PSPF Direction 002-2026 — Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks (Secretary Stephanie Foster PSM, Department of Home Affairs; September 2026; PDF fetched this pass) directs all non-corporate Commonwealth entities subject to the PGPA Act. By 31 March 2027 entities must: (1) conduct a Legacy Technology Stocktake of all legacy technology systems managed by or on behalf of the entity (agencies set depth/scope; prioritise public-facing services); (2) develop and maintain a Legacy Technology Risk Management Plan incorporated into the cyber security strategy and uplift plan (PSPF Requirement 0098), including a reduction target commensurate with risk appetite, prioritisation strategies, mitigations for retained legacy, and procedures to rationalise the estate; (3) report stocktake completion and provide the plan to Home Affairs Commonwealth Security Policy Branch (PSPF@homeaffairs.gov.au). Separately, by 31 December 2026 entities operating Systems of Government Significance (SoGS) must also incorporate SoGS Risk Reduction Measures from Policy Explanatory Note 002-2026 and report SoGS legacy stocktake completion. Further detail: Policy Explanatory Note 002-2026 to be issued by 13 October 2026 plus Home Affairs advisory sessions; entities should also apply Policy Advisory 001-2026 — Cyber Security Readiness in the Frontier AI Era. Direction framing: frontier-AI capabilities have targeted the Commonwealth technology estate; continued vulnerable legacy plus accumulated exploitable vulnerabilities poses an unacceptable risk; strengthen vulnerability/patch management recognising shortened time from discovery to exploitation; prioritise SoGS resilience. Wires: iTnews / Canberra Times 30 Sep. Primary: PSPF Direction 002-2026 PDF.
PSPF — Direction 002-2026 (legacy technology stocktake PDF; Home Affairs)
australia ai
ANSSI (published 29 September 2026; report remitted to the Prime Minister 24 Sep, document dated 23 Sep, TLP:CLEAR PDF) details malicious activity on Direction générale des Finances publiques (DGFiP) systems between May and August 2026. Actor Zerobytes claimed theft from impots.gouv.fr / E-Contact taxpayer messaging on 12 August; ANSSI notified DGFiP the same day. Claimed scope: nearly 353,000 individuals and 252,000 professionals (tax ID/contact/family/income/withholding and message metadata; taxpayer online accounts/passwords not compromised). Exfiltration occurred about seven weeks earlier after weeks of exploration via the interministerial state network (RIE), using dozens of legitimate DGFiP staff credentials stolen over ~three months (likely infostealers on unmanaged personal devices) plus RIE access via a compromised other ministry (Education). Password-only portals (PIGP, ADER) and weak segmentation enabled lateral reach. A second Zerobytes claim (13 Aug) covered cadastral data after compromise of a private land-surveyor workstation bypassed email OTP on the APEX partner portal (exfil ~27 Jul–8 Aug). Neither DGFiP nor ANSSI detected the exfiltrations — ANSSI: not a sophisticated attack but exploitation of identity, architecture and monitoring weaknesses. Containment (cutting agent/partner portal access) disrupted services. Wire: The Hacker News 29 Sep. Primary: ANSSI actualité + incident PDF.
ANSSI — Rapport d’incident cyberattaques DGFiP (actualité 29 Sep 2026)
breaches identity network
Japanese car-sharing service Times Car (Times Mobility / Park24 Group) confirmed a cyberattack that compromised approximately 6.6 million current and former Times Car member accounts and Times Business Service corporate-program members. Company first announced unauthorised access beginning of September 2026 (public notice 25 Sep); blocked access 26 Sep; BleepingComputer (28 Sep) reports today’s update confirming data theft. Exposed data per company update: full name; corporate department; address; date of birth; phone; email; driver’s licence information; identity-verification document images (e.g. licence photos); account password (stored in a form that “cannot be restored” — hashed/encrypted, detail not expanded); linked service IDs. Credit card information stated unaffected; no evidence of online distribution at time of reporting. Services continue; staged individual notifications. Primary wire: BleepingComputer 28 Sep quoting company; seek Park24/Times Mobility primary notice when mirrored in English.
BleepingComputer — Times Car ~6.6M accounts (28 Sep 2026)
breaches identity
Keio Corporation (major private railway / hospitality group, Japan) confirmed a ransomware attack on group servers in the early hours of 26 September 2026; reported to police and investigating with external experts (BleepingComputer 28 Sep quoting company). Network shut down after early-Saturday system failure to limit damage; impact assessment includes whether customer or partner data was accessed. Reporting indicates hospitality side (Keio Plaza Hotel Tokyo warning of possible customer-service delays) and payment systems disrupted; train operations said unaffected. No ransomware brand claim found by BleepingComputer at publication. Same weekend, Tokyo Metro separately disclosed unauthorised access exposing ~59,000 member email addresses (weakness closed) — unclear if related. Primary wire: BleepingComputer 28 Sep; company JP notices as available.
BleepingComputer — Keio ransomware confirmation (28 Sep 2026)
breaches
Incidents
Mon 28 Sep
Updated Wed 21 Oct
Dutch police (Politie Landelijke Opsporing en Interventies, 28 September 2026) confirmed a 24-year-old Amsterdam man arrested earlier in September was detained in an investigation into the ShinyHunters hacking group. UPDATE 28–29 Sep wires (KrebsOnSecurity; Reuters / CBC): employer Neo Security offensive-security lead Benjamin Korper identified the detainee as Pepijn van der Stap; Krebs sources place the arrest around 15–16 September. Van der Stap was previously convicted (2023) over data theft/extortion as handle “Umbreon” (RaidForums/Breached era; custody, release Dec 2025) and had publicly cast himself as reformed. Dutch police clarified on 29 September that the suspect was not detained as part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido (BleepingComputer, 29 Sep). CORRECTION (21 Oct 2026): this card earlier said Krebs linked the Dutch probe to the Odido intrusion, without the police clarification. UPDATE 29 Sep 2026 — BleepingComputer / Dutch police / FBI Cyber Division Assistant Director Brett Leatherman video: Rotterdam District Court ordered at least another 90 days’ pre-trial detention; police said a large amount of information was found on his laptop “including details about two murders that were to be committed abroad” with indications the suspect “gave the order”; further arrests not ruled out. FBI states ShinyHunters and alleged co-conspirators breached more than 140 organizations since last year and collected at least US$70 million in extortion payments, and publicly urged remaining members to turn themselves in, citing seized infrastructure and shifting incentives to talk. Context: group’s prior FBI PeopleSoft breach claim remains on desk (shinyhunters-fbi-peoplesoft-20260922). Distinct from PeopleSoft mass exploitation (cve-2026-35273) and Clop DLS defacement (shinyhunters-clop-dls-20260919). Primary wire: BleepingComputer FBI/Dutch update 29 Sep; naming: Krebs + Reuters.
BleepingComputer — FBI tells ShinyHunters members to turn themselves in (29 Sep 2026)
breaches identity
Incidents
Mon 28 Sep
Updated Sun 25 Oct
District of Columbia Department of Health Care Finance (DHCF) public notice (page dhcf-data-incident) states that on 21 July 2026 DHCF learned two reports on its website contained hidden personal information reachable by unauthorised users. Reports were meant to show only aggregate enrollment/statistics; underlying PII supporting those reports may have been reachable between 2023 and July 2026. Exposed fields may have included Medicaid ID numbers, date of birth, provider name, race, gender, ward, or ethnicity; DHCF says beneficiary names, Social Security numbers, and financial account information were not included. Not a hacking incident — misconfigured public reports. DHCF removed the reports immediately, began an internal review, and is mailing individual notices; enrollees in Medicaid or DC Healthcare Alliance between 2023 and July 2026 may call 1-833-687-5424. DHCF says it has no reason to believe the data was misused. Primary: DHCF notice. Updated 30 Sep 2026: The HIPAA Journal reports that the investigation determined the personal and protected health information of 399,086 Medicaid and DC Healthcare Alliance beneficiaries may have been accessed by unauthorised individuals. (source: The HIPAA Journal)
DHCF — Data Incident public notice (Medicaid / DC Healthcare Alliance)
breaches identity
U.S. Department of Justice (OPA press release linked from BleepingComputer, 28 September 2026) reports that former U.S. Army soldier Cameron John Wagenius (21; online kiberphant0m / cyb3rph4nt0m) was sentenced to 70 months in prison and ordered to pay $294,978 restitution for hacking and extorting at least ten U.S. technology and telecommunications companies between April 2023 and December 2024 while on active duty. Court narrative (via BleepingComputer/DoJ): Wagenius and conspirators used an SSH brute-force tool he helped develop, moved stolen credentials on Telegram, and threatened to publish data on BreachForums / XSS.is or sold it; attempted extortion totaled at least $1 million; stolen data also used for SIM-swapping and other fraud. Prior guilty pleas: February 2025 (AT&T / Verizon confidential phone-records transfers) and July 2025 (aggravated identity theft, conspiracy to commit wire fraud, extortion related to computer fraud). Accomplices Connor Riley Moucka (“Waifu”/“Judische”) and John Erin Binns (“irdev”) were separately accused in the Snowflake-linked campaign affecting customers of AT&T, Ticketmaster, Santander and others; Moucka pleaded guilty August 2026. Primary: DoJ OPA; wire: BleepingComputer 28 Sep.
U.S. Department of Justice — former US soldier sentenced for hacking and extortion scheme
breaches identity cloud
Incidents
Sat 26 Sep
Updated Sun 25 Oct
CNN (25 September 2026, 4:18 pm US Eastern; 26 September, 4:18 am Perth) reports that a data breach at the Pentagon's HR system exposed Social Security numbers and other personal information of current and former military personnel. According to a Defense Manpower Data Center (DMDC) letter to victims reviewed by CNN, unauthorised users gained access to a vulnerable DMDC computer server beginning in October 2025, and the Pentagon discovered and remediated the issue nine months later, in July 2026. The stolen data was not encrypted and in some cases included service members' military occupational specialty; the letter says there are no indications of misuse and offers a year of credit monitoring. It is unclear who was behind the breach. DMDC holds more than 60 million military, civilian, contractor, family member, retiree and veteran records, according to BleepingComputer. Distinct from desk cards astrana-health-8k-20260922 and shinyhunters-fbi-peoplesoft-20260922. Primary: CNN; wire: BleepingComputer. Updated 29 Sep 2026: a Defense Department official told CNN the breach affects 2.76 million living individuals and 294,000 deceased individuals. (source: CNN) Updated 1 Oct 2026: BleepingComputer (5:44 pm Perth) reports that DMDC's notification letters, shared online by affected people, say a small number of unauthorised users had access to their data between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems; the data varies by person and includes Social Security numbers, names, dates of birth, contact information, sex, race and military personnel information. It says Pentagon officials told Federal News Network the breach affects more than 3 million people, and that affected people are offered 12 months of IDX credit monitoring, with enrolment closing on 19 August 2027. (source: BleepingComputer) Correction (25 Oct 2026): the card date has moved from 29 to 26 September 2026 (Perth time), the date of CNN's first report, and the card now rests on CNN and BleepingComputer; details only a wire report we cannot verify gave (a letter date of 18 September and a discovery date of 16 July) have been removed. (source: CNN)
CNN — Pentagon data breach of military personnel raises national security concerns (25 Sep 2026 US Eastern, updated 28 Sep)
breaches identity
The NSW Department of Education has confirmed that James Fallon High School in North Albury was hit by a cyber data breach in April 2026, The Border Mail reported on 25 September 2026. Parents were told in April that the matter was under investigation, and early findings indicated the source of the breach was outside NSW. A letter to families on 17 September said the 'complex investigation' by the department and Cyber NSW had concluded, and that the information involved generally included school policies and procedures, curriculum and teaching materials, and some information relating to students, parents and carers, and staff. People directly affected will be notified about the specific data involved. The department said immediate steps were taken to contain the breach, that it worked with Cyber NSW and relevant authorities, and that monitoring had found no evidence the information had been released. It has not said how the attackers got in or how many people are affected. Source: The Border Mail (25 Sep 2026), quoting the NSW Department of Education.
The Border Mail — Department investigation concludes after cyber breach at Border high school (25 Sep 2026)
breaches australia
Incidents
Fri 25 Sep
Updated Mon 26 Oct
The Arizona Supreme Court says criminal hackers accessed and copied backup court files in an attack that began around 11:30 a.m. on Thursday 24 September 2026 (Arizona time). Court IT staff shut it down less than two hours after it was identified, and Chief Justice Ann Timmer alerted Arizonans to the issue the next day, once staff began to identify who was affected. The court says the evidence so far suggests the attack began with a phishing email in which a court employee clicked a malicious link. According to the court's FAQ, the copied data covers approximately 1.3 million people referred to its Fines/Fees and Restitution Enforcement (FARE) collection program, with court debts dating back 30 years, and includes sensitive information such as case numbers, names and Social Security numbers; records involving active and inactive protective orders, including some sensitive information; and more than 150,000 Foster Care Review Board reports for current and past cases dating back to 2010. The court says no court records were deleted, altered or erased, the copied data did not include information on jurors, witnesses or court employees, and it has no evidence that any of the data has been accessed, is readable or has been shared; the files were copied from a backup server holding highly compressed information. FARE notifications go out by text from short code 83958, and an alert has been added to collection notices. Chief Justice Timmer spoke with FBI Special Agent in Charge Rebecca Day and pledged the court's full cooperation, and state and federal law enforcement have been contacted. Primary: Arizona Courts cybersecurity alert and FAQs. Correction (26 Oct 2026): this card earlier credited an Associated Press report (6 Oct), FOX 10 Phoenix and SecurityWeek. The AP page cannot be read by this desk and the other two were never linked, so those credits and the AP link have been removed, along with a figure of nearly 30,000 protective-order records and a mention of confidential addresses, which the court's page does not give. The 1.3 million figure and the Social Security number detail are now credited to the court's own FAQ. (source: Arizona Courts)
Arizona Courts — Cybersecurity Alert and FAQs (attack 24 Sep 2026)
breaches
Incidents
Fri 25 Sep
Updated Sun 25 Oct
Eye Security research (Dion Fieret & Lucas Hop; published 25 September 2026) documents lookalike storefronts that appeared within days of TypeSafe AI’s Jev model launch (15 Sep; hosted API public ~21 Sep). Fake sites (e.g. jev-ai.pro, jevtypesafeai.com, jev-agent.org and others) ranked above the official property in Google for “Jev AI” / “Jev TypeSafe”, offered playgrounds, docs, pricing and checkout, and resold TypeSafe’s own API at about 3× to 11.5× the official price — so prompts and request/response content pass through an unaffiliated operator’s servers first. At least six sites share the same storefront code; the operator reskins for trending models (six launches in 18 days). Certificate transparency showed ~670 new domains containing “jev” in the first eight days after launch. Affiliation disclaimers buried in footers/terms. TypeSafe temporarily paused new Jev signups around 22 Sep due to demand, increasing the risk users would buy from clones. Buy only via typesafe.ai or documented gateways (OpenRouter, Vercel AI Gateway, Cloudflare AI Gateway). Primary: Eye Research.
Eye Research — Rise of the Jev-Clones (25 Sep 2026)
ai identity
Incidents
Fri 25 Sep
Updated Sun 25 Oct
Microsoft Security Research (Yossi Weizman, Tushar Mudi; published 25 September 2026) documents Azure-focused destructive activity by JADEPUFFER, tracked as Storm-3168 — an evolution of the actor Sysdig described in July 2026 as the first documented agentic ransomware operation (Langflow CVE-2025-3248 initial path; ENCFORGE later). In an early-June 2026 intrusion lasting ~18 hours, two compromised service principals in the same tenant split roles: one performed ~15.5 hours of discovery (300+ reads across VMs/subscriptions/resource groups); the second enumerated then ran a ~7-minute destructive sequence with 100+ storage-account deletion attempts (most succeeded), plus deletion of a Key Vault, Function App and App Service plan; Azure SQL deletions failed (unsupported API version); Site Recovery/Backup locks were targeted. About 30 minutes later the same principal issued 30+ successful ListKeys requests against storage accounts (incl. Site Recovery-related). User agent python-requests/2.34.2; five unique tokens observed. Possible initial access: SP client ID/secret/tenant ID previously exposed in a public GitHub issue edit history (secret removal does not revoke). Resource locks and storage deletion protection blocked some deletions. No ransom note or confirmed exfiltration in the Azure activity Microsoft describes; objective assessed ransomware-aligned (destroy + impair recovery + collect keys). IoCs include 45.131.66.106, 34.153.223.102, 64.20.53.230. Primary: Microsoft Security Blog. Updated 28 Sep 2026: The Hacker News reported Microsoft's findings on JADEPUFFER-linked attackers using compromised service principals to delete Azure resources. (source: The Hacker News)
Microsoft Security Blog — Storm-3168 agentic cloud attacks via compromised service principals (25 Sep 2026)
breaches cloud identity ai
