Breach of the Day

Two members of ShinyHunters — the cybercriminal group behind breaches at Ticketmaster, AT&T, and, notably, the FBI itself — have been arrested within a week of each other, according to The Record.

Saif al-Din Khader, identified by security journalist Brian Krebs last November as a key figure in the group, was detained in Jordan on September 28. He is 16 years old. Separately, Dutch national Pepijn van der Stap — himself a convicted hacker who had only recently completed a previous prison sentence — was arrested by the FBI and Dutch National Police on September 29.

Khader is reportedly cooperating with law enforcement and helping identify other ShinyHunters members. His arrest follows the takedown of the group's leak site, though the group promptly reappeared on Telegram claiming to restart a defunct criminal forum.

The FBI breach at the centre of this investigation was significant. Attackers obtained names, home addresses, phone numbers, Social Security numbers, and email addresses for nearly every FBI agent, along with records for thousands of local police officers working on joint task forces.

ShinyHunters has publicly stated it will not release the FBI data, describing the breach as a response to an advisory they disagreed with. Whether that holds is another matter.

What you should do: If you are a law enforcement employee or have worked with federal agencies in any capacity, assume your contact details may be in circulation. Enable call-screening on your phone, freeze your credit with all three major bureaus, and be especially cautious of unsolicited contact from anyone claiming to know your personal details.

German authorities have identified a 16-year-old Romanian national as the alleged ringleader of KillSec, a ransomware operation linked to roughly 500 confirmed attacks worldwide, according to Dark Reading. At least 70 of those targets were government organisations.

The takedown, dubbed "Operation KillSwitch," involved law enforcement from Germany, the United States, the United Kingdom, Spain, Romania, and Greece, coordinated by Europol and Eurojust. Authorities raided eight properties across four countries and arrested three individuals. Investigators seized five servers and 110TB of stolen data. KillSec's leak site was taken over and redirected to a law enforcement notice.

The alleged ringleader was arrested in Alicante, Spain. A second suspect, Dutch national Fouad Eltibrizi, was arrested in the UK on September 30 and faces US extradition charges related to unauthorised computer access conspiracy, carrying a maximum sentence of ten years.

KillSec operated by exploiting known software vulnerabilities and poorly secured cloud access points to break into enterprise systems, then threatening to publish stolen files unless victims paid a ransom. Investigators also found evidence the group used AI to map potential victims and build its infrastructure.

What you should do: KillSec targeted organisations with known, unpatched vulnerabilities and weak access controls. Check that publicly exposed services require multi-factor authentication and that software is kept current.

Air Traffic and Navigation Services (ATNS), the South African state company that manages air traffic and weather operations across roughly 10% of the world's airspace, has discovered malware linked to ransomware on an operational technology (OT) network — the specialised systems that control physical infrastructure rather than standard office IT, according to Dark Reading.

ATNS says its internal teams detected suspicious activity in systems supporting weather services for air traffic control and moved quickly to contain it. Preliminary analysis found malware consistent with the early stages of a ransomware attack, along with signs of data exfiltration (files being copied and sent out) to external IP addresses based in China.

Two incidents at two separate facilities are now under investigation. The OT compromise occurred at Port Elizabeth Airport in South Africa (FAPE). A second, distinct incident — possibly an insider theft of data — took place at Maputo International Airport in Mozambique (FAMM). These are geographically separate events at separate airports in two different countries. A third site, East London Airport in South Africa, may also have been caught up in the OT incident, though the documentation is unclear on that point.

ATNS is now seeking outside cyber-forensics firms to investigate, having publicly issued a request for quotes on 18 September. The company believes the attack was stopped before any disruption to flights occurred.

This is part of a broader trend. Ransomware attacks against aviation targets increased sixfold in 2025, according to aviation firm Thales.

What to do: If you work in or near critical infrastructure and receive unexpected prompts to open files or change credentials, escalate it immediately — do not assume it is routine.

A threat group called JadePuffer — tracked by Microsoft as Storm-3168 and identified by Sysdig researchers as the first documented AI-driven ransomware operation — compromised a Microsoft Azure environment in early June and spent hours methodically dismantling it, according to a Microsoft Security Research blog post published on September 25.

The attacker compromised two service principals (automated accounts that cloud applications use to authenticate and perform tasks) belonging to the same Azure tenant. One spent roughly 15 hours performing reconnaissance, logging more than 300 successful read operations across virtual machines, subscriptions, and resource groups. The second then swept the same environment in five seconds flat.

Sixteen hours later, the destructive phase began. Over 100 attempts to delete storage accounts followed in rapid succession — most succeeded. A Key Vault, Function App, and App Service plan were wiped. Attempts to delete SQL databases failed only because the attacker used an outdated API version.

Microsoft found that the compromised account credentials had been posted in plaintext to a public GitHub issue by an employee of the targeted organisation. The issue was later edited to remove them, but the edit history remained publicly visible.

No ransom note was observed and data exfiltration was not confirmed — but the pattern is consistent with ransomware and extortion operations.

What to do: Search your organisation's public GitHub history for any committed or posted credentials. Rotate any service principal secrets immediately if you find them. Enable audit logging on your cloud accounts so destructive operations trigger alerts in real time.

Singaporean crypto exchange Bitget confirmed this week that hackers stole $387.5 million from its platform, according to The Record. The company's CEO, Gracy Chen, held a public town hall after the breach and said IP addresses, behavioural patterns, and on-chain signatures all point to North Korea's Lazarus Group — a state-backed operation responsible for some of the largest crypto heists on record.

The attack began when hackers breached a backend system handling Bitget's wallet services and exploited vulnerabilities to push through a wave of unauthorised transfers. Blockchain security firms caught $175 million moving out before the larger withdrawals were complete. The final figure came to $387.5 million in ETH, XRP, USDC, and other cryptocurrencies.

Withdrawals are currently suspended while security firms Mandiant and SlowMist assist with the investigation. Several platforms have already frozen funds linked to the hackers' wallets. Bitget has launched a recovery bounty program offering a 5% reward to any platform that voluntarily freezes attacker funds, and another 5% if funds are actually recovered.

The company says its User Protection Fund, which holds over $464 million, will cover all losses — so customers should not be out of pocket. North Korea stole more than $2 billion from cryptocurrency platforms in 2023 alone, and $3 billion between 2017 and 2023 according to United Nations investigators. Chen drew a direct comparison to last year's $1.5 billion Bybit theft, noting that exchange survived, and Bitget intends to as well.

What you should do: If you hold funds on Bitget, monitor the platform's official communications for updates on when withdrawals resume. For your other exchange accounts, enable withdrawal address whitelisting where available — it prevents transfers to addresses you have not pre-approved, which limits damage if credentials are ever compromised.

CrowdSec, a French cybersecurity firm that makes threat-detection tools, discovered in September that 170 of its private GitHub repositories had been stolen back in May, according to Dark Reading. The whole operation took nine minutes.

The attackers used the Shai-Hulud worm — malware spread through a supply chain attack (where malicious code is hidden inside a trusted software package that developers install routinely) on the TanStack npm package — to compromise a former employee's computer. That machine still held a working GitHub OAuth token (a type of access credential that lets applications read account data without a password) tied to the ex-developer's account. The account still had full read access to CrowdSec's private repositories because the company had not revoked it when he left.

Between 5:52 and 6:01 am UTC on 22 May, the attacker downloaded the contents of 170 repositories. CrowdSec only discovered the breach on 16 September, when someone posted an archive of the stolen source code on an underground forum.

CrowdSec says no infrastructure, databases, or build pipelines were tampered with. The stolen material was source code only.

The lesson is almost painfully simple: when someone leaves your organisation, revoke their access the same day. Not the same week. That day.

What you should do: If you run any project on GitHub, audit your organisation's member list today. Remove anyone who no longer needs access.

Ludwig Maximilian University of Munich, one of Germany's largest universities with more than 52,000 students, confirmed a cyberattack on Saturday, according to The Record.

An attacker accessed a server holding enrollment records. The university's own assessment: the data was almost certainly taken.

The compromised records span names, dates of birth, contact details, LMU email addresses, and bank account information. Health insurance numbers and identifiers tied to Germany's student financial aid programme may also be in the mix. In some cases, the stolen data could include reasons students applied for a leave of absence — information most people would consider deeply private.

Exam results and academic performance records were not affected.

LMU spotted the breach on Wednesday but has not yet confirmed when the attacker first got in, how long they had access, or how many students are affected. No ransom demand has been publicly disclosed. The compromised server is now offline, external security specialists are involved, and the university is monitoring dark web forums for signs the data has surfaced.

Universities make attractive targets precisely because they hold large volumes of sensitive personal and financial records while running complex, sprawling networks.

What to do: If you are or were recently enrolled at LMU Munich, watch your bank account for unusual activity and consider placing a fraud alert with your bank. Be wary of any unexpected emails or calls referencing your student details — attackers who hold this kind of data often use it to craft convincing phishing attempts.

Gyazo is a cross-platform tool that lets you capture screenshots, GIFs, and short screen recordings, then instantly share them via a link. Millions of people use it daily for quick visual communication. On 11 September, a hacker found a vulnerability in Gyazo's image upload server and used it to run malicious commands on the system, according to SecurityWeek. Helpfeel, the Japanese company behind Gyazo, removed the attacker the following day — but not quickly enough.

In that window, the hacker accessed roughly 23.6 million user records. What's in them: names, email addresses, password hashes (scrambled versions of passwords), device IDs, X (Twitter) integration tokens, billing information, and usage data. Payment card numbers were not taken.

The more alarming number is 490 million — that is how many image metadata records were also accessed. That metadata could allow someone to reconstruct URLs for images users may have believed were private. A list of private images was also compromised, though Helpfeel has not confirmed how many.

What you should do: Change your Gyazo password now, and change it anywhere else you used the same one. Enable two-factor authentication on your account if you haven't already. If you stored anything sensitive in a Gyazo screenshot — a document, a login screen, anything confidential — treat that content as potentially exposed.

Roblox — an online gaming and social platform with hundreds of millions of users, particularly children and teenagers — had over 610,000 accounts stolen and sold, according to Ukrainian prosecutors.

A 19-year-old from the city of Drohobych allegedly organised the operation between May 2025 and April 2026, recruiting two 22-year-old associates to help run the sales infrastructure. Their method centred on stolen session tokens, also called cookies — small files a website stores on your device after you log in. If someone steals yours, they can access your account without ever needing your password. Think of it like copying your hotel key card: the lock has no way to tell it wasn't you.

The group disguised information-stealing malware as gaming cheat tools or free in-game bonus software, then harvested the tokens those programs collected. Automated software sorted the stolen accounts by value, checking for virtual currency and rare items. Premium accounts were sold individually; lower-value ones were bundled in bulk. Accounts sold for as little as 70 Russian rubles ($0.80 each), with prosecutors estimating the total operation could have generated around $480,000.

Investigators traced nearly $54,000 in confirmed cryptocurrency proceeds. All three suspects are in custody facing charges including theft, money laundering, and unauthorised access to computer systems, with a maximum sentence of 12 years.

What you should do: If you or your child plays Roblox, log in and check the active sessions in account settings. Sign out of any device you don't recognise. Enable two-factor authentication while you're there.

Revolut, the British fintech app with over 80 million customers worldwide, confirmed it handed sensitive customer data to fraudsters after being fooled by a fake emergency data request sent from a real government email account, according to The Record.

The attackers appear to have compromised a legitimate government domain — likely Italian, based on posts that circulated briefly on Telegram — and used it to submit what looked like an authorised request for user information. Because the email came from a trusted address, Revolut complied.

The exposed data is extensive: birth dates, home and email addresses, phone numbers, passport and driving licence copies, verification selfies, bank statements, IBAN numbers, and full transaction histories including Bitcoin activity.

The targets were not random. The attackers focused on high-net-worth individuals with ties to crypto businesses. Cryptocurrency entrepreneur Marc Zeller and Mark Karpelès, former CEO of the Mt. Gox bitcoin exchange, were among those publicly confirming their data was taken.

The attackers subsequently demanded an extortion payment, threatening to release the stolen data if Revolut refused. Revolut declined to confirm or deny whether any payment was made.

This technique — using compromised law enforcement or government accounts to extract user data under false pretences — is not new. The Lapsus$ group used the same playbook against Apple, Meta and Discord in 2021 and 2022.

What you should do: If you use Revolut, monitor your account for unusual activity and be alert to phishing attempts using your personal details. Consider placing a fraud alert with your bank if you hold significant assets through the platform.