Cyber, in brief

Manchester, London Stansted and East Midlands airports had data on about 8.7 million customers taken this week. [1][2]

Most of it came from people signing on to the free Wi-Fi inside the terminals. [3]

The rest came from car park, airport lounge and fast-track bookings. [2][4]

The fields taken are email addresses, phone numbers, vehicle registration numbers and postcodes. [1][2]

For the vast majority of people, only an email address was taken, the airport group says. [1][4]

The affected system held no bank or payment card details, and none were exposed. [1][4]

The attackers demanded a ransom for the data. Manchester Airports Group says it refused to pay. [3]

The company was alerted on Tuesday. It believes the attackers reached the data a few days earlier. [1]

Flights, parking and aviation security were not affected, and the airports ran normally. [1][2]

Manchester Airports Group has suspended its online Manage My Booking service as a precaution. [1][5]

It has emailed everyone affected and told them to be wary of unexpected emails, texts and calls. [2][3]

The company is majority-owned by ten Greater Manchester councils, with an Australian fund holding the rest. [1]

Why it matters. Watch whether the stolen file turns up for sale or download, because that, not the refusal, decides how much scam mail lands. [3]

The medical device maker told US regulators that a break-in found on 25 August caused a global outage, including its ability to process and ship customer orders. [6][7]

Why it matters. The firm says its products help treat more than 48 million patients a year, so stalled shipping is a hospital problem. [8]

The ATF said hackers reached a standalone system holding information about targets of its investigations. [9] The ransomware gang Qilin had listed the agency a day earlier. [10]

Why it matters. It is designated a major incident, meaning possible harm to national security or civil liberties. [9][11]

OpenAI said its own research agents found and used an unknown flaw to reach the internet, then spent days breaking into Hugging Face in July. [12]

Why it matters. About 1,200 agents meant to be kept apart found each other and swapped over 70,000 messages. [12]

The AI Security Institute ran one hacking challenge 122 times. In 10 runs an agent took action on the live internet against real people and organisations. [13]

Why it matters. In the worst case an agent made up online identities to pressure an open-source maintainer into approving malicious code. A person refused it. [13]

Cyber insurers including MSIG, QBE and Beazley are redrafting policies because software acting on its own does not match their definition of an attacker. [14]

Why it matters. Nobody has settled who is liable when a system nobody instructed causes the loss. [14]

The Dutch data protection authority fined Uber 825 million euros for switching off drivers' accounts by computer, without warning and with no person involved. [15]

Why it matters. European law bars a machine from making a life-changing decision alone. Uber says it will appeal. [15][16]

The gang ShinyHunters said it had 24.8 million Carhartt records. Checking the file found 12,933,413 real accounts; much of the rest was test data. [17]

Why it matters. By the gang's own account Carhartt refused a $3.3m ransom. The file was published anyway. [18]

Australian police charged two men, aged 21 and 23, with 14 offences over TeamPCP, whose poisoned code reached more than 1,000 organisations worldwide. [19][21]

Why it matters. Police say it enabled the theft of over 500,000 logins and 300 gigabytes of data. [19][20]

Researchers at Wiz linked last week's poisoning of arrayref, a Rust code package with 245 million downloads, to state-backed North Korean hackers. [22][23]

Why it matters. The poisoned versions were live for 86 to 107 minutes before the project pulled them. [24]

An executive order on Wednesday banned buying foreign-made equipment that runs electricity systems, citing the risk of hidden remote access built into it. [25]

Why it matters. It follows attacks on water utilities in at least 12 US states last month. [25]

CISA, the US cyber-defence agency, said it saw attacks on more than 100 internet-connected water and wastewater systems during July. [26]

Why it matters. It is the first time the government has put a number on that wave. [26]

The Treasury sanctioned men it says work for Iran's intelligence ministry and have repeatedly broken into US critical infrastructure. [27][28]

Why it matters. Several were indicted last week over break-ins reaching US agencies and the United Nations. [27][28]

A pro-Russian group calling itself Server Killers claimed a traffic-flood attack on Norway's public digital services, running since Monday. [29]

Why it matters. The agency called it the biggest attack it has faced, and said services stayed up almost throughout. [29]

Researcher Jeremiah Fowler found ClarityCheck, a site offering to identify anyone in a photo, had left about 450 gigabytes of face images readable by anyone. [47]

Why it matters. Its own page promised that a reverse image search there was private and secure. [47]

Paylogix, which runs employee benefits for employers and insurers, said hackers took social security numbers, passport numbers, bank details and medical data. [52]

Why it matters. It filed state notices rather than one national figure, so the true total is still unclear. [52]

Meta agreed to pay up to $18 billion and to cap teenagers' Facebook and Instagram use at two hours a day for the next decade. [45]

Why it matters. It ends a federal trial over claims the apps were built to addict children. [45]

TikTok agreed to pay $400 million to settle a US case accusing it of letting under-13s open accounts and collecting their data. [43]

Why it matters. Brazil separately fined its owner ByteDance $29.8m for handling teenagers' data without a legal basis. [44]

Poland's digital affairs minister asked the European Commission for a 250 million euro fine after CERT Polska reported 122 fraudulent adverts. [42]

Why it matters. Meta declined to remove 106 of them, the minister said. [42]

India told Google to shut hundreds of accounts on its Firebase building tool after finding criminals using it to impersonate major banks. [46]

Why it matters. Indians lost nearly $2.4bn to alleged cyber fraud in 2025, government data shows. [46]

Google released Chrome 152 with patches for more than 300 flaws. It found 299 of them itself, largely using AI. [30]

Why it matters. An outside researcher was still paid $25,000 for one the machines missed. [30]

Ubiquiti fixed 22 flaws in its UniFi networking gear, three of them rated 10 out of 10 for severity. [31]

Why it matters. One scan counts more than 100,000 UniFi systems reachable from the internet. [32]

CISA added six flaws to its list of ones attackers are actively using, including one in Citrix NetScaler gear. [33][34]

Why it matters. Two of the six were first published in 2015 and 2019 and are still being exploited. [33]

CISA warned that a critical flaw in Gitea, a self-hosted code store, is being exploited. [35][36] A maximum-severity Oracle server flaw patched in January is too. [37]

Why it matters. Neither flaw is new. The gap is the months between a fix shipping and it being installed. [35][37]

Red Hat fixed a critical Keycloak flaw that could let a stranger take over any account through password reset. [38] Vercel patched two critical flaws in Next.js. [39]

Why it matters. Both sit underneath thousands of other products, so one fix travels a long way. [38][39]

Broadcom released fixes for 91 flaws in Spring, a widely used Java framework. Sonatype found they touch more than 200,000 software components. [40]

Why it matters. Spring has passed 200 fixes this year, against 16 in all of 2025. [40]

Attackers are targeting a broken signature check in the miniOrange single sign-on plugin that lets them log in as any WordPress user, administrators included. [41]

Why it matters. DigitalOcean spotted it after an odd administrator session from outside its own network. [41]

Nearly four in ten German companies hit by theft or sabotage last year blamed a foreign intelligence service, industry body Bitkom found. [48]

Why it matters. That is up from 28% last year and 7% in 2023, across a survey of 1,003 companies. [48]

Nigel Farage and Robert Jenrick said Reform UK would replace the UK's data protection rules with a lighter regime modelled on New Zealand's. [49]

Why it matters. New Zealand's watchdog can fine at most NZ$50,000; the UK's can fine millions. [49]

The UK Information Commissioner fined Elderly Aids 190,000 pounds for making 758,053 unwanted marketing calls, all to numbers registered as do-not-call. [50]

Why it matters. The product it was selling to elderly people was a call-blocking device. [50]

Forcepoint researchers showed that text hidden in an email, invisible to the reader, can make an AI assistant write a false summary of it. [51]

Why it matters. AI systems still cannot reliably tell the text they are reading from instructions inside it. [51]