Search: “Thomson Reuters”

US and Canadian court data exposed in Thomson Reuters breach

Thomson Reuters disclosed a breach of its C-Track court platform exposing sealed court records and personal data across 12+ US states and Canada.

Thomson Reuters disclosed that an unauthorized party obtained files from C-Track, its court case management platform, affecting courts in at least 12 US states, the US Virgin Islands and Canada. The company discovered the activity on June 30 and evidence indicates access ran from March through June; the intrusion method, attacker identity and number of affected people remain unknown. Exposed data may include names, Social Security numbers, driver's license numbers, medical information, dates of birth and health insurance details, including some sealed or redacted court records. Affected individuals are being offered 12 months of free credit monitoring and identity theft protection.

The Record·Sep 3, 12:04 UTC · 13d agoData breach in the wild 2 sources

Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data

Unauthorized access to Thomson Reuters' C-Track court platform may have exposed SSNs and sealed records across 11 US states, USVI, and Ontario.

Thomson Reuters' West Publishing disclosed that an unauthorized party obtained files from the C-Track court case management platform starting in March 2026, with access to one environment running from March 1 through June 29, 2026 per Montana's account. Notices name roughly 24 court bodies across 11 US states, the US Virgin Islands, and Ontario, including appellate courts in Minnesota, Ohio, Montana, and Pennsylvania. Exposed data may include names, Social Security numbers, driver's license numbers, dates of birth, medical and health insurance information, and confidential or sealed court records. The company is offering 12 months of Experian or TransUnion monitoring, and courts disagree over whether the vendor's backup cloud environment or the production platform was accessed.

The Hacker News·Sep 3, 14:39 UTC · 13d agoData breach in the wild

Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Thomson Reuters disclosed a C-Track breach exposing court records and personal data across at least 12 US states, US Virgin Islands, and Canada.

Thomson Reuters discovered unauthorized activity in its C-Track court case management platform on June 30, 2026, tracing the intrusion to March 2026. Affected systems include Ontario's three courts, Wyoming's entire state judiciary, and appellate and supreme courts across at least 12 US states plus the US Virgin Islands. Exposed records may include names, Social Security numbers, driver's license numbers, medical information, dates of birth, and health insurance details, with some sealed court information possibly affected. The company is offering 12 months of free credit monitoring and reports no evidence of fraud so far; attribution and access method remain unknown.

Help Net Security·Sep 3, 00:00 UTC · 13d agoData breach

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online·Sep 7, 10:09 UTC · 9d agoIndustry

Open-Source AI & Open Models Reading List

Interconnects publishes a curated open-model reading list covering release strategy, US-China competition, adoption data, and a narrowed 4-6 month open-closed frontier gap.

The list, updated September 11, 2026, compiles essays on open-model strategy, licensing gradients, safety of open weights, adoption data, and Chinese open-source history. It notes leading open models have come from Chinese labs since roughly 2024, citing Kimi K3 and GLM-5.2/5.3, and that the open-closed gap has narrowed to roughly 4-6 months. It also documents Western adoption of Chinese models, including Perplexity's use of DeepSeek R1 and Thomson Reuters moving to Qwen, which has drawn lawmaker probes at DoorDash, Airbnb, Anysphere/Cursor, and Apple.

Interconnects·updated 13:01 UTC · 9h ago·first Sep 11, 12:36 UTC · 5d agoAI industry 18 sources1

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security·Sep 14, 12:23 UTC · 2d agoPolicy & legal

ICE Is Buying Access to Credit Card Records

Schneier on Security·Aug 7, 10:27 UTC · Aug 7, 2026Phishing & fraud

CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate

CISA and partners issue a joint advisory pressing organizations toward transparent breach notification and incident response as cyber outages escalate.

Dark Reading reports on a new joint government advisory led by CISA that signals a regulatory shift. The advisory presses organizations to adopt more transparent breach notification protocols and incident response practices. The guidance comes as cyber outages escalate and reflects growing government expectation of disclosure over spin.

Dark Reading·Sep 11, 18:44 UTC · 5d agoPolicy & legal1

7th September – Threat Intelligence Report

Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.

Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.

Check Point Research·Sep 7, 14:54 UTC · 9d agoAdvisory in the wildCVE-2026-83548CVE-2026-83549CVE-2026-823291

EU's Cyber Resilience Act starts the 24-hour vulnerability clock

EU Cyber Resilience Act reporting rules take effect, requiring manufacturers to disclose actively exploited vulnerabilities to ENISA within 24 hours, with fines reaching €15 million.

The Cyber Resilience Act's Article 14 mandatory reporting duties became applicable, requiring makers of products with digital elements sold in the EU — regardless of where they are based — to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of releasing a fix. Reports must be submitted through ENISA's Single Reporting Platform to the designated CSIRT, and non-compliance with these core duties can trigger fines up to €15 million or 2.5 percent of annual turnover. Manufacturers must also inform affected users of available fixes without undue delay, and most remaining CRA provisions, including mandatory SBOMs and security-by-design requirements, become applicable on December 11, 2027.

The Register · Security·Sep 11, 11:34 UTC · 5d agoPolicy & legal

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business News·Aug 28, 04:40 UTC · 19d agoPolicy & legal in the wild1

17th August – Threat Intelligence Report

Colombia's Ministry of Justice suffered a ransomware attack disrupting drug-monitoring and legal public services, per Check Point's 17 August 2026 threat intelligence report.

Check Point Research's weekly threat intelligence bulletin for 17 August 2026 leads with a ransomware attack on Colombia's Ministry of Justice. The attack affected part of the ministry's technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were impacted; the bulletin also aggregates other cyber research and attack discoveries from the week.

Check Point Research·Aug 17, 13:37 UTC · Aug 17, 2026Ransomware

The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities

Wiz Research's 2026 cloud risk report finds most high-severity findings lack a viable path to compromise, urging exposure-based prioritization.

Wiz Research telemetry underpins a State of Cloud Risk 2026 report arguing that the majority of high-severity security findings are not real attacker opportunities because they lack a path to compromise. The report pushes defenders to prioritize findings by exposure and exploitability rather than raw severity scores. No specific CVEs, victims, or incident counts are provided in the available text.

Wiz Blog·Aug 26, 15:01 UTC · 21d agoResearch

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer·Sep 8, 20:24 UTC · 8d agoPolicy & legal

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added actively exploited PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 to the KEV catalog, mandating federal patching.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2026-81578 (PaperCut NG/MF missing authentication for critical function) and CVE-2026-82078 (PaperCut NG/MF unsafe reflection). Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize and apply these updates. The KEV listing signals observed exploitation of the PaperCut print management platform.

CISA Advisories·Aug 31, 12:00 UTC · 16d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-82078

Launching managed CRA Article 14 reporting for open source maintainers

EU Cyber Resilience Act Article 14 reporting obligations begin, requiring 24-hour exploit and incident reports; Patchstack launches managed compliance for open-source maintainers.

Starting 11 September 2026, EU Cyber Resilience Act Article 14 requires manufacturers and open-source stewards to report actively exploited vulnerabilities and severe security incidents to ENISA via the EU Single Reporting Platform, with a 24-hour early warning, 72-hour notification, and final reports within 14 days or one month. Patchstack launched a free managed compliance service, acting as Assigned Representative for open-source maintainers and providing a managed VDP. The obligations apply retroactively to all products available on the European market. Patchstack, which has coordinated over 50% of known WordPress ecosystem vulnerabilities, already serves more than 1,000 open-source projects.

Patchstack·Sep 11, 12:20 UTC · 5d agoPolicy & legal

A Cautionary Tale About Data Breach Claims, Verification and Carhartt

Troy Hunt cautions that claimed Carhartt breach data requires verification, warning that criminals' breach claims are not always accurate.

Troy Hunt published a cautionary tale about data breach claims, verification, and apparel brand Carhartt. He argues that claimed breaches from cybercriminals should not be taken at face value and may stem from errors by the criminals themselves. The piece underscores the need to verify breach data before treating it as authentic, in the vein of Have I Been Pwned's validation practices.

Troy Hunt·Aug 25, 21:51 UTC · 22d agoData breach

A Secretive DHS ‘Predictive Policing’ Unit is Analyzing Americans’ Financial Habits and Pulling Them Over

404 Media reveals DHS Border Patrol's secretive Predictive Intelligence Targeting Teams (PITT) analyzing Americans' financial activity and feeding intelligence to local police for traffic stops.

404 Media identified Predictive Intelligence Targeting Teams (PITT) in the Spokane Sector (Washington) and Laredo Sector (Texas), which review law enforcement-sensitive databases including Americans' financial activity and pass intelligence to local police. In one case, a PITT analyst flagged financial patterns associated with narcotics activity, leading Montana Highway Patrol to stop a driver for an obstructed license plate and charge him with DUI and possession with intent to distribute. CBP declined to say what financial data is monitored or whether warrants are obtained; the program extends AP's earlier reporting on ALPR-based predictive policing.

404 Media·Sep 8, 13:10 UTC · 8d agoPolicy & legal

Intelligence Insights: August 2026

Red Canary's August 2026 Intelligence Insights report covers new threat actor debuts, departures, and threats targeting the blockchain sector.

Red Canary published its August 2026 Intelligence Insights, a monthly threat intelligence roundup. This edition highlights newly emerged threat actors, groups that ceased or reduced activity, and danger on the blockchain, likely threats to cryptocurrency and blockchain ecosystems.

Red Canary·Aug 20, 20:09 UTC · 27d agoThreat actor

CISA's logging guidance works beyond government

CISA released its Logging Reference Architecture in August 2026 to help federal agencies meet OMB M-26-14 logging requirements, usable as a benchmark by critical infrastructure operators.

CISA's Logging Reference Architecture (LRA), released in August 2026, helps US federal civilian agencies satisfy logging requirements in OMB Memorandum M-26-14 and explicitly encourages critical infrastructure operators to use it as a benchmark. The framework is organized around continuous event monitoring and threat hunting, investigation, response, and forensics, with a federal baseline of six months searchable and one year retrievable logs. Agencies must submit Agency Logging Plans within 90 days and work toward Advanced maturity within 320 days; the guidance also treats AI outputs as derived data requiring human review and preserved metadata.

Help Net Security·Aug 24, 00:00 UTC · 23d agoAdvisory

PNLD Confirms Data Breach Affecting UK Police and Justice Staff

Security Affairs·Aug 3, 12:23 UTC · Aug 3, 2026Data breach1

NIS2 compliance: Fixing IAM and access control before the 2026 audit

EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.

EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.

Help Net Security·Sep 1, 00:00 UTC · 15d agoIndustry

2026 Cyber Insurance Trends Report: What's Changed and What You Need to Know

Huntress survey: CIRCIA reporting mandates now live, BEC claims exceed ransomware, exfiltration-heavy attacks cost twice as much, premiums rising.

Huntress's 2026 cyber insurance trends report, based on its own survey, finds 79% of respondents carry cyber insurance while 58% report shrinking coverage over five years. New CIRCIA federal reporting mandates and EU NIS2 requirements are reshaping policies, business email compromise now drives more claims than ransomware, and data exfiltration has replaced encryption as the dominant ransomware tactic at roughly twice the cost. After three years of declining premiums, rates are climbing again, and most businesses now refuse to pay ransoms.

Huntress·Sep 1, 17:00 UTC · 15d agoIndustry1

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business News·Aug 20, 05:29 UTC · 27d agoPolicy & legal1

Hacker claims millions of records stolen from corporate Azure tenants

Threat actor TheHatman claims millions of employee records stolen from Azure tenants of nine Fortune 500 firms, including McDonald's, Vodafone, Kyndryl, and TCS.

A threat actor known as TheHatman posted large internal employee directories on cybercrime forums over the past week, claiming each was pulled directly from the victim organization's Azure tenant. McDonald's tops the list at roughly 1.7 million records, followed by TCS (~800,000), Vodafone (~425,000), and HCL (~250,000), with IHG, Kyndryl, Gap, Hexaware, and Wyndham also named. Hudson Rock found samples consistent with standard Azure directory exports and suspects infostealer-derived credentials rather than a systemic Azure zero-day. TCS filed a statement with the Bombay Stock Exchange saying it found no credible evidence of a breach and the data appears over four years old.

Help Net Security·Aug 18, 00:00 UTC · 29d agoData breach

Welsh environment regulator's FoI blunder exposes diversity data of 2,000 staff

Natural Resources Wales inadvertently exposed diversity data of about 2,000 current and former staff via a 2021 Freedom of Information spreadsheet published online.

Natural Resources Wales confirmed equality monitoring data of roughly 2,000 employees who worked between April 2013 and March 2018 was inadvertently disclosed in a spreadsheet released in 2021 in response to a Freedom of Information Act request. The data may have included ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities — special category data under UK GDPR. The breach was reported to the Information Commissioner's Office, the data was removed and permanently deleted, and NRW says it has found no evidence of misuse. The issue was discovered only after a member of the public alerted the regulator on 23 August 2026.

The Register · Security·Sep 7, 11:04 UTC · 9d agoData breach

Trump Authorizes Private Sector Participation in Offensive Cyber Operations

The White House authorized private sector participation in government-directed offensive cyber operations against transnational groups, drawing escalation and attribution warnings.

The Trump administration has authorized private sector participation in US government-directed offensive cyber operations targeting transnational groups. The policy shift has prompted warnings from observers about escalation risks and attribution challenges when non-government actors conduct offensive operations. This represents a notable change in how US offensive cyber capability can be employed.

Infosecurity Magazine·Aug 13, 12:35 UTC · Aug 13, 2026Policy & legal

Hackers Impersonate IT Support to Breach Leading Financial Companies

Security Affairs·Aug 7, 15:51 UTC · Aug 7, 2026Ransomware

Is Cyber missing the Marque?

Cisco Talos analyzes the White House memorandum on private-sector participation in government-authorized offensive cyber operations.

A new White House memorandum addresses private sector participation in government-authorized offensive cyber operations. Cisco Talos's newsletter, introduced by new author Mick Baccio, explores the operational and security implications of this policy for the cybersecurity industry.

Cisco Talos·Aug 20, 18:00 UTC · 27d agoPolicy & legal

From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO

Cyble argues security teams should express cyber risk in financial terms for CFOs instead of high/medium/low ratings, citing its 2025 threat forecast results.

Cyble published guidance on cyber risk quantification, arguing qualitative high/medium/low ratings fail to convey financial exposure to executives. The piece notes that over 80% of its 2025 threat predictions, including AI-driven ransomware and supply-chain attacks, materialized as anticipated.

Cyble·Aug 25, 09:45 UTC · 22d agoIndustry

What the AI Warning Letter Completely Missed

Opinion piece argues the recent AI warning letter identifies a risk window but omits which actors pose risks and who can mitigate.

This Dark Reading commentary critiques a recent AI warning letter for correctly identifying an approaching risk window while failing to name who is coming through it or who will close it. The piece is brief opinion commentary on AI risk discourse rather than a technical report.

Dark Reading·Sep 3, 17:23 UTC · 13d agoAI safety & security

Is Cyber Facing an Affordability Crisis?

Dark Reading analysis argues record breach costs and roughly $240 billion in cyber defense spending leave small businesses dangerously exposed, threatening supply chains.

The analysis examines an affordability crisis in cybersecurity, noting breach costs have reached record highs while defense spending approaches $240 billion. It argues small businesses are dangerously under-protected relative to rising attack costs. Weak small-business defenses are framed as a supply chain security risk for larger organizations.

Dark Reading·Aug 25, 14:53 UTC · 22d agoIndustry

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.

CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.

Security Affairs·Sep 1, 08:13 UTC · 15d agoVulnerability in the wildCVE-2026-81578CVE-2026-82078