The fashion retailer says an attacker impersonated a trusted contact to obtain an employee' credentials and access information on third-party platforms. The incident highlights why protecting customer data requires controls over people, identities and external services—no just the main shopping website. … Read more

An AI agent's unauthorized access to a government statistics portal has exposed a gap between technical capability and organizational accountability. Australia's policy challenge is to establish clear reporting rules without confusing a serious security incident with a proven compromise of personal medical records. … Read more

Research into commercial spyware, advertising-derived location data and government technology contracts points to a difficult accountability question: when surveillance depends on private infrastructure, who is responsible for protecting the people being monitored? … Read more

The marketplace operated from 2018 to 2020 and handled more than four million transactions involving illegal products and services. These included controlled substances, stolen account credentials, personal information, counterfeit currency and computer-hacking tools. Prosecutors said drug sales accounted for nearly $375 million of the marketplace's activity. … Read more

Anthropic is expanding controlled access to its most capable cybersecurity-oriented AI models by combining Project Glasswing with its Cyber Verification Program (CVP). Announced on October 6, 2026, the updated program introduces three access tiers intended to match a security team's permissions and safeguards to the nature of its work. … Read more

Autonomous artificial intelligence agents can do more than answer questions or automate routine tasks. When equipped with tools that access websites, APIs, and external services, they can also generate substantial network traffic and interact with systems beyond what their operators intended. A recent investigation by the Wikimedia Foundation illustrates why those capabilities require strict technical boundaries and accountable oversight. … Read more

A data security incident disclosed in August 2022 exposed personal information associated with approximately 2.5 million student loan borrowers. The incident involved Nelnet Servicing, a technology provider whose online services supported borrowers served by EdFinancial and the Oklahoma Student Loan Authority (OSLA). … Read more

A cyber-espionage campaign documented in 2022 demonstrated how a seemingly ordinary visit to a news website can become an opportunity for digital reconnaissance. Researchers from Proofpoint and PwC identified activity that used emails impersonating an Australian news outlet to direct selected recipients to a deceptive website delivering ScanBox, a JavaScript-based reconnaissance framework. … Read more

A 2022 report identified more than 80,000 Hikvision cameras vulnerable to CVE-2021-36260. Learn what the critical flaw means and how organisations should respond … Read more

The 2022 phishing campaign exposed a critical weakness in enterprise identity security: authentication can still fail when attackers persuade employees to hand over both their passwords and verification codes. … Read more