A bank trusted an inbound request from a government address. A platform's content was rewritten at the delivery edge while its origin files stayed clean. Two energy tankers were compromised at sea. None of these were perimeter failures. They happened where the organization had decided a perimeter was not necessary.

Two US-bound tankers were boarded after their networks were compromised (Americas)

The US Coast Guard and FBI boarded two US-bound energy tankers in August after indications that both vessels' networks had been compromised, in an investigation reported by TechCrunch and gCaptain this week. A joint statement said the boardings were designed to "ensure integrity of the vessel's operational and information technology systems following indications that the networks of both vessels were compromised." One vessel was identified in reporting as the VLCC VL Prosperity; the other was a liquefied natural gas carrier. The agencies reported no operational disruptions, vessel instability, danger to crew or environmental impact. The joint statement made no attribution, though reporting indicates investigators are examining whether Iran, or an actor exploiting Iran and US tensions, was involved.

This is an OT and critical infrastructure story with a supply chain consequence attached. For any firm moving physical goods, the question is not whether your own network is defended, but whether you have visibility into the OT estate of the carriers you depend on. Most carrier contracts never ask.

A bank was defrauded through a channel it was obliged to trust (Europe)

Revolut confirmed customer data was affected after an attacker sent fraudulent data requests impersonating an Italian government agency to Revolut Bank UAB, its Lithuania-based subsidiary. We covered the incident in detail in a standalone breach report. What developed this week is the surrounding picture. SecurityWeek reported that the attacker first compromised a government employee's account using infostealer malware, then used that legitimate government domain to submit requests over roughly five to six months. Two circulating numbers come from outside the company and are claims rather than confirmed facts: roughly 680 affected accounts, reported by the Financial Times, and a $3 million ransom demand publicized by the threat actor. Revolut said on 17 September it had received no direct contact, and it has not published a victim figure.

The domain is identity access and fraud. Regulated firms are legally obliged to answer government data requests, and those workflows are often manual, thinly staffed, and built on a presumption that a valid sending domain satisfies. Any firm with an EU entity should ask who verifies inbound legal process, against what, and whether five months of anomalous requests from one address would surface at all.

The UAE's cyber authority described extortion that skipped encryption entirely (Middle East)

At the Arab Media Summit in Dubai on 15 September, Mohamed Al Kuwaiti, head of the UAE Cybersecurity Council, said in remarks covered by Khaleej Times that the country recorded 640,000 cyberattacks in a single day, naming electricity, water and the wider economy among targeted sectors. He also described a private-sector case in which, per The National, he took a direct call from the attacker demanding more than $5 million, following data destruction and attempted leaks on Telegram and the dark web. In a CNN interview the next day he attributed many of the attacks to Iran, saying "Iran is one of the main players; the IRGC is the specific one behind many of those aspects," and tying that to the same figure. That is the attribution as a named official stated it, and it is where this report leaves it.

For resilience and continuity planning, the shape of the extortion is what matters. Destruction plus threatened publication removes the decryption key from the negotiation entirely. Backup integrity then decides recovery, and nothing decides disclosure exposure except what was taken. A plan built around restoring encrypted systems answers neither.

A Japanese platform breach handed over session tokens, not just email addresses (APAC)

Helpfeel, the Japanese operator of image-sharing service Gyazo, published a notice on 16 September confirming that an attacker exploited a vulnerability in its image upload server to execute arbitrary commands and access roughly 23.62 million user records and approximately 490 million image metadata records. User records included email addresses, password hashes, device IDs, session tokens, SSO details and billing status, excluding card numbers. Helpfeel detected suspicious activity on 11 September, blocked access by early on 12 September, and reported to Japan's Personal Information Protection Commission on 15 September.

This is a data governance and privacy story that becomes an identity story on contact with the enterprise. Session tokens and SSO details are not static records. They are live credentials, and they do not expire because a breach was disclosed. Any organization whose staff signed into a consumer service with a corporate identity now holds an exposure it cannot inventory. The four days between detection and regulator notification is also a useful benchmark against your own process.

The compromise was served from the edge, and integrity checks saw nothing (Europe)

Brevo, the French customer engagement platform, published a post-mortem stating that a long-lived Cloudflare API key with full account permissions was stored in application source code and obtained by an attacker, who used it to deploy a malicious Cloudflare Worker injecting ClickFix scripts. By Brevo's timeline the injection ran on brevo.com from 15:01 UTC on 14 September, extended to sibforms.com from 16:07, and ended at 20:30. Security firm Sansec estimated more than 100,000 websites were likely affected; that figure is Sansec's, not Brevo's, and the two give different durations. Brevo's account of why detection failed is worth reading twice: "the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.

The pattern

Four of these five compromises happened at a point the organization had classified as infrastructure rather than as attack surface. Revolut's inbound legal request channel was a compliance obligation, not a threat vector. Brevo's CDN layer was delivery plumbing, and its integrity monitoring watched the origin because that is where files live. Gyazo's session and SSO tokens were a convenience feature on a consumer service. The tankers were assets in motion, governed by charter contracts rather than security architecture.

This is not a coincidence of one week's news. It is what happens as security programs mature. The well-instrumented core gets harder, and attackers move to the seams between systems that different teams own: between legal operations and security, between the origin and the edge, between your identity provider and every consumer service your staff signed into with it. No seam belongs to one team, which is why nobody watches them continuously.

What this means for security operations

The capability this week implies is not a new control. It is continuous coverage of ground that periodic assessment does not reach, which is a different problem from buying better tools.

Three things follow. Validate trust assumptions in workflows sitting outside the SOC, including inbound legal and government request handling, and treat anomalous volume there as a detection case rather than an administrative matter. Monitor what is served to users at the edge rather than what is stored at the origin, because file integrity monitoring answered the wrong question at Brevo and would answer it the same way almost anywhere. And hold a live inventory of where corporate identity has been delegated to third parties, so a token dump at an unfamiliar service becomes an actionable event rather than a news item.

Each is continuous by nature. A quarterly assessment catches none of them, because all three change daily. That is a standing operational capability rather than a project, and it is what Agents Stack runs as a managed service across six cyber domains.

What to watch

Whether Revolut's characterization holds as the Italian investigation develops, since fraudulent government data requests have a history of proving wider than the first disclosure suggests. And whether maritime sector guidance follows the tanker boardings, because the agencies have confirmed an investigation without issuing an advisory.

The broader read is simpler. If your last assessment covered your network, your endpoints and your cloud, it covered none of the five places attackers worked this week.