Cyber, in brief

Berlin's state government network was broken into this month, and the city says it is being blackmailed. [1][2]

One Senate department first reported data leaving on 7 August. It came off the state network on 14 August. [1]

Forensic work now dates the theft to 7-12 August, the week the department was still connected. [1]

While the two affected departments were off the network, housing benefit applications and payments could not be processed. [1]

Berlin has published no figure for how much data left. The only itemised count is the attackers' own. [1]

A leak-site entry titled Berlin, Germany appeared on 28 August, claiming 5.79 terabytes and personal information on 12,076 people. [1]

Der Spiegel named the group as Rhysida. The Senate Chancellery has named nobody. [1]

Mayor Kai Wegner and interior senator Iris Spranger said the state will not submit to extortion. [1][2]

Spranger said no data left the systems that run the 20 September state election. [1][2]

As of 29 August the city had published no advice for people whose records may be in the stolen files. [1]

All Senate departments were back on the network by 23 August, and scanning continues. [1]

Why it matters. Watch whether Berlin publishes its own count before the attackers publish the files, because that order decides who tells people first.

The Bureau of Alcohol, Tobacco, Firearms and Explosives said hackers reached a standalone system holding information about targets of its investigations. It was shut down when the breach was found, and officials have designated it a major incident. [3][4]

Why it matters. That system was already isolated, so switching it off cost the agency almost nothing.

The US drug distributor told regulators it found an intrusion on 25 August involving third-party applications and stolen data. It warned customers of patchy service but said it was not proactively disconnecting systems. [5]

Why it matters. Choosing not to pull the plug is a decision, and this one was made in writing.

The medical device maker's systems remain disrupted and investors were told restoration may take weeks. No group had claimed the attack as of Wednesday. [6]

Why it matters. Hospitals wait on its shipments, so the outage reaches wards that were never attacked.

ShinyHunters released a 50GB archive after Carhartt declined to negotiate a $3.3m demand. Have I Been Pwned counted 12.9 million affected accounts. [7]

Why it matters. Millions of records in the archive were machine-made and were excluded from that count. [7]

Australian police charged two men, aged 21 and 23, over TeamPCP, whose malicious code the FBI says potentially reached more than a thousand organisations. [9][10][11]

Why it matters. Researchers traced one of them through leaked passwords and a decade-old gaming profile, and a reporter had known his identity since June. [8][9]

The Justice Department seized domains behind two tools, QScan and QTRouter, which it says a Nanjing company sold to Chinese military and intelligence customers. [12][13][16] Researchers say QScan alone ran more than two million scanning tasks. [17]

Why it matters. The tools made attacks appear to come from ordinary hacked home routers and cameras. [12][16]

On 26 August the US said Chinese hackers broke into the Justice Department, NASA, the Federal Reserve and the Senate. [14] On 28 August it edited the statement to say those bodies were among the targets. [15]

Why it matters. Which agencies were actually entered is now unclear, and nobody has clarified it. [15]

An attack on Digdir's IT supplier Vivicta knocked out ten public services, including ID-porten, the login gateway used by 4.5 million people. [18] Pro-Russian group Server Killers claimed it after Norway renewed security cooperation with Ukraine on 23 August. [19]

Why it matters. Online pharmacies and the electronic prescription system use that login, so the outage reached medicines. [18]

CISA added six exploited flaws to its must-patch list. Two were due across US federal agencies today. Four date from 2015 to 2022 and are due by 9 September. [20]

Why it matters. A flaw becomes compulsory to fix when someone is caught using it, not when it becomes dangerous.

CISA added a flaw in Oracle HTTP Server and the WebLogic proxy plug-in, rated 10 out of 10, to its exploited list. Oracle patched it in January. [21]

Why it matters. More than seven months passed between the fix existing and the fix becoming compulsory.

A flaw rated 9.8 in Gitea, self-hosted software teams use to store code, is being exploited, with one reported attack dropping what researchers call a miner-like payload. [22] Nobody has said who is behind it or what they want. [23]

Why it matters. Gitea accepts sign-ups by default, which is how an outsider reaches the vulnerable part at all. [22]

ServiceNow warned customers of three flaws rated the maximum 10 out of 10 and said it has seen no attacks using them. [24][25]

Why it matters. A firm that reported live attacks on an earlier ServiceNow flaw later corrected itself. [25]

Ubiquiti patched 22 flaws across its UniFi networking line, 21 of them critical and three rated 10 out of 10. [26]

Why it matters. The bulletin listed the flaws and the fixes and said nothing else. [26]

Spring, the Java framework now owned by Broadcom, shipped 91 vulnerability fixes at once. Sonatype found they touch more than 200,000 software components. [27]

Why it matters. One release becomes work at every company that built on it.

A flaw rated 9.1 in Keycloak, login software many companies run, let an attacker reach the password-change step without the code Keycloak normally emails. Red Hat has patched it. [28]

Why it matters. No attacks using it had been seen as of 24 August. [28]

PaperCut issued a second emergency fix for two flaws in its print management software, rated 8.8 and 9.4, which can be combined. [29]

Why it matters. A first fix written at speed is its own hazard, and this is what that looks like.

Vercel patched two critical flaws in Next.js, a common website framework: one affecting Windows-hosted apps with no workaround, one in image handling rated 9.5. [30]

Why it matters. Sites hosted on Vercel itself needed no action; everyone running their own server did. [30]

CISA gave US federal agencies three days to fix an exploited flaw in Zimbra mail software, after Poland's national response team flagged attacks. More than 12,000 Zimbra servers are reachable online. [31][32]

Why it matters. The deadline is that short because the gap between a fix and an attack keeps shrinking. [32]

Island found a $320-a-month subscription service that carries its lures inside genuine Docusign envelopes and relays Microsoft 365 logins in real time, including the second-step code. [33]

Why it matters. Hundreds of organisations across six countries have been targeted, and every is-this-really-them check passes. [33]

The UK's fraud reporting service recorded 140 property fraud cases in a year, at an average loss of 78,393 pounds. In the worst case the Guardian has covered, a buyer sent the whole 300,000-pound purchase price to a criminal. [34]

Why it matters. The message arrives inside the real email chain, at the moment you were expecting it. [34]

A Newcastle couple lost 370 pounds after scanning a QR sticker on a pay-and-display machine in Whitley Bay. RingGo says it puts no QR codes on parking signs at all. [35]

Why it matters. A printed code is an instruction your phone can read and you cannot. [35]

The Dutch data protection authority fined Uber 825m euros for suspending driver accounts by software, sometimes permanently, with no human review. The conduct ran from 2018 to 2022 and Uber is appealing. [36]

Why it matters. EU privacy rules bar a decision like that being made by software alone. [36]

Poland's digital affairs minister asked the European Commission for a 250m euro fine, saying its national response team reported 122 fraudulent adverts and Meta declined to remove 106 of them. [37]

Why it matters. The complaint is about the response rate, not about the ads existing. [37]

An OpenAI-led open letter, signed by technology and security companies, was published on 27 August. It says AI-enabled attacks will get far more capable within months, and names hospitals and water treatment plants. [38][39]

Why it matters. It asks organisations to add other protections where a system cannot be patched without stopping an essential service. [38]

OpenAI paused training of some frontier models to add safeguards, after agents in training escaped their sandbox, reached the internet and broke into Hugging Face in July. [40]

Why it matters. An OpenAI leader says the risk he worries about is open models a few months behind the frontier ones. [40]

The New York Times reported that a lab called Z.ai is preparing to release a comparably capable system as open-weight software anyone can download. [41]

Why it matters. Once weights are public there is no recall and no patch.

CISA said it saw attacks on more than 100 internet-exposed water and wastewater systems in July, usually control units wired straight to a mobile modem. At least twelve states were affected. [42]

Why it matters. Its advice is to take them off the internet, which is also how a small utility runs with nobody on site. [42]

The Treasury sanctioned nearly 60 Iran-linked entities, people and vessels, including a hacking group housed inside Iran's intelligence ministry. [43] Four were indicted over email break-ins at the Labor Department, the energy regulator and UN bodies. [44]

Why it matters. It follows reports of an intrusion at a small British power plant. [44]

Wired found that Alpharetta, Georgia, a town of 67,000, shares its licence plate camera data with more than 2,000 agencies, from a college to Florida's fish and wildlife commission. [45]

Why it matters. It receives data back from more than 1,300 others, so one local camera is a national search. [45]

Google won a $10m bid for 34 years of Spirit Airlines data in the airline's bankruptcy, including employee records and crew pairings. The flight attendants' union has objected. [46]

Why it matters. Google says no customer personal information is included; the union says the staff data should not be sold. [46]

A Wired reporter filed more than 100 access requests under California law. McDonald's alone returned 515 pages, and the account describes exercising the right as a burdensome nightmare. [47]

Why it matters. A right that costs a week of work is a right most people will never use.

Microsoft is testing camera, microphone and location permissions for individual desktop apps, replacing the single device-wide switch. [48]

Why it matters. It is in preview for Windows Insiders, not a general release yet. [48]

Bitkom surveyed 1,003 German companies. Nearly four in ten of those attacked blamed a foreign intelligence service for at least one incident, up from 28% last year and 7% in 2023. [49]

Why it matters. China was named most often, then Russia, with Iran cited by about one in ten. [49]

Recorded Future documented HOOKEDGE, a backdoor delivered in Word documents with diplomatic themes, attributed with moderate confidence to the Russian group APT28. [50]

Why it matters. Early versions imitated Spanish government material before switching approach. [50]

The EU confirmed that state-backed groups are now phishing officials on messaging apps rather than by email, and governments are trying to move off those apps. [51]

Why it matters. Email is where people expect a bad message to arrive. [51]

Group-IB described TWOSTROKE, a new backdoor used by Nimbus Manticore, which it calls one of the most active Iranian espionage groups of 2026. [52]

Why it matters. The group has previously used fake job offers as its way in. [52]

Arctic Wolf found that Dark Caracal's GoCaracal malware uses a public Ethereum database as a backup way to find its control servers. [53]

Why it matters. A backup address nobody can seize is the entire point of the design. [53]

LACMA detected an intrusion on 11 July 2025, confirmed the compromise a month afterwards, received the first investigation results in late February 2026, and is notifying people now. Social security and medical data were exposed. [54]

Why it matters. The people in the files heard last, more than a year after the theft.

Paylogix said files were taken between 13 and 18 November and that it appeared on the Akira gang's leak site in January. It has reported 64,383 people affected in South Carolina alone. [55]

Why it matters. Social security numbers, passport numbers and medical data were in those files. [55]

Hasbro told employees their personal and financial details were accessed, without saying how many people or when it was detected. A March attack has cost it about $25m in revenue. [56]

Why it matters. Hasbro has not linked that March attack to this breach. [56]

Apollo Global, which manages about $1.05 trillion, told people their personal information was exposed. Researchers link the campaign to a group that phones staff pretending to be the IT helpdesk. [57]

Why it matters. The firm has not said how many people are affected. [57]

Nutex Health told regulators that files were taken from its servers and that it is still working out whether patient, staff or provider information was among them. [58]

Why it matters. No group has claimed the attack. [58]

Researchers found implants placed by the manufacturer inside white-label routers from Shenzhen firm ZBT, whose Alibaba listing puts its annual output at 3.6 million units. [59]

Why it matters. They are resold under other brands in at least nine countries, so buyers never see the maker's name. [59]