Spain's Agencia Española de Protección de Datos (AEPD) blog (14 September 2026; wired by BleepingComputer and SecurityWeek 16 September) says it received the first notification of a personal-data breach in which the incident was allegedly executed by an AI agent using a known large language model. Per the affected organisation's notification (not yet independently verified by AEPD): the agent searched generic files for flaws, completed a successful login, then autonomously probed the application, modified personal data, and accessed invoices. AEPD stresses the report is from the notifier and must be analysed; use of a named model does not imply the model provider was compromised or that the tool was purpose-built for crime. Relevance for defenders: treat agentic chaining (goal → tools → adapt) as a qualitative speed/scale shift for risk analysis, credential/API hygiene, and detection/containment timing — not only for Spanish controllers. Primary: AEPD blog; wires: BleepingComputer, SecurityWeek.
AEPD — first notified breach allegedly via AI agent (14 Sep 2026)
ai identity
Incidents
Mon 14 Sep
Updated Thu 22 Oct
Cyber Daily (14 September 2026) reports Victorian dealership Penfold Motors (Peter Warren Automotive Group; six Vic sites) is contacting customers after Storm ransomware operators listed the firm (listing dated 17 August; early leak post mis-attributed a similarly named UK organisation before correction). Company statement dated 7 September: contained incident involving an external software provider that stored some Penfold data; systems restored and dealerships operating; investigation with the provider and forensic specialists ongoing. Impact described as basic contact details plus vehicle and servicing information (VINs and tax invoices appeared in published samples per Cyber Daily); Penfold said there was no evidence identity documents or bank-account data were involved, and that it notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner. Cyber Daily also notes Sharp Motor Group and Macquarrie as other recent Australian automotive/machinery victims tied to third-party supplier incidents in the same Storm wave (Macquarrie desk card updated separately). UPDATE 15 Sep 2026: Cyber Daily names Auto-IT as that third-party software firm (see auto-it-storm-20260915). Primary: Cyber Daily exclusive with company quotes. Correction (22 Oct 2026): the headline previously stated 'Storm ransomware via third-party software' as fact; Penfold's statement describes an incident at an external software provider and does not name Storm, which is the group that listed it on its leak site according to Cyber Daily. (source: https://www.cyberdaily.au/security/14179-exclusive-penfold-motors-latest-car-dealer-to-fall-victim-to-the-storm-ransomware-group)
Cyber Daily — Penfold Motors / Storm (14 Sep 2026)
breaches australia
BleepingComputer (14 September 2026) reports that the verified Reddit account u/hbomax was hijacked and used to run about 108 malicious advertisements over roughly 48 hours. Ads used ClickFix social engineering (victims paste commands into Windows Run/PowerShell or macOS Terminal) and redirected to lookalike sites (including hbomaxx[.]us). Hudson Rock and ADAMnetworks link the activity to a broader campaign they call PasteSwitch delivering information stealers, loaders, crypto clippers, and fake wallets on Windows and macOS; one macOS chain referenced “AMOS helper” persistence under a .com.apple.accountsd-style directory. Some ads impersonated HBO Max; others pushed fake AI/developer/macOS utilities. BleepingComputer said HBO / Warner Bros. Discovery had not responded at publication. Distinct from prior desk ClickFix/EtherHiding cards. Primary/wire: BleepingComputer.
BleepingComputer — HBO Max Reddit ClickFix (14 Sep 2026)
breaches identity
Hunt.io (14 September 2026; The Hacker News same day) describes an intrusion against 3BB, a major Thai broadband provider. Researchers captured an attacker-operated server still live on 3 June 2026 that held tooling run from inside 3BB’s network, a MeshCentral deployment reporting to www.ayuthayatech[.]com under device group TH-3BB (agents with root), cleanup scripts that preserved MeshCentral, SSH password spraying against 55+ internal hosts, probes of agent.3bb.co[.]th, and scripts aimed at copying RADIUS subscriber credential databases (targeted; Hunt.io does not state confirmed exfiltration). The same cache held a complete exploit for FortiGate SSL-VPN CVE-2024-21762 aimed at mail.3bb.co[.]th and a valid 3BB VPN certificate plus Jasmine-network sessions (shared infrastructure; Jasmine breach not confirmed). Primary: Hunt.io; secondary: THN.
Hunt.io — 3BB FortiGate / MeshCentral intrusion (14 Sep 2026)
breaches network identity
Incidents
Sat 12 Sep
Updated Thu 22 Oct
TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain. SecurityWeek (17 September 2026) reports that a threat actor using the name 'IAmNotAVillain' publicly demanded US$3 million, threatening to sell the data, and that Revolut said it had received no direct contact or demand; SecurityWeek says it understands about 680 customers were affected, and, citing Hudson Rock's contact with the hacker, that the fake requests impersonated an Italian government agency and ran for about five months (the hacker's own claim). Revolut has not published a number. A Revolut spokesperson described a sophisticated external impersonation scam; the company blocked the mailbox, alerted the agency, law enforcement and regulators, and said systems and customer funds were unaffected. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity). Primary: TechCrunch with Revolut confirmation; NEW scope wire: SecurityWeek 17 Sep; secondary: BleepingComputer 14 Sep; not a core-system compromise. Correction (22 Oct 2026): an earlier version presented the 680-account figure, the five-month duration and a US$3 million ransom demand as established facts; they come from SecurityWeek and the threat actor, and Revolut told SecurityWeek it had received no demand. (source: https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/)
TechCrunch — Revolut fake government-request disclosure (12 Sep 2026)
breaches identity
Incidents
Fri 11 Sep
Updated Mon 26 Oct
Japan's Digital Agency (news 11 September 2026) says unauthorised access to Government Solution Service (GSS) may have exposed about 246,000 personal-information records. Detection on 25 June 2026 (large-scale file access via a maintenance/operations account); on 9 July investigators found a third party had used a vulnerability in a network-connected VPN device to enter the system. That day the agency suspended the account and cut external communication from the compromised equipment. Possible leaked fields include names, email addresses, phone numbers, and addresses of GSS-using agency staff, associated public officials, and contractors/individuals who worked with those agencies. Agency says My Number, bank accounts, and pension numbers were not in the exposed set; no secondary misuse confirmed at publication. Q&A: vulnerability was previously published (not a zero-day) with a medium CVSS rating; product/CVE withheld for security. Primary: Digital Agency notice. Updated 15 Sep 2026: BleepingComputer reported the notice on 14 September US time (15 September 4:36 am Perth). (source: BleepingComputer)
Digital Agency (Japan) — GSS unauthorised access / possible personal information leak (11 Sep 2026)
breaches identity network
Incidents
Fri 11 Sep
Updated Sun 25 Oct
Daily Hive (11 September 2026) reports that Telus confirmed unauthorised access to some customers' personal information. A Telus spokesperson told Daily Hive: "We recently identified and blocked unauthorized access to limited information contained in a small number of telecom consumer accounts," without saying how many accounts were affected. According to an email Telus sent customers, unauthorised individuals used compromised credentials to access customer accounts sometime between February 2025 and June 2026, and may have used the account information to contact customers to persuade them to move their services to competitors and/or made unauthorised changes to their Telus services. The compromised information included full name, account number, billing address, preferred language and phone numbers, and in most cases email address, the last four digits of the payment card on file, the types of service, amounts charged and payment history. Telus says it notified affected customers, provided complimentary identity protection (two years of Telus Guardian through Norton; enrol by 30 November 2026) and contacted law enforcement and the Privacy Commissioner of Canada. Telus has not said where the credentials came from. Distinct from the data theft Telus confirmed in March 2026. Primary: Daily Hive. Correction (25 Oct 2026): the card date has moved from 14 to 11 September 2026, the date of Daily Hive's report (11:16 pm Perth time), and the card now rests on that report; a reference to Vancouver Police, which Daily Hive does not mention, has been removed. (source: Daily Hive)
Daily Hive — Telus confirms 'unauthorized access' to some customers' personal information (11 Sep 2026)
breaches identity
Incidents
Thu 10 Sep
Updated Sun 25 Oct
Trezor's blog (10 September 2026) says that on 9 September 2026 Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts, and an unauthorised actor used Brevo's system to send emails from various customer accounts, including Trezor's. Trezor says the incident affected its opt-in newsletter database of roughly 347,000 email addresses, that no other Trezor system was touched, and that it suspended the Brevo account. The phishing email, subject “Critical Security Alert: STM32 Entropy Vulnerability”, contained a link that prompted users to download an app asking for their wallet backup. Trezor says it took the domain down at the DNS level within 20 minutes, limiting access to 2,500 people who had clicked before the takedown, and contacted all 347,000 recipients. According to BleepingComputer (11 September 2026), the fake alerts came from help@trezor.io and claimed that a “hardware microcontroller vulnerability” in the STM32 microcontrollers used in Trezor wallets could expose seeds to brute-force cracking. Trezor's advice: anyone who entered a wallet backup through such a link should immediately move their funds to a new wallet; Trezor will never ask for a wallet backup. This is a different incident from Brevo's 14 September Cloudflare Worker ClickFix compromise (separate desk card). Primary: Trezor blog. Updated 17 Sep 2026: Trezor's post now says Brevo confirmed that 347,149 marketing email contacts were exported from Trezor's list through the API during the incident. (source: Trezor blog, trezor.io) Correction (25 Oct 2026): the card date has moved from 11 to 10 September 2026, the date of Trezor's blog post, which gives a date but no time; BleepingComputer's report is dated 11 September (03:55 US Eastern, 3:55 pm Perth). (source: Trezor blog, trezor.io)
Trezor blog — Security incident at Brevo, our third-party email provider (10 Sep 2026; updated 17 Sep 2026)
breaches identity
Incidents
Thu 10 Sep
Updated Mon 26 Oct
Cyber Daily (10 September 2026, 06:23 UTC; 2:23 pm Perth) reports Australian financial-hardship charity Way Forward disclosed a cyber incident at an external customer-management platform provider. In a 9 September statement the charity said payment arrangements initiated through the affected system were unavailable, clients were notified as a precaution, and creditors were asked for a temporary payment moratorium so client credit reports stay unaffected. A spokesperson later told Cyber Daily the provider’s initial analysis indicated impacted information related mostly to the provider’s own company, still subject to change while the provider investigation continues. The provider was not named. Primary: Cyber Daily quoting Way Forward. Correction (26 Oct 2026): removed a link to Webber Insurance's breach list, which only repeats Cyber Daily's report, and notes about pages that did not load; every fact on this card is from Cyber Daily's report. (source: Cyber Daily)
Cyber Daily — Way Forward third-party CMS incident (10 Sep 2026)
breaches australia identity
ABC News (10 September 2026) reports a Downing Centre Local Court hearing for Christopher John Duff, 40, who has pleaded not guilty to four counts of accessing restricted data held in a computer. NSW Department of Communities and Justice discovered a breach of the NSW Online Registry (court-user login portal) in March 2025; police say cybercrime detectives investigated alleged unauthorised access to 8,769 restricted documents between January and March 2025 (AVOs, details of minors, and other DCJ forms). Prosecutors allege Duff used ChatGPT to create Python scraper-style scripts for bulk download, then sought legal advice and “coaching” from ChatGPT after his registry login was shut down and before charge — and intend to rely on ChatGPT conversation records plus forensic testimony in what is described as among the first such Australian cases. Hearing stalled on volume (~10,000+ pages of proposed exhibits). Charged April 2025 after a search warrant in Sydney’s east; on bail. Allegations unproven. Primary: ABC; wire: ACS Information Age (10 Sep).
ABC News — Duff / NSW Online Registry ChatGPT hearing (10 Sep 2026)
breaches australia ai identity
Incidents
Wed 9 Sep
Updated Mon 26 Oct
Group-IB (9 September 2026) documents a Gigabud (GoldFactory) banking-trojan chain that installs a second Android app, Vwork, to create a work profile and drop a tampered banking app inside it. Work-profile isolation hides the trojan from the banking app’s malware checks on the personal profile. Confirmed on infected devices in Indonesia. Gigabud arrives as a sideloaded fake airline/tax/government app, demands Accessibility and overlay permissions, overlays fake logins and lock-screen capture, then drives taps via Accessibility under a black screen. Vwork is based on open-source Shelter but strips caller checks so other apps can create profiles, clone apps, and open them; setup is reduced to a single Chinese-language prompt. Order observed: Gigabud → Vwork within minutes → cloned banking app. Distinct from desk card mantax-otax-android-20260910. Primary: Group-IB. Updated 10 Sep 2026: The Hacker News reported the research on 10 September (7:33 pm Perth). (source: The Hacker News)
Group-IB — Vwork app cloning / Gigabud (9 Sep 2026)
breaches identity
Surfshark's 9 September 2026 incident report says unusual activity on an internal engineering test server was confirmed on 2 September 2026 after a human misconfiguration left the host reachable from the internet. The company contained the same day and finished remediation by 5 September. An unauthorised party accessed limited engineering material (parts of system binaries, internal service configurations, and some build-related credentials that had appeared in code history). Access was also gained to an isolated content-accessibility optimisation VPS used as a proxy with no user identities, IP addresses, encryption keys, or browsing traffic. Surfshark states no user data or production VPN services were affected, no customer action is required, and exposed secrets were rotated or retired. Primary: Surfshark blog incident report; wire: BleepingComputer (10 Sep 2026).
Surfshark — September 2026 incident report
breaches cloud identity
