The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 25 to 71 of 71 briefings

Tuesday 6 October

A smartphone lying on a dark desk showing a shopping app of blank product tiles, with one wide notification banner of empty rounded shapes dropped across the top, outlined in thin amber. Nothing carries any lettering.

Breaches and Incidents6 Oct 2026

ASOS confirms the 10am notification was unauthorised, cites third-party platforms and does not name Snowflake

The channel is confirmed and the Snowflake claim is not addressed. What the RNS says and leaves out, what UK GDPR and UK MAR say, and what to do about every platform that can message your customers.

A school office desk in low light with an open laptop showing a list of blank sign-in rows, a stack of plain buff folders, and a pegboard of coloured pegs and blank cards on the wall behind. There is no lettering and nobody in the room.

Breaches and Incidents6 Oct 2026

Bromcom found a legacy sign-on breach on 6 September; its first dated public post came 18 days later

A superseded sign-on service stayed in production because an internal system still called it. Bromcom found the breach on 6 September, posted on 24 September, and by 30 September called the central question ongoing.

Monday 5 October

A matte black laptop on a dark desk, its screen showing a social feed made only of blank rounded cards and empty pills, with a thin hollow amber padlock outline beside the feed, to suggest a lock that is drawn but not engaged.

Breaches and Incidents5 Oct 2026

Microsoft's X account: two unauthorised posts, 47 minutes apart by our arithmetic, and no word on the cause

Microsoft's 13-million-follower X account carried a disclaimer that told readers to trust only official channels, and Microsoft says it did not write it. The minutes, what is not stated, five routes in, and a UK checklist.

A quiet newsroom desk at night: an open laptop showing a contact list made only of blank rounded pills, and a plain closed notebook with one amber ribbon beside it. No people, no writing on the screen or the notebook.

Breaches and Incidents5 Oct 2026

About 9,000 spoofed Nikkei emails reached news sources among others; who was exposed is not yet counted

What Nikkei's notices say in Japanese and English, what they leave out, how Japanese and UK law treat the security of data held for journalism, and an ordered checklist for any organisation that holds the names of sources or whistleblowers.

Breaches and Incidents5 Oct 2026

Frontline's breach letters were first reported 48 days after it found the flaw, and name no software

A supplier to US school districts found a flaw on 14 August and was first reported notifying districts on 1 October, 48 days later. Staff Social Security numbers were taken; the product, the counts and the actor are not stated.

A dark government records room: an open laptop on a wooden desk shows a table of blank rounded rows beside a black server rack with a few indicator lights, and a shelf of identical blank grey ring binders sits behind. The headline reads Denmark's population register: 8.8 million of 11 million entries reached through one company, with the figure about 80 per cent.

Breaches and Incidents5 Oct 2026

Denmark says one company's lawful access reached 8.8 million of the 11 million entries in its CPR register

About 80 per cent of the register, more than the population, reached through one company's lawful access. What the ministry and Datatilsynet state, what CPR's own terms say about controls, and the checks a UK team can run.

A dark bank back-office after hours: a laptop open on an incident board of blank rounded tiles, a row of them hollow amber outlines, in front of a closed server rack, with an empty banking hall visible through a glass wall.

Breaches and Incidents5 Oct 2026

Korea's bank breaches: AI use is unconfirmed on the record, and the faults described are old ones

Shinhan, KB Kookmin and Hana name about 25,000, 99 and 89 customers. The AI-tool claim rests on a vendor researcher's page-title reading and an anonymous official; on the record it is 'cannot be ruled out'. What is stated, what is not, and a UK checklist.

Saturday 3 October

A dim university office at dusk: a laptop on a wooden desk shows a directory list made only of blank rounded rows, beside a blank staff badge on a lanyard, with a brick campus building lit in the window behind. The headline reads DTU deletes former users' addresses after six months, but not their CPR numbers, with the figure 160,000.

Breaches and Incidents3 Oct 2026

DTU deletes former users' addresses after six months, not their CPR numbers, and holds about 160,000 of them

Four in five of DTU's up to 200,000 are former users, and the six-month deletion covers addresses, pictures and next of kin, not the CPR number. What the notice states, what it leaves out, and the checks a UK team can run.

Thursday 1 October

Breaches and Incidents1 Oct 2026

KillSec takedown: five servers and 110 TB seized, but no release says how victims will be told

Three provisional arrests, five servers, five domains and 110 TB, in a case led from Hamburg with one arrest in the UK. The counts do not match, and no release describes how victims will be told or what happens to files already published.

Breaches and Incidents1 Oct 2026

Kiteworks published 125 advisories. None says which one, if any, is the shutdown flaw

The 10.0 flaw has a CVE, a score and a fixed version. The flaw Kiteworks said it found during the shutdown has none that any record attaches to it, and no advisory in the batch says whether it is there.

Editorial illustration for the briefing: By our count, MetaMask Staking queued 7,066 Lido validators to exit hours before its notice, naming no cause

Breaches and Incidents1 Oct 2026

By our count, MetaMask Staking queued 7,066 Lido validators to exit hours before its notice, naming no cause

The beacon chain shows 226,112 ETH of Lido stake queued to exit 6 to 12 hours before MetaMask's first notice. The notice and Lido's post name no cause, no count and no key status, and no funds lost are reported.

Breaches and Incidents1 Oct 2026

DIVD was breached through two Zammad flaws. One has no fix on record, and the AI claim is no stronger

Ten days on, DIVD's breach has a root cause: two Zammad flaws, one with no fix on record. The evidence for an AI agent is still tempo and comments in scripts, and the Zammad finding does not add to it.

Page 4

Thursday 1 October

Breaches and Incidents1 Oct 2026

The Pentagon's breach letter is dated 64 days after the flaw was found, and says accessed, not stolen

The Pentagon's personnel data centre dated its breach letter 64 days after discovering the flaw, after at least 258 days of access. What the notice states, what it leaves out, and the checks a UK team can run.

Wednesday 30 September

Editorial illustration for the briefing: SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Breaches and Incidents30 Sept 2026

SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Two forensic documents published on 30 September add a longer chain, two products, a web shell and a custom withdrawal tool. SlowMist's logs start on 31 August, Mandiant dates the appliance access to 24 September, and neither names a product, vendor or CVE.

Breaches and Incidents30 Sept 2026

Microsoft's Titan skipped the token signature check: 17.3 trillion rows counted, two sampled

Faav's write-up counts 17,333,335,124,315 rows from metadata and describes two one-row samples. The endpoint was locked down 4 days after the report, the bounty was $5,000, and Microsoft edited the only account.

Breaches and Incidents30 Sept 2026

France's tax authority learned of the theft 49 days after it began, from the thief's own claim

The French tax administration took 49 days to learn of a theft made with stolen staff passwords, and only from the attacker's own post. What the ANSSI report establishes, what it leaves out, and the checks a UK team can run.

Tuesday 29 September

Breaches and Incidents29 Sept 2026

DIVD says an AI agent hacked it. Its evidence is tempo and code comments, and the flaw is still unnamed

The record as of 29 September: an intruder that decided each step at machine speed, explained itself in code comments and fought its own tools. The flaw, the attacker, the model and the data outcome are all unstated.

Editorial illustration for the briefing: Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

Breaches and Incidents29 Sept 2026

Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

A redirect changes where a name points, and the public record shows the registration layer stayed still. What is missing is the layer that moved, the real length of the window, and anything beyond Elsevier's own "no indication".

Editorial illustration for the briefing: Bitget says it found the root cause on 25 September. It described it three days later and names no product

Breaches and Incidents29 Sept 2026

Bitget says it found the root cause on 25 September. It described it three days later and names no product

Bitget's account moved from a compromised backend system to a flaw in an unnamed third-party security product. The two are layers of one chain, not rivals, but the wording around them keeps shifting and the report that would test it is late.

Editorial illustration for the briefing: ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

Breaches and Incidents29 Sept 2026

ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

The record moved in a day: a 40 word police post became a full statement with two suspicions, a custody ruling and a statement that the man was not arrested over Odido. The FBI claim is still a claim, and nothing official links the two.

Editorial illustration for the briefing: Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Breaches and Incidents29 Sept 2026

Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Keio's first notice named no company. The group's own pages describe failures in payments, loyalty points, bookings, commuter-pass sales and inbound mail, while trains are reported unaffected and nobody has given a restoration date.

Breaches and Incidents29 Sept 2026

Kiteworks says it fixed a critical flaw. It has published no CVE, score or version

A 55-word notice and a press release close the Kiteworks shutdown. Neither carries a CVE, a score or a fixed version, and the vendor's own advisory register has nothing newer than 27 May 2026.

Editorial illustration for the briefing: Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Breaches and Incidents29 Sept 2026

Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Times Car's parent says about 6.6 million accounts were breached, against a membership of more than 4 million announced in August. The notices name the data and the dates, and leave cause, attacker and headcount open.

Breaches and Incidents29 Sept 2026

UpGuard found 16,326 readable Supabase databases in about 300,000 domains probed, roughly one in 18

UpGuard probed about 300,000 Supabase-using domains and found 16,326 with readable tables, about 5.4 per cent. Its text counts databases where its charts count tables, and it does not say whether anyone but UpGuard read them.

Page 5

Saturday 26 September

Editorial illustration for the briefing: Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Breaches and Incidents26 Sept 2026

Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Migrating away from a processor removes the future risk and leaves the historic risk exactly where it was. Storage limitation is a legal duty, and it is also the only thing that would have helped here.

Breaches and Incidents26 Sept 2026

Every container had its own microVM. The isolation that failed was one option on the disk pool

Firecracker per container is the strongest isolation on the market and it was not the boundary that mattered. A flag set for performance let a 4 KiB write expose the other 60 KiB of somebody else's block.

Breaches and Incidents26 Sept 2026

Kiteworks told customers to shut down for six hours. Its own press release says nine, twice

The public release says nine hours and federal intelligence authorities. The customer email, as quoted, says six hours and law enforcement. Both cannot be the number a defender acts on.

Friday 25 September

Breaches and Incidents25 Sept 2026

OnePlus confirmed the root chain, warned of legal liability, and shipped nothing in 159 days

The researcher agreed to hold publication until 17 September. He asked for an update twice and got no reply. He published on the 24th, with no CVE and no patch in existence.

Breaches and Incidents25 Sept 2026

Google's tracker says P1. Its panel says working as intended. The flaw makes a namespace user an org owner

A Google engineer wrote Nice catch and filed it. Eleven days later a panel called it working as intended. The case is still open at P1 and S1, and the researcher's page says it is still unpatched.

Editorial illustration for the briefing: Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Breaches and Incidents25 Sept 2026

Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Cloudflare has fixed a cross tenant exposure in Containers and Sandboxes. The flag took six hours to change. Clearing the blocks already mapped took fifteen days.

Wednesday 23 September

Breaches and Incidents23 Sept 2026

Gyazo's breach leaked the OCR text inside 490 million screenshots, and the IDs that open them

The Gyazo breach is being read as an account leak. Gyazo indexes the text inside every capture, so the 490 million metadata records are a transcript of what was on people's screens, and the leaked image IDs are the only lock those images had.

Tuesday 22 September

Breaches and Incidents22 Sept 2026

EvilTokens takedown: 226 domains in the court order, two arrests, and a phish MFA cannot stop

The court order lists 226 domains. Microsoft's own sworn declaration says device code theft cannot be stopped by multifactor authentication. What breaks the chain is a Conditional Access setting many tenants have never switched on.

Editorial illustration for the briefing: A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

Breaches and Incidents22 Sept 2026

A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

The Ribon breach on BigCommerce: what each party has said, why app tokens cannot be revoked by merchants, the hours lost at each step, and why the app is not BigCommerce's sub-processor under UK GDPR.

Monday 21 September

Editorial illustration for the briefing: AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

Breaches and Incidents21 Sept 2026

AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

AWS's AWSCompromisedKeyQuarantineV3 went on 10 seconds after a test leak. It is a deny list, not a lockdown: what it blocks, what it leaves open, and what you still have to do.

Editorial illustration for the briefing: September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

Breaches and Incidents21 Sept 2026

September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

File History can stop backing up after September's Windows updates, mostly without a true error. Entra ID retires Microsoft-provided SMS and voice on 1 February 2027. What Microsoft requires, what it only recommends, and what to do.

Sunday 20 September

A wall of screenshot thumbnails and metadata fragments interrupted by a broken digital lock.

Breaches and Incidents20 Sept 2026

Gyazo exposed about 492.4 million image records. Its notice cannot rule out private-image viewing

Gyazo confirmed exceptional metadata exposure and a list of private image files. The disclosed fields can reconstruct the context around screenshots and drive secondary compromise.

Page 6

Friday 18 September

Breaches and Incidents18 Sept 2026

Brevo's attacker hostname sat in a public certificate log for 19 days before the ClickFix injection

A stolen Cloudflare key let an attacker rewrite Brevo's embedded scripts at the CDN edge, so origin files and their timestamps never changed. The earliest public evidence was a certificate logged 19 days before the injection.

Thursday 17 September

A closed laptop with a steel padlock resting on it, beside keys, a circuit board, a network device and a monitor on a desk at night.

Breaches and Incidents17 Sept 2026

KB5124008 revives a dormant Credential Guard setting and breaks domain trust below Server 2025

KB5124008 makes Windows honour Machine Identity Isolation settings dormant since April 2025, breaking domain trust below Server 2025 level. What Microsoft says, what it does not, and the safe order of work.

Sunday 13 September

AI-generated identity-security scene of one access badge opening several tenant mail compartments beside a mail conveyor.

Breaches and Incidents13 Sept 2026

Brevo’s SAML flaw crossed 138 customer accounts. Six sent phishing through legitimate infrastructure.

A Brevo SAML scoping failure let one organisation’s identity assertion cross into other customer accounts.

Wednesday 9 September

AI-generated conceptual airport illustration: waiting aircraft beneath a network of teal and amber routes; not a photograph of the incident.

Breaches and Incidents9 Sept 2026

NATS fixed the flight-processing system. The airport disruption kept moving.

The system was restored on 8 September. The aviation network still had a backlog to clear. A sourced timeline and worked recovery example explain the gap.

Tuesday 1 September

An antique brass wax seal stamp on its side beside a set pool of deep red sealing wax, both blank, on a dark surface lit by a cold indigo rim light.

Breaches and Incidents1 Sept 2026

Hundreds of fraudulent Pix transactions, and nothing was forged. The only sum Google names is tens of thousands.

Google reports Breeze Comet running two waves of fraudulent transactions through Brazilian payment systems. The count is a victim’s, the only money figure is in a different section, and no rail validates intent.

Monday 31 August

An airport car park barrier arm raised at night beside a weathered number plate recognition camera on its post, wet tarmac below, captioned two 72-hour clocks, only one of them started, and 8.7 million customers

Breaches and Incidents31 Aug 2026

Manchester Airports breach reaches 8.7 million customers. Two 72-hour clocks applied, and only one of them ever started

Gigabytes are not people. The verified finding is one authenticated record carrying far more than MAG disclosed, and a NIS duty that never engaged.

Sunday 30 August

A white electrical plug hanging loose in front of a dark wall socket, captioned: six critical flaws, NVD scored none of them. 0 of 8 identifiers independently analysed.

Breaches and Incidents30 Aug 2026

Six critical WordPress flaws in ten days. NVD independently scored none of them, and the claim that plugins cause most compromises has no current source

The 91% figure describes the vulnerability catalogue, not the cause of breaches. The only quantified entry-vector number anyone can cite is a 2016 survey of about 222 sites.

A brass mechanical counter drum caught mid-rotation in deep shadow, captioned: the fix went public, the chains heard last. 20 hours 5 minutes from that release to the first drain.

Breaches and Incidents30 Aug 2026

Cosmos Labs published the security fix 28 hours before it warned the chains. Six networks were drained of about $5.7 million

Cosmos Labs' own policy calls for private distribution before public disclosure on a network-wide risk. The advisory also never reached the global GitHub database, so no dependency scanner ever raised it.

A long blank unprinted paper roll coiling away into darkness, captioned: 284 million records, not 284 million people. 14.9% of revenue, in the units named.

Breaches and Incidents30 Aug 2026

ShinyHunters claims 284 million McKesson records. It is a row count, and the units McKesson named are 14.9% of the business

Every technical detail of this intrusion is single-sourced to the attackers. The one number McKesson has published points the other way.

Tuesday 21 July

Dark server corridor with one rack glowing neon red against cold blue light

Breaches and Incidents21 Jul 2026

Ransomware playbooks keep failing at the same step: recovery

Ransom demands are collapsing and backups are working. Average recovery cost still rose 11% to $1.7m, and JLR lost five weeks of production for a modelled £1.9bn. The money moved from the ransom to the restore.

Breaches and Incidents21 Jul 2026

Half of breaches now involve a third party. Every clock starts too late

A 72-hour clause is not a control, it is an accounting mechanism. The clock starts at the vendor's awareness, which is the one variable your contract cannot set.

That is every briefing in this category