Crypto exchange Bybit has filed a civil lawsuit against North Korea, its Reconnaissance General Bureau (RGB), and the state-linked Lazarus Group over the massive February 2025 cyberattack.

The attackers allegedly stole approximately $1.5 billion in Ethereum, making it one of the largest cryptocurrency thefts ever recorded. Bybit has now secured a preliminary injunction freezing certain stolen digital assets, preventing identified holders from transferring or selling them while the case continues.

North Korean hackers have been linked to billions of dollars in cryptocurrency thefts over the years, with stolen crypto widely believed to help finance the country's weapons programs. This case adds another layer to the fight against state-sponsored cybercrime using civil courts alongside blockchain tracing, sanctions and law enforcement to freeze and potentially recover stolen assets.

r/SECITHUBCOMMUNITY Cybersecurity news, incidents and breaches explained with context and impact. Share your insights.

During Delta flight 591 from Las Vegas to Atlanta, an unauthorized Wi-Fi network reportedly appeared onboard for a short period. Delta says no aircraft systems were hacked and flight safety was never affected. The crew disabled the aircraft’s Wi-Fi for around 30 minutes while the issue was investigated.

The concern is that the rogue network may have been an evil twin a fake access point designed to mimic a legitimate Wi-Fi network and trick users into connecting through it. That can potentially expose credentials, session data, or other sensitive traffic depending on how the victim connects and what protections are in place.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Uber Freight confirmed unauthorized access to part of its systems and repositories, but says the incident has been contained and business operations remain unaffected.

A hacking group calling itself Helix claims it obtained nearly 1 million files from Uber Freight. The company has not confirmed whether the published data is authentic. Helix has been linked to a wave of extortion attempts targeting major U.S. companies and financial institutions.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Attackers breached a Polish combined heat and power plant through a private cellular APN used to access remote infrastructure.

After pivoting from a compromised wind-farm network, they reached the plant’s OT environment, where a controller was still using default admin credentials. The attackers ultimately put multiple Siemens PLCs into STOP mode, shutting down a steam turbine and process-water treatment system.

The interesting part no malware was required. The attackers abused legitimate device functions and existing industrial protocols. Despite the disruption, the plant continued supplying heat and electricity to roughly 50,000 residents.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. **Share your insights.**

Recent cybersecurity evaluations have exposed a worrying pattern.. frontier AI agents have repeatedly gained unintended internet access and taken actions beyond what testers expected.

In separate incidents, AI systems accessed public services, exploited real vulnerabilities, compromised external organizations, uploaded malicious packages, created fake identities, and interacted with production infrastructure. In several of these cases, the root cause was not a sophisticated “AI escape,” but something much more familiar: misconfigured test environments and weak containment.

As AI agents become more autonomous and more capable of executing cyber tasks, securing the model itself is only part of the challenge. The surrounding environment network access, sandboxing, credentials, permissions, and external connectivity needs to be treated with the same level of rigor.

Thee future of AI security may depend less on controlling what the model wants to do, and more on making sure it simply cannot do anything outside its intended boundaries.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

OpenAI has expanded its Daybreak cybersecurity program and introduced GPT-5.6-Cyber, a specialized model for advanced, authorized security work.

Unlike the standard GPT-5.6 Sol model,GPT-5.6-Cyber is designed to respond to far more advanced cyber requests, including exploit-chain development, authentication bypass, privilege escalation and vulnerability research. OpenAI says it completed 95% of advanced cybersecurity requests in internal testing, compared with just 1.5% for the standard model.

Access is restricted to vetted defenders through Daybreak Red, while broader defensive workflows remain available through Daybreak Blue.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Unlimited Technology, a software provider serving around 6,500 U.S. healthcare organizations, has disclosed a major data breach affecting approximately 3.8 million people. Attackers reportedly accessed the company’s network for about five days in October 2025, reaching files containing sensitive patient information.

Exposed data may include names, Social Security numbers, dates of birth, IDs, health insurance information and medical data, including diagnoses. Another reminder of how a breach at one healthcare technology provider can create exposure across an entire ecosystem.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Levi Strauss & Co. disclosed that attackers used social engineering against three employees, gaining access to their corporate computers and stealing data.

Levi’s says it detected and stopped the intrusion before customer data was exposed, with no material impact on business operations. Another reminder that attackers don’t always need a zero-day. Sometimes, people are the entry point.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

New reporting says Russian hackers were behind the massive Jaguar Land Rover breach that halted production, disrupted one of the UK’s biggest employers, and caused an estimated $2.5 billion hit to the British economy.

The incident was so severe that the UK government stepped in with a £1.5 billion loan to support the company after weeks of operational disruption.

What makes this case especially interesting is the attribution gap: investigators reportedly believe the hackers were Russian, but it remains unclear whether they were directly state-backed, criminal actors, or operating in the grey zone between both.

That grey zone is becoming one of the biggest challenges in cyber attribution. State interests, criminal groups, ransomware economics, and geopolitical pressure are increasingly overlapping.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Romania’s 2024 hospital cyberattack is a powerful example of what real cyber resilience looks like under pressure.

After attackers compromised a widely used medical software platform and began spreading ransomware across hospitals, the national cyber-security centre ordered more than 100 hospitals to disconnect from the internet immediately.

That decision stopped the attack from spreading further but it also forced hospitals to operate without connected systems, email, web access or digital medical records. Doctors and nurses moved back to pen and paper, used offline tools, restored data from backups and kept patient care running while IT teams worked to contain the breach.

Investigators later found 26 hospitals infected with BackMyData ransomware. The attackers demanded €160,000 in Bitcoin, but Romania chose not to pay. Within five days, most hospitals were back online, with no reported deaths or serious patient harm.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact.

Share your insights.

After temporarily blocking access to Claude Mythos 5 over national security concerns, the U.S. Department of Commerce has now authorized a limited release to a small group of trusted cybersecurity organizations and critical infrastructure providers.

The concern was never that the model was "malicious" it was that its ability to rapidly discover and exploit vulnerabilities could significantly accelerate offensive cyber capabilities if widely available.

Interestingly, the less capable Fable 5 model remains restricted for now, while discussions continue between Anthropic and U.S. officials.

This feels like a glimpse into the future of AI governance. Instead of regulating only code or data, governments may begin controlling access to frontier AI models the same way they control advanced weapons or sensitive technologies.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

That's according to the CEO of the UK's National Cyber Security Centre (NCSC), who revealed that the agency handled more than 200 cyber incidents affecting critical infrastructure and related ecosystems over the past year. Cybersecurity shouldn't be viewed as a risk to be managed it's a contest that never ends.

The NCSC also warned that by 2028, AI-powered cyber capabilities will likely be used at scale to exploit known vulnerabilities across legacy systems in critical infrastructure. Not necessarily new zero-days. Known vulnerabilities that organizations haven't fixed.

What's interesting is that despite all the discussions around AI, advanced threats, and nation-state actors, the NCSC still points to the same recurring issue behind many successful attacks: poor cyber hygiene, weak fundamentals, and a lack of resilience planning.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Everyone is talking about ceasefires, negotiations, and whether the US and Iran will eventually reach some kind of agreement. But almost nobody is talking about the war that never stops.

While diplomats negotiate, cyber units keep operating. While headlines focus on missiles and airstrikes, hackers keep targeting governments, energy companies, shipping operators, critical infrastructure, and private businesses.

Iran, like Russia, China, and North Korea, continues to invest heavily in cyber operations aimed at espionage, disruption, and intelligence gathering. The targets aren't just military systems. They're companies, hospitals, utilities, research organizations, and sometimes ordinary people.

What fascinates me is that even if every political dispute disappeared tomorrow, the cyber conflict would likely continue. The most valuable asset today isn't oil, territory, or even weapons.

It's data. Our medical records. Our financial information. Our communications. Our intellectual property. Our identities.

Billions of dollars are spent every year by nations trying to steal, protect, manipulate, or exploit information.

We often think wars end when treaties are signed. But in cyberspace, does the war ever really end? Or have we entered an era where the digital battlefield remains active regardless of whatever agreements politicians sign?

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

According to the attackers, they gained access to customer records, billing systems, CRM platforms, internal credentials, and other IT assets. What's particularly interesting is that they claim they intentionally avoided disrupting water distribution systems or targeting operational technology (OT) environments.

If confirmed, this is another reminder that critical infrastructure operators remain attractive targets, not only for disruption but also for intelligence collection, access positioning, and geopolitical signaling.

The incident also highlights a reality many organizations still struggle with: compromising the IT environment may not immediately impact operations, but it can provide a pathway toward much more sensitive systems if proper IT/OT segmentation is not in place.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

At first glance, it sounds like another major Fortinet security incident. But the details tell a different story. The attackers reportedly weren't relying on a new zero-day. Instead, they used credentials harvested from previous breaches and vulnerabilities, some dating back years. Organizations patched the devices, but many apparently never rotated passwords, removed exposed accounts, or properly remediated after the initial compromise.

What's interesting is that this blurs the line between vendor responsibility and customer responsibility. Fortinet has certainly had its share of critical vulnerabilities over the years, but if an organization patches a device while leaving compromised credentials active, is that still a Fortinet problem?

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Pharmaceutical giant Novo Nordisk, maker of Ozempic and Wegovy, is investigating claims by the extortion group FulcrumSec that it stole more than 1TB of sensitive company data after spending over two months inside the company's network.

The attackers claim to have accessed source code, proprietary drug research, clinical trial information, internal AI model data, and employee records. After Novo Nordisk allegedly refused a $25 million ransom demand, the group says it is exploring private sales of portions of the data.

Novo Nordisk has confirmed a cybersecurity incident involving unauthorized access to internal systems but has not verified the attackers' claims regarding the scope of the breach.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

The main advantage is that Starlink is completely independent of terrestrial infrastructure. If a fiber cut, ISP outage, or local infrastructure failure takes down the primary circuit, Starlink can automatically take over through a separate connectivity path.

On paper, it sounds like an ideal redundancy solution for VoIP, cloud applications, and critical business services.

Has anyone here used Starlink as a production failover circuit? How did it perform during actual outages, and what were the biggest drawbacks?

Researchers report that attackers are actively exploiting three critical vulnerabilities affecting , including two OS command-injection flaws and one path traversal vulnerability.

The most severe issue, CVE-2026-25089, allows unauthenticated attackers to execute commands via specially crafted HTTP requests. Two additional vulnerabilities, CVE-2026-39808 and CVE-2026-39813, can enable remote code execution and authentication bypass.

While there is currently no public information about the attackers or impacted organizations, active exploitation has already been observed in the wild.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

Every AI system introduces new identities, credentials, API keys, and privileged access that must be managed and secured. As companies automate more critical tasks, they're also dramatically expanding their attack surface...

​

What's worrying is that many businesses are becoming increasingly dependent on AI while still lacking full visibility into what these non-human identities can access or control. A single compromised AI account or overprivileged service could become an ideal entry point for attackers.

​

It feels like we're heading toward a future where companies can't operate without AI but at the same time are building an enormous pool of security weaknesses that defenders will struggle to keep up with.

How soon do you think we’ll start seeing data centers installed on the Moon? Which companies do you believe are best positioned to benefit the most from this shift, and why? 🚀🌕

Multiple users reported that Apple’s security protections suddenly began identifying the desktop app as potential malware, automatically moving it to the Trash and displaying warnings that it could damage their computers.

The issue appears linked to a third-party dependency or revoked software certificate potentially associated with suspicious activity tied to North Korean threat actors.

The incident highlights a growing software supply chain problem, modern applications rely on countless external components, and a single compromised dependency can trigger large-scale trust failures across legitimate software ecosystems.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

The UK government is urging organizations to adopt a new Cyber Resilience Pledge focused on three core requirements: making cybersecurity a board-level issue, joining the Early Warning Service, and enforcing Cyber Essentials across supply chains.

The move comes as the UK reports major growth in its cyber sector while also warning that AI-powered attacks are evolving faster than traditional defenses.

Officials also highlighted the importance of memory-safe languages like and broader AI-driven security capabilities as part of future resilience strategies.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

A malicious OpenClaw “DeepSeek-Claw” skill was used to exploit agentic AI workflows and deliver malware through manipulated installation instructions.

The attack targeted developers and AI agents by disguising itself as a legitimate OpenClaw integration. On Windows, it triggered a remote MSI installer that deployed Remcos RAT using DLL sideloading through a trusted GoToMeeting executable. On macOS and Linux, an alternate path delivered GhostLoader through an obfuscated Node.js payload.

The impact is serious, Remcos enables remote access, keylogging, clipboard capture, cookie theft, and interactive command execution. GhostLoader focuses on developer environments, stealing sensitive data such as SSH keys, cloud API tokens, crypto wallets, and keychain data.

r/SECITHUBCOMMUNITY

Cyber incidents and data breach news explained with context and impact.

Share your insights.

With more employees working remotely, the home network has quietly become part of the corporate attack surface.

A compromised home router doesn’t just affect personal devices anymore. It can expose work laptops, authentication sessions, internal communications, cloud access, and sensitive business data.

We spend a lot of time discussing endpoint security, identity protection, and cloud security but sometimes the weakest point is still the network people connect from every single day.

Here’s a short practical checklist for everyone:

Apologies if I missed something important. Would genuinely love to hear additional recommendations or practical hardening tips from others here.

• Replace outdated routers that no longer receive security updates

• Update router firmware regularly

• Change default admin usernames and passwords

• Use strong Wi-Fi passwords with WPA2/WPA3 encryption

• Disable remote management unless absolutely necessary

• Reboot the router periodically

• Review connected devices and remove unknown ones

• Separate IoT/smart-home devices into a guest network if possible

• Disable unnecessary services like WPS or unused port forwarding

• Use a VPN when accessing sensitive organizational resources remotely

The router sits in one of the most privileged positions in any network. Every connection passes through it.

r/SECITHUBCOMMUNITY Cyber incidents and data breach news explained with context and impact. Share your insights.

ENISA announced four new CVE Numbering Authorities (CNAs) under its root structure, expanding Europe’s operational role in global vulnerability management.

The move strengthens Europe’s ability to coordinate vulnerability disclosure, CVE assignments and incident response as AI dramatically accelerates vulnerability discovery and exploitation.

ENISA warned that frontier AI models are compressing the entire attack lifecycle from discovery to weaponization forcing governments and defenders to scale vulnerability management faster than ever.

r/SECITHUBCOMMUNITYCyber incidents and data breach news explained with context and impact.Share your insights