The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 1 to 24 of 76 briefings

Today

A dark desk at night. An open laptop shows a database table drawn as rows of blank pills with one pill glowing cyan. In front of it lie a loose fan of blank white member cards and a large brass key with a blank paper tag. The left half is dark, with the headline and a stat drawn over it: 417 days.

Breaches and Incidents27 Oct 2026

Denver Health Medical Plan says a vendor's public key could have opened records of 238,083 members for 417 days

What Denver Health Medical Plan's notice and the HHS breach portal entry establish about a vendor key published for 417 days, the fields listed, what the plan does not say about logs or a finder, and two ranked checklists.

A dark stockroom workbench. A black foam tray holds rows of identical small handheld devices with blank dark screens, with gaps in the front row. A grey steel scrap bin beside it holds devices, some snapped open to show green circuit boards. A brass key on a blank white tag lies on the bench. The left half is empty dark space carrying the headline and the figure 18,835.

Breaches and Incidents27 Oct 2026

Keystone says a website breach exposed its device authentication key, and it will destroy 18,835 unsold wallets

What Keystone's statement, as reported, establishes about the stolen verification key, the 18,835 unsold wallets, the owners of devices delivered after 20 October, the customer data that should have been deleted, and what its own pages still say.

A dark desk in cool blue and warm side light. An open unmarked graphite laptop shows a table made only of empty rounded pills with one row highlighted in red. In front lies a plain white identity card with a blank portrait square and two empty pills, and a small grey door card reader with a red indicator stands beside it. The left half is empty dark navy with the headline and 525,000 drawn over it.

Breaches and Incidents27 Oct 2026

University of Copenhagen says hackers reached a test system with 525,000 people's data, CPR numbers included

What the university's three dated entries state and leave out, the arithmetic behind 525,000 and 68 to 92 hours, what Datatilsynet says the 72 hour clock is, a stated and not stated table, and a ranked checklist for affected people and for organisations with identity data in test systems.

A dark desk lit by a cool screen. An open unmarked laptop shows a message window made only of empty rounded shapes, one outlined in red, with a blue button shape. In front of it sit a clear sealed evidence pouch holding a plain grey storage drive and a cream envelope with a red band. The left half is empty dark blue carrying the headline and a stat: Seoul police, AI used to hack 90 firms, 15 of 90 in the referral.

Breaches and Incidents27 Oct 2026

Seoul police allege a former pentester used AI on 90 firms; the referral covers 15 firms and 11% of 8.2 million records

The Seoul police release read on 27 October 2026: 90 companies, 8.2 million records and 38 extortion demands alleged, 15 firms and about 900,000 records referred, and no product named for the AI tool. What it does not say, and a ranked checklist for buyers of penetration tests.

Yesterday

A dark workstation bench in cool blue light. An open, unmarked black laptop shows a navy control panel window with six blank folder tiles and a list of five blank pills, the top two filled amber. A plain steel padlock and a brass key lie on the slate beside it, with a blurred server rack behind. The left of the picture is empty dark navy carrying the headline and a stat: 55 HOURS.

Breaches and Incidents26 Oct 2026

DreamHost says it reset email and FTP/SFTP passwords as a precaution; nine status updates in 55 hours name no cause

What DreamHost's own status page states and leaves out about its forced email and FTP/SFTP password resets, the clock from 23 to 25 October, the lockout that falls on account owners, and a ranked checklist for customers and agencies.

Sunday 25 October

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Breaches and Incidents25 Oct 2026

More than 1.5 million Canadian Crime Stoppers tips were in a March vendor hack, CBC finds, and four Ontario programs stop taking tips

CBC's count of Canadian tips in the March 2026 hack of the P3 tip platform, what Toronto Crime Stoppers says it was told and when, and which programs have paused.

Breaches and Incidents25 Oct 2026

Railway says up to 100,000 workspaces may have exposed secrets, but the figure is a ceiling

Railway’s preliminary account describes CI credentials, artifacts and a subset of decrypted environment variables. The 100,000-workspace figure is an upper bound, while the entry route, exact keys and source-code question remain unresolved.

Friday 23 October

Sterile data corridors and server racks with glowing blue and crimson biometric data telemetry streams inside a medical facility.

Breaches and Incidents23 Oct 2026

Quest Diagnostics isolates Quanum clinical platform following unauthorized patient record access

Technical analysis of Quest Diagnostics SEC Form 8-K: unauthorized intrusion into Quanum LSM clinical portal exposes patient records across healthcare network.

Breaches and Incidents23 Oct 2026

Capcom ID breach leaks 11.7 million customer records with 196 passwords altered by attackers

Technical breakdown of the Capcom ID data breach: 11,774,247 customer records exposed, 196 unauthorized password changes, and sign-in IP telemetry weaponization.

Wednesday 21 October

Editorial illustration of an unbranded WordPress-style plugin dashboard on a laptop, with a blank checklist and security key on the desk. Headline says UpdraftCentral keys reached customer sites; affected-site count unknown.

Breaches and Incidents21 Oct 2026

UpdraftCentral: revoked keys do not remove backdoors already planted on sites

A validly signed remote command crossed the trust boundary into connected WordPress sites. Key revocation and removal of earlier site changes are separate tasks.

Tuesday 20 October

A dim data hall at night: a row of tall black server rack cabinets with perforated mesh doors, receding to the right. One cabinet in the middle is dark, its indicator lights off, between cabinets lit with rows of small cyan and green lights. A small amber lamp glows on the end wall. The left half is darkened, with the headline and the stat 38 PRODUCTS drawn over it.

Breaches and Incidents20 Oct 2026

Google says a power event hit one London zone: 38 products listed, UK banks and courts report faults

What Google's status entries say, minute by minute, what its documentation and SLAs promise when one zone fails, who said what in the UK, and what the PRA, FCA, ICO and Treasury regimes require. A developing incident, time stamped.

Editorial illustration for the briefing: Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

Breaches and Incidents20 Oct 2026

Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

What Bullhorn's status page, FAQ and known limitations page state and do not state about its cyber incident, the credential changes, and what UK controllers and processors must do under the ICO and NCSC texts. Time stamped 20 October 2026.

Page 2

Monday 19 October

A dark data-centre rack in cool blue light. A plain brushed-metal panel on the rack carries two blank, empty recessed plates and a small steel hook, from which a ring of six or seven plain metal keys in brass and steel hangs. The left half of the frame is empty dark blue, with the headline and a stat drawn over it: 1.4% of Console users, count not stated, as of 19 October.

Breaches and Incidents19 Oct 2026

As of 19 Oct, OpenCode says provider keys of 1.4% of Console users may be exposed; no count is stated

What OpenCode's X post, docs and status page state about the Console breach as of 19 October, what they leave out, the afternoon's timestamps with derived intervals, what the providers' pages say to do, the UK position, and a ranked checklist.

Sunday 18 October

A dim hospital ward office at dusk. A single desktop monitor on a pale grey desk glows blue-white, its screen showing only blank rounded shapes where a patient record would be, with a plain keyboard and mouse in front, an empty office chair behind and a window with a deep blue sky to the left. No people appear. The left half is dark, with the headline drawn over it: 15 dismissed over access to victims' records, and the words still in testing.

Breaches and Incidents18 Oct 2026

NUH has dismissed 15 staff over Nottingham victims' records; its monitoring system is still in testing

What the Trust's 16 October statement establishes (34 hearing outcomes, 15 dismissals) and omits, how its own evidence says the access was found, what the ICO, NMC, GMC and NHS England pages say, and a ranked checklist for holders of health records.

A dark IT desk lit by a flat monitor. The screen shows a long client list made only of blank rounded bars, one row highlighted in pale cyan. Beside it an open cardboard archive box of plain unmarked folders and a coiled stethoscope rest on the desk. The left half is empty dark blue, with the headline and a stat drawn over it: 4 days.

Breaches and Incidents18 Oct 2026

XTIUM warned BCHP 4 days before BCHP saw activity; NY says XTIUM cannot definitively confirm its entry route

What New York's agreement with BCHP and XTIUM states and leaves out: 4 days from warning to detection, 18 client systems reached and one breached, $2.7 million announced against $4 million on paper, 825,000 or 820,000 New Yorkers, and what UK suppliers should check.

Saturday 17 October

A dark school classroom desk lit by a flat monitor. The screen shows a generic file list made only of blank rounded bars, one selected in pale cyan. A stack of unmarked cream test booklets and a soft out-of-focus answer sheet with a pencil lie in front. The left half is empty dark blue, with the headline and a stat drawn over it: 126 days.

Breaches and Incidents17 Oct 2026

ETS says a login copied California student files from 22 May; found 126 days later, no student count stated

What the ETS notice filed with the California Attorney General states and leaves out: 119 days between its two dates, 126 to discovery, who says 7 million, what CDE's own pages could not be read for, other regulators' lists, and what UK suppliers should check. Defender level.

A dark steel corridor in low blue light. A long wall of identical closed steel mailbox doors, each with a plain lock and a blank recessed label well, recedes along the right. A single brass key on a plain steel ring lies on the ledge in front. The left half is empty dark blue, with the headline and a stat drawn over it: 3 counts, Huntress's 162, over 300 and almost 1,000 tenants.

Breaches and Incidents17 Oct 2026

ConnectWise Cloud Backup's app credential, not a person's: Huntress gives 162, over 300 and almost 1,000 tenants

What Huntress, Todyl and ConnectWise state about a stolen Cloud Backup application credential: 162, over 300 or almost 1,000 tenants, a 141-minute window, 35 h 34 min to the first advisory, and no confirmed data access. Where UK guidance and the Bill stop. Defender level.

A dark clerk's counter in low blue light. A tidy stack of plain cream envelopes, all blank, lies on a walnut counter beside an empty black wire tray. Behind them a flat computer monitor stands switched off, its screen dead black, and a blank brass plate sits on the counter edge. The left half is empty dark blue, with the headline and a date drawn over it: US bankruptcy notices halted since 9 October.

Breaches and Incidents17 Oct 2026

US bankruptcy notices halted since 9 October: BAE says 'isolated'; cause, data and end date are not stated

What the Judiciary, nine courts, the bankruptcy rules, BAE's newsrooms and the UK texts establish about the BNC outage, what they leave out, the arithmetic against 14, 21 and 28 day windows, what UK buyers of outsourced systems can rely on, and three ranked checklists.

A dark pathology laboratory bench in cool light. A pale grey rack of identical sealed sample tubes with blank white labels stands in front of a compact grey and white benchtop analyser whose black glass panel is switched off. The left half is empty dark blue, with the headline and a stat drawn over it: 865 days.

Breaches and Incidents17 Oct 2026

Alleged Qilin member held over a 2024 logistics attack; Synnovis 'included' on one BBC report, no charge reported

What German, Japanese and UK authorities have stated about the Qilin arrest and the Synnovis attack, what no record states, whose numbers the 4,000 and 140 million are, how the death link was established, which UK laws could apply and where each stops, and a checklist for suppliers and CISOs.

Friday 16 October

Editorial illustration of halted envelopes on a notice conveyor in front of a generic courthouse, representing the Bankruptcy Noticing Center outage

Breaches and Incidents16 Oct 2026

BAE Systems cyber incident stops US bankruptcy notices; courts diverge on deadlines

A source-led timeline, the operational split between filing and service, district-by-district orders, and the facts still missing about the BAE Systems incident.

Thursday 15 October

A dark records archive. One long bank of pale grey steel shelving runs away on the right, filled with identical grey ring binders whose spines carry empty label slots, with a blank grey microfilm viewer in the foreground. At the far end of the aisle one desktop terminal glows with an empty pale screen. The left half is empty dark blue, with the headline and a stat drawn over it: legal aid breach data now goes back to 1978, 2010 to 1978.

Breaches and Incidents15 Oct 2026

Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

What the Legal Aid Agency's 14 October 2026 update states about records back to 1978, what it leaves out, the arithmetic behind the moving start date, why old records were online, what UK law and policy say, and a ranked checklist. Defender level only.

Wednesday 14 October

A dark glass-walled meeting room at night. A wall-mounted television is swung out on a black arm so that its plain back panel and an empty recessed socket bay are visible, and a handheld detector wand lies on the table at the lower right. The left half is empty dark blue with the headline drawn over it: An alleged recorder in an OpenAI meeting room, and the figure 9 days.

Breaches and Incidents14 Oct 2026

Alleged OpenAI room recorder: 9 days from discovery to arrest, and no motive, recipient or captured audio stated

What the complaint, the Justice Department and OpenAI each say about the alleged recorder in an OpenAI meeting room, where the press accounts differ, what the record does not establish, what UK guidance covers, and an ordered checklist for AI and R&D labs.

A dark meeting room in blue black light. A long bare dark table runs towards the upper right with one empty office chair at each end, a closed grey laptop in the middle and a plain cream envelope in front, with no writing anywhere and no people. The left half is empty dark blue, with the headline and a stat drawn over it: five docket lines, none describing an act.

Breaches and Incidents14 Oct 2026

Ransomware-response executive reportedly arrested in ShinyHunters case: five docket lines, none describing an act

What the court record, the FBI Director's post and the RCMP statement establish about a reported arrest, the 23 days since the Dutch arrest, what is not stated, what the NCSC, ICO, OFSI and Home Office pages say about choosing a response supplier, and an ordered checklist.

A shut service counter in a dim housing office. A silver roller shutter is pulled fully down behind a pale grey counter. On the counter lie a stack of buff cardboard case files with blank label panels and a cream rotary desk telephone. The left half is empty dark blue, with the headline and a stat drawn over it: 8,783.

Breaches and Incidents14 Oct 2026

Housing Ombudsman case-system incident: 8,783 determinations in 2025-26, and no count, supplier or date stated

What the Ombudsman's statement and its own published figures establish about a third-party incident in its case management system, what they leave out, the 72 hour clock, UK GDPR, NCSC and sponsor guidance, and ordered checklists for residents, landlords and small public bodies.

Show 12 more