ls ./category/world
Regulation, policy and global stories with the context you need.
The NSA told organisations to update or take systems offline until they could. Dutch citizens lost MijnOverheid and DigiD. The patch went live hours after the shutdowns started.
Edward Dubrovsky is charged with threatening to disclose stolen data. Separately, two sources told KrebsOnSecurity that the FBI believes an executive at a US consulting firm helped operate Shinywire. Nobody at that firm has been charged or named.
The preliminary analysis covered about 375,000 records. The filing calls the exposure suspected and says an investigation is needed to determine the potential source. The seller has no track record, and the samples anyone checked numbered four.
The filing confirms 3,897 records with personal information. The structure around that number is the real story: two six-hour clocks pointing at institutions, and a customer-notification duty that starts in May 2027.
It is the company's third disclosure in a month. The headline number counts records in a development system, and more than nine in ten of them carry no identifier at all, which the disclosure says and the headlines do not.
The Justice Department alleges an engineer hid a recorder in an executive conference room. The complaint's account of how it was built comes from prompts asking how to make a continuous audio recorder and encrypt its SD card.
CERT-FR's alert names four product families across three vendors and not a single CVE. Claroty's research into the controllers was published in August and does not mention France or any attack. The link between them is an inference.
A cyber incident at BAE Systems has stopped the Bankruptcy Noticing Center. The judiciary's own rules make that more than an outage: for high-volume recipients moved to electronic service, using the BNC website is what constitutes notice.
The AdFection report describes mercenary spyware delivered through ordinary real-time advertising. The visible ad is clean, which is the point: the exploit arrives only for the devices the bidder has already decided it wants.
Fourteen people charged, two arrested, more than forty Texas residences searched and about 187 laptops seized. The most useful thing in the announcement is a list of email addresses, and it tells you where this threat is actually detected: in hiring records, not in network logs.
iRhythm filed a material cybersecurity incident disclosure in June after attackers downloaded patient data and demanded payment. Notifications began on 2 October. Four months on, the only public measure of scale is state-by-state regulatory filings, and they do not agree.
Attackers used stolen credentials to reach DTU's identity system and pulled records going back two decades. The 200,000 figure in every headline is the size of the database, not a count of victims. DTU is notifying employees directly and leaving 160,000 former users to find out from the news.
The FBI seized seven domains behind scanning and malware-delivery platforms run by a Chinese contractor, and CISA added five identifiers to its exploited-vulnerabilities catalog the same week. No coverage we found named them. They are in CISA's own feed, and most of them are a decade old.
Danish authorities say unidentified parties misused a private company's legitimate access to the Central Person Register and stayed inside the limits that access permits. Names, addresses and CPR numbers for 8.8 million people, roughly four fifths of the register, were retrieved over about ten days in September.
Since 11 September, manufacturers selling connected products in the EU must warn authorities within 24 hours of learning that a flaw in one is being exploited. The Cyber Resilience Act applies that duty to products already on the market, while its security requirements reach only those placed on the market from December 2027. For a device already on sale, the Act now requires the report, but not the patch.
A declaration organised by Terence Tao and signed by 25 Fields Medallists says the goals of AI companies and the mathematical community are severely misaligned. The objection is not that machines cannot solve problems. It is that solving them was never the point.
Newsom signed limits on addictive feeds for under-16s and time limits on companion chatbots for children. Neither law asks the app to work out a user's age. Both lean on a bracket the operating system collects at account setup and passes to every app — and the chatbot's parent alert is narrower than the headlines.
Sam Altman told staff OpenAI could pace frontier development alongside other labs, and OpenAI asked lawmakers whether that would breach antitrust law. The bipartisan bill that would answer it permits coordinated delays for loss-of-control risks — if not more than an insubstantial part of the reason is anything else. That week, OpenAI stopped selling its top tier for lack of compute.
NSA, CISA and the FBI accuse six Chinese AI firms of extracting billions of tokens from Claude, GPT, Gemini and Grok since late 2024. No system was breached — the models were queried through the front door. The recommended countermeasure is to subtly alter what suspected accounts get back.
Four submarine systems carrying Europe to Asia traffic were damaged in the Red Sea on 6 September. Rerouting absorbed it within the hour. The repair will take weeks to months, and the reason is a global fleet of specialised vessels that is very small.
Nathan Vilas Laatsch worked in the Defense Intelligence Agency's Insider Threat Division, enabling user activity monitoring on people with access to DIA systems. When he decided to pass secrets to a foreign government, he transcribed them at his desk on paper. He has pleaded guilty, and the plea recommends 11 to 18 years.
Berlin's state network was breached on 7 August and data flowed out until departments were disconnected on the 14th. The governing mayor says the state is being blackmailed and will not pay. The attackers claim 5.79 terabytes and 1.44 million files. Berlin has published no figures of its own, which leaves one source for every number in circulation.
Treasury designated nearly 60 Iran-linked entities, individuals and vessels under Operation Economic Outcast, including six people tied to the Mabna Institute — the outfit sanctioned in 2018 for stealing 31 terabytes from 320 universities. The designations concern US infrastructure. They do not name the UK attack, and the attribution there remains unconfirmed.
On 31 July the RBI published parallel Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for commercial banks, small finance banks, payments banks, urban co-operative banks, financial institutions, NBFCs and credit information companies. They took effect immediately, they repeal what came before, and incidents must reach the RBI within six hours.