cybersecurity

A data breach at the Pentagon has reportedly exposed personal information belonging to more than 3 million people. Details about how the breach occurred, when it happened, and who is responsible remain limited, but the scale makes it one of the larger breaches tied to US defense infrastructure. Cybersecurity observers are watching closely for confirmation from officials and guidance for affected individuals.

BBC News is examining an incident in which artificial intelligence was reportedly used to hack into a government system, and asking how such a breach was possible. The report is drawing wide attention as people debate the security risks of AI and how governments should protect themselves against increasingly capable tools.

A data breach at the Pentagon has affected nearly 3 million people, according to reporting by US broadcaster WQAD. Details about who carried out the breach, what data was exposed and who is at risk were not immediately available. The scale of the incident makes it one of the larger breaches involving US defense infrastructure in recent memory, and officials have yet to give a full public accounting.

Reports suggest the FBI has suffered a data breach that could rank among the most significant in the agency's history. Details about the scale of the intrusion and what information may have been compromised remain limited, but the prospect of attackers penetrating the country's top law enforcement agency has drawn widespread attention and concern.

The hacking group ShinyHunters says it will not publish sensitive data belonging to the FBI, according to a report by CBC News. The statement comes after claims that the group obtained access to sensitive FBI information. It is not clear how the group acquired the data or why it has chosen not to release it, and the FBI has not commented.

Reports circulating online allege a data breach involving FBI employee information. Details remain sparse: it is not clear what data was accessed, how many individuals are affected, or who is responsible. The FBI has not issued a public confirmation, and cybersecurity watchers are urging caution until official statements clarify the scope of the incident.

Dutch police have arrested a suspected hacker as part of an investigation into the ShinyHunters cybercriminal group. The suspect is reportedly linked to a data breach affecting the FBI. The case is drawing attention because ShinyHunters has been tied to a string of major corporate data thefts, and a breach involving FBI-linked data would mark a notable escalation in the group's alleged activities.

Laboratory Corporation of America, known as Labcorp, has reached a settlement with the state of Alaska over a data breach that affected 82,958 residents. The agreement was reported by the Juneau Empire. Details of the settlement terms, including any payments or commitments to improved data security, have not been widely detailed in initial coverage of the agreement.

Cybersecurity firm Proofpoint reports that attackers are hijacking .edu email accounts belonging to U.S. universities and using them to run multi-stage fraud schemes. The campaigns combine fake job offers with advance-fee fraud, exploiting the trust associated with legitimate university email addresses. Security researchers warn recipients to be cautious with unsolicited job-related messages, even those sent from seemingly authentic .edu accounts.

A class action settlement has been reached over a data breach at Summit Medical. Details on the settlement amount, eligibility for compensation, and claim deadlines remain limited, but the case follows a cybersecurity incident affecting the Tennessee-based health care provider. Patients potentially impacted by the breach are expected to be notified about their options under the agreement.

Bain & Company highlights cybersecurity's growing reliance on artificial intelligence to tackle the backlog of unaddressed vulnerability alerts that security teams cannot manage manually. The report argues AI is becoming essential for prioritizing and remediating threats at scale, as organizations face mounting alert volumes and limited analyst capacity.

Cannabis retailer Planet 13 is facing a lawsuit stemming from a data breach, and the case is being closely watched for what it signals about the industry's data security obligations. Legal commentary suggests cannabis companies, which often operate with limited security resources and no federal regulatory framework, may face heightened litigation risk over breaches involving customer personal information. The lawsuit could prompt dispensaries and cannabis operators nationwide to reassess how they protect consumer data.

A jury has been told that a cybersecurity professional stole $53 million in the hack of Uranium Finance, the cryptocurrency exchange that suffered a major exploit. Prosecutors presented the case against the defendant, whose technical background is central to allegations that he orchestrated the theft of digital assets. The trial is drawing attention within the crypto industry, where Uranium Finance's loss remains one of the notable exchange breaches.

Education leaders in Wisconsin are making cybersecurity a priority in their latest budget proposal, seeking dedicated funding to protect school districts from growing digital threats. The proposal signals a shift in how state education officials view technology risks, as schools increasingly manage sensitive student data and rely on connected systems for daily operations.

An Atlanta-based consulting firm is facing a lawsuit over a data breach that occurred in May. Details about the firm's name, the number of people affected, and the plaintiff have not been made available, but the legal action adds to a growing wave of litigation against companies over cybersecurity failures. Observers note such suits often seek damages for exposed personal information.

A new model focused on cyber open-source intelligence (OSINT) has been released, according to a brief announcement circulating among security practitioners. Details about who built the model, its capabilities, and how it compares to existing tools are not provided in the announcement. The security community is sharing the release as interest grows in AI tools applied to intelligence gathering and cybersecurity work.

Security researchers are discussing a malware attack delivered through a small Windows installer package that contains little obviously suspicious code beyond attacker hostnames. The payload uses a randomly generated readme file to evade signature-based detection, then retrieves its code and executes it directly in memory, leaving minimal traces on disk. Observers describe the technique as technically simple but elegantly effective from an attacker's point of view.

A blog article examining how online creators use psychological techniques to influence their audiences' behaviour is drawing attention in digital investigation and cybersecurity circles. The piece links influence tactics to themes like OSINT, cyberpsychology and online crime, prompting discussion about manipulation, persuasion and the risks of creator-driven influence across social platforms.

A recorded talk from BSides Luxembourg 2026 titled "AI In Cybersecurity: How Can We Make Best Use Of It?" by security professional Diana Waithanji has been published online. The conference says recordings from the track and its other villages are available in a public archive, letting security practitioners watch sessions on how artificial intelligence can be applied defensively and operationally in cybersecurity work.

A comment circulating on social media questions whether Anthropic, Google, OpenAI and Meta would face different consequences if they had 'accidentally' hacked a Chinese company instead of American or German ones. The writer also claims the hacking firm involved is Israeli, and calls the situation irregular, sparking discussion around AI companies, cybersecurity and accountability.