The Center for AI Safety (CAIS) maintains a Wage Loss Dashboard that estimates the economic cost of US job cuts companies attribute to AI. It was updated this month with September data. It shows just over 117,000 AI-attributed job cuts nationally since January 2026, equal to about $8.5 billion in estimated annual wage losses. This is indu…
An actor using the handle Feel claims to have leaked data tied to IAD France, a French real estate network that supports property buying, selling and rental. The listing references three JSONL files: 8,592 agent records, 112,780 property records and 8,592 user-photo records. A sample archive is advertised, and the full download is gated b…
An actor using the handle malconguerra2 claims to be sharing a dataset allegedly from KFC Venezuela, advertised at roughly 1.55 million records. The detailed description lists 1,542,021 JSON records totaling 17.5 GB. A visible sample shows customer and transaction fields: full names, email addresses, phone numbers, physical addresses, ord…
The German municipality of Tangerhütte (Saxony-Anhalt) was hit by a cyberattack that its software provider Innocon believes was carried out with artificial intelligence. Attackers exploited a previously unknown vulnerability in Innocon software behind the municipality's digital town hall, according to an MDR investigation. A municipal IT …
The Eclipse leak site has listed Taiwan Otsuka Pharmaceutical, a Taiwan-based pharmaceutical manufacturer, and claims to hold about 832 GB of internal company data. The victim page shows a countdown to a claimed publication deadline. The listing gives examples of allegedly stolen material across many business functions, including finance,…
A threat actor using the handle ByteToBreach claims to have copied 10 databases from Ampath Laboratories, out of an environment said to contain roughly 375 databases. The claimed data includes HR and employee records, multiple patient databases, financial information and system-configuration data. The actor says the laboratory admissions …
A threat actor using the handle Alduin claims to be selling a customer dataset from Climb Up, described as the largest network of indoor climbing gyms in France. The listing advertises approximately 151,000 records covering customers across 29 locations, with data spanning January 2016 to March 2026. The seller asks for offers in XMR only…
Records were exported from the management information system (MIS) of Southville Primary School in Bristol during a targeted cyberattack, according to Bristol City Council. The council has not disclosed what data was taken or how many students, parents or staff are affected. The school has notified affected parents and guardians and repor…
An actor using the handle Liberland is advertising a hosting service branded Libre, offering "bulletproof" or abuse-resistant VPS and VDS servers. The listing claims no registration, no email, no KYC and no logs, with cryptocurrency payments including XMR, and rental terms starting at one month. Customers get full root access, multiple op…
An actor using the handle WolfBlxck posted an updated recruitment announcement for Beelzebub ransomware. The actor claims the malware was rewritten from scratch with a stronger focus on disabling endpoint defenses, suppressing telemetry and hindering incident response. The post seeks three more members: a developer, a penetration tester a…
An actor using the handle 0xRune claims to have uploaded roughly 20 GB of data belonging to Cast AI, described as a multi-cloud, multi-region infrastructure backup and development environment. The listing references AWS Lambda deployment packages, S3 backups, infrastructure-state data, billing exports and a GitLab backup dated October 5, …
An actor using the handle Shenron claims to have released a dataset tied to APICRYPT Messaging, a secure healthcare messaging system created in 1996 and managed by the APICEM association. The listing advertises 852,757 rows covering 60,911 users, and marks the breach and release as occurring in 2026. The visible sample contains healthcare…
Authorities in North Macedonia have filed charges against the alleged administrator of OLVX, a cybercrime marketplace that sold stolen personal data, credentials and malicious tools from 2023 to 2025. The suspect is a 20-year-old North Macedonian national, identified only as "E.A.", and is charged with computer fraud, misuse of personal d…
A threat actor using the handle ChimeraZ claims to have leaked a user dataset linked to ISEP, a French engineering school specializing in digital technology, computer science, electronics and cybersecurity. The listing advertises 5,091 lines covering 5,088 people in a 720 KB JSON dataset, with multiple download mirrors provided. The data,…
Threat actor ChimeraZ claims to be selling a partial dataset from I-CAD, the French national identification registry for dogs, cats and ferrets. The listing advertises 2,948,630 lines in a 643 MB JSONL file, made up of 2,898,001 animal records and 50,629 veterinary records, with the price set to "make offer". The dataset's authenticity, s…
An actor using the handle Erich claims to have breached an unnamed conference-space company with an estimated $80-100 million in annual revenue. The actor says the compromise came through a support panel and that access is still active. The post cites 24,753 tickets, 387,388 comments, 274,294 system notes, 113,094 real replies, 115,948 at…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
Edward Dubrovsky, a longtime cybersecurity executive described by Dark Reading as a prominent ransomware negotiator, was arrested and charged in Pennsylvania last week with conspiracy to extort money. The available article text is a brief summary and does not describe the alleged scheme, the victims, the amounts involved or any link to sp…
Sen. Ron Wyden sent a letter to CISA and the Office of Management and Budget (OMB) urging federal adoption of Encrypted Client Hello (ECH). ECH hides the name of the website a user visits from anyone monitoring network traffic. His office identified at least 350 federal sites that do not use ECH. Wyden warned that hackers and foreign adve…
CISA, the NSA and the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) at the Department of Commerce have issued joint, voluntary guidance urging frontier AI companies to harden the sandbox environments used to test AI agents. It follows a summer in which OpenAI, Anthropic, Google, Meta and others said their m…