The Briefing

What happened, why it matters, and what to do about it. Analysis, not rewritten press releases.

Showing 37 to 48 of 71 briefings

Thursday 1 October

Breaches and Incidents1 Oct 2026

The Pentagon's breach letter is dated 64 days after the flaw was found, and says accessed, not stolen

The Pentagon's personnel data centre dated its breach letter 64 days after discovering the flaw, after at least 258 days of access. What the notice states, what it leaves out, and the checks a UK team can run.

Wednesday 30 September

Breaches and Incidents30 Sept 2026

SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Two forensic documents published on 30 September add a longer chain, two products, a web shell and a custom withdrawal tool. SlowMist's logs start on 31 August, Mandiant dates the appliance access to 24 September, and neither names a product, vendor or CVE.

Breaches and Incidents30 Sept 2026

Microsoft's Titan skipped the token signature check: 17.3 trillion rows counted, two sampled

Faav's write-up counts 17,333,335,124,315 rows from metadata and describes two one-row samples. The endpoint was locked down 4 days after the report, the bounty was $5,000, and Microsoft edited the only account.

Breaches and Incidents30 Sept 2026

France's tax authority learned of the theft 49 days after it began, from the thief's own claim

The French tax administration took 49 days to learn of a theft made with stolen staff passwords, and only from the attacker's own post. What the ANSSI report establishes, what it leaves out, and the checks a UK team can run.

Tuesday 29 September

Breaches and Incidents29 Sept 2026

DIVD says an AI agent hacked it. Its evidence is tempo and code comments, and the flaw is still unnamed

The record as of 29 September: an intruder that decided each step at machine speed, explained itself in code comments and fought its own tools. The flaw, the attacker, the model and the data outcome are all unstated.

Breaches and Incidents29 Sept 2026

Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

A redirect changes where a name points, and the public record shows the registration layer stayed still. What is missing is the layer that moved, the real length of the window, and anything beyond Elsevier's own "no indication".

Breaches and Incidents29 Sept 2026

Bitget says it found the root cause on 25 September. It described it three days later and names no product

Bitget's account moved from a compromised backend system to a flaw in an unnamed third-party security product. The two are layers of one chain, not rivals, but the wording around them keeps shifting and the report that would test it is late.

Breaches and Incidents29 Sept 2026

ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

The record moved in a day: a 40 word police post became a full statement with two suspicions, a custody ruling and a statement that the man was not arrested over Odido. The FBI claim is still a claim, and nothing official links the two.

Breaches and Incidents29 Sept 2026

Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Keio's first notice named no company. The group's own pages describe failures in payments, loyalty points, bookings, commuter-pass sales and inbound mail, while trains are reported unaffected and nobody has given a restoration date.

Breaches and Incidents29 Sept 2026

Kiteworks says it fixed a critical flaw. It has published no CVE, score or version

A 55-word notice and a press release close the Kiteworks shutdown. Neither carries a CVE, a score or a fixed version, and the vendor's own advisory register has nothing newer than 27 May 2026.

Breaches and Incidents29 Sept 2026

Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Times Car's parent says about 6.6 million accounts were breached, against a membership of more than 4 million announced in August. The notices name the data and the dates, and leave cause, attacker and headcount open.

Breaches and Incidents29 Sept 2026

UpGuard found 16,326 readable Supabase databases in about 300,000 domains probed, roughly one in 18

UpGuard probed about 300,000 Supabase-using domains and found 16,326 with readable tables, about 5.4 per cent. Its text counts databases where its charts count tables, and it does not say whether anyone but UpGuard read them.