Briefing — 7 September 2026

🎧 Subscribe to the podcast feed | Download episode

Security News

Hackers withdraw ~4k BTC (~$320M) from Liquid Federation wallet (Hacker News) — Approximately 3,900 Bitcoin has been drained from the Liquid Network federation wallet in what may be one of the largest single cryptocurrency thefts in history; investigation ongoing.

Alleged data breach of the United States Department of War (Threat Feed) — A dark web forum post claims access to sensitive US government defence data; unverified but flagged across multiple threat intelligence channels.

Alleged data leak of Steam — 29.7 million users (Threat Feed) — A threat actor is claiming to sell a 29.7 million account database from Steam; credential stuffing risk is high given Steam's payment integration.

Critical MikroTik Vulnerability — Patch Now (SANS ISC) — SANS Internet Storm Center is urging immediate patching of a critical vulnerability in MikroTik routing and wireless devices, which have historically been weaponised rapidly by nation-state actors.

Alleged data breach of Hospital Alemán (Threat Feed) — Argentine healthcare institution Hospital Alemán has appeared in breach disclosure forums; unverified claims of compromised patient data.

Claro Brazil — 46M phone numbers linked to CPF IDs for sale (Threat Feed) — A full 2026 Claro Brazil database containing 46 million phone numbers linked to national ID numbers is allegedly available on dark web forums, raising SIM swap and fraud risks.

Alleged data breach of Jinko (Threat Feed) — 3.7GB of Jinko care database data is being leaked on breach forums.

Alleged data breach of Medela (Threat Feed) — Medela, the medical device and breast pump manufacturer, has appeared in breach disclosure activity.

US Military disables ad trackers on personnel devices (Slashdot) — The US Military has removed advertising SDKs from devices issued to troops, citing location data and behavioural profiling concerns — a model civilian organisations with sensitive operations should consider.

Alleged data leak of The Wharton School (Threat Feed) — Data attributed to the University of Pennsylvania's Wharton School of Business is being shared on breach forums.

UK & Critical National Infrastructure

The Big Table Group (🇬🇧 UK) — Qilin ransomware: The UK hospitality group operating multiple casual dining brands has appeared on Qilin's leak site. Customers with accounts in The Big Table's booking or loyalty systems should be alert to phishing and credential exposure risks.

Ben Leeds Properties — SHADOWBYT3$ ransomware: A property firm with a Leeds-based name has appeared on the SHADOWBYT3$ leak site. If UK-based, this adds to a growing list of UK SMEs targeted by ransomware groups. Details are limited and the UK connection requires confirmation.

MikroTik critical vulnerability: Widely deployed in UK enterprise and ISP environments, the SANS ISC advisory on unpatched MikroTik devices is directly relevant to UK network operators. Patch immediately.

Philippine Ports Authority (Qilin): While not a UK victim, the ransomware attack on a national port authority is a CNI signal worth noting — UK port operators and logistics infrastructure should continue to treat ransomware groups as a tier-1 threat.

No new NCSC advisories in the past 48 hours.

Ransomware Victims (48h)

18 victims · 8 groups