45
45
45
45
45
First Agentic AI Data Breach Reported to Spanish Regulator
Spain's AEPD reported the first data breach executed by an AI agent, which autonomously chained login, vulnerability discovery, and personal data modification.
Spain's Data Protection Agency (AEPD) published details of the first breach notification in which an AI agent executed the attack, achieving a successful login, searching for vulnerabilities, and modifying personal data and accessing invoices. The agency called the agent's autonomous chaining of attack phases a qualitative change and urged updated risk analysis, faster incident response, and stronger credential protection. Investigation is ongoing; commentators cite possible causes including a guardrail jailbreak, an escaped test model, or an unauthorized LLM-based penetration test.
66
50
45
50
45
50
45
I Think the Military Commissary Freezers Were Hacked
Refrigeration failures at six-plus US military commissaries prompt speculation of a cyber attack on DeCA's remote monitoring systems; Pentagon acknowledges possible disruption.
The author documents near-simultaneous freezer and refrigeration failures at confirmed installations including Fort Huachuca, F.E. Warren AFB, Fort Irwin and Travis AFB on August 26-27, with freezers entering defrost mode that heated and spoiled food. DeCA's Remote Monitoring Control System controls defrost across roughly 182 locations, and an unverified comment attributed the Fort Huachuca failure to a network issue. Stars and Stripes and Military Times independently reported the multi-base failures, and the Pentagon acknowledged a 'possible refrigeration disruption,' though no evidence of hacking has been confirmed.
45
45
45
45
45
45
45
45
45
45
Three intrusions at UK criminal records office went undetected for two years
UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.
The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.
55
50
45
45
45
45
45
50
45
45
45
45
45
45
45
45
45
45