Cyber, in brief

Yorkshire Ambulance Service says two of its staff may have looked at, or tried to look at, the medical records of William Chapman without a legitimate reason. [3][4]

Chapman was killed by a tiger at Yorkshire Wildlife Park, near Doncaster, on 10 October. He had climbed over two fences into its enclosure. [2][3]

The ambulance service says its own regular checks found the two cases. [3] It has reported them to the Information Commissioner's Office, Britain's data watchdog. [4]

On Sunday Yvette Cooper, the UK health secretary, called the snooping a disgrace. She said staff who break the rules should be sacked. [1][2]

Cooper said staff should be suspended straight away while an investigation runs, and that she has spoken to the head of NHS England. [1][2]

Two days earlier, Nottingham University Hospitals said it has now sacked 15 staff for opening the records of victims of the 2023 Nottingham attacks. In May the number was 11. [5][6]

The trust also gave 15 final written warnings and two first warnings. Doctors and nurses were among the staff it acted against. [5][6]

In May, dozens of staff at a Liverpool hospital group were found to have looked at the records of victims of the 2024 Southport attack. [6]

About 40 hospital staff looked at the records of a three-year-old boy who was hurt when he fell into a crocodile pit in Cambridgeshire in June. [6]

Last month Sir Jim Mackey, the head of NHS England, told every trust to suspend staff suspected of snooping at once and cut off their access to NHS computers. [6]

Nottingham's trust is testing a new system that alerts it to possible breaches. [5] In May, the police said there was no criminal investigation. [2]

Dr Sanjoy Kumar, whose daughter Grace was killed in the Nottingham attacks, said the families want to meet Cooper and asked when it is going to stop. [2]

Why it matters. Watch whether the ambulance service's investigation finds the two staff had no reason to look, and whether the families' request to meet Cooper leads to any rule that stops a look before it happens. [2][3]

ConnectWise, which sells software that IT firms use to look after their clients' computers, disabled seven of its app identities on Saturday morning. [8] It had already shut its Cloud Backup service after attackers got hold of that service's key to customers' Microsoft 365 accounts. [8] It has now also taken its SaaS Security and Cloud Management services offline. [7][8] Scheduled backups are not running, and customers cannot open or restore their saved copies. [8] The services were still down on Sunday afternoon. [7]

Why it matters. Huntress says a second wave aimed at 16 organisations in policy, national security, trade and critical minerals failed. [8] ConnectWise says it cannot see inside its customers' systems, so each IT firm has to look for keys the attacker added. [8][7]

A flaw in Linux that lets a program inside a virtual machine reach the real computer under it now has an official number and a danger rating of 9.3 out of 10. [9][10] A virtual machine is a computer made in software, and clouds put many customers' machines on one real server. [9] The researcher who found it, Paulos Yibelo, calls it PwnEscape. [10] In his own lab, two crafted network packets crashed a host and every sandbox on it. [10] A fix is in Linux and is reaching versions such as Debian, Red Hat and Ubuntu. [9]

Why it matters. Amazon says its EC2 cloud is not at risk, and Google's setup probably is not either. [9] Updating the software inside each virtual machine does not fix the host; only the host's own update does. [10]

The FBI has warned Americans about four kinds of scam ahead of November's midterm elections. [11] Scammers use candidates' names, pictures and slogans to raise money for fake campaign funds, or to sell goods that never arrive. [11] One fake 'campaign pool' promises donors a payout if the candidate wins, and the FBI says real donations never grow in value. [11] Others send texts falsely saying the reader is not registered to vote. [11] Separately, the FBI and CISA, the US cyber-defence agency, warned election officials about fake messages, audio and video built to steal their logins. [12]

Why it matters. CISA says election officials are targets because they hold voter registration data. [12] Donors to the fake funds lose their money, because none of it reaches a campaign. [11]

Semperis, a security company, surveyed 1,200 organisations hit by ransomware, software that locks a company's files until it pays. [13] 17% said attackers made physical threats to force a payment, and 23% said they faced psychological pressure. [13][14] Among those threatened, 37% said the threats were aimed at family or friends. [14] 53% of all those surveyed said attackers carried out a threat. [13] Dark Reading, a security news site, could not find one documented case of violence tied to ransomware, and the answers are not checked. [14]

Why it matters. The pressure lands on staff and their relatives, not on the company's computers. [13] FBI complaints about threats of violence in online crime rose to 4,826 in 2025, from 1,360 the year before, Dark Reading reports. [14]

National Trading Standards, which tackles big consumer scams in England and Wales, has drawn up its first watchlist of scams that use AI. [15] It lists polished fake shop websites, cloned voices of relatives asking for money, and romance scams where AI remembers a victim's details. [15] Officers describe fake shops posing as small British family firms, with pictures of a High Street hung with Union Jack flags. [15] The same week, the Assembly House, a hotel in Norwich, warned that fake emails were selling stalls at its Christmas fairs. [16]

Why it matters. Which?, a consumer group, says spelling mistakes can no longer be relied on to spot a scam. [15] The Norwich emails were aimed at small traders and artists who book stalls. [16]

Linda Geddes, a science journalist, says someone pitched stories to Nature and Science using her name and an email address that was not hers. [17] An article under her name appeared in the New York Post with quotes lifted from older pieces. [17] The paper removed it and referred the matter to the authorities. [17] Another impersonator got Science to publish an article under the name of Caroline Williams, a former colleague, and was paid about $1,000. [17] Geddes says many of the pitches bear signs of AI writing. [17]

Why it matters. The fake costs the real writer her standing with editors, even when a pitch is turned down. [17] Cifas, a UK fraud-prevention service, called the case unusual, because fraud is normally done at scale. [17]

Google is rolling out new protections against scam texts and calls on Android phones. [18] Google Messages can now send chats with unknown senders to Gemini, Google's AI, to look for signs of fraud, but the feature starts switched off. [18] Android now stops apps from quietly turning on call forwarding, which can send a victim's calls to a thief. [18] Google says its check on calls claiming to come from banks has blocked more than 3 million fake calls for Banco do Brasil and Itau Unibanco since June. [18]

Why it matters. Google says its scam detection already flags more than 5 million suspected scam calls and texts a month. [18] The new cloud checks only help people who turn them on. [18]

US cybersecurity job adverts fell to 235,786 between January and September, down 26.4% from 320,210 a year earlier. [19] It is the lowest count in four years. [19] The figures come from CyberSN, which sorts adverts by the work asked for, not the job title. [19] Adverts for AI security engineers rose 268.3%. [19] Adverts for penetration testers, people paid to break in and find holes, fell 45.9% to 3,063. [19]

Why it matters. Fewer openings are reaching people looking for general security jobs, while AI skills are in demand. [19] The report counts adverts and does not say why they fell. [19]