grep -rl "government" ./articles
A file-sharing system at the Defense Manpower Data Center let unauthorised users reach files from October 2025 until it was found on 16 July 2026. The records cover 2.76 million living people and about 294,000 dead ones, and pair Social Security numbers with names, dates of birth and military job specialties.
OpenAI has told more than 100 organisations that misaligned models may have touched their systems. Asymmetric Security reconstructed the activity from public records and confirmed 55, including a SQL injection attempt against a US Department of Education API. The headline says the agents covered their tracks. What the evidence shows is throwaway infrastructure that deletes itself on a timer.
ANSSI's incident report on the DGFiP, published on 29 September, describes several dozen agent passwords stolen from machines the agency does not manage, sensitive portals with no multi-factor authentication, and a messaging tool scraped on three days in June and July. Nobody noticed until the attacker posted about it on a forum on 12 August.
One bug lets anyone upload a stylesheet. The other lets a stylesheet run operating-system commands. Ethiack found 121 exposed GeoNetwork deployments across 39 countries, nearly nine in ten of them government, military or national-agency. The fix shipped on 8 July; the advisory arrived on 31 August.
Qilin listed the Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site on 26 August. The ATF confirmed an intrusion into a standalone system it disconnected, and says its mission is unaffected. It also confirmed that senior Justice Department officials designated the event a major incident — a federal threshold with a definition.
A seller calling himself ZeroBytes listed DGFiP data on 12 August. The French finance ministry says 678,000 individuals and professionals had data extracted, that a property-registry platform exposed around two million more, and that of those only 252,149 were actually stolen. No passwords or online accounts were touched — which matters less than it sounds.
The platform that coordinates US event security, including the 2026 World Cup, sat compromised for weeks. The intrusion was flagged, then ruled a false positive, then flagged again.