Briefing — 4 October 2026

🎧 Subscribe to the podcast feed

Security News

🚨 Alleged Sale of NHS England Data — 38.23 Million Records (Threat Feed) — A threat actor is claiming to sell a dataset of 38.23 million NHS England records including NHS login IDs, NHS numbers, full names, dates of birth, and email addresses. Unconfirmed; NHS England has not issued a statement at time of publishing.

Alleged Data Breach of Tata Consultancy Services (TCS) (Threat Feed) — Source code, private keys, hardcoded credentials, API keys, SQL files, and configuration files claimed stolen from one of the world's largest IT services providers; downstream risk to TCS clients is significant.

Alleged Data Breach of PenFed Credit Union (Threat Feed) — Approximately 3,024,095 member records for sale including names, email addresses, phone numbers, and addresses from one of the largest US credit unions.

Gunra Ransomware — New Group Emerges (Threat Feed) — New ransomware group claimed two victims: Teuto Bauelemente GmbH 🇩🇪 (60GB, 4–5 day publication deadline) and Ambassador Tours & Travels (600GB, 2–3 day deadline). Large initial data volumes suggest experienced operators.

Alleged Data Leak of IRGC (Threat Feed) — A group claims to have leaked 10GB of internal Islamic Revolutionary Guard Corps documents including weapons training materials and Basij operational files. Authenticity unverified.

Alleged Data Breach of smava (Threat Feed) — German online lending platform; 1,015,030 records including names, email addresses, postal addresses, phone numbers, and birth dates for loan applicants — high sensitivity financial data.

Alleged Data Breach of Clinica Vesalio 🇵🇪 (Threat Feed) — 1,011,464 patient records from a Peruvian private healthcare centre, including patient names, DNI numbers, doctor information, consultation details, and appointment data.

Alleged Sale of Chile Ministry of Education Data (Threat Feed) — 3,046,248 records from 8,045 Chilean schools including student and tutor names, RUT identifiers, and other personal data.

Alleged Data Breach of Direktorat Jenderal Ketenagalistrikan 🇮🇩 (Threat Feed) — Indonesia's electricity directorate general database claimed breached. Energy sector targeting continues.

Alleged Data Leak of Worldwide VIP Records (Threat Feed) — Threat actor claims 19.6 million records from a "VIP section worldwide" dataset. Details sparse; scale claim notable.

Oxford University Press DDoS (Threat Feed) — Tunisian Maskers Cyber Force claimed a DDoS against Oxford University Press, a UK-based academic publisher.

UK & Critical National Infrastructure

⚠️ NHS England — 38.23 Million Records Claimed for Sale
The most significant UK cyber threat indicator of this cycle. A dark web actor is advertising 38.23 million NHS England records covering NHS login IDs, NHS numbers, names, DOBs, and email addresses. If genuine, this would represent one of the largest breaches of any national health system globally. NHS England has not confirmed the incident. UK defenders should be on high alert for NHS-adjacent phishing and credential-stuffing campaigns leveraging this alleged dataset.

🇬🇧 Westrop Primary & Nursery School — Hit by The Gentlemen ransomware group. A UK primary school victim underlines that educational institutions of all sizes remain active targets. The Gentlemen showed five victims this cycle across three continents.

Oxford University Press DDoS — UK academic publisher targeted by Tunisian Maskers Cyber Force. Low impact but part of a broader pattern of pro-Palestinian hacktivist activity against Western institutions.

No new NCSC advisories in the past 48 hours. UK defenders should continue to monitor the ongoing Warlock ransomware SharePoint exploitation campaign against water and telecoms infrastructure (confirmed yesterday).

Ransomware Victims (48h)

29 victims · 12 groups