Briefing — 3 October 2026

🎧 Subscribe to the podcast feed

Security News

Apple Changes macOS Full Disk Access Permissions to Curb AI Agent Abuse (Ars Technica) — Apple is tightening macOS privacy controls after acknowledging that increasingly capable AI agents substantially increase the risk of third-party apps gaining broad access to files, messages, mail, and browsing history.

Warlock Ransomware Exploits SharePoint Vulnerabilities in Water and Telecom Attacks (BleepingComputer) — A Warlock ransomware campaign exploited unpatched SharePoint vulnerabilities to breach a water utility, a telecom provider, a regional government, and a university in the same attack wave.

Frontline Education Data Breach Impacts School District Employees (BleepingComputer) — Attackers exploited a third-party software vulnerability to access Frontline Education systems; exposed data includes Social Security numbers for staff across multiple school districts.

NightSpire ransomware hits Forma Therapeutics — Seven gigabytes stolen from the biotechnology firm, including clinical trial data, electronic lab notebooks, research IP, and drug discovery pipeline information — among the most sensitive data types in a ransomware breach.

Trezor customer data circulating on underground forums — A threat actor claims to be selling Trezor hardware wallet customer records including order details, personal information, and email addresses — a high-value target given customers' likely crypto holdings and physical device shipping addresses.

Flink Germany — 5.3M records for sale — The German instant grocery delivery platform's data is being offered on dark web forums, covering one million customer accounts, nearly 14,000 staff records, and 4.3 million order records with payment details and delivery addresses.

Carrefour Belgium — 63,000 records with banking data — A threat actor claims to have breached Carrefour Belgium's database; exposed data includes names, dates of birth, email addresses, and bank account details.

China Railway 12306 — 221 million records claimed for sale — An actor on dark web forums claims to be selling a dataset purportedly containing 221 million China Railway user records including names, national ID numbers, and contact details. Scale unverified.

1,287 UK payment cards for sale — A batch of British payment cards is being sold on underground forums alongside Belgian cards, including full card numbers, expiry dates, CVVs, and cardholder names — a direct threat to affected UK consumers.

UCLA root access for sale — Unauthorised root access to UCLA systems is being offered on Telegram-based marketplaces, alongside access to Indonesian government targets including a district court, a regional government, the BMKG meteorological agency, and Bank Indonesia.

UK & Critical National Infrastructure

Three confirmed UK ransomware victims in this forty-eight hour window: parkdental.com (chaos group — ⚠️ Healthcare), Sports Events365 (qilin — Hospitality), and Dynamic Office Solutions (qilin — Professional Services). The dental practice hit is the most sensitive — patient records, clinical data, and potential NHS system integrations.

The Warlock ransomware campaign against a water utility and telecom operator via SharePoint vulnerabilities is the primary CNI threat this cycle. Both sectors are critical national infrastructure under the UK NIS Regulations. UK operators should cross-reference with NCSC's SharePoint and Microsoft vulnerability guidance and verify patching status immediately.

1,287 UK payment cards are being sold on dark web forums — a small but concrete indicator of active financial data harvesting targeting British consumers.

No new NCSC advisories in the past 48 hours.

Ransomware Victims (48h)

33 victims · 16 groups