Archive

Second recent arrest of a security-industry figure in the ShinyHunters extortion probe; shows who you hire to handle incidents matters.

Network switches can be taken over if certain features are on; patch or turn off unused features.

Qilin has hit 2,350+ organisations in 62 countries; an arrest is welcome but the group is not shut down, so backups and patching still matter.

Backup management tools used by IT providers are being hijacked; if your IT supplier runs AhsayCBS, ask whether its admin page is locked down.

AI is speeding up attacks on firms that hold your data, so strong unique passwords and watching for breach notices matter more.

A sponsored result can look trusted yet lead to a fake download page that hands you a harmful command to paste, so get apps only from the maker's own site.

Shows firms paid to negotiate with extortionists are under scrutiny; businesses hit by ransomware should check who they hire.

Health-linked details such as insurance numbers can fuel convincing scam calls; expect to be targeted and verify callers.

The regulator is examining the data-protection risks of AI tools that act for you; businesses using AI assistants should watch for guidance.

Complaints rose from 1,374 in July to 3,684 in September; reporting suspicious calls to the ICO helps it act.

Easy 'work from home' payment-handling jobs can make you an unwitting money launderer; walk away from them.

Remote-access gateways are prime targets; any shop using SMA1000 should patch now.

Old files kept for decades were the target; affected people are urged to place holds on their credit.

Names and contact details were exposed (not cards or passwords); expect follow-on scam calls and texts pretending to be ASOS.

Cheap unbranded phones can arrive already infected, and a factory reset may not remove it; buy from known sellers and check for firmware updates.

Another NetScaler flaw on top of this month's exploited ones; any business running these appliances should update at once.

The "update payment details" button leads to a phishing site that captures card and personal details.

The link leads to a fake NatWest login that steals your details; go to your bank through its app or the number on your card instead.

Free tools and 'AI' add-ons from look-alike code pages can steal logins; only download from the vendor's official page.

The tools relied on hijacked internet-connected devices; update or replace old routers and cameras.

Fake-boss video calls are a growing fraud route; Teams warnings help, but a call-back check on payment requests still matters.

Windows PCs that are not kept up to date will stop receiving security updates in 2027; installing the latest updates now avoids being locked out.

A hacker's guilty plea confirms 165+ organisations were extorted after criminals used stolen cloud logins that lacked MFA - a concrete reminder for any shop using cloud/SaaS accounts to turn on MFA everywhere, not just on the accounts that feel important.

A stalking victim's new address and phone number were sent, unredacted, to the man she was being protected from - a stark reminder to ask any organisation (police, school, GP) how they handle sensitive details, especially in abuse or safeguarding situations.

Small businesses whose IT is run by an outside provider (MSP) are often managed through tools like N-central - if that provider hasn't patched, criminals can hijack every business it manages at once. Worth an email to your IT provider asking if they're patched.

Cheap no-name streaming boxes and even smart-TV apps quietly enrolled homes in the Popa botnet - practical advice: stick to name-brand devices and check Play Protect certification

Fake 'prove you're human' pages trick people into pasting malicious commands; Opera's Paste Protect now blocks this by default - a hook to explain the trick everyone should know

AI deepfake video ads on Facebook/Instagram reached 155,000+ accounts selling a fake plug-in device via a phishing link - timely as July energy bills rise

Over half of UK ransomware reports come from small firms; most shops don't know about the free 24/7 attack hotline

A lookalike AI extension quietly intercepted searches and browsing data - a plain-English hook on vetting extensions before installing

Criminals reused breach-leaked passwords and slipped past half-configured MFA - a check-your-MFA-settings moment for any shop on Microsoft 365

Old breach passwords used to hijack retail accounts

Breach details power realistic travel scams

MFA now a hard requirement for certification

CE becoming a condition of supplying larger firms

Parental anxiety data; a hook for family guides

Age-gates coming; a regulatory shift