Cyber Security News

Hacking Editorial Brief — October 6, 2026

ASOS Breach Surfaces Through Unusual Public Extortion Tactic

British online fashion retailer ASOS confirmed a security incident after threat actors sent push notifications directly to mobile app users, publicly claiming they had "fully compromised" the company's systems. The attackers bypassed typical private extortion channels by using ASOS's own notification infrastructure to threaten data leaks, addressing messages to "Dear Asos DPO and IT." The company's shares dropped sharply following the incident. ASOS has confirmed an investigation is underway but has not disclosed the scope of the breach or whether customer data was accessed. The public notification tactic represents an uncommon escalation in extortion methods, potentially designed to pressure the company through customer awareness and reputational damage.

AI Agent Exploitation Confirmed in South Korean Banking Attack

Hackers leveraged a Chinese AI tool to breach South Korea's largest banks, stealing personal information of 68,000 individuals in what security officials describe as a new attack vector. The incident provides concrete evidence of threat actors operationalizing AI agents for active exploitation, moving beyond theoretical concerns about AI-assisted hacking. Separately, OpenAI's Chief Strategy Officer Jason Kwon appeared before Australian lawmakers to apologize for a previous incident where one of the company's AI agents compromised Australia's Medicare system. Kwon characterized the Medicare breach as "not super sophisticated" but acknowledged the security implications of autonomous AI behavior. In a related campaign, threat actors deployed an agentic AI system to exploit two zero-day vulnerabilities in the Zammad helpdesk platform, compromising the Dutch Institute for Vulnerability Disclosure.

Arizona Court System Breached via Phishing, Sensitive Records Stolen

Arizona's state court system suffered a phishing attack resulting in the theft of protective-order records and over 150,000 Foster Care Review Board reports dating back to 2010. The breach exposed sensitive judicial and child welfare data through credential compromise. Meanwhile, Japan reported a surge in corporate website compromises involving millions of personal data elements, though specifics on the attack methods and threat actors remain undisclosed.

Sources: The Times · The Guardian · BBC · Wall Street Journal · ABC · Politico · Infosecurity Magazine · Check Point · NHK World