozens between them, Adobe and Nvidia dozens more, Cisco fixed critical flaws in two products, and Ubiquiti patched three maximum-severity flaws affecting a product with more than 100,000 instances visible online. [23][21][27][28][26] One carrier physically cut a cable to stop an intrusion. [32]

Why it matters. None of this is news in itself, which is the point: this is a normal week, and every one of those numbers is somebody's Tuesday.

About 70% of enterprise workforce users now have multi-factor authentication, and a detailed argument this week set out how that creates a false sense of security rather than an end state. [29]

Why it matters. A control that almost everyone has is a control attackers have had years to learn to work around.

The build-time malware planted in Rust crates with 245 million downloads has been linked to North Korean actors. The malicious dependency was published, spotted and pulled within 47 minutes. [30][31]

Why it matters. The response was fast and it did not matter much: a build script runs at build time, so anyone who compiled during those 47 minutes was affected.