ExfilSquad claims theft of 740,000 records from UK education, police databases

Metacurity is your daily cybersecurity reality check.

Every weekday, thousands of cybersecurity professionals—including many of the industry's most respected security leaders—start their day with Metacurity because it cuts through the noise. Instead of vendor hype, social media outrage, and recycled headlines, you get the stories that matter, the context behind them, and an explanation of why they're important.

We spend hours reading, researching, and connecting the dots so you don't have to.

If Metacurity saves you time, helps you make better decisions, or gives you a clearer view of what's happening in cybersecurity, please consider becoming a paid subscriber.

Reader support is what keeps Metacurity independent. It allows us to focus on serving the cybersecurity community—not advertisers, vendors, or investors—and to continue delivering the thoughtful analysis you've come to rely on every weekday.

The UK Department for Education and a police database have been targeted by a cyber-attack, exposing more than 740,000 pieces of data.

A previously unknown hacking gang calling itself ExfilSquad claimed it had carried out the attack and posted samples of the data on its leak site, a typical gambit for cybercriminals seeking money for the information they have stolen.

Details of government officials, senior school leaders, university staff, police officers and members of the public have been taken by hackers.

Just over 600,000 lines of data have been stolen from the DfE’s helpdesk portal. They show parent and staff contacts including full names, email addresses, phone numbers and job titles, according to a “leak” website set up by the hackers.

A smaller package of similar data has been taken from the department’s Turing portal, which manages a scheme for students studying abroad.

The hackers have also breached the police national legal database (PNLD), which provides legal assistance to UK police forces. The cybercriminals claimed to have taken 135,000 pieces of data.

The PNLD said the details taken related to “police officers and those working in criminal justice including their name, the force or organisation they work for and their work email address”.

Some names and addresses of members of the public who had previously submitted a question to the Ask the Police service had also been taken. It said the database did not hold confidential victim, witness or offender information.

“The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay,” said the gang.

The message is apparently directed at 14 hacking victims including the DfE. The list of alleged victims includes a UK university.

Sophos, a cybersecurity company that provided the screenshots, said the data samples appeared to be legitimate. It added that an account on the social media platform X apparently belonging to the group had been suspended but had been illustrated by a picture of a cybersecurity researcher, presumably Allison Nixon, who had been targeted before by members of the Com, a sprawling ecosystem of native English-speaking hackers. (Dan Milmo and Vikram Dodd / The Guardian)

Related: Cybersecurity Insiders, BBC News, The Times, The Telegraph, Firstpost, LBC, Financial Times, The Independent

US semiconductor maker Analog Devices is assessing a new claim by a group of hackers who say they’ve stolen hundreds of files containing information on customers of the computer chips maker.

A hacking group known as ExfilSquad has claimed to have breached Analog Devices and is threatening to release sensitive customer data unless its demands are met, according to the cybersecurity firm DeXpose. Analog Devices said in an SEC filing that it was made aware of reports and is assessing “validity, scope, and any potential impact.”

Analog Devices said in the same filing that it had separately uncovered unauthorized access to its systems last month and determined that some files were “exfiltrated.” Operations weren’t interrupted by the breach, which was identified on June 23, the Wilmington, Massachusetts-based firm said. The investigation is ongoing, and the company has notified law enforcement.

The files haven’t been publicly released or used for fraudulent purposes, and the company is monitoring for any indication of misuse, according to a company spokesperson. (Dina Bass / Bloomberg)

Related: SEC, DeXpose, Cyber Insider, Insurance Business

A data breach that exposed personal details of thousands of Afghans applying to come to the UK to flee the Taliban was a "foreseeable" failure, a parliamentary inquiry has found.

In a report by the Commons' Defence Committee said the Ministry of Defence (MoD) had lacked the expertise to run the UK's Afghan relocation scheme after the fall of Kabul to the Taliban and had used secrecy as a "shield" against proper accountability.

The breach came to light in August 2023, but an unprecedented super-injunction prevented it from being reported on until July 2025.

A MoD spokesperson said the leak "should never have happened" and welcomed the opportunity to learn from the incident.

A super-injunction is a court-mandated gagging order that forbids news outlets from reporting private or sensitive information.

It also bans the media from revealing that the injunction exists.

The leak was not "an individual mistake" but a "foreseeable systemic failure" caused by "inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability", the Defence Committee said in its report.

The data breach could have been prevented if Ministry of Defence (MoD) personnel had received basic Excel training. (Henry Moore and Hannah O'Grady / BBC News and UK Parliament)

Related: The Independent, Sky News, ITV News

A bipartisan group of US senators urged Apple to abandon any efforts to buy chips from blacklisted Chinese semiconductor suppliers CXMT and Yangtze Memory Technologies, warning that the iPhone maker risked becoming reliant on a US adversary for crucial components.

In a letter addressed to Apple Chief Executive Officer Tim Cook, the senators said the company should refrain from using memory chips from CXMT and YMTC in its devices, even if the products are destined exclusively for the Chinese market.

The lawmakers, led by Indiana Republican Jim Banks and New York Democrat Chuck Schumer, highlighted that both CXMT and YMTC are on a recently updated Pentagon list of Chinese entities believed to support Beijing’s military.

“This short-sighted move would be a mistake, and it would ensure the world’s most valuable consumer-electronics company grows dependent on critical supplies from a firm the United States government has formally designated as a Chinese military company,” the senators wrote. Other signers included Democrats Andy Kim and Jeanne Shaheen, as well as Republicans Mike Crapo and Pete Ricketts.

Apple has been in negotiations to acquire chips from CXMT and YMTC as it grapples with a global squeeze on supplies that’s caused memory prices to soar, fueled by unprecedented demand from makers of AI processors including Nvidia Corp. In June, Apple raised prices of all its Macs, iPads, home devices and the Vision Pro, attributing the increases to the memory chip shortage. (Maggie Eastland / Bloomberg)

Related: Benzinga, 9to5Mac, Global Times, The Mac Observer

Australia’s eSafety regulator has commenced civil penalty proceedings in Federal Court against the provider of Telegram for the messaging service’s alleged failure to detect and remove pro-terror material.

The action follows a year-long investigation, with the regulator citing videos of terrorist executions and mass shootings, among others.

The agency is seeking a range of orders, including that Telegram pay a penalty determined by the court. The failure to comply with Australia’s codes and standards could potentially result in civil penalties of as much as A$54.6 million ($38 million).

On Wednesday, Pavel was accused by Russia’s Federal Security Service of aiding what it called terrorist activities, the Associated Press reported, with the Russian agency saying it would add Durov’s name to international wanted lists. (Zoe Ma / Bloomberg)

Related: eSafety.gov.au, ABC.net.au, Reuters, BBC News, The Independent, The Conversation, DW.com, Sydney Morning Herald, The Times of India

OpenAI CEO Sam Altman said that ​he was meeting with US senators to talk about his ‌company's upcoming models while Donald Trump said he was considering AI "controls," following OpenAI's disclosure that one of its AI systems escaped containment during a security test.

"We're looking at controls," ​Trump told reporters in the Oval Office in response to ​a question about OpenAI's rogue agent, adding that he did ⁠not want to "restrict" AI developers from building new products.

Altman, who is ​in Washington this week, met with Senators Bernie Moreno and Jon Husted ​on Wednesday, spokespeople for the senators said. He was seen walking into Senator Raphael Warnock's office. He is also expected to meet with Senator Mark Warner, the top ​Democrat on the chamber's Intelligence Committee, a spokesperson for Warner said.

Altman told reporters on Wednesday that he discussed the hack "a little bit" with senators. (Courtney Rozen / Reuters)

Related: AI Magazine, Benzinga, BBC News, Al Jazeera

According to Amazon researchers, a North Korea-linked hacker group has been tied to four open-source software compromises dating back to March 2025, significantly expanding the publicly known scope of Pyongyang’s efforts to use trusted code to reach large numbers of potential victims and gain access to companies’ systems.

The assessment for the first time links the same financially motivated hacking group to compromises of four major JavaScript packages — typo-crypto, debug, chalk and axios — that developers use as building blocks for other software. The axios package alone receives more than 100 million downloads each week, and its compromise had previously been attributed to the North Korean group.

Amazon said Wednesday that it had uncovered evidence connecting the actor to the three earlier incidents, based on technical findings that included instances of reused code and similarities in how the attacks were carried out.

Amazon Threat Intelligence attributed the campaigns to the group with “medium confidence,” according to a blog post authored by Amazon Integrated Security CISO CJ Moses scheduled for release Wednesday evening. Researchers track the cyber intruders under several names, including Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces. (David DiMolfetta / NextGov/FCW)

Related: Amazon, CyberScoop

According to researchers at Clemson University working with a collective of internet monitors who track Russian influence operations and call themselves the dTeam,  hundreds of accounts on Bluesky had been hijacked by Kremlin hackers known as the Social Design Agency and used to post fake news articles.

The compromised Bluesky accounts included those of people who are influential in their fields, though perhaps not famous. They were journalists and professors, a pollster in Texas, an anime artist and a filmmaker in Hollywood, whose account posted a video doctored by artificial intelligence to impersonate a Canadian police official criticizing France’s president, Emmanuel Macron.

The campaign, which the researchers at Clemson linked to the Social Design Agency, a company in Moscow, shows how Russia continues to seek new ways to erode public support for Ukraine, which Russian forces invaded in 2022.

Bluesky has grown more prominent as a rival platform to X since X’s owner, Elon Musk, threw his political support behind President Trump before the 2024 election. With 42 million users, though, Bluesky trails far behind X’s nearly 600 million. (Steven Lee Myers / New York Times)

Related: Clemson University, AFP

The Korean National Intelligence Service (NIS), the Korean National Police Agency, the Korea Internet & Security Agency (KISA), and the Financial Security Institute shared a recent "joint cyber security advisory" with private security corporations including AhnLab, S2W, ENKI WhiteHat, and Plainbit, warning that North Korea's Lazarus group contines to send phishing emails disguised as support or donation offers and "watering hole" attacks exploiting news and hospital websites.

The hacking group mainly sends emails disguised with content likely to draw recipients' interest, such as job applications or donation offers. A tactic was also confirmed in which a resume is inserted in the email body as a link rather than as an attached file.

When the link is clicked, it leads to webpages such as blogs or GitHub that the hacking group directly set up or hijacked. In this process, vulnerabilities in outdated security programs installed on the PC can be exploited, allowing infection with malware even without running a separate file.

They also use a method of sending malicious attachments directly. They disguise them as recruitment offers like "high-paying job offer" to induce recipients to open the attachments. There were also cases detected in which an actual headhunter's email account was hijacked to make the message appear to come from a legitimate sender.

They also use watering hole attacks, in which websites that users visit frequently, such as news outlets or hospitals, are hacked in advance and seeded with malware. When a user accesses the tampered site, malware is automatically installed through vulnerabilities in security programs installed on the PC.

The advisory said recent watering hole tactics are becoming more sophisticated by hiding malware or directly tampering with website source code, making detection through security monitoring more difficult. If security software such as electronic signature, security authentication, or keyboard security programs are not the latest versions, the risk of infection can increase. (Lee Ho-jun / Chosun Biz)

Related: Boho.or.kr, The Chosun Daily

South Korea's Personal Information ‌Protection Commission has fined telecoms company KT Corp 54 billion won ($37.43 million) ​for a leak of customer ​personal information, the commission said.

Hackers ⁠stole more than 16,600 KT ​mobile service customers' personal data and ​payment information and used them to make 240 million won worth of illegal ​payments, the commission said in ​a report of its investigation.

The leak occurred ‌in 2024 and 2025.

The panel said it separately found multiple malware in KT's servers as ​it probed ​the ⁠data breach and that the company tried to ​cover up the infiltration and ​failed ⁠to notify authorities as required by law. (Jack Kim / Reuters)

Related: The Korea Herald, Yonhap News, Korea JoongAng Daily

Independent researcher NetAskari and hunt.io report that Chinese cybercriminals have been using full-service mobile malware frameworks to steal money from popular finance apps.

The researchers say there is a substantial cybercriminal ecosystem built around a sophisticated, all-in-one malware-as-a-service (MaaS) builder called "Flying Eagle."

Flying Eagle supplies all the infrastructure and features any ordinary hacker would need to build their own easy mobile malware campaign. Nowhere is this point more obvious than in how it's distributed. Instead of files on some server somewhere, Flying Eagle is packaged as a complete Docker deployment. Every user gets their own goodie bag with a Web server, a WebSocket server, PHP, and MySQL. (Nate Nelson / Dark Reading)

Related: Hunt.io, SC Media, GBHackers, Cyber Security News

A growing number of Republicans are advocating for rehiring staff and restoring funding to the nation’s cyber agency, following a torrent of punitive measures against CISA over the past 18 months.

The agency fell out of favor with President Donald Trump in 2020 after former CISA Director Christopher Krebs said the presidential elections were the “most secure in American history” — an assertion that Trump has repeatedly refuted — and it has drawn his ire ever since.

Among those leading the effort to rehabilitate CISA’s image are Reps. Andrew Garbarino (R-NY) and Don Bacon (R-NE), who head key House panels with oversight of federal cyber policy. Both have worked behind the scenes in recent months to convince Republican colleagues that CISA urgently needs more resources because of the critical role it plays in securing the nation’s electoral process and critical systems, including water treatment plants and energy grids.

These systems, Garbarino argues, are under even greater threat as new AI models grow more capable of inflicting major damage, should cybercriminals or foreign governments appropriate the technology to launch cyberattacks.

“Unfortunately, I have colleagues that focus on the mis- and disinformation part of CISA, and that has turned them off to the entire agency,” Garbarino said at the recent Homeland Security and Defense Forum. He added that the AI race with China is “starting to show other members” how pivotal CISA is to protecting national security as these threats evolve at a rapid pace.

Bacon stressed that recent staffing strain on the agency, coupled with indecision around installing a permanent leader to help the agency navigate these challenges, has crippled the agency’s capacity ahead of a contentious midterm election season.

“I’m a big proponent of CISA. If you don’t like what it’s doing, get new leadership; don’t fire a third of its people … because they’re the ones who defend our private sector, our energy grid and our elections,” Bacon said. (Maggie Miller / Politico)

The US Cybersecurity and Infrastructure Security Agency (CISA), together with its co-authoring partners, has released the 2026 Minimum Elements for a Software Bill of Materials (SBOM), replacing the 2021 guidance published by the National Telecommunications and Information Administration (NTIA).

The update introduces new minimum SBOM elements, including component hash algorithms, component licenses, the name of the SBOM generation tool, and generation context. It also renames several existing fields to improve clarity and consistency, making SBOMs easier to use for automated software supply chain and vulnerability management. (Anamarija Pogorelec / Help Net Security)

Related: CISA, NSA, Department of War

OpenAI’s ChatGPT and video game company Roblox will be subject to stricter scrutiny and monitoring requirements under the European Union’s content moderation rules after surpassing a threshold of 45 million monthly users in the bloc.

The EU’s executive arm will designate ChatGPT’s search function as a “very large search engine” and Roblox as a “very large online platform” in line with the Digital Services Act, a person familiar with the matter said.

The designations will come as soon as August, the person said, asking not to be identified because the decision was confidential.

The DSA requires all social networks and search engines to clamp down on illegal and harmful content on their platforms. The “VLOPs,” which also include Meta Platforms Inc. and Elon Musk’s X, must also file transparency reports, detail risk mitigation plans and pay an annual fee to the European Commission. Companies that breach the DSA risk fines of as much as 6% of their annual global sales. (Gian Volpicelli and Cecilia D'Anastasio / Bloomberg)

Related: Heise Online

Health-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters.

Over the past two years, the threat actors have become notorious for conducting numerous supply chain attacks on third-party integration partners. These breaches give them access to OAuth tokens that are used to integrate with SaaS providers like Salesforce and Snowflake.

These applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.

According to the Health-ISAC, ShinyHunters attacks follow a chain that begins with voice phishing (vishing) to manipulate employees or helpdesk personnel into resetting passwords, changing multifactor authentication methods, or enrolling new devices.

Health-ISAC said that in recent incident reporting, ShinyHunters claimed it successfully vished multiple employees, compromised a Microsoft Entra SSO account, and stole data from Microsoft 365, SharePoint, and other enterprise platforms.

However, the organization cautioned that not every data theft claim has been verified, and defenders should instead focus on the attack pattern of using compromised SSO identities to access and exfiltrate data from connected cloud services.

Health-ISAC says the most important defensive step is breaking the attack chain between the initial vishing call and the takeover of an SSO account. (Lawrence Abrams / Bleeping Computer)

Related: Health-ISAC, SC Media

Researchers at Proofpoint say the Russian state-linked hacking group tracked as Laundry Bear has been more active in recent months than originally thought.

Government agencies and cybersecurity companies warned on July 23 that the cyber-espionage group was abusing a vulnerability in Zimbra Collaboration Suite’s webmail platform. On Wednesday, the researchers claimed in an update, saying that the same hackers began exploiting a bug in Microsoft Outlook Web Access (OWA) a day before the international alert.

Laundry Bear, also tracked as TA488 and Void Blizzard, started laying the groundwork for the OWAReaper campaign in March, Proofpoint said. The OWA bug, tracked as CVE-2026-42897, was first publicized and patched in May. Microsoft posted additional remediation information in mid-July.

Laundry Bear targeted “US and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors,” the researchers said. The goal, as with the campaign against Zimbra users, was to steal emails and account credentials.

The malware campaign represented “an improvement in the group’s tradecraft and capability,” Proofpoint said. The company said it had not seen any activity by the group between February and July 22.

“This novel infection chain ends with a previously unknown JavaScript browser-based implant we call OWAReaper, purpose-built for persistent access inside OWA,” the researchers said, adding that it’s “feasible” that Laundry Bear was exploiting the vulnerability as a zero-day. (Joe Warminsky / The Record)

Related: Proofpoint, Bleeping Computer, Computer Weekly, The Register, Infosecurity Magazine

Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.

Static credentials cause the vulnerability for a low-privilege account built into Cisco Secure FMC Software.

Cisco says an unauthenticated, remote attacker can use these credentials to log in to an affected system and access sensitive data available to the account.

While CVE-2026-20316 has a CVSS score of 5.3, Cisco assigned it a High severity rating because the access can be combined with other FMC vulnerabilities to elevate privileges.

However, the company has not identified the additional vulnerabilities or explained how they are being used in attacks.

The flaw affects Cisco Secure FMC Software regardless of device configuration, but does not impact Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, or Security Cloud Control.

Cisco has released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds that address the vulnerability, and customers are strongly advised to install the available fixes. (Lawrence Abrams / Bleeping Computer)

Related: Cisco, Help Net Security, Security Week

Researchers at AI safety nonprofit FAR.AI found that some of the industry's most advanced artificial intelligence models remain vulnerable to automated "jailbreak" attacks that can bypass built-in safety guardrails.

The researchers developed a system that generated more than 1,000 variations of harmful prompts designed to trick models into providing prohibited information, including guidance related to cyberattacks and other dangerous activities.

The testing found significant differences among leading models. SpaceXAI's Grok was the most susceptible, with researchers achieving hundreds of successful jailbreaks at an estimated cost of about $58, while Google's Gemini 3.1 Pro also proved vulnerable at a cost of roughly $278. In contrast, the automated attacks failed against the versions of OpenAI's GPT and Anthropic's Claude models tested, though researchers cautioned that more sophisticated techniques could still succeed.

The findings have renewed calls for standardized, independent testing of frontier AI systems rather than relying primarily on company-led evaluations. FAR.AI Chief Executive Adam Gleave argued that the relatively low cost of mounting automated jailbreak campaigns underscores the need for stronger oversight, while other researchers said the results demonstrate that more robust safeguards are achievable and should become the industry standard. (Will Knight / Wired)

Related: FAR.ai

The OpenAI–Hugging Face incident has been widely portrayed as a rogue AI "breaking out" and independently hacking another company's systems, but much of the public reaction has overstated what actually occurred.

OpenAI's recent breach of Hugging Face has sparked widespread claims that an AI system independently "hacked its way out," but the incident is better understood as a failure of the environment in which the model was operating than as evidence of a rogue AI. Much of the public discussion has blurred the line between demonstrated capabilities and speculative fears, creating a narrative that extends well beyond the available evidence.

The model pursued the objective it had been assigned and exploited weaknesses in the evaluation environment that allowed it to access systems beyond its intended boundaries. Describing the behavior as the AI "wanting" to escape or acting with independent malicious intent mischaracterizes how current frontier models function, conflating optimization of assigned goals with autonomous agency.

The incident nonetheless highlights important security concerns surrounding increasingly capable AI systems. The priority should be improving evaluation environments, containment mechanisms, and oversight so that testing frameworks cannot be exploited in unintended ways.

Clearer communication about AI incidents is also needed to distinguish genuine technical failures from sensational interpretations that can distort public understanding of the risks. (Kate Klonick / Lawfare)

Cybersecurity startup Onyx Security has raised $113 million in a Series B funding round.

Bessemer Venture Partners led the round with participation from Cyberstarts, TCV, Conviction, FirstMark, Vintage Investment Partners, QuantumLight, and G Squared. (Meir Orbach / CTech)

Related: Onyx, RuntimeWire, Onyx Security, Axios

Okta announced it has signed a definitive agreement to acquire Permiso Security, a cloud-native identity security platform that detects and mitigates threats across human, non-human, and agentic identities in multi-cloud environments.

With the addition of new identity risk signals, behavioral analytics, and threat detections from Permiso, the Okta Platform will offer comprehensive identity threat detection and response (ITDR) capabilities, helping customers surface identity-related risk faster, remediate vulnerabilities and excessive privileges, and stop attacks across their technology stack. (Okta)

Best Thing of the Day: Recognizing the Moral Dimensions of AI

Shaw University, a seminary in Raleigh, NC, plans to offer a new degree track: a Doctor of Education (or Ed.D) in Artificial Intelligence and Moral Agency.

Worst Thing of the Day: Cops Have a Duty to Doublecheck Underscores

One missing underscore in a Skyrim-themed username put an innocent Nova Scotia man in prison for 18 months.

Closing Thought