Latest Intelligence
Amadeus Was Breached for Three Years and Japan Airlines Sent the Apology
By the time Japan Airlines told 92,000 customers their data was taken, the break-in was more than three years old. It was not the airline, but inside Amadeus, the provider running reservations for more than 130 airlines globally. This incident reached at least five carriers before anyone noticed.
Osaka's Backups Died in the Same Blast Radius as Its Servers
Ransomware did not just lock 500 servers at Osaka Metropolitan University. It encrypted most of the backups too, turning recovery into a rebuild and exposing data on 130,000 people. The real failure was never the break-in. It was backups that shared the blast radius.
Denmark Was Not Hacked, It Was Logged Into
Attackers never breached Denmark's national population register. They abused one trusted company's legitimate access to enumerate and pull 8.8 million identities, then got caught by the bill, not by security. Permission, not malware, emptied the CPR.
Eleven Years After the OPM Breach the Pentagon Lost Three Million More Records
OPM was supposed to be the breach that changed everything. Eleven years later, a Pentagon data hub exposed 3 million defense personnel through a file-sharing flaw nobody watched for nine months. DoD wrote the fix into its own 2022 strategy, then skipped it. The warehouses are still open.
Cyber Crime Put AI on the Payroll
Gambit Security cracked the staging server behind a card-theft campaign and found the AI crime story that actually arrived. One operator rented open-source AI agents to break into 119 online retailers and steal more than 600,000 credit cards, for roughly $25 a target.
Revolut Says No One Demanded a Ransom, the Internet Disagrees
A group claiming the Revolut breach demanded US$3 million in Monero, with a 24-hour countdown clock, and never once contacted Revolut directly. The demand was public from the start. That is the inversion worth noticing. The pressure was not a private negotiation. It was everyone else watching.
Nobody Broke Into Revolut, They Just Asked
Revolut handed a stranger its customers passports, selfies, and full transaction histories. Nobody broke in. A fraudster asked, using a legitimate government email domain, and Revolut said yes. No hack, no exploit, just an email and a lie, and the trust a bank extends to anything official.
McKesson Was Breached by a Phone Call, Not a Zero-Day
ShinyHunters claims 284 million patient records stolen from McKesson, which moves a third of North America's prescriptions. Read that carefully: records, not patients. McKesson confirmed a breach, not the number. The healthcare data now sits behind a login a convincing voice can open.
You Never Chose the Company That Just Leaked Your Face
More than 153 million driver's license records are allegedly for sale on the dark web for US$100, traced to an identity verification vendor most victims never heard of. You cannot change your face or your date of birth. Lawmakers want to make this exact model mandatory to use the internet.
Berlin Won't Pay VICE SPIDER and Here Is Why It Changes Nothing
Berlin refused to pay the ransomware crew that breached its network. Good. But the data was already gone a week before anyone pulled the plug. Refusing to pay is the honorable call, and it does not save you. The failure that mattered happened quietly, days earlier.