https://www.fire-vault.com/feeds/news.xml Latest news from Firevault — UK air-gapped data resilience. en-GB Tue, 04 Aug 2026 17:45:07 GMT https://www.fire-vault.com/news/minnesota-water-attacks-connectivity-critical-infrastructure-risk https://www.fire-vault.com/news/minnesota-water-attacks-connectivity-critical-infrastructure-risk More than 30 US water and wastewater utilities were targeted in a coordinated cyber attack on operational technology. The lesson for critical infrastructure is that unnecessary connectivity is now the risk itself. Fri, 31 Jul 2026 07:08:56 GMT Industry Insight https://www.fire-vault.com/news/guide-safeguarding-education-data https://www.fire-vault.com/news/guide-safeguarding-education-data A practical, forward-looking briefing to help schools, colleges and universities protect students, staff and partner data after the Department for Education breach. Wed, 29 Jul 2026 19:48:49 GMT Guides https://www.fire-vault.com/news/dfe-cyber-attack-607000-records-2026 https://www.fire-vault.com/news/dfe-cyber-attack-607000-records-2026 Around 607,000 records were taken in a cyber attack on the Department for Education in England, affecting the Turing Scheme portal and the departmental help desk. The incident lands in a sector where more than half of schools reported an attack or breach in the past year. Wed, 29 Jul 2026 19:47:51 GMT Breach Analysis https://www.fire-vault.com/news/rogue-ai-agents-hugging-face-opinion-2026 https://www.fire-vault.com/news/rogue-ai-agents-hugging-face-opinion-2026 Firevault commentary on the first fully autonomous AI hack. Our take on what boards should do, informed by Joe Tidy's BBC reporting. Wed, 29 Jul 2026 11:18:29 GMT Industry Insight https://www.fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026 https://www.fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026 SAP and Google Cloud have made data migration quietly optional. The data stays put. The operating judgment built above it does not. That is the lock-in the architecture diagram will never show. Wed, 29 Jul 2026 10:29:12 GMT Opinion https://www.fire-vault.com/news/ipmi-bmc-flaw-exposes-24000-servers-2026 https://www.fire-vault.com/news/ipmi-bmc-flaw-exposes-24000-servers-2026 A 22-year-old authentication weakness in IPMI 2.0 is leaking password hashes from more than 24,000 internet-exposed Baseboard Management Controllers, giving attackers near-physical control of servers beneath the operating system. Wed, 29 Jul 2026 10:23:27 GMT Breach Analysis https://www.fire-vault.com/news/ernst-young-shinyhunters-supply-chain-breach-2026 https://www.fire-vault.com/news/ernst-young-shinyhunters-supply-chain-breach-2026 The ShinyHunters extortion gang has claimed responsibility for the Ernst & Young breach, saying stolen third-party credentials opened the door to EY's Jira, GitHub and Azure environments, and to client tax documents. Mon, 27 Jul 2026 12:00:00 GMT Breach Analysis https://www.fire-vault.com/news/uk-healthcare-tenfold-rise-cyber-attacks-2026 https://www.fire-vault.com/news/uk-healthcare-tenfold-rise-cyber-attacks-2026 SonicWall recorded 264,000 attack events across UK healthcare in the first five months of 2026, nearly ten times the total for all of 2025. Legacy Java middleware, unpatched patient portals and internet-exposed load balancers are being stress-tested to breaking point. Sun, 26 Jul 2026 19:14:27 GMT Insight https://www.fire-vault.com/news/tribeca-film-festival-celebrity-contacts-leak-2026 https://www.fire-vault.com/news/tribeca-film-festival-celebrity-contacts-leak-2026 Cybersecurity researcher Jeremiah Fowler says three unprotected Tribeca-linked databases exposed a folder of celebrity contact details, including phone numbers and email addresses for Angelina Jolie, Robert De Niro and Martin Scorsese. Sun, 26 Jul 2026 18:00:00 GMT Breach Analysis https://www.fire-vault.com/news/firevault-cyber-essentials-plus-certified https://www.fire-vault.com/news/firevault-cyber-essentials-plus-certified Firevault has been awarded Cyber Essentials and Cyber Essentials Plus certification, the UK Government-backed scheme run by the NCSC, following an independent technical audit of its systems and controls. Sun, 26 Jul 2026 10:00:00 GMT News https://www.fire-vault.com/news/laundry-bear-zimbra-zero-click-2026 https://www.fire-vault.com/news/laundry-bear-zimbra-zero-click-2026 The NCSC and 15 partner agencies have exposed LAUNDRY BEAR, a Russian state-supported group using a zero-click exploit called "beehive" to silently steal email from Western organisations running Zimbra Collaboration Suite. The user only needs to open a message. No click, no attachment, no warning. Fri, 24 Jul 2026 09:00:00 GMT Breach Analysis https://www.fire-vault.com/news/frontier-ai-models-go-rogue-aisi-2026 https://www.fire-vault.com/news/frontier-ai-models-go-rogue-aisi-2026 The AISI Frontier AI Trends Report and OpenAI's live sandbox escape have finally put numbers behind what researchers, regulators and lab leaders have been saying for two years. Frontier models can be jailbroken, agents can escape, and containment is an open engineering problem. A Firevault synthesis of the evidence, the industry chorus, and what UK policy should now require. Fri, 24 Jul 2026 07:28:43 GMT Insight https://www.fire-vault.com/news/openai-agent-escapes-sandbox-hugging-face-breach-2026 https://www.fire-vault.com/news/openai-agent-escapes-sandbox-hugging-face-breach-2026 OpenAI has confirmed one of its advanced agents broke out of a controlled security-test sandbox, discovered a vulnerability on its own, and used it to gain access to internal systems at Hugging Face. It may be the first publicly disclosed autonomous AI-on-AI breach. Thu, 23 Jul 2026 19:45:01 GMT Breach Analysis https://www.fire-vault.com/news/origin-energy-customer-data-breach-2026 https://www.fire-vault.com/news/origin-energy-customer-data-breach-2026 Origin Energy, Australia's largest energy retailer, has confirmed unauthorised access and disclosure of customer data. Names, addresses, dates of birth, phone numbers, account information and partial card and bank details may be exposed. Thu, 23 Jul 2026 06:00:00 GMT Breach Analysis https://www.fire-vault.com/news/coca-cola-fairlife-ransomware-halts-us-production-2026 https://www.fire-vault.com/news/coca-cola-fairlife-ransomware-halts-us-production-2026 A ransomware event at fairlife, Coca-Cola's billion-dollar dairy subsidiary, forced the company to suspend all United States production on 16 July 2026. The incident shows how a single IT breach can stop physical manufacturing lines and disrupt consumer supply chains. Mon, 20 Jul 2026 16:37:01 GMT Breach Analysis https://www.fire-vault.com/news/assuranceamerica-jade-puffer-ss7-week-in-hacks https://www.fire-vault.com/news/assuranceamerica-jade-puffer-ss7-week-in-hacks A single week in July 2026 brought a seven million record insurance breach in the United States, a malware shutdown at Japan's largest taxi operator, mobile network spying against US military personnel, and the first documented agentic ransomware operation. The common thread is data that lived where attackers could reach it. Mon, 20 Jul 2026 16:31:42 GMT Breach Analysis https://www.fire-vault.com/news/lidl-third-party-it-provider-data-breach https://www.fire-vault.com/news/lidl-third-party-it-provider-data-breach Lidl has warned online shoppers in Germany, Belgium and the Netherlands that names, phone numbers, email addresses and dates of birth were stolen from a third-party IT provider. The breach is a fresh reminder that supplier risk is customer risk. Tue, 14 Jul 2026 21:50:59 GMT Breach Analysis https://www.fire-vault.com/news/urgent-guide-protecting-personal-data-high-profile-public-eye https://www.fire-vault.com/news/urgent-guide-protecting-personal-data-high-profile-public-eye Practical steps for serving and former politicians, councillors, campaigners, journalists, executives, broadcasters and anyone in the public eye, covering email security, device hygiene, threat handling and offline secure storage. Tue, 14 Jul 2026 19:25:32 GMT Guides https://www.fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact https://www.fire-vault.com/news/jlr-cyber-attack-cmc-category-3-19bn-uk-impact The Cyber Monitoring Centre has categorised the Jaguar Land Rover cyber incident as a Category 3 systemic event, estimating a £1.9 billion UK financial impact and disruption to more than 5,000 organisations. It is described as the most economically damaging cyber event ever to hit the UK. Sat, 11 Jul 2026 11:26:43 GMT Breach Analysis https://www.fire-vault.com/news/fbi-warns-malicious-traffic-distribution-systems-ransomware https://www.fire-vault.com/news/fbi-warns-malicious-traffic-distribution-systems-ransomware FBI PSA I-061826-PSA warns of cyber criminals using Traffic Distribution Systems to deliver ransomware. Mark Fermor on the offline defence. Fri, 10 Jul 2026 06:56:32 GMT Breach Analysis https://www.fire-vault.com/news/centers-for-dialysis-care-breach-exposes-8000-patients https://www.fire-vault.com/news/centers-for-dialysis-care-breach-exposes-8000-patients Centers for Dialysis Care in Cleveland has confirmed a network breach exposing 8,000 patients and staff. Mark Fermor on why offline storage stops this cold. Fri, 10 Jul 2026 06:28:35 GMT Breach Analysis https://www.fire-vault.com/news/nhs-chief-condemns-staff-curiosity-after-major-patient-privacy-breaches https://www.fire-vault.com/news/nhs-chief-condemns-staff-curiosity-after-major-patient-privacy-breaches Sir Jim Mackey has warned 40 NHS workers who accessed a child's medical records. Mark Fermor explains how air-gapped storage prevents insider snooping. Fri, 10 Jul 2026 05:09:29 GMT Breach Analysis https://www.fire-vault.com/news/accenture-confirms-breach-hacker-35gb-source-code https://www.fire-vault.com/news/accenture-confirms-breach-hacker-35gb-source-code Accenture has confirmed a security incident after a threat actor known as "888" advertised 35GB of stolen source code, RSA and SSH keys, Azure access tokens and configuration files on a cybercrime forum. The consultancy says the source is remediated and operations are unaffected, but the leak underlines how quickly developer secrets become an attacker's launchpad. Thu, 09 Jul 2026 11:36:09 GMT Breach Analysis https://www.fire-vault.com/news/ncsc-warns-uk-organisations-fortinet-firewall-vpn-credential-leak https://www.fire-vault.com/news/ncsc-warns-uk-organisations-fortinet-firewall-vpn-credential-leak The National Cyber Security Centre has issued an alert after a threat actor leaked a database of credentials harvested from brute-force and credential-stuffing attacks against internet-facing Fortinet firewalls and VPN gateways. UK organisations using FortiGate or Fortinet VPN portals are urged to investigate exposure and apply mitigations immediately. Wed, 08 Jul 2026 17:15:23 GMT Breach Analysis https://www.fire-vault.com/news/russian-hackers-steal-uk-government-logins-offline-vaults https://www.fire-vault.com/news/russian-hackers-steal-uk-government-logins-offline-vaults The Telegraph reports that Russian-linked hackers have harvested UK government login credentials and traded them on dark-web forums. The incident is a reminder that credentials, however well protected in the cloud, remain the single point of failure that offline data vaults are designed to remove. Tue, 07 Jul 2026 07:51:36 GMT News https://www.fire-vault.com/news/fbi-flash-teampcp-software-supply-chain-attacks https://www.fire-vault.com/news/fbi-flash-teampcp-software-supply-chain-attacks FBI FLASH warns that TeamPCP is compromising widely used developer and security tools to steal cloud tokens, SSH keys and Kubernetes secrets. What UK organisations must isolate now. Sun, 05 Jul 2026 10:19:25 GMT Breaking https://www.fire-vault.com/news/russian-noname-hack-quebec-water-treatment-plant https://www.fire-vault.com/news/russian-noname-hack-quebec-water-treatment-plant Russia-linked NoName breached a Quebec water treatment plant's SCADA. What UK and Canadian water utilities must isolate, air-gap and audit now. Sun, 05 Jul 2026 09:49:53 GMT Breaking https://www.fire-vault.com/news/employment-documentation-breach-readiness https://www.fire-vault.com/news/employment-documentation-breach-readiness Breach readiness does not start with the alert. It starts in the employment contract, the staff handbook and the policies that tell people what they are responsible for. Mark Fermor on why vague duties become the firm's problem. Sat, 04 Jul 2026 12:30:00 GMT Insight https://www.fire-vault.com/news/nissan-oracle-peoplesoft-shinyhunters-commentary https://www.fire-vault.com/news/nissan-oracle-peoplesoft-shinyhunters-commentary Nissan Americas has confirmed employee SSNs, banking and tax data were exposed through the Oracle PeopleSoft zero-day (CVE-2026-35273) campaign linked to ShinyHunters. Mark Fermor on why HR systems keep becoming citizen-scale breaches. Sat, 04 Jul 2026 11:00:00 GMT Commentary https://www.fire-vault.com/news/tata-apple-iphone-18-supply-chain-leak-commentary https://www.fire-vault.com/news/tata-apple-iphone-18-supply-chain-leak-commentary World Leaks has posted iPhone 18 Pro supplier maps and drop-test photos taken from Apple's Indian manufacturer Tata Electronics. Mark Fermor on why the answer is architectural, not contractual. Sat, 04 Jul 2026 10:00:00 GMT Commentary https://www.fire-vault.com/news/conwy-council-insider-data-breach-commentary https://www.fire-vault.com/news/conwy-council-insider-data-breach-commentary Three separate disciplinary outcomes in one department in twelve months. Mark Fermor on why the Conwy County Council data breaches are a structural warning to every UK local authority, not a one-off. Sat, 04 Jul 2026 09:00:00 GMT Commentary https://www.fire-vault.com/news/fortibleed-inc-lynx-ransomware-commentary https://www.fire-vault.com/news/fortibleed-inc-lynx-ransomware-commentary SOCRadar has now tied the FortiBleed credential-harvesting operation directly to INC and Lynx ransomware deployments. Mark Fermor on why physical severance is the only durable answer. Fri, 03 Jul 2026 09:00:00 GMT Commentary https://www.fire-vault.com/news/firevault-sponsors-cbn-cybersummit-2026 https://www.fire-vault.com/news/firevault-sponsors-cbn-cybersummit-2026 Firevault backed the first CBN CyberSummit at Bird and Bird, joining Baroness Liz Lloyd, Alison Griffiths MP and CNI leaders on the future of UK cyber resilience. Tue, 23 Jun 2026 09:00:00 GMT Announcement https://www.fire-vault.com/news/scattered-spider-tfl-guilty-plea-offline-recovery https://www.fire-vault.com/news/scattered-spider-tfl-guilty-plea-offline-recovery Two Scattered Spider members have admitted the £39m TfL hack. Mark Fermor on identity blast radius and why offline recovery is the deciding layer. Mon, 22 Jun 2026 15:26:35 GMT Threat Analysis https://www.fire-vault.com/news/iran-ot-ics-targeting-offline-golden-copies-cni https://www.fire-vault.com/news/iran-ot-ics-targeting-offline-golden-copies-cni A new Congressional Research Service report names Iran alongside China, Russia and North Korea as a leading cyber adversary, with operations now reaching deep into industrial control systems. The recovery problem is no longer about backups. It is about whether your golden copies are reachable by the attacker. Sun, 21 Jun 2026 18:59:08 GMT Insight https://www.fire-vault.com/news/ncsc-uk-critical-infrastructure-incidents-double https://www.fire-vault.com/news/ncsc-uk-critical-infrastructure-incidents-double NCSC chief Richard Horne says the UK faced more than 200 nationally significant cyber incidents against critical infrastructure in a year, with about three-quarters tied to state actors. Sat, 20 Jun 2026 05:14:36 GMT Threat Analysis https://www.fire-vault.com/news/24-billion-credentials-infostealer-leak https://www.fire-vault.com/news/24-billion-credentials-infostealer-leak Cybernews researchers found an 8.3 TB Elasticsearch cluster holding 24 billion records, including plaintext passwords and login URLs harvested from infostealer logs. Fri, 19 Jun 2026 20:49:36 GMT Threat Analysis https://www.fire-vault.com/news/fortibleed-74000-fortinet-firewalls-credentials-exposed https://www.fire-vault.com/news/fortibleed-74000-fortinet-firewalls-credentials-exposed Researchers say a Russian-speaking crew cracked nearly half the internet's Fortinet firewalls, exposing plaintext logins for Oracle, Chevron, Lenovo, FedEx, a NATO defence contractor and Fortinet itself. Thu, 18 Jun 2026 09:03:31 GMT Threat Analysis https://www.fire-vault.com/news/cbn-cybersummit-2026-baroness-liz-lloyd-cni-leaders https://www.fire-vault.com/news/cbn-cybersummit-2026-baroness-liz-lloyd-cni-leaders The Cybersecurity Business Network has unveiled the full agenda for its inaugural CyberSummit on 23 June 2026, with Baroness Liz Lloyd headlining a CNI-focused line-up. Firevault joins as a sponsor. Sun, 14 Jun 2026 15:29:27 GMT Industry https://www.fire-vault.com/news/south-korea-fines-coupang-400m-data-breach-37m-customers https://www.fire-vault.com/news/south-korea-fines-coupang-400m-data-breach-37m-customers South Korea has issued its largest-ever data breach fine, penalising e-commerce giant Coupang more than $400m after the personal data of 37.5 million customers, more than half the country's population, was exposed. Sun, 14 Jun 2026 15:21:39 GMT News (Threat Analysis) https://www.fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure https://www.fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what it tells us. Sun, 14 Jun 2026 15:18:42 GMT News https://www.fire-vault.com/news/essex-nhs-hospitals-synnovis-breach-2380-records https://www.fire-vault.com/news/essex-nhs-hospitals-synnovis-breach-2380-records Mid and South Essex NHS Foundation Trust has confirmed around 2,380 patient test records were stolen via third-party diagnostics provider Synnovis, as the fallout from the June 2024 Qilin ransomware attack continues to widen. Mon, 08 Jun 2026 22:37:29 GMT Breach Analysis https://www.fire-vault.com/news/disconnect-to-protect-ai-era https://www.fire-vault.com/news/disconnect-to-protect-ai-era Inside the AI Security Institute, the NYT reports red-teamers cracking OpenAI's newest model in six hours and finding safety gaps in every leading system. Autonomous cyber capability is now doubling every 4.7 months. Why selective physical disconnection is becoming the only honest answer. Tue, 26 May 2026 19:33:28 GMT Insight https://www.fire-vault.com/news/south-staffordshire-water-ico-fine-963900-data-breach-2026 https://www.fire-vault.com/news/south-staffordshire-water-ico-fine-963900-data-breach-2026 The ICO has fined South Staffordshire Water £963,900 after a phishing email went undetected for 20 months, leading to 4.1 TB of personal data appearing on the dark web. Why physical disconnection breaks this chain. Mon, 11 May 2026 09:00:00 GMT Cyber Attack https://www.fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault https://www.fire-vault.com/news/cisa-ci-fortify-isolation-recovery-firevault Insights from Mark Fermor on OT, ICS, and the underlying storage layer. Thu, 07 May 2026 09:38:59 GMT Industry Insight https://www.fire-vault.com/news/controlled-access-buyers-guide-offline-secure-storage https://www.fire-vault.com/news/controlled-access-buyers-guide-offline-secure-storage In April 2026, approved researchers exfiltrated the health records, genetic data, and medical histories of 500,000 UK Biobank volunteers through authorised access channels, then listed the data for sale on Alibaba. The breach was not caused by a hack. It was caused by a model that assumes licence agreements can prevent data theft. This guide covers why that model fails and what physical controls replace it. Thu, 23 Apr 2026 00:00:00 GMT Guides https://www.fire-vault.com/news/offline-secure-storage-operational-technology https://www.fire-vault.com/news/offline-secure-storage-operational-technology Which operational technology files create the greatest consequence when compromised, why connected backups still leave them exposed, and how offline custody supports safe recovery. Thu, 23 Apr 2026 00:00:00 GMT Insight https://www.fire-vault.com/news/hasbro-cyber-attack-peppa-pig-transformers-2026 https://www.fire-vault.com/news/hasbro-cyber-attack-peppa-pig-transformers-2026 Toy and entertainment giant Hasbro, owner of Peppa Pig, Transformers and Monopoly, has confirmed unauthorised access to its network. The breach was discovered on 28 March 2026 and could delay product deliveries for several weeks. Wed, 01 Apr 2026 12:00:00 GMT Cyber Attack https://www.fire-vault.com/news/world-backup-day-2026-why-backups-alone-are-not-enough https://www.fire-vault.com/news/world-backup-day-2026-why-backups-alone-are-not-enough Every 31 March, World Backup Day reminds organisations to protect their data. But in 2026, the real question is not whether you back up. It is whether your backups can survive the attack that is coming for them. Tue, 31 Mar 2026 09:00:00 GMT Opinion https://www.fire-vault.com/news/european-commission-aws-cloud-data-breach-350gb https://www.fire-vault.com/news/european-commission-aws-cloud-data-breach-350gb The European Commission is investigating the theft of over 350GB of data from its Europa.eu cloud infrastructure hosted on AWS. The attacker plans to leak the data publicly rather than extort the institution, highlighting why sovereign data must be physically disconnected from cloud platforms. Mon, 30 Mar 2026 19:37:59 GMT Breach Analysis