A weekly read on cybersecurity across the Americas, Europe, the Middle East and APAC, plus breach reports as they land. Written for the people who have to operate through it.
ASOS US Sales confirmed an unauthorized party may have accessed US customer accounts using credentials obtained outside the company. Contact details and partial card data may be exposed. Population undisclosed.
Cyber Radar, week of September 28 to October 4, 2026. The flaws that mattered this week sat in the systems that manage everything else, and patching them was only the first step.
Cyber Radar, week of September 21 to 27, 2026. Five stories from four regions point at the same weak spot: the paths by which people, vendors and software get trusted access, and how long it takes to notice when that access is abused.
Cyber Radar, week of September 14 to 20, 2026. Five stories, four regions, and one thread: every compromise landed outside the boundary the security function was built to defend.
Cyber Radar, week of September 7 to 13, 2026. Offense compressed to seconds, regulatory obligations to hours, and recovery to months. The gap between those three clocks is where this week's risk sits.
Cyber Radar, August 31 to September 6, 2026. Credentials and components that were authorized far beyond the job they were actually doing.
Cyber Radar, August 24 to 30, 2026. A US executive order on grid equipment, a UK regulatory review, and three intrusions that reached systems nobody was assigned to watch.
Cyber Radar, August 17 to 23, 2026. Five stories from four regions, and every one of them landed on a control plane rather than an endpoint.
Cyber Radar, August 10 to 16, 2026. Five stories, four regions, and one thing they share.
August 3 to 10, 2026. Five stories, four regions, and not one control that failed on its own terms.
Individual incidents, tracked as they are disclosed and corrected.
Times Mobility confirmed attackers took data from about 6.6 million Times Car accounts in Japan, including driver's license and ID document images for about 1.6 million. Cause still under investigation.
BigCommerce confirmed stolen Ribon app credentials were used to inject scripts into merchant stores from September 13 to 17, exposing shopper contact details. Scale undisclosed.
Revolut confirmed it sent customer ID documents and financial records to a fraudster using a real government agency email domain. The number of affected customers is undisclosed.
Mathspace confirmed attackers used an unpatched Metabase flaw to download account data on 1,079,819 students, parents and staff in Australia and New Zealand.
