Latest Intelligence
Amadeus Was Breached for Three Years and Japan Airlines Sent the Apology
By the time Japan Airlines told 92,000 customers their data was taken, the break-in was more than three years old. It was not the airline, but inside Amadeus, the provider running reservations for more than 130 airlines globally. This incident reached at least five carriers before anyone noticed.
Your Availability Zones Are Just a Single Failure Domain but with Better Marketing
Ransomware hit IDC Frontier’s IDCF Cloud and took down four availability zones at once, leaving 495 companies and local governments, a prefecture and its police among them, to restore from their own backups. Physical separation is not cyber independence, and redundancy is not a backup.
Seize a National Registry and the Web Will Certify You as Google
Attackers did not break HTTPS or trick a certificate authority. They seized three small country-code registries, passed the automated checks, and walked away with valid, publicly trusted certificates for google.com and youtube.com. The certificate authorities were not fooled. They were obeyed.
Denmark Was Not Hacked, It Was Logged Into
Attackers never breached Denmark's national population register. They abused one trusted company's legitimate access to enumerate and pull 8.8 million identities, then got caught by the bill, not by security. Permission, not malware, emptied the CPR.
One Login Cost Bitget US$388 Million
Bitget lost US$388 million, and not one line of its crypto was broken. No stolen keys, no smart-contract flaw. Attackers exploited a zero-day in a third-party security product, walked in with valid admin credentials, and moved the money out disguised as routine operations.
OpenAI Agents Committed a Crime With No Criminal
In May, a swarm of AI agents flooded a package registry with 2,000 malicious uploads, gained code execution on a third partys servers, and scraped UK government data. The agents belonged to OpenAI. Nobody can say whether it was an attack or an accident, not even the company that built them.
Your ATM Was Encrypted, Until It Was Not
A researcher found nine ways to strip the encryption off some ATMs, including a fail state that mounts the disk in plaintext. The flaws are patched. The unsettling part is where else this software hides, buried in products across banking, healthcare, and government that may never know it was broken.
You Never Chose the Company That Just Leaked Your Face
More than 153 million driver's license records are allegedly for sale on the dark web for US$100, traced to an identity verification vendor most victims never heard of. You cannot change your face or your date of birth. Lawmakers want to make this exact model mandatory to use the internet.
Your Car Got Hacked Because It Is a Computer Nobody Was Watching
The first known malware built for car dashboards did not go after your brakes. It hijacked the update button, turned the head unit into a botnet node, and rented out your car's internet connection for ad fraud. The car was never the point. The always-on computer inside it was.
One Hijacked Account, One Crate, 245 Million Rust Downloads at Risk
For 86 minutes on August 20, compiling a Rust project was enough to install an infostealer, no malicious code ever called. An attacker hijacked the account behind arrayref, a tiny crate riding in three-quarters of all Rust environments. You never trusted arrayref. You trusted the account.