Threats & incidents
-
France suspends Vacaf holiday aid platform after beneficiary data incident
France’s national family benefits body has taken the Vacaf holiday aid platform offline after receiving a report of exposed beneficiary data. Regular family benefit payments are unaffected, the agency says.
-
Cohesity data points to rising UK ransomware claims in latest quarter
Newly reported Cohesity threat figures indicate a 60% quarterly increase in UK ransomware activity, with a small number of groups accounting for a substantial share. The figures require careful interpretation.
-
H&M investigates cyberattack allegation but reports no confirmed compromise
H&M is examining claims circulated by cybercriminals but says it has no evidence its systems or data environment were compromised. The retailer has not confirmed a breach.
-
Ahold Delhaize takes network systems offline while investigating security issue
Dutch retailer Ahold Delhaize says it has isolated some systems in response to a network security incident. Stores remain open, but the company has not disclosed the cause or extent of any compromise.
-
French supermarkets lose chilled stock after refrigeration cyberattack
Supermarket chains in France have reported disrupted refrigeration after attackers altered remote controllers, forcing stores to remove stock and assess damage. Investigators are examining the mechanism and scale.
-
Luna Moth files portray law firm extortion as a managed service operation
Check Point’s analysis of an unverified leaked archive depicts an organised extortion workflow focused heavily on law firms and telephone-based deception.
-
Fake Claude installers conceal malicious redirects behind Google and Bing
Push Security has identified a paid-search campaign that passes through apparently reputable search destinations before delivering a fake Claude installer.
-
Attackers turn compromised backup servers into cryptocurrency miners
Attackers are exploiting flaws in AhsayCBS backup software to establish persistent access and install cryptocurrency miners, threatening infrastructure used by managed service providers.
-
SonicWall exploitation attempts observed after critical SMA1000 patch
Independent honeypot research indicates attacks targeting a newly patched SonicWall gateway vulnerability, although successful compromise has not been established.
-
GhostAction attack expands from GitHub secrets into cloud credentials
Researchers have documented a new GhostAction wave that planted malicious workflows across hundreds of GitHub repositories and sought credentials from their histories.