Japan's Cloud Provider Hit, 1.36 Million Accounts at Risk

Sakura Internet, a Japanese provider of web hosting, cloud, and data centre services, has disclosed that attackers accessed its sales management system, according to Bleeping Computer. Up to 1,360,563 customer accounts may have been exposed.

The breach began on August 9 and was only discovered during a separate investigation into an earlier, smaller incident at Sakura's rental server service. That first intrusion involved unauthorised logins to 583 accounts and the installation of malware on Sakura's systems. The company invalidated the compromised credentials and removed the malware — but the follow-on investigation revealed a far larger exposure underneath.

Contract and membership data was stored in the affected system. The good news: passwords were stored in hashed form (scrambled into a format that is very difficult to reverse), and no credit card details were held there. No data exfiltration (the theft of data off a company's systems) has been confirmed so far.

Sakura has notified authorities and is contacting affected customers individually. The company confirmed this was not a ransomware attack.

Sakura is a designated provider for Japan's Government Cloud programme, which adds a layer of national security significance beyond the customer impact.

What you should do: If you hold or have held a Sakura Internet account, change your password immediately and enable two-factor authentication. Check whether you reused that password anywhere else and change it in those places too.

The NSA, CISA, FBI, and several other U.S. agencies have jointly warned of an active campaign targeting Siemens S7 Series PLCs (Programmable Logic Controllers — the specialised computers that control physical industrial processes like water treatment, power generation, and manufacturing), according to The Hacker News.

Attackers are using AI to generate exploit scripts from publicly available information on the S7-200, S7-300, S7-400, S7-1200, and S7-1500 Series, then disguising them as legitimate monitoring tools. They scan the internet for exposed or outdated systems using services like Censys and ZoomEye.

The danger is the lowered barrier: AI means attackers no longer need deep technical expertise to target industrial infrastructure. A successful hit could disrupt power, water, food production, or chemical facilities.

What you should do: If your organisation operates industrial control systems, isolate them from the internet, apply all available patches, and monitor for unusual network activity.

What Microsoft Entra ID is: Microsoft Entra ID is a cloud-based identity and access management service — the system that verifies who you are and controls what you can access across Microsoft 365 and connected apps.

What it is: A deserialization flaw (where an application converts user-supplied data back into executable code without properly checking it first) allows an unauthenticated attacker to run arbitrary code on Microsoft's servers over a network connection.

Who's at risk: Any organisation using Microsoft Entra ID was theoretically exposed. Microsoft has confirmed active exploitation in the wild, though no customer action is needed.

CVSS: 10.0 (Critical — the highest possible score). Patch today — though in this case, Microsoft has already applied the fix on their end.

Root cause: The service failed to validate untrusted data before converting it back into active objects. Think of it like a mail room that opens every package and assembles whatever is inside without checking whether the contents are safe.

Attack vector: An unauthenticated attacker sends a specially crafted network request to the Entra ID service. The service deserializes the payload without validation, triggering code execution on Microsoft's infrastructure. No credentials or user interaction were required.

Detection strategies: Microsoft handled the mitigation server-side, so traditional patch detection won't apply. Review your Entra ID sign-in logs for unexpected authentication events around and before the disclosure date. Look for unfamiliar service principals or newly granted admin permissions.

Recommended actions:

1. Confirm your Microsoft 365 tenant is receiving service updates — no manual patch is required, but verify your environment reflects the current service version.
2. Audit recent Entra ID activity logs for anomalous sign-ins or privilege changes.
3. Enable Conditional Access policies and alert on unusual admin role assignments.

Email filters were built to catch known threats. AI-generated phishing emails are designed to look like normal business correspondence, personalised using public information from LinkedIn and company websites. A Harvard Business Review study found AI-crafted spear phishing (targeted, personalised phishing) hit a 54% click-through rate. Filters alone will not cut it.

The article from Bleeping Computer makes a useful point: assume some phishing will always reach the inbox. The better question is what you have in place once it does.

What you should do: Pair your email filter with endpoint detection software and identity monitoring. Enable multi-factor authentication on every account so that a stolen password alone cannot open the door. When in doubt about an email, call the sender directly using a number you already have.

CISA has added CVE-2026-64849 to its Known Exploited Vulnerabilities catalogue and ordered U.S. federal agencies to patch within two weeks, according to Bleeping Computer. MLflow is an open-source platform used to build and manage AI applications. The flaw allows an unauthenticated attacker to reach internal systems and steal cloud credentials such as AWS access keys. Attackers began scanning for vulnerable instances within hours of the CVE being assigned.

What you should do: If your organisation uses MLflow, upgrade to version 3.15.0 immediately and audit your logs for signs of unauthorised access.