Cyber Incidents - International 2026-27

[Commonground]

UK

Criminals publish data of 8.7m people after airports hack​

9 hours ago
Criminal hackers have posted the personal data of nearly nine million people online after breaching three UK airports.
Hackers extorted Manchester Airports Group (MAG) for an undisclosed amount but failed to get their ransom paid.

Customers of Manchester, London Stansted and East Midlands airports are being warned of secondary attacks as the data is now available to other criminals.
continued: https://www.bbc.com/news/articles/c74k39g3ee5o

 

[Commonground]

Preparing for the Post-Quantum Era: A Call to Action

Published on Thursday 3 September 2026

We, the G7 Cybersecurity Working Group, recognize the growing threat that

quantum computing poses to public-key cryptography, and the security of

both public and private organizations. Although the exact timeline is uncer-

tain, several recent advances suggest an anticipation of the development

of quantum computers able to break widely used public-key cryptography

mechanisms and threaten the security of digital infrastructures.

To address these risks, we must reframe the quantum threat from a distant

future problem to a near‑term threat that demands action across all sectors,

not just critical infrastructure. Post-quantum cryptography (PQC) is a new

field of cryptography, designed to be resistant to both classical and quan-

tum cryptographic attacks, that can safeguard organizations from both the

conventional cyber threat and the quantum threat. For this reason, govern-

ments and organizations should begin their PQC transition as soon as pos-

sible to avoid exposure to quantum risks and to provide a level of long-term

protection of confidential data.

We acknowledge that transitioning to PQC is not a problem for individual

organizations to solve in isolation, but rather a collective transition that can

only be achieved with early engagement, coordinated planning, and infor-

med decision‑making across the public and private sectors.

This publication aims to highlight some of the risks that can be posed by

cryptographically relevant quantum computers (CRQCs)1 and to reaffirm our

collective efforts to addressing this threat. It identifies five priority areas for

PQC migration and highlights initiatives that G7 countries have advanced,

in whole or in part, to encourage timely measures today and inspire other

countries to take similar actions.

Continued: https://oos.cloudgouv-eu-west-1.out...cab3ce84648792434b5b944d73797f0e10c61bdbe8ca2

 

[Commonground]

ICS ADVISORY​

IXON VPN Client​

Release Date September 03, 2026
Alert Code ICSA-26-246-02

Summary​

Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges.

The following versions of IXON VPN Client are affected:

• VPN Client <1.4.7 (CVE-2026-75925)

CVSS	Vendor	Equipment	Vulnerabilities
v3 9.6	IXON	IXON VPN Client	Improper Neutralization of CRLF Sequences ('CRLF Injection')

Background​

• Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Energy, Information Technology, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Netherlands

IXON VPN Client | CISA

www.cisa.gov

 

[Commonground]

ICS ADVISORY

OPCFoundation OPC UA LocalDiscoveryServer (LDS)​

Release Date September 03, 2026
Alert Code ICSA-26-246-01

Summary​

Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands.

The following versions of OPCFoundation OPC UA LocalDiscoveryServer (LDS) are affected:

• UA-LDS-Installers <1.04.420 (CVE-2026-77477)

CVSS	Vendor	Equipment	Vulnerabilities
v3 4.6	OPCFoundation	OPCFoundation OPC UA LocalDiscoveryServer (LDS)	Execution with Unnecessary Privileges

Background​

• Critical Infrastructure Sectors: Chemical, Energy, Food and Agriculture, Water and Wastewater, Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

---

OPCFoundation OPC UA LocalDiscoveryServer (LDS) | CISA

www.cisa.gov

 

[Commonground]

Tycon Systems TPDIN-Monitor-WEB2 (Update A)​

Last Revised September 03, 2026
Alert Code ICSA-26-202-01

Summary​

Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk.

The following versions of Tycon Systems TPDIN-Monitor-WEB2 (Update A) are affected:

• TPDIN-Monitor-WEB2 <2.4.5 (CVE-2026-61884, CVE-2026-55985)

CVSS	Vendor	Equipment	Vulnerabilities
v3 9.8	Tycon Systems	Tycon Systems TPDIN-Monitor-WEB2	Missing Authentication for Critical Function, Cleartext Storage of Sensitive Information

Background​

• Critical Infrastructure Sectors: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities:​

Continued: https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-01

 

[Commonground]

Rockwell Automation ControlFLASH​

Release Date September 03, 2026
Alert Code ICSA-26-246-03

Summary​

Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.

The following versions of Rockwell Automation ControlFLASH are affected:

• ControlFLASH <=V15.07 (CVE-2026-12663)

CVSS	Vendor	Equipment	Vulnerabilities
v3 7.3	Rockwell Automation	Rockwell Automation ControlFLASH	Missing Authentication for Critical Function

Background​

• Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: United States

Vulnerabilities​

Continued: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-03

 

[Commonground]

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)​

Last Revised September 03, 2026
Alert Code ICSA-26-169-07

Summary​

Schneider Electric is aware of a vulnerability in the following products: The Easergy C5 is a scalable and interoperable bay controller, protection and merging unit for large and critical infrastructure electrical distribution systems. The Easergy MiCOM P30 is a family of multifunction protection and control relays designed for medium, high and extra high voltage electrical networks. The Easergy MiCOM P40 is a protection relay series for Medium Voltage, High Voltage and Extra High Voltage protection. The Easergy MiCOM C264 is a modular and compact substation or bay controller, smart RTU and MV one box solution The EcoStruxure Power Automation System Gateway (EPAS=GTW) is a scalable, interoperable, and rugged communication gateway that helps to remotely monitor and operate electrical processes The EcoStruxure Power Automation System User Interface (EPAS-UI) product is an HMI SCADA designed for electrical networks and substations operations. The EcoStruxure Power Automation System Intelligent Power Management System and Fast Load Shedding (iPMFLS) is a range of solutions designed to overcome size and performances constraints. The EcoStruxure Power Operation (EPO) are an on-premises software offers that provides a single platform to monitor and control medium and lower power systems. The PowerLogic P5 is a medium voltage protection relay. The PowerLogic P7 is a protection and control platform designed for complex and advanced electrical network applications. The PowerLogic T300 is a modular platform for medium voltage and low voltage public distribution network management. The PowerLogic T500 is a control unit and RTU for substation automation. The Saitel DP RTU is a modular platform for medium voltage and low voltage public distribution and transmission network management. The EasyLogic T150 (formerly Saitel DR RTU) is a field device, offering a solid and powerful platform for data acquisition, communication, automation and IED integration for distribution and transmission networks, generation sector and railway. Failure to apply the fix provided below may risk session hijacking, which could result in malicious actors performing unauthorized operations within the affected system.

The following versions of Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A) are affected:

-snip-

CVSS	Vendor	Equipment	Vulnerabilities
v3 8.3	Schneider Electric	Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products	Insufficient Entropy

Background​

• Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: France

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A) | CISA

www.cisa.gov

 

[Commonground]

China
Scam alert related to banks
The following is issued on behalf of the Hong Kong Monetary Authority:

The Hong Kong Monetary Authority (HKMA) wishes to alert members of the public to the press releases issued by the banks listed below relating to fraudulent websites, internet banking login screens, phishing emails or other scams, which have been reported to the HKMA. Hyperlinks to the press releases are available on the HKMA website.

Bank	Type of scam
The Bank of East Asia, Limited	Fraudulent website and internet banking login screen
Shanghai Commercial Bank Limited	Fraudulent website and internet banking login screen
OCBC Bank (Hong Kong) Limited	Fraudulent websites and internet banking login screens

The HKMA wishes to remind the public that banks will not send SMS or emails with embedded hyperlinks which direct them to the banks' websites to carry out transactions. They will not ask customers for sensitive information, such as login passwords or one-time password, by phone, email or SMS (including via embedded hyperlinks).

Anyone who has provided his or her personal information, or who has conducted any financial transactions, through or in response to the scams concerned, should contact the relevant bank with the information provided in the corresponding press release, and report the matter to the Crime Wing Information Centre of the Hong Kong Police Force at 2860 5012.

Ends/Friday, September 4, 2026
Issued at HKT 17:25

Scam alert related to banks

The following is issued on behalf of the Hong Kong Monetary Authority: The Hong Kong Monetary Authority (HKMA) wishes to alert members of the public to the press releases...

www.info.gov.hk

 

[sharon sanders]

DNB improves tradability of gold stocks​

Press release
Read aloud
De Nederlandsche Bank has improved the tradability of its gold reserves. To this end, part of its own gold reserves has been moved from New York and Ottawa to London. As a result, DNB is better prepared for serious crises.
Published: 02 September 2026


Due to increasing geopolitical unrest, DNB is working on strengthening its crisis preparedness. Improving the tradability of Dutch gold, and thereby how quickly the gold can be deployed in crisis situations, is part of this. At the same time, a more balanced distribution of the gold stock between North America, the United Kingdom, and the Netherlands helps to spread risks.

Between March and August 2026, approximately 86 tonnes of gold (of the nearly 313 tonnes in those two countries combined) will be transferred from the United States and Canada to London, which is viewed globally as a major trading center for physical gold. Gold stored at the Bank of England in London must comply with modern international trading standards and is considered the most easily tradable gold in the world. This makes it the quickest for DNB to deploy in a crisis situation. The portion of the gold reserves held in New York and Ottawa is less immediately deployable.

By holding a larger share of the gold reserves in London, the function of gold as a confidence anchor has been strengthened. Gold is seen as the ultimate confidence anchor because it is ideally suited to hedge extreme systemic risks.

"With this step, we have improved the deployability of the gold reserves. We assume that we will never need to deploy the gold, but it is nevertheless necessary to strengthen our resilience and preparedness," says DNB President Olaf Sleijpen.

The Dutch gold stock, amounting to 612.4 tonnes and valued at €72.2 billion at the end of 2025, is part of DNB's official external reserves. With the aim of risk diversification, Dutch gold has long been stored in various locations around the world. It is currently held at the DNB Cash Centre in Zeist and at the central banks in the United Kingdom, Canada, and the United States. Following the relocation of the past few months, this geographical distribution has become more balanced, with the percentages of the gold stock in the US and Canada being harmonized. 18.5% of the Dutch gold is now held at both locations.

Storage location	Share for relocation (%)	Share after relocation (%)
Zeist	30.8%	30.8%
London	18.1%	32.1%
New York	31.3%	18.5%
Ottawa	19.7%	18.5%

The relocation was largely realized by selling nearly 59 tonnes of gold in New York, after which gold meeting international trading standards was purchased in London. In addition, over 27 tonnes of gold from the United States and Canada were physically moved to Zeist. The same quantity of gold, meeting international market standards, was moved from Zeist to London. This prevented the melting down of gold bars. The increased usability of the gold means that the quality of the gold stock has improved. The total size of the stock has remained unchanged.

By combining buying and selling and physical transport, the risks associated with physically moving a large quantity of gold have been spread. This also allowed the relocation to be carried out both efficiently and cost-effectively. Furthermore, experience with both methods of moving gold is useful in the event that gold needs to be moved again during a future crisis and one of the methods proves impossible for whatever reason. This also aligns with increasing DNB's crisis preparedness.

DNB verbetert verhandelbaarheid goudvoorraad

Hiervoor is een deel van de eigen goudvoorraad vanuit New York en Ottawa naar Londen verplaatst

www.dnb.nl

 

[Commonground]

China
Ends/Friday, September 4, 2026
Issued at HKT 21:25

HKMA reminds public to stay alert to phishing scams targeting binding of payment cards to contactless mobile payment services
The following is issued on behalf of the Hong Kong Monetary Authority:

The Hong Kong Monetary Authority (HKMA) has recently received reports from banks of scams involving the unauthorised binding of payment cards, including ATM cards, to contactless mobile payment services. The HKMA has shared the relevant modus operandi with the banking industry and reminded banks to stay vigilant and strengthen customer education.

In the cases reported, fraudsters impersonated merchants or other organisations through phishing messages, fraudulent websites or phone calls, and used various pretexts, such as offering compensation for goods, to deceive victims into disclosing their payment card information and ATM personal identification numbers (PINs). To bind the victims' payment cards to devices under the fraudster's control, fraudsters coaxed the victims into approving payment card-binding requests through different channels, such as mobile banking applications or two-way SMS messages. Once the payment cards have been bound, the fraudsters can use them to make unauthorised transactions.

The HKMA reminds members of the public that binding a payment card is a high-risk operation. The following must always be borne in mind:

• never click hyperlinks in messages from unknown sources;
• never disclose payment card information, ATM PINs, login passwords or one-time passwords (OTPs) to anyone;
• never follow instructions from unknown or unverified persons to respond to or approve any requests or transactions, including those received through mobile banking applications or two-way SMS messages; and
• carefully read all messages and notifications from banks, and reject any card-binding request that they have not initiated.

Members of the public who suspect that they have fallen victim to a scam should immediately contact their bank and report the matter to the Police. They may also call the Police's Anti-Scam Helpline at 18222 for assistance.

HKMA reminds public to stay alert to phishing scams targeting binding of payment cards to contactless mobile payment services

The following is issued on behalf of the Hong Kong Monetary Authority: The Hong Kong Monetary Authority (HKMA) has recently received reports from banks of scams involving...

www.info.gov.hk

 

[Commonground]

Germany
Please also see https://flutrackers.com/threads/cyber-incidents-international-2026-27.1039754/post-1040193

Berlin cyberattack: hackers leak highly sensitive data across dark web​

05/09/2026
Excerpt:

The scale of the leak is enormous: 1,439,893 files. So far, there has been hardly any response from Berlin's administration and political leaders.
Among the published files is a folder titled "AG CBRN-Rahmenplanung." CBRN stands for chemical, biological, radiological and nuclear threats. This means that highly sensitive information about potential threat scenarios may now be publicly accessible and could also be viewed by terrorists or foreign intelligence services.

... https://www.euronews.com/next/2026/...rs-leak-highly-sensitive-data-across-dark-web

 

[Commonground]

Germany

Berlin launches crisis response after hackers publish stolen data​

September 5, 2026
BERLIN, Sept 5 (Reuters) - Berlin's state government said on Saturday it was reviewing with the highest intensity a trove of stolen data ‌published by a ransomware group, as investigators attempt to assess the scale and impact of the cyberattack that targeted two departments.

Continued: https://www.reuters.com/world/berli...after-hackers-publish-stolen-data-2026-09-05/

 

[Commonground]

Bump this

UK
26 August 2026
Households will be told to stock up on essentials as part of a new government campaign to improve the nation's resilience

The scheme, led by the UK Government, aims to improve public resilience in the face of national emergencies such as flooding, extreme weather and cyber-attacks.
-snip-
Louise Haigh, the Cabinet Office minister, is said to be overseeing cross-departmental crisis planning to ensure faster support for affected communities.

Preparation for a range of scenarios—including cyber-attacks, extreme weather, and military threats—has intensified in recent months following a series of incidents both in the UK and abroad.

continued: https://uk.news.yahoo.com/uk-warn-citizens-stock-food-074235781.html

 

[Commonground]

Egypt
September 5, 2026

HDB conducts cyberattack simulation exercise with Unit 42​

The Housing and Development Bank (HDB) has conducted a cyberattack simulation exercise, known as a Tabletop Exercise, in cooperation with Unit 42, a global company specialising in cyberattack simulation and digital threat response. The exercise forms part of the bank’s strategy to strengthen its cybersecurity framework and enhance its readiness to address digital threats, in line with the Central Bank of Egypt’s (CBE) directives in this area.

continued: https://www.dailynewsegypt.com/2026/09/05/hdb-conducts-cyberattack-simulation-exercise-with-unit-42/