Security News
N0n exposes 1.7 billion Infutor consumer rows — SSNs in plaintext
The threat actor N0n has posted what may be the single largest consumer data exposure of 2026, targeting US data broker Infutor Data Solutions. Over 1.7 billion rows were exfiltrated including 590 million survey responses, 1.1 billion address history entries, and Social Security Numbers stored in plaintext. N0n separately posted data from Staples/SBD (381,964 margin records, 30 SSNs from chat logs), Lampenwelt GmbH in Germany (81 million search queries), and Higginbotham insurance brokerage (217,000 client policy documents spanning 2013–2026). These are pure data exposure operations — the material is reportedly accessible now.
€133M French bank heist via service provider — Crédit Mutuel Arkéa
Crédit Mutuel Arkéa suspended systems after attackers moved through a service provider to initiate fraudulent transactions totalling €133 million. Customer accounts were locked as a precaution. This is the classic third-party supply chain attack applied directly to financial settlement infrastructure.
British soldier blackmailed after ignoring SIM removal order in Estonia
A British soldier deployed near the Russian border in Estonia was targeted for blackmail after leaving his SIM card active, contrary to standing OPSEC orders. Adversaries used location data obtained via the active SIM to coerce him. A stark real-world example of individual-level electronic discipline failure in a forward-deployed context.
SonicWall CVE-2026-19868 exploited — SAML MFA bypass for VPN access
CVE-2026-19868 is a SAML authentication bypass in SonicWall SSL-VPN appliances that allows attackers to skip multi-factor authentication entirely. Under active exploitation. Emergency patch available — organisations running affected firmware should treat this as urgent given the appliance's prevalence at network perimeters.
Chinese MSS asset placed close to Jensen Huang
A Chinese businesswoman reportedly recruited by the Ministry of State Security cultivated access to Nvidia CEO Jensen Huang's inner circle, according to reporting from the New York Times. The case reflects the persistent focus of Chinese intelligence on semiconductor leadership, with Nvidia's AI chip dominance making it a primary collection target.
NHS Royal Cornwall — breach helpline staff suffering burnout one year on
Helpline staff supporting patients affected by the 2025 Royal Cornwall NHS Trust breach are experiencing emotional distress at a rate health trust leaders describe as unsustainable. One year after the initial incident, the human cost of a healthcare breach extends far beyond the technical. Cyber incidents in the NHS carry long tails.
ARTEX/Storm-3358: agentic AI targeting financial sector
Microsoft has published new threat intelligence on ARTEX (Storm-3358), a threat actor deploying autonomous AI agents to target financial organisations. The group uses agentic AI for reconnaissance, targeted phishing, and early-stage intrusion steps with minimal human direction. This represents an escalation beyond simple AI-assisted phishing generation.
GPT-6 Cyber: 81 Firefox flaws and 948 Linux exploits discovered autonomously
The autonomous vulnerability discovery system GPT-6 Cyber has catalogued 81 unpatched Firefox vulnerabilities and 948 Linux kernel exploits in its latest evaluation run — discovered without human prompting. Whether and when this material becomes operationally available to threat actors remains the central concern for the security research community.
CISA Known Exploited Vulnerabilities
No new KEV additions in the last 24 hours.
Ransomware & Threat Activity
N0n — 14 victims (data exposure)
Infutor Data Solutions 🇺🇸 Technology — 1.7B rows, SSNs in plaintext ⚠️ | Staples/SBD Inc. 🇺🇸 Retail — 381,964 margin records, 30 SSNs | Lampenwelt GmbH 🇩🇪 Retail — 81M search queries | Higginbotham 🇺🇸 Insurance — 217,000 policy docs 2013–2026 | Company #138 🇨🇦 Financial Advisory | Company #139 🇺🇸 Entertainment | Company #140 🇨🇦 Financial Planning | Company #141 🇺🇸 Apparel | Company #142 🇰🇷 Consumer Electronics | Company #143 🇺🇸 Apparel Retail | Company #144 🇺🇸 Athleisure | Company #145 🇺🇸 Outdoor Footwear | Company #146 🇺🇸 Appliance Retail | Company #147 🇺🇸 Coffee Retail
metaencryptor — 7 victims
Daeah E&C 🇰🇷 Manufacturing — nuclear/power plant construction, 100GB ⚠️ CNI | Hyundai Engineering & Construction 🇰🇷 Manufacturing ⚠️ | Proterial America 🇺🇸 Manufacturing — high-grade metals/magnetics | Christie Digital Systems 🇺🇸 Technology | DAEWON Chemical 🇰🇷 Manufacturing | Wooshin Systems 🇰🇷 Automotive Technology | Pekin Insurance 🇺🇸 Financial Services
rhysida — 2 victims
Tribunal de Justica do Estado de Minas Gerais 🇧🇷 Government & Defense ⚠️ | Treuhand & Immobilien Abt AG 🇨🇭 Financial Services
payload — 4 victims (Germany 🇩🇪)
Autohaus Arnold | Retail/Automotive | Brauco | Pipeline Services | Schroers Ingenieure | Engineering | Otto Stops | IT Services
safepay — 1 victim
by.zivor.co.il 🇮🇱 Education/Jewish Studies
Total: 28 victims across 5 groups. N0n accounts for 14 listings — the most prolific data exposure actor currently active.
Threat Intelligence Feed
Hindustan City Gas 🇮🇳 Oil & Gas — 361,952 customer records breached. | Israel Electric Corporation — customer phishing campaign exploiting utility brand. | ACCESSTRADE 🇻🇳 Affiliate Marketing — 1.8 million records including 228,000 user accounts. | Defacer Indonesia — mass website defacement campaign targeting UK, Brazil, Philippines, Saudi Arabia, Mexico, Lebanon.