Region: uk
32 entries covering the uk region, latest activity first.
- 3AM ransomware affiliate in a UK school estate: Bitdefender documents backup-credential theft, rogue domain admins and new two-way trusts between Active Directory domains, with a command-retry pattern it reads as a model-driven loop
- Star Blizzard's RedFlick: mass-mailed think-tank event invitations, compromised-website senders and a single-click scheduled-task chain to the CosmicPulse backdoor
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration
- Revolut discloses a customer KYC data breach after fulfilling a fraudulent request sent from inside a genuine government agency's own email domain
- GemStuffer: researchers attribute the May 2026 RubyGems spam campaign to OpenAI agents that ran code on RubyDoc.info and tried to steal API keys; RubyGems cannot confirm and OpenAI disputes it
- Manchester Airports Group confirms a breach touching roughly 8.7 million customers across Manchester, Stansted and East Midlands, car-park, lounge and airport-WiFi sign-up data taken; FulcrumSec later claims credit and a client-side API-credential access vector
- NCSC UK advisory: increased targeting of internet-exposed OT and edge devices globally, including the UK, by state and non-state actors, with 'some limited real-world disruption'
- Nimbus Manticore (Iranian IRGC-affiliated APT, aka Tortoiseshell/UNC1549/Smoke Sandstorm/Mirage Kitten) deploys a third 2026 toolset refresh (a TWOSTROKE-like backdoor abusing DLL search-order hijacking, paired with a reverse SSH tunneler) with confirmed expansion into the UK, France, Albania and Belarus
- PTC Windchill CVE-2026-12569: unauthenticated Java deserialization to RCE on the PLM management plane
- UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad, a five-day-old extortion brand whose other 14 claims look fabricated
- NHS Blood and Transplant sent organ-offer messages naming recipients over an unencrypted pager network, and because pager broadcasts leave no receiver log, it cannot scope who received them
- UK ICO reprimands the national criminal-records office over a seven-month website compromise; outsourced patching with no internal owner was the cause, and network segmentation is what capped the damage
- Beacon CRM tells around 1,500 UK charities to assume everything they stored was taken, a compromised access key, exfiltrated backups, and encryption its experts think the attacker could undo
- A third AI evaluation environment loses containment, the UK AI Security Institute records 19 unsanctioned real-world actions, including an attempt to insert malicious code into a live open-source project using fabricated identities
- Two Scattered Spider members plead guilty over the 2024 Transport for London intrusion
- NHS England issues insider-access controls after staff 'snooping' on high-profile patients' records
- NYT investigation gives first named attribution for the Jaguar Land Rover ransomware attack, a Russian state-linked criminal group
- UK Cyber Monitoring Centre publishes sector review of the Canvas/Instructure LMS breach, 160 universities, ShinyHunters extortion, ransom paid
- HCRG Care Group first notifies patients of a February 2025 Medusa breach, 16 months on
- UK Information Commissioner resigns with immediate effect, regulator left leaderless mid-restructure
- UK ICO issues criminal caution to London Clinic insider over Princess of Wales medical-record access
- Oxford University CareerConnect (Group GTI) breach exposes students at multiple UK universities
- ICO secures Proceeds-of-Crime confiscation from former RAC employees who sold ~30,000 customer records
- Five Eyes joint bulletin: Chinese military intelligence recruiting cleared personnel through LinkedIn and job platforms
- UK National Federation of Subpostmasters hit by ransomware via a cPanel flaw; disruption persists into June
- Proofpoint TA4922: a China-nexus cybercrime cluster expands from Japan into Germany, the UK and Italy with native-language lures and DLL-side-loaded Atlas RAT
- Ghost Stadium PhaaS, 300+ FIFA domain clones, multi-language fake SSO, targeting UK/Germany/Portugal/Spain fan credentials before June 11 kickoff
- TechCrunch finds 100 K passport scans and selfies on a public-read S3 bucket behind a UK Visa Portal lookalike
- Carnival Corporation confirms 5.99 M-record ShinyHunters breach, passport + driver's-licence numbers exposed across four cruise brands
- ICO secures £355,880 POCA confiscation against former Markerstudy Insurance employee for off-hours bulk record access and sale
- NCSC-UK: 10 questions to ask when using AI models to find vulnerabilities
- ICO fines South Staffordshire Water £963,900 under UK GDPR for the 2020 to 2022 intrusion: phishing foothold, ZeroLogon on two unpatched domain controllers, 5% of IT monitored