China-Linked Group UNC6508 Targets North American Research; US Curbs Anthropic AI Models Sparking Industry Outcry

Chinese APT UNC6508 Targets Medical, Military, and AI Research in North America in Multi-Year Campaign

A sophisticated, multi-year cyberespionage campaign by a China-nexus threat actor, UNC6508, has been exposed by Google's Threat Intelligence Group. Active since at least 2023, the group targeted major medical, academic, and military research organizations in the U.S. and Canada, exfiltrating sensitive data for over a year before detection. The attackers exploited vulnerabilities in public-facing REDCap web servers, deploying custom malware dubbed 'InfiniteRed' to establish persistence, harvest credentials, and steal intelligence on topics including AI, U.S. defense strategy, and medical research that correlated with a real-world virus outbreak in China.

UNC6508InfiniteRedREDCapCyberespionageChina +5 more

6 min read

China-Linked Group UNC6508 Bypasses Defenses for Over a Year in Massive Research Data Heist

Maine Disables Public Data Breach Portal After Trolls Post Fake VRChat and Discord Breaches

LOW

Maine Data Breach Reporting Portal Abused with Fake Submissions, Forced Offline

The Office of the Maine Attorney General has temporarily disabled its public-facing data breach notification portal after it was abused by an unknown entity. The perpetrator submitted fraudulent breach reports for the companies VRChat and Discord, claiming millions of users were affected. VRChat publicly denied any breach. The AG's office has removed the false reports and taken the database offline to review procedures and prevent future abuse, highlighting the challenge of maintaining public transparency while combating misinformation.

MaineData Breach PortalHoaxDisinformationVRChat +2 more

3 min read

Maine Disables Public Data Breach Portal After Trolls Post Fake VRChat and Discord Breaches

Ransomware Attack by 'The Gentlemen' Halts Production at Mackay Sugar, Australia's Second-Largest Producer

Ransomware Attack Shuts Down Mills of Australia's Second-Largest Sugar Producer

Mackay Sugar, Australia's second-largest producer of raw sugar, has suffered a ransomware attack attributed to a group called 'The Gentlemen.' The cyberattack forced the company to shut down at least two of its cane-processing mills in Queensland and halt harvesting operations. The incident, which began around June 10, has had a significant impact on the company's operations, highlighting the vulnerability of the agricultural and manufacturing sectors to cyber threats.

RansomwareThe GentlemenMackay SugarAustraliaICS +3 more

Ransomware Attack by 'The Gentlemen' Halts Production at Mackay Sugar, Australia's Second-Largest Producer

Anubis Ransomware Hits Adriatic Port, Stealing Port Safety Plans in $10M Extortion Attempt

Anubis Ransomware Attack on Adriatic Port Highlights Maritime Security Risks

A ransomware attack by the Anubis group on a port authority in the Adriatic Sea has crippled operations and resulted in the theft of highly sensitive data, including port safety plans. The incident, which dates back to December 2025, involved a $10 million ransom demand. Analysis by Resecurity indicates the initial access was gained via a spear-phishing email, allowing attackers to move laterally and compromise insecure cloud accounts. The theft of safety and security plans poses a significant physical security risk, as this information is valuable to criminal groups involved in smuggling or planning physical attacks.

AnubisRansomwareMaritimePort SecurityCritical Infrastructure +3 more

5 min read

Anubis Ransomware Hits Adriatic Port, Stealing Port Safety Plans in $10M Extortion Attempt

Irish DPC Fines Health Service €300,000 for GDPR Failures in 2018 Hospital Ransomware Attack

MEDIUM

Irish DPC Fines Health Service Executive €300,000 for GDPR Breaches in 2018 Hospital Attack

Ireland's Data Protection Commission (DPC) has fined the Health Service Executive (HSE) €300,000 and issued a formal reprimand for multiple GDPR violations related to a 2018 ransomware attack. The attack targeted the Midlands Regional Hospital Tullamore, encrypting patient diagnostic data and affecting approximately 84,000 people. The DPC found the HSE failed in data security, did not have sufficient safeguards with third-party processors, and failed to properly maintain records and inform affected individuals, highlighting the long-term regulatory consequences of security incidents.

GDPRDPCHSEIrelandData Breach +4 more

3 min read

Irish DPC Fines Health Service €300,000 for GDPR Failures in 2018 Hospital Ransomware Attack

Hacker 'AckLine' Leaks Data of 16,000+ Travel Agency Customers for Free on Underground Forum

MEDIUM

Threat Actor 'AckLine' Leaks Data of 16,000+ Needlework Tours Customers on Forum

A threat actor named 'AckLine' has leaked the personal records of more than 16,000 customers of Needlework Tours, an Australian travel agency specializing in craft tours. The compromised data, which includes full names, addresses, contact numbers, dates of birth, and emergency contact details, was posted for free on an underground forum. This distribution method significantly increases the risk, as an indeterminate number of malicious actors can now access the data for use in fraud, phishing, and other scams.

Data LeakAckLineNeedlework ToursAustraliaData Breach +2 more

3 min read

Hacker 'AckLine' Leaks Data of 16,000+ Travel Agency Customers for Free on Underground Forum

Updated Articles (5)

State Officials Warn of Cyber Crisis, Urge Congress to Renew Critical Grant Program

INFORMATIONAL

US State Officials Push for Renewal of State and Local Cybersecurity Grant Program (SLCGP)

Eight months after federal funding changes, the Multi-State Information Sharing and Analysis Center (MS-ISAC), a critical resource for state and local cybersecurity, has lost dozens of states and over 10,000 local government members. These entities can no longer afford MS-ISAC services without federal subsidies, leading to staff cuts at MS-ISAC and leaving thousands of smaller jurisdictions, including critical infrastructure, significantly more vulnerable to ransomware and nation-state attacks. This development actualizes the warnings made previously about the impact of federal funding shortfalls.

May 22, 2026

SLCGPCybersecurity GrantUS CongressPolicyGovernment +1 more

ShinyHunters Exploits Oracle PeopleSoft Zero-Day, Breaching Over 100 Orgs, Primarily in Higher Education

CRITICAL

ShinyHunters Data Extortion Group Compromises Over 100 Organizations Using Oracle PeopleSoft Zero-Day Vulnerability

The University of Nottingham has confirmed a data breach affecting approximately 454,600 current and former students. The ShinyHunters group exploited CVE-2026-35273 in Oracle PeopleSoft to steal highly sensitive personal information, including passport numbers, contact details, enrollment information, and fee payment records. This update provides concrete details on the scale and sensitivity of the data compromised for a previously identified victim, underscoring the severe impact of the ongoing campaign.

June 13, 2026

ShinyHuntersCVE-2026-35273OraclePeopleSoftZero-Day +5 more

5 min read

Pharma Giant Novo Nordisk Discloses Data Breach Affecting Clinical Trial Participants

Novo Nordisk Reports Cybersecurity Breach, Exposing Data of Clinical Trial Participants and Healthcare Professionals

Novo Nordisk has re-confirmed its data breach, providing slightly more specific details regarding the exfiltrated data. For clinical trial participants, the pseudonymized data now explicitly includes immunogenicity data and biomarkers, in addition to previously mentioned health metrics and lifestyle factors. The company reiterated that while healthcare professionals' contact details were exposed, patients do not need to take any specific action beyond remaining vigilant against potential phishing attempts. The overall scope and impact remain consistent with initial reports, focusing on privacy concerns and regulatory scrutiny under GDPR.

June 13, 2026

Novo NordiskData BreachPharmaceuticalClinical TrialHealthcare +2 more

5 min read

Pharma Giant Novo Nordisk Discloses Data Breach Affecting Clinical Trial Participants

The AI Sword: Anthropic Model Demonstrates Hacking Prowess Surpassing Human Experts

Advanced AI Models Can Now Find and Exploit Vulnerabilities Faster Than Human Security Teams

New projections indicate that AI models, including Anthropic's Mythos and OpenAI's GPT-5.4-Cyber, are driving a record-high forecast of 66,000 CVEs in 2026. This overwhelming volume creates a 'signal-to-noise' crisis for defensive security operations, leading to alert fatigue and prioritization paralysis. The update emphasizes the need for a shift to risk-based vulnerability management, moving beyond traditional CVSS scores, and leveraging AI for exploit prediction and automated patching to cope with the unprecedented number of disclosures.

May 28, 2026

AIArtificial IntelligenceAnthropicvulnerability researchautomated exploitation +2 more

The AI Sword: Anthropic Model Demonstrates Hacking Prowess Surpassing Human Experts

US Government Orders Anthropic to Halt Foreign Access to Advanced AI Models

Citing National Security, US Mandates Shutdown of Anthropic's Fable 5 and Mythos 5 AI for Foreign Nationals

New details reveal the US government's ban on Anthropic's Fable 5 and Mythos 5 models was prompted by a third-party 'jailbreak' demonstration and suspicions of China-linked access. In response, Anthropic disabled the models for all global users. Over 50 prominent cybersecurity leaders, including CISOs from Nvidia and Adobe, have signed an open letter condemning the ban. They argue it harms defenders by removing powerful tools, creates market uncertainty, and undermines U.S. AI leadership due to an opaque justification process. This backlash highlights growing concerns within the industry regarding the decision's impact on AI development and security.

June 14, 2026