Skip to content
REALNEWS HUB

Topic

Cybersecurity & Data Breaches

Hacks, data breaches and ransomware attacks, and what each one means for the people whose data was exposed.

What you need to know

  • A hacking group called ShinyHunters claims it stole personal records on about 38,000 FBI staff, including addresses and phone numbers.
  • The FBI says it is investigating the claim and trying to determine if its own systems or a contractor's were breached.
  • A former UK cyber security chief says the breach, if confirmed, would be among the most severe on record.
  • Separately, Australia's PM confirmed a rogue AI agent built on OpenAI technology breached a government statistics site linked to Medicare.
  • OpenAI has withheld release of a new AI model, GPT-6.1 Astra, after it failed internal safety checks on staying within its intended scope.
  • Rival Anthropic earlier withheld a different model after finding it unusually effective at finding software flaws.
ExplainedHow did hackers steal $6.3bn from Binance?Attackers compromised Binance using deceptive recruitment interviews and an internal artificial intelligence system, draining $6.3 billion in cryptocurrency in an assault US authorities link to North Korea.Read the explainer →

World· Verified

South Korea replaces passports for president and 167 others after data breach

South Korea’s foreign ministry said on Tuesday it was taking steps to reissue passports for all 168 people affected by an online leak of sensitive personal information, including President Lee Jae Myung and first lady Kim Hea-kyung, as police investigate how the data was exposed. “The foreign ministry is swiftly taking measures to ensure the smooth reissuance of passports for all affected individuals, including the president and first lady,” ministry spokesman Park Doo-soon said during a...

Finance· Verified

Crypto industry scrambles to upgrade security after record Binance theft

Crypto exchanges are taking quick action to bolster their defences and urging greater industry-wide information-sharing after a record $6.3 billion hack of Binance exposed their vulnerability just as they become more embedded in mainstream finance. Coinbase said it made adjustments to its systems that store cryptocurrency keys offline “solely out of an abundance of caution”, while Kraken said it was monitoring industry incidents for lessons it could apply to its defences. But the industry will need to move urgently, analysts and industry executives said, as United States President Donald Trump’s regulators promote deeper integration of digital assets into the financial system, raising the stakes for an industry with a history of big hacks. “For crypto to reach its full potential, the security situation must be addressed immediately,” said Chris Perkins, Franklin Templeton’s head of crypto. Binance, the world’s largest crypto exchange, halted withdrawals after Thursday’s attack, which analysts blamed on North Korea and said it would use company funds to cover the losses. Binance co-CEO Richard Teng said on X that the complex attack may have begun with a compromised software engineer’s laptop, giving hackers access to systems used to process withdrawals. The company later found additional breaches, while software designed to erase traces of the attack hampered the investigation. Rival crypto exchanges moved quickly on Friday to shore up their own systems and to reassure customers that their tokens were safe. Full-time teams at Kraken look for potential vulnerabilities every day, a Kraken spokesperson said. Still, even as the industry reeled from the biggest cryptocurrency heist of all time, executives expressed confidence that Binance had sufficient resources to cover the losses and that the hack would not have broader financial repercussions. Bitcoin fell more than 4 per cent on Thursday while ether, the second-largest cryptocurrency, fell more than 5pc, although both tokens recovered some of that ground on Friday. “Our expectation is the industry writ large will actually not suffer material losses, even though Binance is obviously going to have to deal with the exploit directly,” said Josh Riezman, chief legal and strategy officer at crypto firm GSR. The bulk of the heist unfolded in around 20 minutes late on Thursday and bore similarities to previous attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis. North Korea routinely denies involvement in cryptocurrency thefts, and its mission in Geneva did not respond to requests for comment. Hack involves social engineering, money laundering While much remains unclear, social engineering, a common tactic in which hackers trick victims into revealing sensitive information or granting access to systems, may have been involved in compromising the laptop, security experts said. Harry Donnelly, CEO of Circuit, a crypto risk infrastructure company, said companies are planning more employee training to guard against social engineering attacks. In such attacks, hackers race to launder the funds before the exchange detects the breach and token issuers freeze assets. Stablecoin issuer Tether said it had frozen nearly $1.57bn linked to Binance, while Circle said it froze $800 million. Bitcoin and ether cannot be frozen because no single entity controls the coins. Chainalysis said the hackers appeared to be using sophisticated laundering patterns it had not seen before. On Friday, some crypto exchange executives called for the industry to develop a coordinated hack detection system. “We need a real-time alert system that allows participants to share information immediately when a hack occurs, coordinate a rapid response, and temporarily freeze suspected stolen funds,” said Star Xu, CEO of crypto exchange OKX, in a post on X. GSR’s Riezman added that the Binance hack could spur the industry to act: “As we’re at this kind of confluence moment for traditional finance and digital assets, I think it’s obviously important that we continue to improve, and I think this, if anything, will be a catalyst for that.”

Technology· Developing

Homeland Security staff records exposed after non-profit posts data on 40,000 workers

Information released by Distributed Denial of Secrets is the third such government data disclosure in the last month The leak website Distributed Denial of Secrets said on Wednesday it has released data on more than 40,000 Department of Homeland Security (DHS) employees, including details about officials working in sensitive fields such as surveillance and human intelligence. DHS did not immediately return a message seeking comment. Continue reading...

Technology· Verified

Starlink users targeted by Israeli ad firm in suspected surveillance campaign

By Raphael Satter WASHINGTON, Oct 27 (Reuters) - Experts at a digital defense firm recently found that an Israeli ad tech company was heavily targeting users ofStarlink's satellite internet service in a likely effort to spy on them, according to six people familiar with the matter.

AI· Developing

Anthropic says Claude AI skirted paywall to reach Georgia vote figures

Latest example of unauthorised behaviour shows AI model bypassed paywall to access data as part of statistics project Business live – latest updates Anthropic sued for allegedly using 274 Elvis songs to train AI models Anthropic’s Claude model accessed voter data in the US state of Georgia, the AI company has confirmed, in the latest example of unauthorised behaviour by the technology. The AI model managed to bypass a paywall to reach data that is publicly available but is typically accessible only after paying a fee. Claude accessed aggregate vote counts as part of a statistics project at Anthropic, which is preparing for a $1.5tn (£1.1tn) flotation. Continue reading...

Politics· Verified

UK urges households to store three days of emergency provisions

The British government advised the public on Friday to keep three days of emergency supplies at home, a message it said had been hammered home by this week’s PHP software glitch, as well as a record-setting summer of heat, drought and wildfires. Governments and businesses worldwide have rushed to secure systems running the PHP programming language after flaws were disclosed on Wednesday, forcing some services offline and triggering millions of hacking attempts in one of the most significant cybersecurity incidents in recent years. The British government said the internet outage showed the importance of its newly launched “Be Ready” campaign, which advises the public to keep three days of bottled water and non-perishable food in the house. Prime Minister Andy Burnham, hosting a meeting on the response to wildfires, said that in the past Britain had been “on the back foot” responding to emergencies and that it needed to be more proactive. The government announced a new wildfire response plan that includes deploying military aircraft. Defence Secretary Wes Streeting said cyber incidents such as the PHP outage would become more common as AI made it easier to find ways to thwart traditional defences. He also cited risks from hostile states, organised criminals and climate change. The UK was facing a greater level of threat “than we have certainly for most, if not all, of my lifetime”, he said during an appearance on the BBC’s ‘Question Time’ programme broadcast overnight. Britain’s advice is similar to that issued by the European Commission, which told EU citizens last year to keep a 72-hour emergency kit containing supplies such as food, water, cash and power banks.

Technology· Verified

PHP security flaw discovered with AI triggers global website shutdowns

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems. Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years until they were uncovered using AI, saying that all users were “encouraged to update immediately.” With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution. Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of fixes. AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP: Black. He said the next step was the “mass compromise of every vulnerable web server on the internet”. PHP, a language that dates back to the early 1990s and initially stood for “Personal Home Page”, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning that any critical vulnerability potentially has enormous knock-on consequences. “All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the Internet.” Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched. Even some world leaders, who don’t typically get involved with software updates, weighed in. Japanese Prime Minister Sanae Takaichi, in a post on X, said website owners should “check whether your live site uses PHP and prepare to apply the new fix.” Bug found with AI The flaw in PHP was discovered using artificial intelligence, Alphabet-owned cybersecurity company Wiz said in a blog post. The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to have taken advantage of, the post said. “Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.” Wiz said its research relied on Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said it coordinated with the PHP team, OpenAI, and the cybersecurity company Calif on the discovery of the vulnerability and patch verification. The company said it also partnered with Google Cloud, Cloudflare, Amazon’s AWS, Microsoft, WordPress.com operator Automattic, and other companies such as Fastly, Akamai, Imperva, and Vercel to protect customers and prepare mitigations. In a statement, the White House said it was made aware of the flaw on Friday. “This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security. Critical software When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers. Because of its ubiquity, PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs, and because the vulnerabilities are considered so dangerous, experts are anxious about a potentially vast pool of sitting ducks. AI-assisted hacking campaigns, which have proliferated in recent weeks, would only make things worse, said Lukasz Olejnik, a visiting senior research fellow at King’s College London. “The scale is huge, and with AI, exploitation may happen instantly, on a large scale,” Olejnik said. The risk is particularly acute for small websites run by individuals or organisations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers. Security experts said such sites could take longer to patch and remain exposed well after fixes become available. Mass outages In the Netherlands, several organisations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital websites. Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform. Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”. France’s Interior Ministry said it had placed all of its websites into preventive maintenance. Japanese cloud service provider Sakura Internet said on Wednesday it had suspended a database appliance function. A screen displays the unavailable French government website, info.gouv.fr, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany on October 21, 2026. — Reuters

Load more