Incidents
Sat 5 Sep
Updated Sun 25 Oct
Mathspace's incident blog (published 5 September 2026, last updated 8 September 2026) says attackers exploited a security vulnerability in its self-hosted Metabase internal-reporting install, obtaining administrator access without a legitimate login. Metabase published a critical advisory and patches on 6 August 2026; Mathspace says its vulnerability-notification process did not escalate that advisory, and it only updated on 29 August after a later Metabase notice. Unauthorised access dated from 10 August 2026 AEST; data was downloaded from the Australian reporting database on 27 August; Mathspace confirmed the historical access on 3 September. About 1,079,819 people in Australia and New Zealand were affected (students, parents/guardians, school staff, and Mathspace staff). Exported fields included user ID, username, names, email, country, time zone, user type, email-verification status, and last-active / last-login / date-joined. Passwords, SSO tokens, API credentials, academic records and school-link tables were not exposed. School notifications began 4 September. Mathspace notified the OAIC, ASD's ACSC, NZ OPC, NZ NCSC, and Australian state/territory education departments. The timeline matches Metabase CVE-2026-72898 (GHSA-vwf4-m7j8-wcjf); Mathspace's post does not name the CVE. Primary: Mathspace incident blog.
Mathspace incident blog (updated 6 Sep 2026)
breaches australia cloud
Incidents
Fri 4 Sep
Updated Mon 26 Oct
Trezor's blog (original 13 August 2026; updated 4 September 2026) says ShipMonk, a shipping provider, suffered unauthorized access. On 2 September 2026 Trezor was told the breach also held order data from prior cooperation (November 2019–August 2021) that ShipMonk had repeatedly assured in writing had been deleted. That tranche affects about 67,000 further US customers with full exposure of name, email, phone, shipping address and order number; all were emailed from privacy@satoshilabs.com. Hardware wallets are not affected; phishing and physical-security risk rise for exposed addresses. Earlier August disclosures covered customers who ordered to US/UK/Sweden/Colombia/Brazil/Italy/Portugal between 10 May and 8 August 2026 (about 11,742 in the original summary, with later August clarifications). Trezor did not say how ShipMonk was breached. According to BleepingComputer (13 August 2026), breach notification emails that ShipMonk sent to affected customers, which BleepingComputer reviewed, said the attackers exploited a vulnerability in Metabase's software, and BleepingComputer has since learned that ShipMonk received extortion emails from the ShinyHunters extortion gang. Trezor has not confirmed either point. Primary: Trezor blog update. Updated 11 Sep 2026: Trezor separately disclosed on 10 September a phishing wave sent from its account at its newsletter provider, Brevo; that story is now on its own desk card. Correction (24 Oct 2026): an earlier version said unlinked reporting tied ShipMonk's break-in to a specific Metabase CVE number rated CVSS 10.0 and named ShinyHunters as a claimed extortion actor. The card now credits BleepingComputer, which names Metabase but not a CVE number, and the Brevo phishing story has moved to its own card. (source: BleepingComputer)
Trezor blog — ShipMonk incident (updated 4 Sep 2026)
breaches identity cloud
Arctic Wolf Pack Alert (3 September 2026) tracks PREY-0058: executives (directors/VPs) are cold-called by actors impersonating internal IT/help desk and steered to authentication-themed lure domains (assignpasskey.com, mfaregister.com, nowsso.com, oskeysetup.com, oursso.com, passkey-mfa.com, passkeydeploy.com, registermymfa.com, setpasskey.com and org-specific subdomains). An operator-gated AiTM Microsoft 365 login harvests credentials and MFA approvals; stolen sessions are replayed via residential proxies (notably NodeMaven, often same geo/ASN as the victim). Post-access discovery hits SharePoint/Entra (SearchQueryPerformed with contentclass:STS_Site/STS_Web and indexdocid pagination), then bulk exfil from SharePoint, OneDrive, Exchange, and Box — no endpoint malware or network lateral movement observed. Overlaps GTIG UNC6671 tradecraft; related extortion brands cited include BlackFile, Pink, Helix, Cinder, and Redact (affiliate/rebrands, not a single proven identity). Targets primarily US construction/engineering, healthcare/pharma, real estate, finance, professional services. Defences: phishing-resistant MFA (FIDO2/device-bound passkeys), Conditional Access (device compliance; block proxy/hosting ASN), Continuous Access Evaluation, tighten SharePoint scope, train staff that IT will not cold-call for passkey enrolment. Wire: The Hacker News (7 Sep 2026). Distinct from BigBear Evilginx2 PhaaS already on desk.
Arctic Wolf Pack Alert — PREY-0058 (3 Sep 2026)
breaches identity cloud
iTnews (3 September 2026) reports the Australian Communications and Media Authority fined Telstra $277,000 for not applying required identity-authentication processes to prevent SIM-swapping fraud. ACMA said the fraud caused at least $39,500 in losses to 15 customers between January and October 2025, with 13 further attempts where agents failed to add fraud protections or to act on risk signals; ACMA member Samantha Yorke said frontline staff did not follow Telstra's own processes. SIM swaps let attackers move a victim's number onto their own SIM and intercept MFA codes and other mobile traffic. ACMA accepted court-enforceable undertakings for stronger fraud prevention and staff training. Context in the same report: a larger $1.551 million Telstra penalty in July 2024 for related ID-authentication failures, and more than $5 million in ACMA telco fines to date on mobile-number fraud. Watchlist relevance: Telstra.
iTnews (3 Sep 2026)
australia identity
Incidents
Thu 3 Sep
Updated Fri 23 Oct
Verve Portraits, a family photography business that Cyber Daily describes as Sydney-based with studios in NSW, Victoria and Queensland, told Cyber Daily (8 September 2026) that it is "currently responding to a cyber incident involving unauthorised access to some company data". The company said the incident was contained as soon as it was detected, that it engaged independent cyber security specialists, and that the limited sample data reviewed so far includes a combination of company records and customer content. It says it is still assessing the full scope and that individuals identified as impacted will be contacted as they are discovered. According to Cyber Daily, the Settra extortion group listed the company in a 3 September leak post. UPDATE 22 Oct 2026: re-sourced to the company's own statement; this card previously rested on a leak-site listing alone (source: Cyber Daily, 8 Sep 2026). Correction (23 Oct 2026): removed Settra's own claims about the volume and content of the data, which Verve Portraits has not confirmed. (source: https://www.cyberdaily.au/security/14158-exclusive-verve-portraits-data-allegedly-compromised-by-settra-ransomware-attack)
Cyber Daily — Verve Portraits data allegedly compromised by Settra ransomware attack (8 Sep 2026, updated with company statement)
australia
Incidents
Thu 3 Sep
Updated Fri 23 Oct
Machinery management specialist Macquarrie has confirmed it is responding to a cyber security incident at a third-party supplier, Cyber Daily reported on 14 September 2026: 'The Sharp Motor Group and machinery management specialist Macquarrie both recently confirmed they were responding to a cyber security incident at a third-party supplier.' On 15 September Cyber Daily reported that Sharp Motor Group, Penfold Motors and Macquarrie 'have all confirmed their incidents were linked to a third-party cyber incident, which Cyber Daily understands was the one just disclosed by Auto-IT'; Auto-IT told Cyber Daily it could not comment on individual customers, and Cyber Daily does not quote Macquarrie naming the supplier (see auto-it-storm-20260915). No Macquarrie customer notice, OAIC entry or ACSC advisory has been found. Primary: Cyber Daily (14 Sep); Cyber Daily (15 Sep).
Cyber Daily — Exclusive: Penfold Motors latest car dealer to fall victim to the Storm ransomware group (14 Sep 2026; Macquarrie confirmation)
australia ot ics
Incidents
Thu 3 Sep
Updated Sun 25 Oct
BleepingComputer (3 September 2026) reports France’s CNIL fined Hôpital privé de la Loire (HPL, Ramsay Santé group, Saint-Étienne) €500,000 for GDPR security and notification failures after a summer 2025 intrusion into the electronic patient record system exposed sensitive data of 524,867 patients plus 202,246 trusted third parties (about 727,000 people). CNIL findings cited include external physician access without VPN or multi-factor authentication, overly broad access once an account was compromised, lack of near-real-time monitoring that let exfiltration run for days, and failure to directly notify the trusted-third-party cohort (Articles 32 and 34 GDPR). HPL strengthened controls during proceedings. Practitioners: remote clinical access needs MFA and VPN; least privilege on EPR; detection that catches multi-day bulk extract; notify every category of affected individual. Correction (25 Oct 2026): removed a sentence that rested on the attacker's own account of how he got in and what he did with the data. (source: BleepingComputer)
BleepingComputer (3 Sep 2026)
breaches identity
Incidents
Wed 2 Sep
Updated Sun 25 Oct
Microsoft Threat Intelligence (2 September 2026) documents a human-operated campaign abusing Microsoft Teams external collaboration: actors in a separate Microsoft 365 tenant impersonate IT/helpdesk, coax users past external-tenant labels into granting interactive remote access (Teams request-control, Quick Assist, or similar RMM), then use PowerShell to silently install a malicious MSI from cloud storage that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, Active Directory reconnaissance, desktop capture, and WinRM lateral movement toward domain controllers and other high-value hosts. Expel (20 August 2026) independently details a related Teams helpdesk-phishing delivery of SynkLoader (MSI presented as “PowershellCleaner” from an Azure blob endpoint; sender display name IT Service Desk on a *.onmicrosoft.com tenant), including a PhishLocker module that shows a fake Windows lock screen designed to trick the user into giving up their system login credentials, plus a tunneling module for follow-on access. ScamDrill (17 September 2026) and CyberSecurityNews (22 September) summarize the same pattern for SMB defenders. Not a Teams product CVE — social engineering of legitimate external chat and remote-support features. Distinct from desk card prey-0058-m365-vishing-20260903 (phone vishing + AiTM MFA-registration domains). Australia relevance: M365/Teams tenants with open external access — restrict to trusted domains, verify unsolicited IT chats out-of-band, control Quick Assist/RMM, and hunt MSI→Node.js under LocalAppData plus user-context WinRM.
Microsoft Security Blog — Impersonating IT support / Teams remote-session intrusion (2 Sep 2026)
breaches identity cloud
West Publishing Corporation (Thomson Reuters Court Management Solutions) notified courts that an unauthorised party obtained files from the C-Track appellate case-management platform in March 2026; activity was discovered 30 June 2026. The Supreme Court of Ohio public statement says ten of twelve Ohio Courts of Appeals use C-Track hosted by the Court and managed by TRCMS; the 8th and 10th districts do not and are unaffected; TRCMS told the Court on 31 August 2026 that unauthorised access hit the production platform. The Hacker News (3 Sep) summarises West’s 2 September notice: courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario may be in scope; a subset of records could include names, SSNs, driver’s licence numbers, dates of birth, medical and health-insurance information; sealed or redacted material may be impacted for some courts; TRCMS says no evidence of fraud or misuse to date and offers Experian IdentityWorks (US) / TransUnion myTrueIdentity (Canada) monitoring via engagement B171847 and https://www.ctracknotification.com. Distinct from other court or identity cards on this desk.
Supreme Court of Ohio C-Track incident statement
breaches identity
Incidents
Tue 1 Sep
Updated Thu 22 Oct
KrebsOnSecurity (1 September 2026) reported a dark-web identity-theft service branded Nexus advertising digital scans of more than 153 million US and Canadian driver’s licences plus millions of other ID cards, travel documents and medical cards. Krebs’s checks pointed to Louisiana identity-verification firm IDScan.net as the likely source; the company said it was investigating and the FBI New Orleans field office opened an inquiry. SecurityWeek (3 Sep) and Ars Technica (2 Sep) corroborated the listing. BleepingComputer (4 September 2026) reports multiple lawsuits against IDScan, with firms including Markovits, Stock & DeMarco and Hall Attorneys launching investigations into potential class-action litigation. Nexus appeared to shut shortly after Krebs published. Organisations that rely on third-party ID-scan vendors should treat this as a supply-chain identity risk. NEW 10 September 2026 (BleepingComputer): IDScan published a 4 September 2026 security notice (initially noindex) stating it learned on or around 1 September that an unauthorised party may have accessed or copied customer information in IDScan.net cloud accounts — full names and driver's licence or other government ID numbers — and that investigation continues with third-party specialists. IDScan's notice does not mention the Nexus listing or the 153 million figure; the link between the two comes from KrebsOnSecurity's reporting. UPDATE (IDScan notice, updated 29 September 2026): IDScan says an unauthorised third party gained access to a portion of its cloud environment between 4 April and 2 September 2026, that the event was limited to its VeriScan platform, and that the information potentially involved could include full name, contact information, date of birth, and driver's licence, passport or other government ID numbers, varying by how each customer organisation used VeriScan; it says it is not aware of misuse. UPDATE 16 September 2026 desk: primary_url switched to IDScan.net press notice (datePublished 4 Sep 2026) stating unauthorised access/copy of cloud customer info may include full names and driver's licence or other government ID numbers; free credit monitoring offered; cooperating with federal law enforcement. ACS Information Age (8 Sep) re-covered the dump for AU readers — no new scope beyond vendor notice. Correction (22 Oct 2026): an earlier version said IDScan's notice tied the company to the 153M+ licence dump; the notice does not mention the dump, and that link is KrebsOnSecurity's reporting. (source: https://idscan.net/press-release/notification-of-data-security-incident/)
IDScan.net — Notification of Data Security Incident (4 Sep 2026)
breaches identity
Decrypt published on 1 September 2026 that Dropbox had emailed users about unauthorised access between 4 and 21 August 2026 via Lenovo ID single sign-on. A Dropbox spokesperson told Decrypt the company identified unauthorised access affecting Dropbox accounts connected through Lenovo ID that did not have Dropbox two-factor authentication enabled, and that an issue with Lenovo email verification allowed an unauthorised party to register a Lenovo ID using another person's email address and then use that Lenovo ID to log into the Dropbox account associated with that address. The spokesperson said approximately 5,000 Dropbox accounts were impacted, less than a third of those had files viewed or downloaded, and Dropbox had emailed all impacted users; users who did not receive an email were not impacted. Decrypt also reported that Dropbox's notification letter said logs showed no evidence files were viewed or downloaded, and that Dropbox has since changed how Lenovo IDs can access accounts. Affected user Yoni Levy posted screenshots of a new-browser sign-in alert from near Canary Wharf (Chrome on Windows, 18 August) and said he had never had a Lenovo account. This desk has not found a Dropbox public advisory page; the company notice in hand is the user email plus the spokesperson comments to Decrypt.
Decrypt (1 Sep 2026; Dropbox spokesperson)
breaches identity cloud
Coder published GitHub advisory GHSA-vx42-ghc9-gw65 on 1 September 2026 (Critical). An unidentified actor gained access to Coder's Cloudflare infrastructure and added unauthorised IP addresses to the pool used for the Coder module registry (registry.coder.com). Those addresses hosted a malicious copy of registry artefacts. For a short window the registry served malicious packages to a subset of users. The implanted code was designed to identify credentials and exfiltrate them to a lookalike domain (coder-infra.com). Coder says it has no indication that any customer data maintained by Coder was impacted. Users who downloaded a Coder Registry module between 07:35 UTC and 21:45 UTC on Monday 31 August 2026 may be affected (new templates or template versions; also workspace creation if module caching is disabled). Coder recommends reviewing firewall, DNS and VPC logs for outbound traffic to coder-infra.com, purging cached modules from the affected window, rotating potentially exposed credentials, and updating Coder. Patched versions: 2.37.0, 2.36.4, 2.35.7, 2.34.9. Affected: versions before 2.37.0.
Coder GHSA-vx42-ghc9-gw65 (1 Sep 2026)
tech cloud
