All news in category “Incidents and Data Breaches”

🔒 The National Crime Agency and The Law Society have warned that UK house buyers faced average losses of £82,000 from payment diversion fraud over the past year. This form of payment diversion fraud (PDF) — a type of business email compromise — relies on hijacked or spoofed emails and lookalike domains to alter bank transfer instructions. The campaign urges solicitors and conveyancers to tighten checks and advises clients to verify bank details, use strong passwords, avoid public Wi‑Fi and transfer small initial amounts to confirm receipt.

⚠ The Computer Emergency Response Team of Ukraine (CERT‑UA) warns of targeted attacks using a new backdoor dubbed CABINETRAT distributed via malicious Excel add-ins (XLL) concealed inside ZIP archives shared over Signal. The XLL implants an EXE in Startup, places BasicExcelMath.xll in the Excel XLSTART folder and drops a PNG that hides shellcode. It employs registry persistence and robust anti-VM checks, and the C-based backdoor performs reconnaissance, remote command execution, file operations and data exfiltration over TCP.

⚠️Recent cyberattacks forced production halts at Jaguar Land Rover and Asahi, underscoring that operational disruption is now a primary objective for threat actors. JLR paused production after an August 31 compromise attributed to the Scattered Lapsus$ Hunters group, reportedly using vishing to obtain credentials, while Asahi halted orders and shipments following a systems failure. Experts emphasize that attackers exploit phishing, unpatched systems, and supply‑chain weaknesses, and urge layered defenses such as zero trust, MFA, PAM, micro‑segmentation, continuous monitoring, and air‑gapped backups to preserve business continuity.

🔍 INTERPOL announced the arrest of 260 alleged romance scammers, sextortionists, and online fraudsters across 14 African countries as part of Operation Contender 3.0. Authorities identified more than 1,400 victims and estimate total losses at almost US $2.8 million. Law enforcement seized 1,235 electronic devices, including USB drives and SIM cards, and say they dismantled the infrastructure of 81 criminal operations by taking control of websites and servers. Officials warn that while takedowns are important, public awareness and victim support remain the best defenses against these growing threats.

🔒 WestJet has confirmed that a cybersecurity incident disclosed on June 13 exposed sensitive customer information, including passports and other government IDs, according to a notification shared with U.S. authorities. The airline said an investigation completed on September 15 found impacted records varied by individual and could include full name, date of birth, mailing address, travel documents, loyalty program details, and certain card account information. WestJet emphasized that no credit or debit card numbers, expiry dates, CVV codes, or user passwords were compromised and is offering free two-year identity theft protection to affected customers. The company said the FBI is involved in the probe and that it is still working to determine the full scope of the incident.

🔍 Palo Alto Networks Unit 42 has attributed a two-and-a-half-year campaign of espionage to a previously undocumented China-aligned actor dubbed Phantom Taurus, which has targeted government and telecommunications organizations across Africa, the Middle East, and Asia. The group uses a bespoke .NET malware suite called NET-STAR to compromise Internet Information Services (IIS) web servers and maintain stealthy access. Observed techniques include exploitation of on-premises IIS and Microsoft Exchange flaws, in-memory payload execution, timestomping and AMSI/ETW bypasses, enabling persistent data collection tied to geopolitical events.

📩 Research from Sekoia.io’s TDR team reveals a wave of smishing attacks that abused APIs on Milesight Industrial Cellular Routers to send phishing SMS, primarily targeting Belgian users by impersonating government services such as CSAM and eBox. The activity was first detected on 22 July 2025 via honeypots, and investigators found messages in Dutch and French using Belgium’s +32 code. Sekoia noted over 19,000 devices are publicly accessible and at least 572 permit unauthenticated SMS access, enabling large-scale abuse. The campaigns used infrastructure linked to Podaon and domains often registered through NameSilo, with attackers testing compromised routers before launching mass waves.

⚠️ Cleafy's Threat Intelligence team discovered a previously unknown Android Remote Access Trojan named Klopatra in late August 2025, actively targeting financial institutions across Spain and Italy. The malware leverages commercial-grade protection (notably Virbox) and shifts much of its functionality into native code to evade detection and frustrate reverse engineering. Operators use Hidden VNC, dynamic overlays and abuse of Accessibility Services to harvest credentials and perform unauthorized transactions while victims remain unaware.

🔒 Broadcom issued patches for a high-severity privilege escalation vulnerability in VMware Aria Operations and VMware Tools that has been actively exploited since October 2024. European firm NVISO linked the in-the-wild abuse to the China-aligned group UNC5174 and published a proof-of-concept for CVE-2025-41244. The flaw allows an unprivileged local attacker to stage a malicious binary (commonly in /tmp/httpd), have it discovered by VMware service discovery, and escalate to root-level execution on vulnerable VMs.

🚨 A ransomware group calling itself Randiant claims to have attacked UK childcare operator Kido, publishing names, photos, addresses and family contact details for ten children from one of Kido's London nurseries and threatening to release further data unless a ransom is paid. The attackers' leak page alleges data on more than 8,000 children was exfiltrated. Kido has not yet issued a public statement; London police say an investigation is ongoing. Kido also operates sites in the United States, India and China.

🔍 A reader recounts a sophisticated phone scam in which callers posed as bank employees and provided plausible details to build trust. The scammers supplied case numbers and 'cancellation codes,' then transferred the victim to a staged supervisor named Mike Wallace to legitimize their story. Even security-aware individuals can be deceived; the anecdote illustrates how social engineering exploits procedural expectations and authority. Independently verify any unexpected bank contact via official channels before taking action.

🔎 Two 17-year-olds in the Netherlands were arrested after allegedly being recruited via Telegram by pro‑Russian hackers to map Wi‑Fi networks near government targets. Reports say the youths walked areas of The Hague close to Europol, Eurojust and several embassies while using a Wi‑Fi sniffer; the Canadian embassy was reportedly targeted. The domestic intelligence service tipped off police, who carried out raids and seized evidence. One teenager remains in custody while the other has been electronically tagged and placed under house arrest as the probe continues.

🌐 Cloudflare observed a nationwide Internet shutdown in Afghanistan on 29 September 2025 that began with a brief fixed-line interruption around 11:30 UTC and escalated to a full fiber-optic cut shortly after 12:30 UTC. HTTP requests, DNS queries (1.1.1.1) and total bytes dropped to zero at a national level, while mobile providers showed brief, partial connectivity. The outage removed the majority of announced IPv4 and IPv6 prefixes and threatens banking, customs, emergency communications, television and radio services.

🔍 Unit 42 documents a newly designated Chinese-aligned threat actor, Phantom Taurus, which uses a previously undocumented .NET malware suite called NET-STAR to target IIS web servers. The actor focuses on government and telecommunications organizations across the Middle East, Africa and Asia and has shifted from email theft to direct database exfiltration. The report outlines technical behaviors, in-memory fileless execution, and mitigation guidance for Palo Alto Networks protections.

🔒 Asahi has halted order, shipment and call center operations across its Japanese group companies after reporting a system failure caused by a cyber-attack in a September 29 press release. The company said the outage is confined to Japan, offered no estimated recovery timeline and apologized to customers and business partners. It also stated there has been no confirmed leakage of personal or customer data at this time, while security experts caution that positions on compromised data may change as investigations continue.

🛡️ThreatFabric disclosed a newly observed Android banking trojan named Datzbro that targets elderly users via Facebook groups promoting senior activities. Attackers lure victims to install purported community apps (Android APKs and placeholder iOS TestFlight links) via Messenger or WhatsApp; payloads either install Datzbro directly or use a Zombinder dropper to bypass Android 13+ protections. Datzbro abuses Android Accessibility services to perform device takeover, overlay attacks, keylogging and remote control, enabling credential theft and fraudulent transactions. The malware is tied to a Chinese-language desktop C2 and contains Chinese debug strings, suggesting origin and potential wider distribution.

💰 British authorities have seized £5.5 billion (about $7.39 billion) in cryptocurrency — approximately 61,000 Bitcoin — from the London home of Zhimin Qian (aka Yadi Zhang), who pleaded guilty to acquiring and possessing criminal property. The Metropolitan Police say the seizure, uncovered after a probe opened in 2018, is believed to be the largest such confiscation worldwide. Qian is accused of running a large-scale fraud in China from 2014–2017 that targeted more than 128,000 mostly older victims and converted proceeds into Bitcoin before fleeing to the U.K. A co-conspirator, Jian Wen, was previously jailed and ordered to repay millions.

🚨 The Metropolitan Police secured a conviction in what is believed to be the world's largest cryptocurrency seizure after Zhimin Qian (aka Yadi Zhang) pleaded guilty to acquiring and possessing criminal property under the Proceeds of Crime Act. Investigators say Qian ran a multibillion-yuan fraud in China that targeted over 128,000 victims and raised roughly 40 billion yuan before converting proceeds to Bitcoin. The Met seized 61,000 BTC, now valued at approximately £5.5 billion, following a cross-border probe and cooperation with Chinese authorities. An associate involved in laundering attempts was previously sentenced for their role.

⚠️ Asahi Group Holdings, Japan’s largest brewer, has suspended multiple domestic operations after a cyberattack disrupted ordering and shipping processes. Call center and customer service desks are currently unavailable to the public, and the company says the incident is confined to Japan-based systems. Investigations are ongoing; there is no confirmed leakage of personal or customer data, no public claim by ransomware gangs, and no recovery timeline has been announced.

🧑‍💻 Threat actors claiming to represent Medusa contacted BBC cybersecurity correspondent Joe Tidy via Signal in July, offering him a cut of any ransom in exchange for providing access to BBC systems. They initially offered 15% of the paid ransom, later adding an extra 10% and even proposing 0.5 BTC placed in escrow. When Tidy hesitated, the actors launched MFA bombing attempts; he alerted the BBC security team and was disconnected from corporate systems as a precaution.