> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Massive DHS leak exposes surveillance secrets as archive domain is suspended
- URL: https://www.metacurity.com/massive-dhs-leak-exposes-surveillance-secrets-as-archive-domain-is-suspended/
- Published: 2026-10-29T13:08:26.000Z
- Updated: 2026-10-29T13:08:26.000Z
- Description: Records on more than 41,000 DHS personnel reveal undercover operations and surveillance tools. Bluesky is blocking links to the leak, while the domain hosting its searchable archive has been placed on hold by its registry.
- Author: Cynthia B Brumfield
- Tags: Cybersecurity, News, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/ICEagentslocatedinChicago-1.png)

Excerpt of ICE and HSI agents located in Chicago. Source: Icepick database.

### An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. 

The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates.

The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026\. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, which they say they obtained from a group calling itself the Department of Peace.

DDoSecrets published the archive, which it calls “Icepick,” on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs.”

An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says.

The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees’ names and faces. The agency has also expanded its definition of “doxing”—a term that typically refers to publishing someone’s home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles.

The leak follows a breach in which a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group.

The DHS records are searchable on a website crimew built. “I don't think we should let them scare us into not looking into them,” she tells WIRED.

According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.

Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. 

At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI's St. Paul, Minnesota, area of operations, references "Keyhole," which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”

The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.

Meanwhile, the social media site Bluesky is blocking users from opening links to a newly leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, and labels the pages “malicious.”

Users who try to open the archive through Bluesky’s website or app land on a page labeled "Blocked Link," which says the URL has been identified as “malicious” and blocked for their safety. Bluesky did not respond to questions about whether the block was imposed automatically or whether any government agency had asked the company to restrict access to the data.

The DDoSecrets homepage loads normally from Bluesky. At least one third-party app, Klearsky, opens links to the DHS archive with no warning.

The Icepick website hosting the leaked DHS records also appears to have been suspended at the domain registry level. Registration records for icepi.cx show the domain has been placed on “server hold,” a status that prevents it from resolving through the domain name system. The records also list the domain as “inactive” and “server renew prohibited.” It was not immediately clear why the restrictions were imposed, when they took effect, or whether they were related to the publication of the DHS records. ([Dhruv Mehrotra, Maddy Varner, Dell Cameron / Wired](https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/?ref=metacurity.com) and [Dhruv Mehrotra, Maddy Varner, Dell Cameron / Wired](https://www.wired.com/story/bluesky-blocks-links-to-major-leak-of-dhs-data/?utm%5Fmedium=social&utm%5Fsource=bluesky&utm%5Fcampaign=aud-dev))

***Related:*** [*DDoSecrets*](https://ddosecrets.org/article/icepick?ref=metacurity.com)*,* [*icepi.cx*](https://icepi.cx/?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/legal/government/leak-website-releases-data-tens-thousands-dhs-employees-2026-10-28/?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/dhs-employee-data-leak-ddosecrets/?ref=metacurity.com)*,* [*NextGov/FCW*](https://www.nextgov.com/cybersecurity/2026/10/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/416901/?ref=metacurity.com)*,* [*The Washington Post*](https://www.washingtonpost.com/immigration/2026/10/28/ice-cbp-other-dhs-officer-identities-posted-online-data-breach/?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/10/29/dhs-data-breach-ice-cdp-deportations.html?ref=metacurity.com)*,* [*Shattered*](https://shattered.io/dhs-staff-directory-leak-40000-five-security-lessons-2026/?ref=metacurity.com)*,* [*Cyber Daily*](https://www.cyberdaily.au/security/14371-data-leak-exposes-tens-of-thousands-of-us-homeland-security-staff?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/legal/government/leak-website-releases-data-tens-thousands-dhs-employees-2026-10-28/?ref=metacurity.com)*,* [*Straight Arrow News*](https://san.com/cc/shielded-by-dhs-immigration-agents-identities-exposed-in-massive-data-breach/?ref=metacurity.com)*,* [*NPR*](https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice?ref=metacurity.com)*,*[ *The Guardian*](https://www.theguardian.com/us-news/2026/oct/28/homeland-security-data-leak?ref=metacurity.com)*,* [*UNICORN RIOT*](https://unicornriot.ninja/2026/icepick-leak-exposes-thousands-of-homeland-security-personnel-groups-and-more/?ref=metacurity.com)*,* [*BBC*](https://www.bbc.com/news/articles/cq8jzkpjr28vo?ref=metacurity.com)*,* [*NBC News*](https://www.nbcnews.com/tech/tech-news/dhs-ice-hack-agent-information-name-identity-rcna605980?ref=metacurity.com)*,* [*NPR*](https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice?ref=metacurity.com)*,* [*RuntimeWire*](https://runtimewire.com/article/ddosecrets-dhs-employee-data-icepick?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/dhs-data-leak/?ref=metacurity.com)*,* [*Politico*](https://www.politico.com/news/2026/10/28/dhs-data-leak-hacktivist-01140028?ref=metacurity.com)*,* [*The Verge*](https://www.theverge.com/tech/1021528/ice-cbp-data-leak?ref=metacurity.com)*,* [*Engadget*](https://www.engadget.com/2300661/hackers-leaked-details-more-than-41000-homeland-security-personnel/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-95.png)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-94.png)

### Researchers at Lumen Technologies’ Black Lotus Labs report that Volt Typhoon, a China-government-backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected.

The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office/home office (SOHO) routers, internet of things (IoT) devices, and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023\. 

The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain deeper, persistent access into victim networks, researchers said. 

“Individual chains are assembled and dismantled every day, with infrastructure continually refreshed,” Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.”

Black Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms. Other victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.

“The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity,” said Horka, who was also the lead researcher on the report. ([Matt Kapko / CyberScoop](https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/?mid=1&ref=metacurity.com#cid=3777305))

**Related:** [*NextGov/FCW*](https://www.nextgov.com/cybersecurity/2026/10/chinas-volt-typhoon-quietly-built-another-hacking-network-following-us-crackdown-new-findings-say/416848/?mid=1&ref=metacurity.com#cid=3777081)*,* [*Lumen*](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework?ref=metacurity.com)*,* [*Zero Day*](https://www.zetter-zeroday.com/silent-train-volt-typhoons-sophisticated-infection-chain-into-us-targets-exposed/?ref=metacurity.com)*,* [*Bleeping Computer*](https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-91.png)

Operational infrastructure transition following successful KV-botnet disruption efforts, leading to full adoption of the Silent Train operational framework. Source: Lumen.

### The US Justice Department announced that a 36-year-old Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021.

Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist's office, a company in the oil and gas transportation industry, and law firms. He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.

“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Stryzhak pleaded guilty to multiple cybercrimes in late 2025\. He was arrested in Spain in June 2024 and extradited to the United States in April 2025\. Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction. ([Matt Kapko / CyberScoop](https://cyberscoop.com/nefilim-hive-ransomware-affiliate-artem-stryzhak-sentenced/?ref=metacurity.com))

***Related:*** [*Justice Department*](https://www.justice.gov/opa/pr/ukrainian-national-pleads-guilty-conspiracy-use-nefilim-ransomware-attack-companies-united?ref=metacurity.com)*,* [*Bitdefender*](https://www.bitdefender.com/en-us/blog/hotforsecurity/hive-ransomware-jailed-fbi-infiltrated?mid=1&ref=metacurity.com#cid=3777164)*,* [*The Register*](https://www.theregister.com/cyber-crime/2026/10/28/serial-ransomware-crook-gets-70-months-behind-bars-for-nefilim-hive-roles/5306050?ref=metacurity.com)*,* [*Security Week*](https://www.securityweek.com/ukrainian-hive-and-nefilim-ransomware-affiliate-gets-70-months-in-us-prison/?mid=1&ref=metacurity.com#cid=3777109)*,* [*Security Affairs,* ](https://securityaffairs.com/201960/cyber-crime/hive-and-nefilim-ransomware-affiliate-gets-70-months-in-jail.html?ref=metacurity.com)[*Bleeping Computer*](https://www.bleepingcomputer.com/news/security/nefilim-and-hive-ransomware-affiliate-gets-70-months-in-prison/?ref=metacurity.com)

### Alphabet's Google unveiled Gemini 4 Carbon, its latest frontier ​AI model, stepping up competition ‌with OpenAI and Anthropic as the race to build more capable coding and cybersecurity ​systems intensifies.

The launch comes two ​weeks after Google introduced Gemini 4 Argon, ⁠as the company expands its ​Gemini family of AI models for developers ​and enterprise customers.

The company said the Carbon model delivers state-of-the-art performance across cybersecurity tasks​, including vulnerability discovery, exploitation, and software ​patching.

Google said Carbon generates secure code at more than ‌twice the success rate of Gemini 4 Argon on internal benchmarks.

The model is designed to handle complex, long-running engineering ​and coding ​tasks.

Carbon ⁠is being made available first to a subset of ​cybersecurity defenders through Google's Fairwind ​Program ⁠as the company continues testing safeguards. ([Prathik Jayaprakash / Reuters](https://www.reuters.com/technology/google-launches-gemini-4-carbon-ai-model-with-cybersecurity-focus-2026-10-28/?ref=metacurity.com))

**Related:** [*Google*](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/?ref=metacurity.com)*,* [*The Verge*](https://www.theverge.com/tech/1021339/google-gemini-4-carbon-cybersecurity-frontier?ref=metacurity.com)*,* [*Ars Technica*](https://arstechnica.com/ai/2026/10/google-announces-gemini-4-carbon-its-latest-frontier-ai-model-that-you-cant-use/?ref=metacurity.com)*,* [*Techzine*](https://www.techzine.eu/news/security/145370/google-gemini-4-carbon-is-fully-committed-to-cyber-defense/?ref=metacurity.com)*,* [*Silicon Angle*](https://siliconangle.com/2026/10/28/google-debuts-flagship-gemini-4-carbon-model-with-cybersecurity-upgrades/?ref=metacurity.com)*,* [*Venture Beat*](https://venturebeat.com/technology/google-unveils-gemini-4-carbon-retaking-the-worlds-no-1-spot-on-updated-harder-benchmarks-but-access-is-limited?ref=metacurity.com)*,* [*New York Times*](https://www.nytimes.com/2026/10/28/technology/alphabet-earnings-google-ai.html?ref=metacurity.com)*,* [*CNET*](https://www.cnet.com/tech/services-and-software/google-genie-4-gemini-4-carbon-ai-news/?ref=metacurity.com)*,* [*Mashable*](https://mashable.com/tech/google-gemini-4-carbon-frontier-announcement?ref=metacurity.com)*,* [*Artificial Analysis*](https://artificialanalysis.ai/models/gemini-4-carbon?ref=metacurity.com)*,* [*The Verge*](https://www.theverge.com/tech/1021339/google-gemini-4-carbon-cybersecurity-frontier?ref=metacurity.com)*,* [*Wccftech*](https://wccftech.com/googles-gemini-4-carbon-mogs-every-other-model-on-nearly-every-benchmark-performs-over-10x-better-than-any-publicly-available-model-when-generating-high-quality-security-patches/?ref=metacurity.com)*,* [*VentureBeat*](https://venturebeat.com/technology/google-unveils-gemini-4-carbon-retaking-the-worlds-no-1-spot-on-updated-harder-benchmarks-but-access-is-limited?ref=metacurity.com)*,* [*Windows Report*](https://windowsreport.com/google-unveils-gemini-4-carbon-with-record-cybersecurity-scores-and-stronger-ai-safeguards/?ref=metacurity.com)*,* [*Ars Technica*](https://arstechnica.com/ai/2026/10/google-announces-gemini-4-carbon-its-latest-frontier-ai-model-that-you-cant-use/?ref=metacurity.com)*,* [*WinBuzzer*](https://winbuzzer.com/2026/10/28/gemini-4-carbon-ai-leads-test-for-fixing-vulnerable-code-xcxwbn/?ref=metacurity.com)*,* [*Android Authority*](https://www.androidauthority.com/google-announces-gemini-4-carbon-3729367/?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/technology/google-launches-gemini-4-carbon-ai-model-with-cybersecurity-focus-2026-10-28/?ref=metacurity.com)*,* [*TestingCatalog AI News*](https://www.testingcatalog.com/google-unveils-gemini-4-carbon-for-cyber-defenders/?ref=metacurity.com)*,* [*The Decoder*](https://the-decoder.com/google-deepmind-releases-gemini-4-carbon-just-two-weeks-after-argon-with-gains-across-the-board/?ref=metacurity.com)*,* [*Blockchain.News*](https://blockchain.news/news/google-gemini-4-carbon-cybersecurity-benchmarks?ref=metacurity.com)*,* [*Neowin*](https://www.neowin.net/news/google-gemini-4-carbon-dethrones-gpt-6-astra-and-claude-opus-55-at-a-fraction-of-the-price/?ref=metacurity.com)*,* [*9to5Google*](https://9to5google.com/2026/10/28/gemini-4-carbon-announcement/?ref=metacurity.com)*,* [*The Information*](https://www.theinformation.com/briefings/google-launches-gemini-4-carbon-second-major-ai-model-month?ref=metacurity.com)*,* [*Digital Trends*](https://www.digitaltrends.com/computing/googles-new-ai-model-gemini-4-carbon-is-built-for-complex-coding-and-cybersecurity-tasks/?ref=metacurity.com)*,* [*The Deep View*](https://www.thedeepview.com/articles/with-gemini-carbon-can-google-keep-up?ref=metacurity.com)*,* [*Artificial Analysis*](https://artificialanalysis.ai/articles/gemini-4-carbon-new-number-1?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-92.png)

Source: Google.

### US law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities.

The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities.

The US Department of Justice (DOJ) confirmed that Virtualine marketed services that permitted “illegal/black hat activities” ranging from phishing, spamming, and carding to port scanning.

The FBI seized the primary domain of the service, virtualine\[.net\], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and Lumen.

Although Virtualine drew an apparent line at child content, authorities say that the operator knowingly hosted an online forum promoting child abuse material and ignored repeated notices from law enforcement, the National Center for Missing and Exploited Children (NCMEC), and a victim’s attorney. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/police-seize-virtualine-bulletproof-service-tied-to-ransowmare-cybercrime/?ref=metacurity.com))

***Related:*** [*Justice Department*](https://www.justice.gov/usao-edva/pr/bulletproof-website-domain-seized-international-law-enforcement-operation?ref=metacurity.com)*,* [*TRM Labs*](https://www.trmlabs.com/resources/blog/fbi-seizes-virtualine-domain-after-provider-led-bulletproof-hosting-sector-in-illicit-inflows?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/virtualine-bulletproof-hosting-provider-seized/?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/202002/cyber-crime/virtualine-domain-seized-but-allegedly-abusive-website-remains-online.html?ref=metacurity.com)*,* [*The Cyber Express*](https://thecyberexpress.com/fbi-seizes-virtualine-domain-over/?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/10/28/fbi-seizure-virtualine-bulletproof-hosting-domain/?ref=metacurity.com)*,* [*The Record*](https://therecord.media/fbi-seizure-csam-virtualine?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/fbi-seizes-virtualine-bulletproof-hosting/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-93.png)

Seizure banner. Source: Bleeping Computer.

### The Pentagon is treating the spate of mysterious freezer ​malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.

One of the ‌officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.

When asked about the investigation, the Pentagon said that a unit of Cyber Command — the military's cyber force — was "working in close coordination with interagency and law ​enforcement partners." 

The US Army Criminal Investigation Division said its Cyber Field Office was involved in the investigation and that it was working with French law enforcement ​to better understand "the refrigeration outages in Europe."

The late August malfunctions in the United States affected at least six commissaries — on-base stores where military personnel buy ⁠their food — according to a Reuters review of the military bases' contemporaneous Facebook posts and website updates. In at least one of the cases, the freezers did not simply stop working; the cooling ​units' temperatures were cranked up overnight, yielding mounds of wilted or melted food in the morning.

The Fort Huachuca, Arizona, Facebook account explained on August 26 that its freezer "went into defrost mode where it heated ​all the food. Trust us when we say it was 'spoiled.'" ([Raphael Satter, AJ Vicens, and Phil Stewart / Reuters](https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/?ref=metacurity.com))

---

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

---

### A top executive at a Singapore-based data center company was under scrutiny for possibly steering advanced Nvidia AI chips to China, and now American officials had concluded that she was a Chinese intelligence asset, funneling information to Beijing.

But what came next was even more alarming. Surveillance of the executive, Alice Huang, or Huang Le, a Chinese citizen, revealed that she had developed a close relationship with Jensen Huang, Nvidia’s chief executive.

For years, Washington has worked to deny China the technology needed to match or surpass the United States in the intense global competition for superiority in artificial intelligence. The discovery that Beijing was getting reports from someone with direct access to Mr. Huang, one of the most powerful figures in the AI revolution as well as an influential ally of President Trump’s, set off alarms at the White House.

Roughly a year ago, Mr. Trump was briefed on the intelligence findings, which have not been previously reported, and chose not to do anything with the information. Mr. Trump has been wary of disrupting Nvidia’s chip sales, which are helping to drive the economy and the stock market, and of further complicating the trading relationship with China. ([Jonathan SwanMaggie HabermanAna SwansonPaul MozurTripp Mickle and Julian E. Barnes / New York Times](https://www.nytimes.com/2026/10/29/us/politics/nvidia-china-jensen-huang-trump.html?unlocked%5Farticle%5Fcode=1.MVE.x76w.ZYbHMWyXXAU2&smid=nytcore-ios-share&ref=metacurity.com))

### Japan Airlines said one of its IT providers suffered a data breach that leaked the personal records of more than 90,000 customers, adding to a series of cyberattacks on Japanese firms that has prompted government action in recent days.

The company published a notice on Wednesday saying Amadeus IT Group, the company that runs its flight reservation, ticketing and check-in systems, informed the firm last week that hackers accessed a “portion of customer reservation data” for Japan Airlines and Japan Transocean Air flights. In total, 92,000 customers were impacted, with hackers accessing names, reservation codes and flight information.

For about 2,000 Japan Airlines customers, the hackers stole passport numbers, frequent flyer numbers, email addresses, and phone numbers.

Japan Airlines said the breach never impacted flight operations and credit card numbers were not compromised.

“We will contact the affected customers individually to provide necessary assistance, including reminders to remain vigilant against phishing emails, fraudulent phone calls, and suspicious websites impersonating the JAL Group,” the company said. ([Jonathan Greig / The Record](https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents?ref=metacurity.com))

**Related:** [*Japan Airlines*](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html?ref=metacurity.com)*,* [*The Standard*](https://www.thestandard.com.hk/world/article/346807/JAL-hit-by-major-data-breach-affecting-92000-customers?ref=metacurity.com)

### French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.

ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year.

An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems.

"ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said.

The ENGIE spokesperson didn't say how many customers were affected, but said the incident is limited to customers in France.

Although the company didn't share what customer information was stolen in the attack, it said in breach notification letters sent to affected customers that the threat actors gained access to their first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number. ([Sergiu Gatlan / Bleeping Computer](https://fuitesinfos.fr/article/2026-10-23-engie?ref=metacurity.com))

**Related:** [*F Suites Info*](https://fuitesinfos.fr/article/2026-10-23-engie?ref=metacurity.com)*,* [*Infosecurity Magazine*](https://www.infosecurity-magazine.com/news/energy-giant-engie-supply-chain/?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html?ref=metacurity.com)*,* [*SC Media*](https://www.scworld.com/brief/engie-confirms-customer-data-breach-via-marketing-platform?ref=metacurity.com)

### Researchers at CloudSEK report that a new Android malware-as-a-service (MaaS) operation has been found renting customized banking trojans to criminals targeting Indian bank customers, with one affiliate intercepting 5407 text messages from 153 infected devices in an operation branded MR ROBOT.

The researchers found an operator control panel, a Telegram-based storefront, and a malware builder that let affiliates create bank-themed Android trojans on demand.

The lures are distributed through fake Play Store-style pages and messaging-app links, and impersonate banks as well as utility providers and government services.

CloudSEK said MR ROBOT is not a single actor’s campaign but a multi-tenant crimeware platform. Each affiliate receives its own application ID and can generate Android packages impersonating specific Indian banks.

The platform supports a tiered reseller model with sub-admin accounts, and licenses access for set periods through a control panel identified as version 7.0.

The malware intercepts text messages carrying one-time passwords (OTPs), shows fake screens to harvest banking credentials, card details, PINs, and identity information, and can silently enable call forwarding. CloudSEK said this reroutes incoming calls, including banks’ fraud-check callbacks, to a number the attackers control.

The storefront, a Telegram bot called APK Shield, offered around 36 lure apps, including bank impersonations and fake apps for utility bills, telecom services, traffic fines and government services. ([Alessandro Mascellino / Infosecurity Magazine](https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/?ref=metacurity.com))

**Related:** [*CloudSEK*](https://www.cloudsek.com/blog/inside-mr-robot-malware-as-a-service-targeting-indian-bank-customers?ref=metacurity.com)*,* [*Express Computer*](https://www.expresscomputer.in/news/cloudsek-identifies-android-malware-operation-targeting-indian-bank-customers/140594/?ref=metacurity.com)*,* [*Daily Pioneer*](https://dailypioneer.com/technology/cyber-gang-mr-robot-rents-out-malware-to-target-indian-banking-customers-cloudsek?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-96.png)

Screenshot of the fake app. Source: CloudSEK.

### Best Thing of the Day: Let's Hope This Is Not a Headfake

The Trump administration said FBI and Immigration and Customs Enforcement (ICE) agents [will not serve](https://www.newsweek.com/doj-says-it-wont-deploy-fbi-ice-agents-as-poll-monitors-12633663?utm%5Fterm=Autofeed&utm%5Fmedium=Social&utm%5Fsource=Bluesky#Echobox=1793264537) as federal election monitors during the 2026 general election, according to a Justice Department court filing Wednesday.

### Worst Thing of the Day: Spy on Students, Everywhere All at Once

A draft video surveillance policy at the University of Sydney in Australia shows the nation’s oldest university[ is contemplating](https://www.smh.com.au/national/nsw/like-1984-university-of-sydney-s-plans-for-campus-surveillance-under-fire-20261028-p618vc.html?ref=metacurity.com) using AI-powered facial recognition, CCTV watch lists and body-worn cameras for all security guards for “recording details of access” and “identifying people involved in relevant conduct” under a shake-up of security operations.

### Bonus Worst Thing of the Day: As If Gambling Weren't Risky Enough

Illicit software on the computers of some of the world’s best online poker players [allowed](https://www.wired.com/story/a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards/?utm%5Fmedium=social&utm%5Fsource=bluesky&utm%5Fcampaign=aud-dev) an accused cheater to see what cards were in the victims’ hands and trounce them at the tables.

### Closing Thought

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-97.png)