Ransomware Hits Cloud Provider, AI Risks Emerge, Law Firms Breached

IDC Frontier (IDCF) has warned customers that data recovery from the ransomware attack is "unlikely," forcing affected organizations to rebuild systems from their own backups. Attackers explicitly destroyed over 554,000 snapshots, confirming their intent to inhibit system recovery. The incident has caused a major supply chain disruption across Japan, with specific impacts including Nissui Logistics Corp. unable to process shipments at 17 distribution centers, JR East's email services affected with potential exposure of 6.09 million records, and official websites for Ibaraki Prefecture's local government and police headquarters taken offline.

Further investigation into the FBIJobs.gov breach by ShinyHunters has revealed critical new details. The attack exploited an unpatched Oracle PeopleSoft vulnerability, CVE-2026-35273, on a system managed by contractor Accenture. This led to the exfiltration of 2-3 terabytes of sensitive Personally Identifiable Information (PII), including names, home addresses, and phone numbers, belonging to thousands of FBI employees and applicants. The contractor has since been removed from the project, highlighting significant supply chain risks.

New intelligence reveals the U.S. Department of Justice has seized domains and hacking tools, including 'FishHub' and 'MicroScan', used by Integrity Technology Group (ITG). The advisory further details ITG's custom toolset: 'MicroScan' for scanning, 'EBurst' for password spraying Microsoft 365 accounts, and 'office-cli' for exfiltrating emails. ITG is explicitly identified as a contractor for Chinese state-sponsored threat actors like Flax Typhoon, targeting critical infrastructure in locations such as South Carolina, Poland, and Taiwan. This provides deeper insight into their operational methods and supply chain.