The Federal Bureau of Investigation says [North Korea took more than $6 billion from Binance](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack). Kim Yo-jong answers that the accusation is a provocation, and asks who will keep the coins once they are frozen.
Artex, the open-source Chinese agent that orchestrates Claude, GPT and DeepSeek, was used against some 20 Japanese firms. State attribution still lacks proof.
Japanese companies suffered 239 ransomware attacks from January to October, more than double the 2021 total, according to a survey by security firm Macnica. The count by Yokohama-based Macnica includes attacks without data encryption and already exceeds the 228 cases recorded in all of 2025, a new annual record. Among 100 Japanese firms surveyed by Proofpoint, the ransomware infection rate jumped to 73% in 2025 from 38% in the 2023 survey, the largest increase among 11 comparable countries — and about 40% of organizations that paid ransoms failed to recover data or regain access after a single payment, many facing additional demands.
Several regional facilities of the French Blood Establishment (EFS) were affected on November 2 by a cybersecurity incident that hit cold storage room monitoring and control systems, according to the French Health Ministry. The situation is now under control and the safety of blood supplies was preserved thanks to monitoring and alarm systems — no health impact has been identified and no blood products have been lost, the EFS said, with collection and hospital deliveries continuing normally. Hackers accessed control units for fridges containing blood samples and programmed them to raise temperatures to 110°C, according to local media. The incident followed attacks that forced stores in eight European countries to throw away vast quantities of food after hackers tampered with their fridges on Monday.
South Korean President Lee Jae Myung is pushing for a centralized cybersecurity agency after passport details and other personal information of 168 people, including the president, his wife and senior security officials, were reported to be accessible online for nearly five months, according to the South China Morning Post (SCMP). Technology experts warn that creating a new organization alone does little to address the deeper problem of complacency, with businesses and government agencies viewing tighter cybersecurity as an unnecessary expense until a serious breach occurs.
A cybersecurity incident altered the operating parameters of cold chambers at supervision and control installations in three regional sites of the Établissement français du sang (EFS) on Monday. According to Le Canard Enchaîné, the chambers that store donor samples at -30 °C were set to 110 °C. The EFS said no health impact had been identified and that there were no blood product losses to report. Coolworld, the refrigeration company serving the EFS, said only a limited number of units were affected, through remote monitoring software that relied on a third-party component. The case came shortly after a wave of suspected attacks on supermarket refrigerators and freezers in a dozen European countries, France among them; it is not yet known whether the episodes are linked.
Ransomware attacks on Japanese companies have more than doubled in five years.
French authorities said a cyberattack on several blood banks sought to raise temperatures to extremely high levels and was thwarted before it could do any damage to blood products or samples. The French Blood Establishment (EFS) said “temperature and defrosting thresholds were raised to extremely high levels” on Monday at three of its cold-storage sites for plasma, and that no health consequences were identified and no blood products were lost. The attack hit a supplier of refrigeration equipment at three EFS sites. France's national cybersecurity agency and the Health Ministry are investigating the incident. The incident comes after supermarkets in several European countries reported that their fridges and freezers warmed up after being remotely taken over, with tons of spoiled food at a total cost of millions of dollars.
The French bank Crédit Mutuel Arkéa, based in Brittany, confirmed it had suffered a cyberattack detected by its services. Its leadership said it took “the decision to temporarily suspend certain transactions in order to secure operations and prevent any new fraudulent movement”. The newspaper Le Télégramme reported that 133 million dollars (118 million euros) disappeared, an amount the bank does not confirm, and Le Monde reported the attack with losses estimated at 118 million euros.
According to the Associated Press (AP), in a text republished by the Boston Globe, Indonesia's military deployed more than 20,000 troops and personnel to Jakarta as authorities investigate an alleged illegal wiretapping operation targeting the president. The total number of personnel involved reached 20,980, according to Vice Adm. Yayan Sofiyan. Police named Listyo Sigit Prabowo, Ahrie Sonta Nasution and Eko Hadi Santoso as suspects in the case and said they were detained Sunday. There are allegations that the president, Cabinet officials, politicians, journalists, civil society leaders and business executives were subjected to unauthorized surveillance. The suspects are also accused of ordering in late October the deletion of files containing intercepted communications.
Kim Yo-jong, the North Korean leader’s sister, denied that North Korea was behind the record $6.3 billion hack of the Binance exchange and called the accusation “absurd rhetoric.” The FBI, the Secret Service and US cyber analysts say North Korea orchestrated the attack and describe it as the largest in history. According to Reuters, in a text republished by Internazionale, the statement was carried by the state-run KCNA agency, and Kim said there was no need to sit down with “such unreliable and hostile persons,” while Elliptic counted about $2.85 billion frozen or seized from funds that moved through roughly 12,000 wallets and 40,000 transactions across 11 blockchains.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied the FBI’s accusation that North Korea was responsible for the theft of more than $6 billion in crypto assets from Binance and said she sees “no need” for dialogue with Washington. In a statement published by the official KCNA on Wednesday, the ruling-party director said the accusation showed “US hostile policy” toward North Korea. The rejection comes amid speculation about a possible summit between Donald Trump and Kim Jong Un later this month. Trump said in August that he wanted to meet the North Korean leader later this year, and Pyongyang had not responded to the offer.
Binance said hackers used fake job interviews and a compromised internal artificial intelligence tool to breach its systems and drain $6.3 billion in cryptocurrency. An engineer was instructed to download malware disguised as an “assignment” during a second interview, and the code used obfuscation techniques to evade detection. The agencies investigating the case said the hack bore the signs of having been orchestrated by North Korea, and Pyongyang denied on Tuesday that it was behind the theft. The exchange froze $2.85 billion in assets and replenished about 98% of the affected tokens with company funds.
An unprecedented leak exposed the personal information of South Korean President Lee Jae Myung, first lady Kim Hea Kyung, senior aides, bodyguards and journalists accompanying them overseas. The breach, reported by local broadcaster KBS on Monday, exposed sensitive personal information belonging to 168 people aboard the presidential aircraft over a period of about five months, including passport numbers and issue dates. The government has launched an investigation and moved to reissue passports for Lee and the first lady, and the presidential office ordered a sweeping review of security protocols for presidential overseas trips. South Korea’s Foreign Ministry is examining the possibility that the leaked document originated from its protocol office, which is responsible for the presidential aircraft’s passenger list.
A spate of cyber-attacks hit supermarket chains across at least 10 European countries on Monday, prompting European Union (EU) officials to warn of a deliberate attempt to disrupt the food supply chain. Supermarkets reported problems in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden, and the rise in freezer temperatures, reportedly as high as 50°C, forced retailers to discard food. The EU’s food and agriculture commissioner, Christophe Hansen, said the bloc was taking the incidents very seriously and warned of further disruption in the future. In Belgium, dozens of stores reported refrigeration failures and federal prosecutors opened an investigation.
Italy’s government held emergency talks with intelligence chiefs on Tuesday after cyberattacks on supermarket freezer systems in at least nine European countries, according to AFP, in a report published by RFI. Supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden reported refrigeration problems that forced some retailers to discard food after temperatures rose. In Italy, cabinet undersecretary Alfredo Mantovano called the meeting with intelligence officials and the National Cybersecurity Agency, which also issued technical advice for retailers. European Commissioner for Food and Agriculture Christophe Hansen said the bloc takes the incidents “very seriously” and described them as a deliberate attempt to disrupt the food supply chain and undermine consumers’ confidence in it. Carlos Cancinos, a spokesperson for the Coop chain in Sweden, said there had been no further attacks overnight and that the affected shops had resumed “normal functioning”. The refrigeration equipment affected was connected to “old 4G networks”, he said.
A suspected cyberattack hit grocery stores in at least nine European countries on Monday, and the European Union (EU) warned of a deliberate attempt to disrupt the bloc's food supply chain. European Agriculture and Food Commissioner Christophe Hansen said the incidents are “a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence.” The Paris prosecutor's office counted around 700 victims in October's attack on French supermarkets, and around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, along with a smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland.
The attack on Binance began in the early hours of October 29 and, in about 20 minutes, became the biggest crypto hack in history, with more than US$ 6 billion stolen, and by November 2 the company had returned 100% of the amount to customers. The company secured assets covering approximately 95 percent of the US$ 6.3 billion stolen, after net outflows of US$ 3.6 billion in the first nine hours, about 2 percent of the US$ 171 billion under management, while stablecoin issuers froze approximately US$ 3 billion of the affected funds. The preliminary investigation points to a compromised laptop belonging to an engineer, which could have allowed unauthorized withdrawal transactions. The Federal Bureau of Investigation (FBI) said two days after the attack that North Korea was responsible for the theft, attributed by security firms to the TraderTraitor group.
Grocery stores in at least nine European countries suffered refrigeration failures on Monday in a suspected cyberattack, and the EU warned of a deliberate attempt to disrupt the bloc’s food supply chain, according to AFP. Security researchers said the cause was internet-connected refrigerators made by Danish company Danfoss, which was no longer providing security updates.
The United Kingdom National Cyber Security Centre assesses it as highly likely that AI-powered malware will have been used in a ransomware attack on UK critical infrastructure by 2028. The center chief, Richard Horne, said the United Kingdom will likely face AI cyberattacks on critical infrastructure by 2028, from criminals and states — including China and Russia.
Emergency alert systems in Russia and Ukraine were hit in cyberattacks overnight, with fake warnings of possible nuclear strikes broadcast to users in both countries, according to France 24, and have since been restored, with attribution still unknown.
The sister of North Korea’s leader, Kim Yo-jong, called the Federal Bureau of Investigation’s (FBI) allegation that Pyongyang stole US$ 6 billion from the crypto platform Binance a “grave political provocation”, in a statement released by the state-run KCNA news agency. The FBI attributed the theft to a North Korea-affiliated group called TraderTraitor. Kim said the claim was “absurd rhetoric and nothing new,” citing earlier US allegations about last year’s major hack of Bybit.
Germany's federal cybersecurity office (BSI) said over the weekend that members of the Bundestag, Germany's parliament, and other unnamed public figures had received warnings from Apple that they may have been targeted by cyberattacks. Government spokesperson Stefan Kornelius said, according to the Financial Times, that Berlin was “taking the incident and the warning very seriously,” but he did not say who in the federal government had been targeted or whether Chancellor Friedrich Merz was among them. Apple does not attribute attacks to specific governments or say whether someone's phone has actually been compromised. For that reason, the BSI said anyone who receives an Apple threat notification “should therefore assume that their device may have been compromised.”
The European Union (EU) described as a deliberate attempt to disrupt the bloc’s food chain the cyberattack that hit refrigeration settings on supermarket freezers in at least eight countries, including Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands. Israel’s National Cyber Directorate warned retail chains, food companies and logistics centers because of the wave of attacks, and a retailer reported freezers reaching 50 degrees Celsius.
Ukraine and Russia said their emergency alert apps had been hacked overnight, sending citizens false warnings about impending air raids and chemical and nuclear attacks. In Ukraine, one of the alarms said Russia had launched a hypersonic Oreshnik missile — one capable of carrying a nuclear warhead — and that a nuclear alert had been declared.
Supermarket chains in Sweden, Belgium and Luxembourg said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, raising fears of a cyber-attack similar to one that caused millions of euros in food losses in France. In Sweden, the Coop chain told the daily Aftonbladet that six of its stores had been affected, and ICA said a “limited number” of stores had their refrigeration and freezer systems impacted.
Dozens of supermarkets in Belgium and Sweden have been hit by a suspected cyber-attack affecting refrigerators and freezers, according to the BBC. In Belgium, around 40 Delhaize stores and 15 Carrefour stores were affected; in Sweden, ICA and Coop shops, and thirteen SuperValu shops in Ireland. Thousands of euros worth of food had to be thrown away, according to local media reports, and one ICA store in Sweden said its freezers' temperatures had been set to 50 C (122F).
Authorities in Ukraine and Russia said their emergency alert mobile apps were targeted by cyberattacks late Sunday, with users in Ukraine receiving false warnings of dangerously high radiation levels in the capital, Kyiv. Hours later, Russia said its own alert system had also been hacked.
Binance customers withdrew $3.64bn as the exchange reopened on Sunday following the record hack, which hit $6.3bn in digital assets and led to the suspension of all transactions — an attack the Federal Bureau of Investigation (FBI) blames on North Korea, according to the BBC.
Russia and Ukraine have both reported cyberattacks targeting their emergency alert apps, with hackers sending fake warnings of nuclear, chemical and radiation threats to mobile phone users. In Russia, the emergency ministry's app was hit by a massive cyberattack that resulted in the spread of false information to the public, according to Reuters, which cited the state news agency TASS. The fake alert sent to Russia's app warned that nuclear warheads mounted on P1-Suns, a Ukrainian attack drone, had been launched against all regions of Russia.
After the truce ended, Russia and Ukraine reported cyberattacks against their warning apps — with false information about drone strikes published on the Russian side and false radiation alerts on the Ukrainian side, according to TRT World. Russia reported its case on Monday, hours after the Ukrainian report, according to The Hindu.
Japanese group GMO Internet suspects that a North Korea-linked hacking group was behind a data leak. The company suspects that the attack targeting users of its foreign exchange service was the work of a North Korea-linked group and reported the case to authorities.
Residents of Kyiv received chemical and nuclear risk alerts on their phones this Sunday (the 1st). The Kyiv Military Administration said the notifications were issued after a probable hack of the system and denied any radiological threat, urging residents to stay calm.
GMO Internet Group CEO Masatoshi Kumagai and other executives will hold a news conference in Tokyo on Monday to address a series of unauthorized access incidents, the company said Saturday, according to The Japan Times. The company will explain the circumstances surrounding a cyberattack on its Onamae.com Desktop Cloud service, which provides servers for automated foreign exchange margin trading.
Binance resumed withdrawals of bitcoin and other cryptocurrencies on Sunday after the record theft of around $6.3 billion in token assets from its hot wallets, and said 90% of the stolen user assets are covered, according to CNBC. The remaining 10% of tokens are less liquid, meaning they may take longer to buy back, the company said in a post on X on Saturday. Binance said it will absorb the financial impact of the stolen funds and that users will not bear the losses.
The Federal Bureau of Investigation (FBI) blamed North Korea for the theft of more than $6 billion in virtual assets from the Binance exchange on or about October 29, according to a statement from the bureau itself. The FBI said the attack was tied to “malicious cyber activity” by an entity known as TraderTraitor, the same actor behind last year’s $1.5 billion Bybit hack, according to The Associated Press (AP). Binance said on Saturday that it had replaced 90 percent of the stolen amount using company money to buy new tokens, according to Al Jazeera.
The FBI attributed to North Korea the theft of more than $6 billion in virtual assets from the Binance exchange on or about October 29 and identified the operation as TraderTraitor, saying it had observed the hackers converting the stolen assets primarily into Ethereum, according to the South Korean news agency Yonhap, which published the statement. Binance, the world’s largest cryptocurrency exchange, told the BBC it had covered 90% of the $6.3bn stolen in Thursday’s hack. The remaining 10% are less liquid tokens that may take longer to source in the required amounts, the company added.
Hackers attributed to North Korea stole at least 6.3 billion dollars in crypto from Binance’s wallets, and about half of that amount was frozen as the stolen assets moved across various blockchains, according to security researchers cited by TechCrunch. Thursday’s attack on Binance was most likely the work of the North Korean group TraderTraitor, which took digital assets from the exchange across 10 blockchain networks, most of the funds in about 20 minutes, according to TRM Labs, in information published by the Korea Herald. Binance, the world’s largest crypto exchange, suspended all deposits and withdrawals while its investigation into the breach continues.
US President Donald Trump said the United States is investigating whether the attack on Binance was carried out by North Korean hackers, according to G1. Reuters reported that analysts pinned the theft of US$6.3 billion from Binance, the world’s biggest cryptocurrency exchange, on North Korea, in a record theft.
Binance said it has frozen around half of the US$ 6.3 billion stolen in a hack it described as “complex,” the BBC reported. The case is believed to be the biggest heist of its kind on record, eclipsing the US$ 1.5 billion attack on the Bybit exchange in 2025. The broadcaster also reported that several analytics firms have linked the attack to a North Korean hacking unit.
Hackers stole US$6.3 billion from Binance, the world's biggest cryptocurrency exchange, in the largest crypto theft in history, according to Reuters. The exchange said that deposits and withdrawals are suspended and about US$3 billion in funds have been frozen after the security incident, according to Al Jazeera. Blockchain investigation firm TRM Labs said it had high confidence that the attack was orchestrated by the TraderTraitor group, linked to North Korea, according to Euronews.
Cursor said a tampered version of the Anthropic.claude-code 2.1.313 extension was available in its extension marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, affecting at most 5,000 users. According to the company, the extension runs malicious code that collects data from the host computer and attempts to install a persistent SSH backdoor, with an attacker-controlled key, the local SSH service enabled and a reverse tunnel. Cursor said it removed the malicious version and blocked its distribution, and shut down the marketplace as a precaution, adding that the attacker's server is offline and there is no evidence other versions of the extension were affected. Reuters reported the removal and the blocking of distribution.
Analytics firm TRM Labs attributed the attack on Binance to North Korea’s TraderTraitor unit with high confidence, based on on- and off-chain intelligence — Chainalysis also said it has “high confidence” in the North Korean group’s link to the hack, according to the BBC. Reuters reported that North Korean hackers were behind the $6.3 billion raid on Binance, according to TRM.
Binance estimated the impact of the security incident at $6.3 billion, with around $3 billion in crypto assets frozen so far, according to CNBC. Early checks point to a compromised engineer’s laptop, which allowed unauthorized withdrawals, and the exchange says it will cover all losses, according to the BBC.
Binance suspended all deposits and withdrawals as a precaution while it runs security checks, freezes funds and works with law enforcement, and says the volume frozen after the likely hacker attack totals about US$ 3 billion, up from the US$ 2.5 billion previously reported, according to TASS.
Binance said at least $2.54 billion in funds were frozen following a “potential security issue” and that it suspended all deposits and withdrawals as a precaution while it investigates the case, according to Al Jazeera. Founder Changpeng Zhao said the episode looks like a hack on the exchange, according to Al Jazeera, and Tether and Circle said they froze funds in response to the incident, according to The Guardian.
The United States Department of Homeland Security asked Icelandic web hosting company FlokiNET to take down a site with information about tens of thousands of its employees, according to Al Jazeera. In a letter cited by the outlet, the department says the content is live and “places more than 40,000 identifiable individuals at risk of harassment, stalking, and physical harm.”
Binance said it is investigating “a potential security issue” on its trading platform and that user funds are safe, CNBC reported. The exchange, the world’s largest by daily trading volume, has not confirmed, as of publication, that it suffered an exploit. Circle CEO Jeremy Allaire said Thursday evening that the company had frozen more than $800 million in USD Coin tied to the incident, and Tether CEO Paolo Ardoino said his firm had frozen more than $1.5 billion of its stablecoin. Crypto data provider Arkham Intelligence linked nearly $6 billion in digital assets — including bitcoin, ether, solana and various stablecoins — to 55 wallet addresses it has tied to the potential exploit. Bitcoin slid more than 3% and traded below $80,000 after the executives’ statements, according to NBC News.
The Pentagon is treating as a suspected hack a spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August, according to four officials familiar with the matter in a Reuters report published by US News. One of the officials said military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets in France earlier this month. Hackers are suspected of tampering with freezer temperatures at six military commissaries — the US Army’s tax-free grocery and household goods stores — causing food to spoil, according to the Hindustan Times.
The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter who spoke to Reuters. US military investigators are in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets in France earlier this month, according to one of those officials.
Norway’s National Security Authority (NSM) raised the country’s cyber risk level to “high”, the second-highest on its scale, citing a deteriorating security situation and events in recent months. According to Haugstoyl of the NSM, businesses have hours, not days or weeks, to close known vulnerabilities.
Operation Serengeti III, coordinated by the International Criminal Police Organization (INTERPOL), led to the arrest of 1,462 suspects and the recovery of 105 million dollars, according to Kaspersky, in a text published by AllAfrica. The action brought together 20 African countries and the United States and ran from June 29 to August 31, 2026. Financial investigators estimate losses linked to those criminal activities at 385 million dollars and identified nearly 66,000 targeted victims, with almost 11,000 malicious networks neutralized.
Cambodian police and military officers worked as private security guards in scam compounds where thousands were forced to work in the online fraud industry, according to an Amnesty International report, based on 151 survivor interviews, visits to 82 compounds and guard videos, identifying more than 20 personnel with an active presence at the sites and linking the operations to five security companies.
The leak site Distributed Denial of Secrets released data on more than 40,000 Department of Homeland Security employees, including details about officials working in sensitive fields such as surveillance and human intelligence, according to the Jerusalem Post. The data include job titles and email groups that show which agents were assigned to special operations, surveillance jobs, computer forensics and undercover work, according to Reuters.
The GLM-5.3 model, from Z.AI, from China, completed 3 of 13 multi-stage cyberattack scenarios at least once in controlled tests, the strongest performance Irregular has recorded from an openly available model, according to Reuters. In the same tests, the model gained access to protected services, established alternative connections to move through computer networks and coordinated operations across multiple machines, refusing none of the offensive tasks, according to Reuters.
The defense chiefs of Japan and the United States agreed to boost cooperation against cyberattacks, according to Kyodo News.
The Israeli firm Discover-Tech concentrated ad spending in markets with no commercial appeal and was the top bidder for ads targeting Starlink users in more than 100 countries, according to the Russian network RT, citing researchers at TrendAI, a unit of Japan's Trend Micro — and the researchers conclude the operation was tracking infrastructure, not commercial advertising, but with no proof of infection of Starlink users.
The website of the US Federal Election Commission (FEC) has been targeted by a hacker or hackers, disrupting the agency’s electronic filings system a week before the November 3 elections, according to an email seen by Reuters and published in a text republished by the Denver Gazette. In a statement, the FEC said that “at this time, the FEC’s electronic filing system is currently offline and our IT staff are actively working to restore service.”
Italian Prime Minister Giorgia Meloni's parliamentary email address was among those hit in a massive cyberattack on the Lower House's IT systems in recent days, along with accounts of other lawmakers, according to ANSA.
The GMO Internet Group called on users to unplug their computers ahead of a threatened midday ransomware attack, according to Kyodo News. The group is investigating a cyberattack on a cloud trading service after the apparent culprit threatened ransomware attacks on user computers, according to Nikkei.
GMO Internet Group chief executive Masatoshi Kumagai admitted on Sunday night that the company's own engineers had flagged security issues before unauthorized access to a foreign exchange trading service it provides and that its response to the concerns was insufficient, Kyodo News reported. Japan's Prime Minister Sanae Takaichi and relevant cabinet ministers will meet on Monday evening to discuss cyber security plans, amid data leaks and misuse, the top government spokesman said.
Some 421,000 internal AfD emails are available for download on a website, a set dating from this autumn back to 2014 and including messages attributed to party leader Alice Weidel, deputy leader Beatrix von Storch and former AfD chairs Jörg Meuthen and Alexander Gauland. The AfD told taz there had been a “hacker attack” in September 2026 on a hosting provider used by the party, in which “parts of a few” mailboxes were copied illegally.
The BBC World Service identified 56 Facebook pages that published at least 90 paid political ads between mid-September and mid-October, ahead of Serbia’s snap parliamentary election, targeting the student movement and carrying unsubstantiated accusations against political opponents. All the ads were paid in Romanian leu, totalling at least 29,437 lei by October 16, although Serbian law bans foreign funds in political advertising, and at least three were paid by a Romanian company, according to the BBC.
Japanese parcel delivery company Sagawa Express said up to 53.23 million records containing personal information may have leaked after unauthorized access to its parcel tracking system, according to Xinhua. Potentially compromised data includes names, addresses and telephone numbers of parcel senders and recipients, as well as email addresses registered with its Smart Club membership service, covering shipments from June 21 through Sept. 30. The company said no credit card information or tracking passwords were exposed, and that the figure includes many duplicates and does not represent the number of individuals affected.
Leading Democratic lawmakers on the US Congress intelligence committees said on Wednesday (21) they had received information that Russia is running a disinformation campaign against Democratic candidates, according to G1. According to the lawmakers, the Russian campaign follows the same pattern of online disinformation operations identified by the US intelligence community in the 2016, 2020 and 2024 elections.
UK Defence Secretary Wes Streeting said Britain should prepare for the threat of “state-sponsored terrorism” by hostile powers targeting everyday infrastructure, as part of a national conversation about resilience in the face of emergencies, according to the Guardian. He said on Thursday the public should consider how to respond to hybrid warfare risks, such as cyber-attacks that could knock out payment systems used by businesses or cause supply chains to collapse.
Flaws in the PHP programming language could let attackers take control of affected servers without authentication and steal sensitive data, and developers of the platform rolled out patches on Wednesday for vulnerabilities that had been lurking in the software for years, the BBC reported. In the UK, 32 government services were offline and four were partially unavailable while the fix was carried out, a minister said, according to the Guardian.
Vulnerabilities found in the PHP programming language, which is mainly designed for servers, led Japan’s Ministry of Health, Labor and Welfare to temporarily suspend a website for its information disclosure system as a precaution, according to Kyodo News. The site lists contact information and service details of long-term care providers nationwide. The government-affiliated Innovation Platform Agency said patches would be released by the developer later Wednesday. According to a European research organization, PHP is used by 69.3 percent of websites worldwide whose server-side programming language is known.
A GMO Internet security subsidiary found six units of attacking devices aimed exclusively at Japanese firms, according to Kyodo News. Its probe indicated that the autonomous artificial intelligence (AI) agent Artex was employed in the cyberattacks against Japanese entities.
The phone of the University of Belgrade rector, Vladan Djokic, was infected in 2026 with Pegasus spyware from the NSO Group, according to a report by the SHARE Foundation reported by CyberScoop. Djokic is a prominent figure in the country’s student protest movement, and Rade Bajic, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime, was also targeted, according to the research.
Chinese-made cars filmed sensitive information during a Norwegian military exercise, including access codes at secure sites and officials’ comings and goings, raising concerns about the risks posed by connected vehicles, according to the South China Morning Post (SCMP). The recordings came from rental cars, at least two of them Deepal brand cars made by Chinese state-controlled carmaker Changan and supplied to the army by Hertz Norge, according to the newspaper.
Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of online ads that it used to track targets and help hack their devices, the research groups Citizen Lab and Confiant said, in a report by The Jerusalem Post. Its services gave Candiru, an Israeli spyware company blacklisted by the US government, and other Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia’s Yandex and others. According to Citizen Lab, a powerful form of Candiru spyware delivered through Discover-Tech’s ads compromised 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, confirmed through network logs from the media group. Google said it had collaborated with Citizen Lab and Confiant on the investigation and kicked Discover-Tech off its ad platforms for “systematically violating our policies.”
The US Department of Justice said that Saudi national Abdulrahman Alfozan, 35, a former OpenAI engineer, was arrested last week on allegations of placing a secret audio recording device inside an executive conference room at the company. OpenAI discovered the device on 30 September, connected to a USB port behind a television in an executive meeting room at its San Francisco office, according to the FBI complaint. The company said it has no indications, at this time, that the individual inappropriately accessed or exfiltrated model weights, source code or customer data; the employee was terminated.
A cyberattack targeted a Danish software system used in at least 380 supermarkets in France, forcing some stores to throw out frozen produce, according to The New York Times.
A cyberattack raised the temperature of refrigerators and freezers at hundreds of supermarkets in France to as high as 50°C, causing fires and spoiling food, according to The Hindu. The Paris prosecutor’s office said on Monday (October 12, 2026) that a “large-scale” attack was affecting connected refrigerators at several major food retailers across the country, leading to food losses and fires. According to Al Jazeera, shelves were left empty across France, as hackers remotely raised temperatures and forced hundreds of stores to discard food.
French supermarket chains, including Intermarché and Coopérative U, were hit on Monday (12) by a cyberattack against the refrigeration control systems of the Danish manufacturer Danfoss. According to BFMTV, the attackers reportedly hijacked that function overnight, imposing a forced and continuous defrost with the temperature set at 50 degrees. AFP reported that French supermarket chains say the cyberattack forced the shutdown of refrigerators.
Check Point research describes hundreds of hacking attempts that targeted consumer security cameras around the Middle East, according to Wired. Russia and Ukraine have ramped up camera-hacking in their war, aiming to spy on each other, find new targets and assess damage from their attacks, according to The Wall Street Journal, in a text republished by LiveMint. The Jerusalem Post reported that hackers use security cameras to track troops and military targets in Israel and Ukraine.
The UK Security Service (MI5) said that more than 100 UK-based academics had contributed to projects funded by the China General Technology Research Institute (CGTRI), according to Reuters, in a text republished by The Olympian. According to Reuters, in a text republished by UNN, MI5 established that CGTRI’s primary purpose is to fund academic research that directly enhances the technical espionage capabilities of China’s state security service (MSS). The funded projects include artificial intelligence, cybersecurity, covert communications systems and steganography.
MI5, the UK's domestic security service, said publicly on Wednesday that the China General Technology Research Institute (CGTRI) is a front for Chinese intelligence, namely the Ministry of State Security, and asked universities and researchers to halt collaboration with the institute, according to The Guardian. According to the paper, the organisation [gave money to 100 or more academics at a series of UK universities and in return obtained access to the research], in fields such as artificial intelligence and cybersecurity, and part of the material is alleged to have reached the Chinese intelligence service. With the alert, MI5 said researchers who keep engaging with the Chinese institute will be subject to legal action, according to G1.
OpenAI warned dozens of global institutions that their websites may have been targeted by improper manipulation by its artificial intelligence (AI) bots, according to G1. The agents attempted to get information from governments, universities, public agencies and other institutions, including the US Securities and Exchange Commission (SEC), the Census Bureau and the Education Department, according to the BBC. Information the bots accessed from the SEC was later published by AI agents on another website, an action OpenAI says was not intended, according to the BBC. The activity resulted in at least 53 incidents in which an OpenAI agent captured an image of ChatGPT user activity and transferred it elsewhere, according to G1.
Current and former agents of the Federal Bureau of Investigation (FBI) spoke of their shock, fear and anger following a hack against the agency. The FBI said it is investigating a claim of compromise of the FBIJobs.gov portal and the alleged impact on employees’ personally identifiable information. The ShinyHunters group is threatening to publish the stolen databases and documents within four days unless its demands are met.
Ukrainian President Volodymyr Zelensky said Russia has widened its attacks to target data centres and internet providers, according to BBC News. On Friday, September 25, 2026, a Russian drone hit a business centre in Kyiv, killing four people and damaging a data centre, the same report said. Russia’s defence ministry confirmed it had hit the Datagroup site, which it said was being used by Ukrainian military intelligence.
China’s Cyberspace Administration (CAC) is investigating whether DeepSeek and Moonshot AI sent sensitive domestic data to Anthropic servers in the United States, The Information reported, in a story cited by NDTV Profit and Yahoo Finance. The regulator summoned representatives of the seven Chinese companies named in Anthropic’s September threat report (DeepSeek, Moonshot, Alibaba, Zhipu, SenseTime, MiniMax and Xiaomi) before narrowing its focus to the first two, and has announced no penalties. Anthropic, which brought the allegation, says the seven Chinese labs accessed its Claude model illicitly to extract capabilities: according to the company, Moonshot routed nearly 300,000 customer requests through 5,380 fraudulent accounts over 10 days and displayed the answers as though they came from its own Kimi model, while DeepSeek rerouted more than 12.1 million exchanges over 14 days in July. Anthropic says some of that traffic contained sensitive material, including surveillance footage from cameras in Chengdu and data from a case-management system at a municipal public security bureau. The Chinese companies deny the allegations, which Beijing describes as an attack on its AI sector.
In his debut at the United Nations (UN) General Assembly on Tuesday, 22 September 2026, British Prime Minister Andy Burnham accused Russia of an “industrial-scale assault” on the information environment and of trying to interfere in the United Kingdom’s 2019 general election: “Russian agencies have used every means at their disposal to spread lies and disinformation and prey on people’s fear. They’ve used bots and fake websites. Falsified newspaper articles. Forged the branding of 28 British organisations — including universities and the BBC,” he said, according to the Daily Express and Al Jazeera. Burnham said the Kremlin spends around £ 1.3 billion each year on manipulating information and announced a new National Centre for Information Defence to detect, attribute and disrupt hostile state information attacks and identify deepfakes damaging British interests, according to Reuters, in a report published by the Global Banking & Finance Review. The body starts out under the prime minister’s office and will work with intelligence agencies, government departments, the police and social media companies, according to the Daily Express. The prime minister said the United Kingdom has already supported Moldova in protecting its elections from Russian interference and that the country is ready to lead an international effort to set standards for artificial intelligence (AI).
The digital extortion group known as ShinyHunters says it has breached the Federal Bureau of Investigation (FBI) and stolen data on thousands of bureau employees, according to Reuters and 404 Media. The bureau did not reply to requests for comment. The group told Reuters in an online chat that it targeted the agency in response to a May 2026 FBI announcement that detailed its methods and advised targets not to pay, and posted on its dark-web site a screenshot of a vandalized FBI jobs site and what it described as a sample of the stolen data, including names, home addresses, phone numbers, dates of birth and, in some cases, information about spouses. Reuters said it could not verify the authenticity of the screenshot, but a message posted to the FBI jobs site on Tuesday said the portal and the Special Agent Applicant Portal were “currently unavailable”. The news agency said it partially verified the authenticity of some of the alleged personnel data by running names and postal addresses against credit bureau records and previously breached data preserved by dark-web intelligence firm District 4 Labs: it found a match in at least nine cases, but could not establish where the data came from or whether it was stolen from the FBI’s internal systems as the group claims. 404 Media, which reviewed a sample of 5,000 employees, said some of the phone numbers in the list matched people with the same names, and reported that the group defaced the jobs site with the message “this site has been seized by ShinyHunters”.