Cyber, in brief

Revolut, a British bank that works only through a phone app, confirmed that it gave customer files to someone posing as a government agency. [2][5]

The requests came from a real government email address, so they passed the technical tests on the sender. Staff handled them as normal legal requests. [4]

Banks must answer legal requests from police and government agencies. [2] Because Revolut is required to respond, it complied. [1]

The files included passport and driving licence copies, the selfies customers take to prove who they are, bank statements, account numbers and full transaction histories, including Bitcoin. [2][3]

Revolut says only a very limited number of customers were affected. SecurityWeek understands it was about 680 people, reportedly holding large amounts of cryptocurrency. [5][1]

The requests went to Revolut Bank UAB, the company's arm in Lithuania. The hacker told investigators at the firm Duel that it answered them for roughly five months. [1]

The sending address appears to belong to an employee of Italy's Interior Ministry. [1] Italian authorities did not answer questions from The Record. [3]

Hudson Rock, a firm that tracks stolen logins, knows of more than 300 logins for that Italian ministry's email system. [1] They were taken by infostealers, malware that copies saved passwords off infected computers. [1]

On Wednesday a hacker calling themselves IAmNotAVillain publicly demanded $3m from Revolut and threatened to sell the files. [1] That is about 2.2m pounds. [6]

Revolut says no person or group has contacted it directly with a demand. [1] The hackers also claim they took 147GB from an Italian police agency, and Italian police have opened an investigation. [1]

Revolut says it blocked the email address and told the agency whose address was used, the police, and the data-protection and financial regulators. [5][3]

The same trick was used in 2021 and 2022, when a group called Lapsus$ sent fake emergency requests from police accounts to Apple, Meta and Discord. [3]

Why it matters. Watch whether Italy's Interior Ministry confirms the account was its own, and whether any other bank says it received requests from the same address. [1][3]

Cisco said on Wednesday that attackers were already using a flaw in ISE, its Identity Services Engine. [7] ISE is the system many organisations use to decide which people and devices may join their network. The flaw scored 10 out of 10 for severity and lets an attacker in without a password. [8] Cisco says there is no workaround, only the update. [9] An attacker who gets in gains full control and can erase the signs of it. [7]

Why it matters. A break-in here reaches the part of a company that decides who else is trusted. Cisco also released fixes for 20 ISE flaws the same day, 12 of them critical. [10]

A group calling itself CikLeak says it broke into systems of Russia's Central Election Commission and companies that build Vybory, the state platform that runs elections. [11] It claims it took internal papers, server settings, passwords and staff chats. [11] Important Stories, an independent Russian news outlet, says the documents are real. [11] It is unclear whether the hackers reached anything used to cast or count votes. [11] Voting for all 450 seats in Russia's lower house of parliament runs for three days from Friday. [11]

Why it matters. Ella Pamfilova, who chairs the commission, said attacks on election systems have never been this intense. [11] The group urged Russians to vote in person, saying that makes results harder to change. [11]

Ofcom, Britain's media regulator, told a House of Lords committee that most of the fines it has issued under the Online Safety Act have not been paid. [12] The law is meant to protect children and other users from illegal content online. [13] Ofcom has fined 11 services more than 7m pounds in all. [12] It cannot close a website worldwide, only ask a court to block it in the UK. [12] It cannot use a block just to collect an unpaid fine. [12]

Why it matters. A company with no money or offices in Britain can ignore a British fine, because Ofcom has nothing of it to seize. Ofcom says it is working with the UK government on stronger powers. [12]

A court in Washington DC dismissed a lawsuit by 4chan and Kiwi Farms, two US online forums, against Ofcom. [13] The forums had called Ofcom's letters threats to their rights under the US constitution. [13] Ofcom fined 4chan 20,000 pounds last October for not answering its legal requests for information. [13] The judge said the case did not belong in a US court. [13] Any British judgment against the forums would most likely have to be enforced in the US, where they could fight it. [13]

Why it matters. The ruling lets Ofcom keep investigating. It does not put the fine within Ofcom's reach, because the forums have no presence in Britain. [13]

A New Jersey judge ordered radaris.com and more than a dozen sister websites handed to Atlas Data Privacy, which had sued them. [14] Radaris sold detailed files on millions of Americans through people-search websites. [14] New Jersey's Daniel's Law lets police officers, judges and their families have their details removed, with fines of $1,000 for each ignored request. [14] Radaris stonewalled for years and kept moving its paperwork to companies in places like the Marshall Islands. [14]

Why it matters. The judge took the one thing Radaris could not move out of reach, its web address. The site no longer sells personal files, and Radaris says it will appeal. [14]

Google released its September update for its own Pixel phones, fixing 110 flaws. [15] One, in the part of the phone that talks to the mobile network, was already being used in targeted attacks. [15] An attacker nearby on the same network could use it to gain more control of the phone. [15] On 16 September CISA, the US cyber-defence agency, added it to its list of flaws known to be under attack. [16]

Why it matters. US government offices are required to fix flaws on that list quickly. [16] Pixel phones get their fixes from Google directly, separately from other Android phones. [15]

CISA says ransomware gangs are now exploiting a critical flaw in VMware vCenter, the console that runs a company's virtual servers. [17] Broadcom, which owns VMware, fixed it on 29 July and told customers to treat the update as urgent. [17] A spying group used it first, and a forensics firm counted 361 hacked addresses in 47 countries. [17] Shadowserver, which scans the internet, still counts more than 450 vCenter servers reachable online. [17]

Why it matters. Nobody knows how many of those 450 are fixed. A console like this can open a whole company's network to a gang that wants to lock its files for ransom. [17]

Check Point, which makes firewalls, fixed a critical flaw in the server that sets its firewall rules and administrator access. [18] Someone with no password could have run commands on it over the network. [18] The flaw scored 9.8 out of 10. [18] Check Point says it knows of no attacks, and CISA also recorded none. [18] Customers with automatic updates switched on were already protected. [18]

Why it matters. The fix arrived before anyone was known to be using the hole, the opposite of the Cisco case the same week. One version, R82.20, still has no full update, according to the scanning firm Censys. [18]

Spain's data protection agency, the AEPD, says it has received its first report of a personal-data breach carried out by an AI agent. [19] An AI agent is a program that plans and carries out tasks on its own. [20] This one logged in, searched the system for weak points, then changed personal details and viewed invoices. [20] The agency has not named the victim or the AI model, and is still reviewing the case. [19]

Why it matters. The agency says AI makes attacks faster, leaving less time to spot and stop them. [19] It says the use of a model does not mean the model's maker was hacked. [19]

Premier Medical Group, which runs doctors' offices in New York's Hudson Valley, is telling 282,075 patients that their files were taken. [21] Attackers reached the files on 14 June, when some of its systems were disrupted. [21] They held names, birth dates, diagnoses, medicines and health insurance details. [21] No ransomware group has claimed the attack. [21]

Why it matters. Three months passed between the theft and the letters. The group says patients should look for charges for care they never received. [21]

Elastic Security Labs, a security research team, described a malware kit called KREMLIN used against people in Brazil since May 2025. [22] It arrives as a fake bank receipt or invoice, and its lures copy 12 banks. [22] It quietly adds an extension to Chrome or Edge that records passwords typed into forms. [22] Elastic confirmed 1,515 infected computers, almost all in Brazil. [22]

Why it matters. Elastic stopped the current campaign by registering a web address the malware relied on, which made it shut itself down. [22] Despite its name, the kit is linked to a Brazilian group. [22]

Kaspersky, a Russian security company, says Hacking Cat, a pro-Ukraine group, has attacked Russian organisations since about February 2024. [23] By mid-2025 it moved from defacing websites to locking and wiping files. [23] In March it claimed a break-in at a contractor for Rosatom, Russia's state nuclear company. [23] Kaspersky also describes a spying group, NightEagle, that got into Russian firms mostly with stolen logins. [24]

Why it matters. Kaspersky says several groups share the same tools, which makes it hard to say who did which attack. [23] Both reports come from Kaspersky, a Russian company describing attacks on Russia. [23][24]

Microsoft issued extra fixes on Monday for problems caused by its record September update. [25] That update closed 974 security flaws, more than it fixed in all of 2023. [25] The new fixes repair Remote Desktop, which lets people use a computer from far away. [25] They also repair virtual machines and some USB sound devices. [25]

Why it matters. A security chief at the firm SOCRadar told Dark Reading that the risk of faulty updates will grow as they get bigger. [25] AI tools finding more flaws is one reason they are getting bigger. [25]

CISA published guidance on decoys for companies that run power, water and other essential services. [26] A decoy is a fake system, account or file that no real user should ever touch. [26] When an intruder touches one, defenders get an alert they can trust. [26] CISA says decoys can be added bit by bit, without rebuilding the network. [26]

Why it matters. It starts from the view that an attacker may already be inside. A decoy turns that intruder's exploring into a warning sign. [26]

Microsoft agreed privacy and safety rules for its AI tools in US schools with the American Federation of Teachers, a large teachers' union. [27] It says it will not use student or teacher data to train AI, and the data cannot be sold or used for adverts. [27] The agreement bans AI features built to make students emotionally attached. [27] It is legally binding, with outside audits, from 1 November. [27]

Why it matters. OpenAI and Anthropic say they are discussing similar deals. Google, the biggest supplier of school technology in the US, has not said. [27]

SecurityWeek, reporting a study by the security company Black Kite, says ransomware attacks on manufacturers are up 40% on the same period last year. [28] Black Kite counted 5,237 disclosed victims in manufacturing and distribution from January 2023 to July 2026. [28] It says mid-sized suppliers take most of the attacks. [28] A stopped production line puts pressure on a victim to pay. [28]

Why it matters. The count comes from a security firm's own report. SecurityWeek notes that the attack on Jaguar Land Rover in September 2025 hit more than 5,000 other companies. [28]