Cyber, in brief

Ireland's Data Protection Commission fined Google 403 million euros, or $463 million, over the way it handled people's location data. [1][2]

The regulator found Google did not handle that data lawfully or fairly in Web and App Activity, the setting that records what a person searches and visits. [1]

It made the same finding about Location History, the service that maps the places a phone has been. [1]

It also found Google was not lawful, fair or open about Location Accuracy, a setting inside the Android phone software. [2]

Google said the case is about old policies and that it has changed how location data works since 2019. [1]

Ireland decides these cases for all 27 European Union countries, because Google's European headquarters is in Dublin. [1]

The investigation opened six years ago and examined the period from 2018, when the law took effect, to February 2020. [1]

It is the fourth largest privacy fine this regulator has issued; a 1.2 billion euro fine on Meta, which owns Facebook and Instagram, is larger. [1]

The regulator says three more privacy investigations into Google are still open. [1]

Why it matters. Watch the three other Google investigations the same regulator says are open, because whether any of them reaches a fine is the test of how fast one office can work for 27 countries.

The US Government Accountability Office, a watchdog that audits federal agencies, reported on Monday that the two systems carrying text messages between air traffic controllers and airliners were built before encryption was normal and still have none. [3] It said the US aviation regulator has not finished its risk assessments and cannot spot all of these threats as they happen. [3] Someone able to transmit on those channels could send a plane a fake cancellation of its clearance. [3] The regulator agreed with all nine recommendations. [3]

Why it matters. Senator Ron Wyden, who asked for the report, called the technology incredibly insecure. [3] Jamming and faking of satellite navigation is already a problem over northern Europe, where Estonia and Finland blame Russia and Russia denies it. [3]

ShinyHunters, a data-theft crew, took over the dark web leak site of Clop, a ransomware gang, and has spent the week demanding money from it. [4] It first asked for an eight-figure sum, then for everything Clop earned from its attacks on Oracle's business software, with interest. [4] On Monday it added a public apology to the list and said the price rises every 24 hours. [4][5] It also named three people it says run Clop. [5] It claims to hold private keys and server data used to run Clop's operation. [6]

Why it matters. ShinyHunters has threatened to publish which companies paid Clop, how much, and the Bitcoin addresses used. [5] That threat lands on the victims, not on the gang.

Researchers at Forever Security found a way for an ordinary browser extension to cross into the AI assistant built into the browser, an attack they call BragJack. [7] It worked on five of the most used AI browsers, from Google, Microsoft, Opera, Anthropic and Perplexity. [7] In Chrome they could take screenshots, read files on the machine and switch on the camera and microphone with no click from the user. [7] All five companies have fixed it. [7]

Why it matters. Anyone running one of those browsers with a single extension installed was exposed, which the researchers put at hundreds of millions of people. [7] The bounties paid ran from $600 to $7,000. [7]

Ludwig Maximilian University in Munich, which has more than 52,000 students, detected an intruder on its network on Wednesday and disconnected the affected server. [8] The records that may have been taken include names, dates of birth, contact details, bank account information, health insurance numbers and the reasons some students asked for leave. [8] The university has not said how many people are affected or when the access began. [8] Enrolment was briefly suspended. [8]

Why it matters. A university holds bank details and health identifiers for tens of thousands of people who never chose its security. Some students say they still cannot register for courses or see their grades. [8]

RansomHouse, an extortion group active since 2021, listed Namibia's Ministry of Defence and Veterans Affairs on its leak site and accused that ministry's IT department of hiding the break-in. [9] Namibia's national cyber incident team then confirmed unauthorised activity on the defence ministry's network. [9] It has not said what was taken, whether files were encrypted, or whether a ransom was demanded. [9] Its head urged other organisations in the country to report attacks promptly. [9]

Why it matters. The country's own responders learned the shape of the incident from the criminals' website. They have no reach at all over the group itself.

Kaspersky's research team said on Monday that a public torrent archive was compromised and used to hand out a previously unknown malware disguised as popular films, including The Odyssey. [10] The first stage checks whether it is being examined by security software before it does anything. [10] It then takes administrator rights without the usual Windows warning and opens remote access. [10] It finds its control server through the Solana blockchain, which makes the network harder to shut down. [10]

Why it matters. Several hundred victims have been found in Russia, Turkey, Japan, Kenya, Uganda, Colombia and several European countries. [10] They include companies, government bodies, retailers and transport firms. [10]

Check Point, an Israeli security company, published a fix on 16 September for a flaw in its Security Management Server, the machine that holds firewall rules and administrator accounts. [11] The flaw is rated 9.8 out of 10 and can be triggered before anyone logs in, by sending a login request with a very long username. [11] A successful attack runs the attacker's own code with full control of the server. [11] Customers on automatic updates were already protected. [11]

Why it matters. The US cyber-defence agency recorded exploitation as none, and the scanning firm Censys found no public attack code. [11] This is the rarer case where the fix arrives before the attacks.

The US cyber-defence agency said ransomware gangs have joined the attacks on a flaw in VMware vCenter, the software companies use to run their virtual servers. [12] Broadcom, which owns VMware, patched it on 29 July and told customers to treat it as an emergency. [12] Two weeks later an incident response firm found more than 361 addresses across 47 countries compromised through it. [12] About 450 vCenter servers are still reachable from the internet. [12]

Why it matters. The fix has existed for nearly two months. What changed this week is who is using the hole.

Spain's data protection regulator said it has received the first breach report in which an AI agent is blamed for carrying out the attack. [13] The agency said the attacker used a well known large language model to find a way in, then changed personal records and opened invoices. [13] It did not name the model, the organisation or the attacker. [13] It stressed that neither the model nor its provider was itself compromised. [13]

Why it matters. The agency's point was that one attacker ran several stages of a break-in with very little human work. [13][14] This is a first report, which is not the same as a first event.

British Columbia, a Canadian province, sued OpenAI on Monday. [15] The case is over the company's failure to tell police about a user's ChatGPT activity before the Tumbler Ridge school shooting in February, in which eight people died, six of them children. [15] Reports say OpenAI's safety team flagged the account for references to gun violence months earlier. [15] The company's chief executive apologised to the families in April. [15] The province filed in California, because that is where the decision not to report was made. [15]

Why it matters. British Columbia has asked for the chats and OpenAI has refused. [15] Families of the victims have filed their own lawsuits, and any damages the province wins would go towards rebuilding the school. [15]

Researchers outside China noticed in September that satellite pictures of military and government sites across the country had been blurred on Apple Maps. [16] The BBC's verification team went through the platform and identified thousands of obscured locations. [16] Several of them are detention facilities linked to alleged human rights abuses. [16]

Why it matters. Satellite pictures are what outside researchers have used to document those sites. Blurring them on one widely used map takes away a record that anybody could look at.

A United Nations panel reported on Wednesday that Vietnam, Laos, Pakistan and Argentina have taken real steps against schemes that get North Koreans hired into well paid technology jobs using stolen or bought identities. [17] A 140-page United Nations report last October described the scheme and said the workers live illegally in China and about 40 other countries. [17] Argentina opened an investigation into a woman accused of laundering their earnings and froze some assets. [17] Pakistan opened a case against an alleged forger of identity papers. [17]

Why it matters. None of these cases touches North Korea itself. Each country is prosecuting the local person who made the scheme work where they live.

Belgium's French-speaking table tennis federation and its gymnastics federation were both hit by attacks disclosed this week. [18] A person using the handle Venus1337 claimed responsibility and posted samples said to include names, membership numbers and records of sporting sanctions. [18] The claim covers about 1.69 gigabytes. [18] The table tennis federation says its checks so far show no evidence its own systems were compromised, and it is looking at the supplier that runs its website. [18]

Why it matters. A small membership body holds years of personal records and buys its website from an outside firm. The break-in can happen at a company the members have never heard of.

Two critical flaws in The Events Calendar, a WordPress add-on installed on more than 600,000 websites, can let a stranger run code and take over the site. [19] Both are rated 9.8 out of 10 and neither needs a login; one of them works through the comment box on an event page. [19] StellarWP, which makes the add-on, fixed one on 25 August and the other on 10 September. [19] WordPress figures show about 240,000 sites still run versions old enough to carry both. [19]

Why it matters. A fix that exists is not a fix that is installed. Every one of those sites has to update itself, and most are run by somebody with another job.

The US cyber-defence agency added three flaws in the Linux kernel, the core of the software running most servers, to its catalogue of bugs known to be under attack. [20] The most serious is rated 9.8 out of 10 and sits in the code handling encrypted network traffic, where it can crash a machine or leak memory. [20] The other two can corrupt memory or produce wrong results from encryption work. [20] Federal agencies were given three days to patch all three. [20]

Why it matters. That agency can order US federal bodies and can only advise everyone else. The same kernel runs most of the machines behind the internet.

LastPass, which makes a password manager, found a fake version of its authenticator app handed out through GitHub pages tuned to appear high in search results. [21] The download installs a kernel driver, attested by Microsoft, built to shut down 145 antivirus and security products, and then runs a data stealer called Rapuncel. [21] LastPass says none of its own systems were touched, and that the campaign impersonates at least 40 companies. [21] It has been running for several months. [21]

Why it matters. The lure is a security product, which is exactly what a careful person goes looking for. Searching for the official app is how victims arrive.

Researchers at Elastic described malware they call KREMLIN, which waits for Chrome or Edge to close, copies an extension straight into the browser's profile folder and registers it as approved. [22] To do that it takes the browser's own encryption keys and rebuilds the checks the browser uses to spot tampering. [22] The extension then poses as a media tool. [22] It steals cookies and session data and logs what is typed into forms, including passwords. [22]

Why it matters. The owner never approves the add-on, and the browser treats it as though they had. [22] The extensions list is the one place it shows.

Securonix researchers described a campaign they call TASK#STOMP, which drops a script with a random file name on the victim's desktop and uses it to install a PowerShell backdoor. [23] The backdoor collects business documents, watches for new files as they are created, takes screenshots, and steals Wi-Fi passwords and whatever is on the clipboard. [23] It stays alive through four scheduled tasks named to look like Windows services, such as Network Audio Service. [23] It also alters file timestamps. [23]

Why it matters. How the first script reaches the desktop is not known, and the researchers think an emailed lure is likely. [23] The altered timestamps are there to mislead whoever examines the machine afterwards.

A report from the security firm Black Kite says ransomware incidents at manufacturers this year are 40% above the same period last year. [24] It argues that mid-sized manufacturers absorb most of the attacks, because they are the suppliers the larger firms build their products from. [24] Its example is the attack that shut Jaguar Land Rover's UK plants in September 2025, which affected more than 5,000 other companies. [24] The UK's Cyber Monitoring Centre put that one incident at 1.9 billion pounds. [24]

Why it matters. This is a security vendor's count of its own data, not an official figure. The direction is worth more than the exact number.

The Hiscox Cyber Readiness Report 2026, published on 15 September, puts the average cost of a cyber incident over the past year at about $52,000, with average downtime of 32.8 hours. [25] The highest average cost was in Italy, at $134,138. [25] Firms based in the UK were the most likely to report a successful attack, at 38%, and firms in the US the least likely, at 20%. [25] Among victims, 69% reported staff burnout, high stress or a worse workplace afterwards. [25]

Why it matters. The numbers come from a survey of 6,800 people responsible for security at firms in the UK, Europe and the US, so read them as that company's own count. [25] The 33 hours is the part an ordinary customer feels.

A report from the security firm Forcepoint sets out five ways an AI system can be pushed into using far more computing than anyone budgeted for, a pattern it calls denial of wallet. [26] The service stays up while the bill climbs, so nothing looks broken. [26] No single request has to look suspicious or break a usage limit. [26] The industry body OWASP now ranks this sixth in its 2026 list of the main risks in AI applications. [26]

Why it matters. A misconfigured automation or a long session can do it with nobody attacking at all. [26] The damage arrives as an invoice rather than as an outage.

Richard Grabowski, who runs service delivery for the US cyber-defence agency's Continuous Diagnostics and Mitigation programme, told a conference on 15 September that it has to get faster. [27] The programme supplies security tools and capabilities to other US federal agencies. [27] He said the way agencies worked together was not fast enough for yesterday's threats, let alone tomorrow's. [27] His answer is automation at scale, so specialists spend their time on new threats rather than routine alerts. [27]

Why it matters. This is the same agency that hands federal bodies three-day deadlines to patch. It is saying its own side of the work moves too slowly.