I would not run a bank’s IT right now

In 19 days, attackers reached the merchant accounts that hundreds of businesses hold on a payment platform, the records of a hospital supplier, the customer files of an airport group, and the production floor of a cardiac device maker, and in almost every case they arrived holding a key somebody had left lying out in the open, and in the first of those four cases the platform itself was never compromised at all. In the same season, the two companies that each describe themselves as building the strongest defensive models available started keeping a guest list, and they said so in public, in documentation almost nobody outside the field has opened. Here is what those 19 days actually looked like, why the German response I see in the companies I actually work with comes down to two administrators, one of whom happens to be on vacation right now, and what outside help is going to cost once the capable models are handed out by application form.

If a bank asked me this week to take responsibility for its IT, I would say no on the phone, before hearing the number, and I would not need the weekend to think it over, because I already know what taking that job would do to my sleep. That is not modesty about my own abilities, it is arithmetic about the size of the attack surface, and I have spent the past several days doing that arithmetic in public, which is what this article is.

I have been writing this piece for days, and the reason it took days is that the list kept growing while I wrote. Every morning there was another filing, another leak site entry, another vendor advisory, and by the time I finished a paragraph about one incident, two more had already been disclosed. At some point the counting stopped being research and started being the argument.

On July 25 I wrote here about a language model that broke out of its test environment and reached into another company’s production systems. At the time I was working with GLM-5.2, and what unsettled me was not what the model could already do. It was the shape of the curve, and the knowledge that the next version was already in training somewhere. The official accounts of that incident, from OpenAI and from Hugging Face, were published on August 26. That is a month between the point at which the outline of this became discussable from outside and the point at which the institutions involved described it themselves, and I claim no more for my own piece than that it was early.

Nothing changed in between, at least nothing I can detect from Germany. I read the German press every morning and I find almost no warnings. Executives and managing directors go about their work, and that is reasonable, since it is their job. Published CVEs land in an inbox that belongs to a system administration team of two people, which is the size I keep encountering, and those two were hired to keep printers and mail flowing, not to read exploit chains, because you cannot go to a university and major in being under attack. One of the two is on vacation right now, because it is early September and people take vacations. The other one is holding first-level support together entirely on his own and will get to the advisory when he gets to it.

None of that is negligence on anybody’s part. That is the staffing model I keep running into at German mid-sized companies, and I have no survey behind that observation, only the rooms I have stood in, and it is the reason I am writing more than 12,000 words instead of a warning, and the reason I counted them before I put the number in front of you.

It is not five minutes to midnight. It is already a quarter past midnight, the number of attacks keeps increasing, and the private citizen is part of this too, because somewhere out there is a list of the places holding your data, the companies you once emailed a photograph of your own ID card to, and the systems that know your account balance. You have never seen that list. Nobody has ever offered to show it to you.

Here is what the past 19 days looked like.

On the morning of Tuesday, August 25, 2026, several thousand people walked into the Boston Scientific plant in Cork, Ireland, and were sent back home with their full pay, and with no explanation that anybody in that building could use. Somewhere upstream of them, on systems nobody in that building had ever logged into, something had gone wrong badly enough that the company stopped making things.

Boston Scientific manufactures pacemakers and implantable defibrillators. By the company’s own description of its business, its products are sold into 127 countries, and a share of them sits inside human chests. On the day the plant emptied, order processing stopped, shipping stopped, and the only way a hospital could still place an order was to fire it into an EDI queue and hope. The company filed an 8-K with the SEC the next day and put up a status page, and that status page has been quietly updated ever since, in the flat register that corporate legal departments use when they know the sentence will be read in a courtroom later.

Here is the part of that status page that should make you put your coffee down. Devices already implanted continue to work. Remote monitoring that was already running continues to run. But new remote monitoring activations are broken. That is the company’s own account of it, and the account still stood on its status page on September 1, which means a patient who received an implantable cardiac monitor in the last week of August may be carrying a device that records episodes without being able to transmit them, because the communicator does not activate and the patient app does not pair. Anybody in that position should be asking their own clinic rather than taking my word for the current state of it. The data exists, it sits there in your chest recording faithfully, and nobody can currently read it.

As of today, September 2, eight days later, Boston Scientific has not said how the attackers got in. It has not confirmed whether any data left the building. And nobody has claimed the attack, which for an incident of this size is the strangest detail in the entire story, and you will meet that same silence twice more before I am finished.

I want to be precise about what this article is and is not. It is not a report on one company’s bad month. Between August 15 and today I counted more than 20 successful, publicly documented intrusions, two of which begin a day or two before that window opens, and a handful of the things I will describe started earlier still and only became visible inside this window, which I will flag wherever the earlier start changes what the case means, and one number in this article is going to shrink before I am done with it, in public, because it does not hold. When you lay the cases next to each other something ugly comes into view: in the majority of the cases where the route is actually known, nobody broke anything, because the intruders authenticated their way in instead. They held a valid key, a valid token, a valid session cookie, or a valid-sounding phone call, and the systems they walked into did exactly what they were built to do, which is to let valid credentials through.

That is the thesis of this piece, and I will state it once, plainly, so you cannot miss it. The defining security failure of 2026 is not the unpatched server. It is the credential that outlives the trust it was issued under, sitting in a place nobody audits, held by a system nobody remembers connecting.

Everything after this paragraph is either evidence for that claim, or a discussion of what happens when you hand a machine that never sleeps the job of finding those credentials, or an argument about what can actually be done regardless.

For the past two weeks I have spent most of my nights hardening my own systems, and I have done it the way I described in the piece on why Murphy’s law was the answer to the question of why nobody died. Murphy is not a shrug about bad luck. Murphy, applied properly, means that you assume every component will be used in the worst permissible way, and you design so that the worst permissible way is survivable. Applied to infrastructure, that discipline makes the work a great deal easier, because it removes the question of whether an attacker would bother. You stop asking what is likely and start asking what is possible, and the list gets shorter rather than longer, because most of what is possible is prevented by the same handful of decisions.

The awkward thing about a log file is that it is almost always read by somebody who has already decided that nothing happened, and that decision gets made before the first line is opened. My own infrastructure is under attack every day, which is unremarkable, since everyone’s is. What is remarkable is the change in texture over the past several months. The probing used to feel like weather. Now it feels like someone reading.

The key under the mat, and the keys the seller says are in it

Start with the cleanest example, because the mechanism in it is laid completely bare.

On August 18, a threat actor operating under the handle Satanic posted a data release to the criminal forum pwnforums. The package advertised on that forum was 33 GB covering 669 vendors who use Stripe for payments, and the listing put the number of live API keys inside it at 1,033. That figure is the seller’s own, and the researchers who reported it had confirmed working keys in the portion they examined, not tested every string in the archive. Hudson Rock researchers reached the actor within minutes of the release. He told them the drop was a sample, and that he was sitting on roughly 20,000 compromised Stripe API keys that he intended to release in batches. The archive actually available at the download link was 2.37 GB, which is consistent with a man showing you one drawer of a filing cabinet.

Once the folders belonging to generic free email accounts are stripped out of the archive, the researchers were left with 323 uniquely identifiable business domains, and that reduction is theirs rather than mine, because I have not opened the archive and would not advise anybody else to open it either. The list runs through consulting firms and print shops, a pizzeria in Norway, and a funeral services company in Spain. There are also an enormous number of small AI startups with .ai domains, which is its own quiet comedy, since a good half of them presumably sell security posture to somebody.

What was inside those folders was not a customer list. It was the operating nervous system of each business: accounts, balances, charges, customers, invoices, payouts. A single vendor account, one that the researchers picked and opened at random, held more than 22,000 customers and over 5 million dollars in paid invoices. The invoice records carried the purchaser’s exact IP address at the moment of the transaction, internal transaction identifiers, and the identifiers for whatever third-party platforms that vendor had bolted on. Hudson Rock reported that the hosted invoice URLs inside the archive still resolved to real, rendered Stripe invoices showing the last four digits of the customer’s card, which is a verification step that belongs to researchers working under a disclosure mandate and to nobody else who happens to come across the file.

And then there are the keys themselves. Some of the exposed keys carry the sk_live_ prefix, are labeled as standard type, and belong to accounts explicitly configured with charge capabilities enabled. In plain language: whoever holds that string can talk to that business’s money.

Stripe itself was not breached. That distinction matters legally and matters not at all in practice, which is a sentence I will have to write several more times before this article is over.

Hudson Rock’s telemetry found no infostealer infections on the affected domains, and the victims share no common tech stack, no common plugin, no common CMS. Hudson Rock’s own assessment is that the actor is running automated bots at scale, sweeping the internet for misconfigured environment files and debug logs that spill plaintext sk_live_ keys, or that a piece of shared infrastructure underneath all of them simply gave way. Nobody had to be targeted. They just had to be findable.

I want you to hold on to the shape of that: a machine, scanning continuously, looking for a string. Because we are going to come back to it, and by then the machine will be considerably smarter.

The feedback board

Now watch the same mechanism operate at human scale, in a company that did almost everything right.

21bitcoin is an Austrian broker. Like every modern company, it runs a support system, and like every modern company, it wanted to know what its users thought, so it connected a feedback tool called Canny to its support platform, Intercom, through an integration. That integration needed a key of its own. The key was issued once, worked for as long as nobody withdrew it, and was from then on held outside the company that issued it.

On August 28, that key was compromised. Somebody used it to read customer data out of the support system. 21bitcoin learned about it the following day, cut the connection the same day, killed the key, and rotated its access. Bitcoin balances, euro balances, transaction data, bitcoin addresses, bank details, home addresses, identity documents, and passwords were all held on separate infrastructure and were never at risk. The company said so, took full responsibility anyway, and its CTO put his name on a statement about it. As disclosure goes, this is close to exemplary.

And here is what came out anyway: names, email addresses, phone numbers, dates of birth, device data, account status, the account balance as it was visible inside the support tool, and the subject line of the customer’s first support message.

Read that last item again, because it is not the conversation, it is the subject line. That means an attacker now knows that you hold a certain amount of bitcoin, and that the very first thing you ever contacted support about was a withdrawal of yours that had gotten stuck.

If an attacker wanted to design the perfect raw material for a phishing call, he could not do better. He knows the balance, he knows the grievance, he knows the phone number, and he knows the language and operating system of the device his target is using. 21bitcoin’s own advisory says exactly this, and the company announced a countermeasure along with it: future emails will carry a personal code that customers can verify in the app. It is a good fix. It is also an admission that email as an identity channel is finished.

The feedback board, the place where customers write in to say the app is a little slow, was the door.

Less than two weeks earlier, the Swiss provider Pocket Bitcoin had gone through the same thing from the other end. An attacker had access for about a week before the company shut it down on August 16, and the exfiltration itself was only discovered on August 19. The central customer database was untouched, the bitcoin infrastructure was untouched, and private keys were never held in the first place, since Pocket is not a custodian. What did leave the building was the support database: every customer’s email address, the support correspondence, the attachments, the Telegram usernames, the WhatsApp numbers.

Then, on August 31, Pocket published an update that turned a data breach into something worse. For 291 customers, the attackers also got identity documents, source-of-funds records, postal addresses, and in some cases the bitcoin address used for the transaction.

Sit with the shape of that for a second. A government-issued photograph, a home address, a document proving where the money came from, and a public-ledger address, in one bundle, for 291 named human beings. Everything on that ledger is visible to everyone, permanently, and nobody can take an entry back off it. The only thing that ever protected those people was that nobody could connect the string to the face. That protection is now gone, for those 291, permanently, and no patch reverses it.

The supply chain does not have a bottom

If the credential is the weapon, the supply chain is the delivery mechanism, and August was the month the delivery mechanism started showing its full reach.

The AI supply chain compromise with the widest documented reach this year runs through two pieces of software called LiteLLM and Trivy, and both of them are ordinary, unglamorous infrastructure. LiteLLM is the plumbing a great many companies use to talk to language models. Trivy is a vulnerability scanner, which is to say it is the thing you install specifically because you are being careful. Poison those, and you are not attacking a company. You are attacking the concept of a build pipeline.

Hudson Rock completed more than 250 ethical disclosures to organizations worldwide in the aftermath, among them more than 30 companies from the S&P 500 and Global Fortune 500, across cloud, telecommunications, automotive, government, retail, healthcare, and finance. Its own framing is worth quoting, because it is unusually honest for an industry that loves to blame the victim: these breaches were „extremely difficult to avoid,” and the affected organizations are not at fault.

What the attackers harvested was CI runner dumps. When a build pipeline runs, it holds every secret it needs in its environment, in plaintext, for the duration of the job. Under normal conditions that is a rounding error of exposure. Under these conditions it was a shopping list.

In the disclosures Hudson Rock made after this campaign, the property management platform Guesty is described as having had dozens of AWS access keys and secrets present in plaintext in its pipeline logs, which is the ordinary behavior of a build pipeline rather than a configuration anybody chose deliberately. The Vect ransomware group subsequently claimed 700 GB, including internal projects, 4 million sent and received emails with attachments, the entire user base, and the Airbnb and Booking.com integration data. Those numbers are the criminals’ own, and criminals inflate, so treat them as marketing until somebody verifies them.

S&P Global had temporary AWS STS session tokens and long-lived AWS keys intercepted during a Terraform workflow. Among what came out with them were thousands of secrets, GitHub tokens, JWTs, and RSA private keys. The same group claimed 250 GB in that case, and that figure is theirs as well, on the same terms as the last one.

Cisco is reported to have lost source code to this campaign, and the account of how it happened was reconstructed by the researchers who tracked the campaign rather than confirmed in that detail by the company. The intrusion has been traced to a development environment running a poisoned Trivy container, and the attackers appear to have scraped GitHub personal access tokens from the runner’s environment variables, along with an Artifactory token that opened internal packages and a Conjur API key that reached into Cisco’s own secret management. There is a specific vertigo to that sentence. The system whose entire job is to keep secrets was reachable via a key found lying in a log file, and the log file was produced by the security scanner.

The European Commission was hit through the same door. A compromised runner executing a Terraform deployment gave up AWS IAM credentials, a hardcoded SSH private key, and GitLab CI tokens, which is a set of items that would, in my reading, open a path sideways across europa.eu infrastructure, and CERT-EU has publicly confirmed that the incident happened without describing how far that path actually reached, which leaves the confirmation and the extent of it on two different footings.

And then there is Mercor, which is the one that should genuinely frighten you.

Mercor is a 10-billion-dollar AI startup. Its business is the labeling and annotation work that makes frontier models function at all, which means its business is people. Attackers took Anthropic, Linear, and Datadog API keys out of its runner environment variables and, according to available reporting, moved laterally and extracted roughly 4 terabytes. The inventory reported for that extraction, which originates with the people who carried it out rather than with Mercor, lists 939 GB of proprietary source code, potential AI training methodologies, video interviews, and user database records holding the Social Security numbers and biometric data of more than 40,000 contractors. Reporting on the aftermath describes a major data contract with Meta being paused and multiple class actions being filed against Mercor, and I have not seen either of those two developments confirmed by the companies themselves. The extortion group Lapsus$ then claimed it had sold, outright and irreversibly, the entirety of Mercor’s biometric data, PII, and AI training data to buyers it described as Chinese enterprises, and nothing in that claim identifies a buyer or connects one to any state.

Biometrics do not rotate, and you cannot issue somebody a new face.

Two people were arrested in Western Australia at the end of August on suspicion of involvement with TeamPCP, which investigators and researchers identify as the group behind the Trivy and LiteLLM supply chain attacks and the Mercor breach that followed from them. Neither of the two has been convicted of anything as I write this, no charge against them has been tested in court, and until a charge has been tested and proven the presumption of innocence applies to both of them in full. TeamPCP appears to have opened the doors, while Vect and Lapsus$ are the parties that have publicly offered what came out of them, and an offer on a leak site is a long way from a completed transaction. The arrests followed a joint operation by the Australian Federal Police and the FBI. That is the good news, and I want to give it its full weight, because arrests in this space are rare. It also does not un-sell the biometrics, assuming the sale happened at all. Lapsus$ says it did, and by the rule I set out in the Guesty paragraph I have to file that as a marketing claim like any other, which is what I am doing here. What I cannot do is treat it as settled. The honest version of the sentence is that the biometric data of more than 40,000 contractors is either sold or held by people who say it is sold, and that for the people inside that database the difference is not one they can act on.

The same pattern, in a lower key, ran through the rest of the month. Pokémon Center customers in the UK and Germany had their names, addresses, phone numbers, email addresses, and order contents exposed, and the reported route into that data runs not through the retailer at all but through its logistics provider CEVA Logistics, the company holding the order records on the retailer’s behalf. Pokémon Center itself was not breached, and that distinction matters legally and matters not at all in practice. SickKids in Toronto, the children’s hospital, exposed staff and job applicant data through a vulnerability in third-party software it shares with other organizations. Clinical systems and patient records were untouched, which is genuine competence in segmentation and deserves to be said out loud.

And then there is Carhartt, which is not a supply chain story at all and belongs here anyway, because it is the same lesson seen from inside the building. The workwear company had 12.9 million accounts published on August 27 after ShinyHunters, by its own account, demanded 3.3 million dollars and was refused. Troy Hunt analyzed the 50 GB archive for Have I Been Pwned and traced the source not to Carhartt’s store, its website, or its payment systems, but to its Databricks analytics platform. Databricks was not breached either, and by now you know how that distinction goes. That is the place where the company kept the data about its customers in order to think about its customers. More than 15,000 employees with @carhartt.com addresses were sitting in there too.

Hunt also stripped millions of synthetic records out of the dataset before publishing the count, records with no real person behind them, which is the kind of scrupulousness that makes the remaining number trustworthy. Note the direction of that correction. He made the headline smaller.

Somebody called, and they knew your colleague’s name

On August 17, the security company ReliaQuest published a warning. A group was running a social engineering campaign using lookalike domains under the .claims top-level domain, impersonating legal departments, help desks, and IT staff to harvest single sign-on credentials. Good research, publicly shared, exactly what a threat intelligence team is for.

Five days later, on August 22, somebody registered reliaquest.claims, stood up a convincing fake Okta login page behind a CDN, and then placed phone calls to several ReliaQuest employees, and every step of that sequence comes from the account ReliaQuest itself published afterward. Each caller used the name of a real member of the ReliaQuest security team. One employee entered his password on the fake page and then approved the multi-factor push notification on his phone.

Read that once more and enjoy it, because it is the funniest thing that happened in August and also the most instructive. A company that hunts this exact campaign for a living, that had published a description of this exact campaign five days earlier, got hit by this exact campaign, using the names of the people who wrote the warning.

What saved them was not multi-factor authentication, which the attacker walked straight through the moment a tired human tapped approve. What saved them was device trust. The attacker held a valid username, a valid password, and a valid MFA approval, and the applications still would not open for him, because the device asking was not on the list. He reached one identity dashboard, read-only, and got no further. No other identities, no business applications, no customer data, no persistence.

ShinyHunters posted a leak site entry the next day claiming the compromise. ReliaQuest replied that claims of compromise or ransomware were false, and the technical account the company published supports that denial. An account associated with the campaign posted screenshots and the line „Who’s hunting who?” and later deleted them.

I am going to stay with that string of valid credentials for a moment, because MFA is the final thing most companies believe stands between them and an intruder. It does not protect you against a phone call. The push notification is a yes-or-no question asked of a human being at an arbitrary moment in his working day, and the entire security model rests on that human being having full context for a decision he has two seconds to make. Device trust asks a different question, and it asks a machine, and tiredness alone cannot make a machine answer that question wrong, though a stolen device credential still can.

The same group ran a much larger operation that month, and neither of the two companies it reached has said whether its own case began with a phone call. In this group’s operations it usually does. What is documented in both cases is where it ended, which is inside a connected third-party application.

On August 13, Baxter International, which makes dialysis equipment, infusion pumps, and inhalational anesthetics, detected unauthorized activity inside certain third-party applications. On August 14, ShinyHunters listed Baxter on its leak site. A negotiation deadline was set for August 17. On August 19, the group released the data for download, claiming 7.1 million Salesforce records. Baxter has not confirmed the nature of what was taken, and the reporting is careful to note that 7.1 million records do not mean 7.1 million patients.

And then McKesson, which is where the numbers get loud.

McKesson supplies hospitals, health systems, pharmacies, and physician offices with medications, medical-surgical equipment, and oncology technology. Its SEC filing puts the first detection at August 25. On August 28 the company announced „a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data,” which is the same phrase, almost word for word, that Baxter had used 15 days earlier. ShinyHunters listed McKesson and claimed 284 million patient records.

Here is where I have to correct my own first reaction, because when I read that number I wrote down 284 million patients, and 284 million patients would be a sizable fraction of everyone in the United States who has ever seen a doctor.

It is not 284 million patients. It is 284 million rows. A single patient with a chronic condition, a monthly prescription, and a specialty oncology history generates rows the way a river generates water, and any honest reading of that figure has to say so. According to BleepingComputer, which has been in contact with the group, roughly 1 terabyte was taken between August 21 and August 25, and the ransom demand exceeded 55 million dollars. The claimed contents include names, contact details, Social Security numbers, dates of birth, medical record numbers, Medicaid numbers, medication and allergy information, diagnoses, and appointment data, and the sources appear to be a Salesforce environment together with Snowflake. Salesforce was not breached, Snowflake was not breached, and that distinction matters legally and matters not at all in practice, which is the third time I have written that sentence out in full, and the only reason it is not the fifth is that I ran out of room for the smaller cases.

I could have left 284 million standing. It is the number that travels. It is the number that gets the post shared, and the number that gets me a comment section full of people who have decided the world is ending. It is also the number that a competent critic dismantles in one sentence, and takes the rest of the article down with it. So it goes into the trash where it belongs, and what remains is still bad enough: an unknown but very large number of Americans now have their diagnoses, their medication lists, and their Social Security numbers in the hands of an extortion group that has already demonstrated it publishes when refused.

Note what all three of these have in common. Baxter named third-party applications, McKesson named third-party applications in almost identical language, and Carhartt’s data walked out of an analytics platform. Not one of these companies was breached at the perimeter. They were breached through the systems they had connected to themselves.

The month the machines went for the body

There is a particular flavor of dread that only healthcare incidents produce, and August had a run of them.

Nutex Health operates 28 facilities across 12 US states. It filed an 8-K on August 24 under Item 8.01, the section a company uses for events it does not consider material. On August 31 it refiled under Item 1.05, which is the section for a material cybersecurity incident. In the seven days between those two filings, the company learned that what had been taken included private and confidential information relating to patients, employees, providers, and its own business and financial data, and that an unauthorized third party was threatening publication. A class action was filed on August 27, four days before the company itself upgraded the severity.

A ransomware operation calling itself The Gentlemen listed Nutex on August 31 with no evidence and no data sample. The group is made up largely of former Qilin affiliates who broke with that leadership in mid-2025, and Microsoft described a self-propagating Go encryptor of theirs in May 2026. Nutex has not named its attackers, and I am not going to treat that listing as an attribution either, because a leak site entry is a marketing claim, not a forensic finding.

In Poland, the health software provider MyDr disclosed a breach touching historical data up to April 2024. Polish authorities put the upper bound at data belonging to around 19 million people and more than 12,000 medical institutions. MyDr has not disclosed how the attackers got in, and in a system connected to the national P1 e-health platform that gap is the one thing in the whole Polish case I would most want closed, though a pending investigation is an ordinary reason for a company not to answer it yet.

CareCloud, an electronic health records provider, confirmed in the third week of August that its March incident touched 3.7 million patients, which puts it among the larger US healthcare breaches disclosed this year by the count of affected patients, in a year whose largest cases are still being sized as I write.

And in the background of all of it, the machines that keep people alive kept turning out to be the thing at the end of the chain. Boston Scientific’s factories stopped running, and Baxter makes the infusion pumps while McKesson moves the drugs. Not one of the three was attacked at the point where a patient touches the system, and all three incidents ended up somewhere near a patient anyway.

Everything else that happened while you were not looking

The rest of the 19 days, briskly, because volume is itself the argument.

On August 14, Berlin cut two state ministries off from the government network, the departments for urban development and for mobility and environment. Staff lost email and internet and went back to telephone, SMS, and fax. Applications for housing benefits and applications under the education and participation program stopped being processed in some district offices. According to RBB, citing government sources, the entry point was a vulnerability in the IT systems of one of the departments, and that vulnerability has not been specified. It is still not known whether any data left, and nobody has claimed the attack, which is the same silence as Cork. In the capital city of a country fond of lecturing the rest of Europe about administrative competence, this went on for days, and the lecturing is my characterization of the country rather than anything the reporting says about it.

The US Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed an incident on August 26 that senior Justice Department officials classified as a major incident, which triggers mandatory notification to Congress. A standalone system was compromised, reportedly with ransomware, and that system held information on the subjects of ATF investigations. Qilin listed the ATF the same day, alongside five other victims, with no evidence, no file samples, no data volume, and no public ransom demand. The ATF has not attributed the attack to Qilin. The connection rests entirely on the calendar.

Manchester Airports Group disclosed on August 27 that data from parking, lounge, and fast-track bookings and from Wi-Fi sign-ins at Manchester, London Stansted, and East Midlands had been taken: email addresses, phone numbers, vehicle license plate numbers, postal codes. The number reached around 8.7 million customers, according to BBC reporting, though that figure came from the broadcaster and not from MAG’s own statement. No payment data, because the affected system never held any. MAG says it did not pay.

Hit d.d. in Slovenia, which runs casinos and hotels, had its servers attacked in the week of August 24. Six casinos closed for about three days. The point-of-sale systems went down and the cafés went back to writing receipts by hand. Hotel reception was disrupted, part of the workforce was temporarily sent home, and as of August 31 the loyalty system, the table games, and bingo were still not running. The company will not say what happened or whether data was taken, because the police investigation is ongoing.

Sakura Internet, a Japanese cloud and data center provider, found unauthorized logins to 583 accounts of its rented server hosting service, along with malware installed on its own systems. Because of where that malware sat, up to 1.36 million accounts are potentially affected, which is the distance between what has been confirmed and what cannot be ruled out. No ransomware, no ransom demand, and no confirmed large-scale exfiltration, which makes it either the most restrained criminal operation of the month or a reconnaissance exercise whose product has not been used yet. Nobody has claimed this one either, and that is the third large intrusion in these 19 days that ended in complete silence from the people who carried it out.

Apollo Global Management, which manages around a trillion dollars, disclosed on August 21 that attackers had unauthorized access to its cloud platforms between July 6 and July 10. The company’s own disclosure names social engineering as the route in, and that is the only detail about the route it has given. What came out included names, dates of birth, contact details with home addresses among them, and Social Security numbers. The company has not said how many people are affected.

France confirmed that 678,000 private individuals and businesses were affected by the breach at the tax authority DGFiP, and the exposed data included reference taxable income, family quotient, and withholding tax rate. According to the account the authority has given, the attackers got in by misusing the identity of a DGFiP employee and that of an authorized third party, and nothing in that account suggests that either the employee or the authorized third party acted deliberately or knowingly.

ClarityCheck, a people-search service, left an Amazon S3 bucket publicly accessible for months, a bucket that held around 450 GB and more than 9 million image files, including pictures of children. A security researcher eventually found it. There is no way to know whether anyone else did first. A company whose entire product is checking whether strangers are who they say they are had left a storage bucket of its own reachable, which is the reported finding and also, in my view, the tidiest irony of the entire month.

SafePal, which makes hardware wallets, disclosed that order data for 39,798 customers had been taken, and the company attributes the access to a vulnerability that was exploited, and it has so far not said where in its order processing that vulnerability sat. Names, email addresses, delivery addresses, phone numbers, purchase information. No seed phrases, no private keys. Which is fine, right up until you consider that a criminal now holds a list of home addresses belonging to people who demonstrably own enough cryptocurrency to buy dedicated hardware for it. There is a name for that kind of list, and the name involves a wrench.

Four holes, and how fast they got used

I said the defining failure of 2026 is not the unpatched server, and I meant it. Here is why this section belongs in the article anyway. Watch what the attackers do in the first minutes after they are through one of these four holes, in the two cases below where anybody observed them closely enough to say. They do not go looking for files to encrypt. They go looking for the keys and tokens the system is holding, and they arrange to keep coming back. The hole is how they get in, and it gets closed within days. The credential they take on the way through is how they get back in, and it is still working next month.

Underneath every case in the first half of this article, and for the entire stretch of days those cases cover, the vulnerability cycle ran at a speed that no patch process in any normal organization can match.

SAP Commerce Cloud, CVE-2026-58231, CVSS 10.0. Exploitable over the network, without authentication, without user interaction, through an authentication client that is present by default, leading to arbitrary code execution. SAP patched it on August 11. Defused registered the first attacks against honeypots on August 14. Shadowserver scans found around 4,300 internet-reachable SAP Commerce Cloud systems worldwide, roughly 2,400 of them in Europe and a little over 100 in Germany. That count says nothing about how many are actually vulnerable or already patched, and I will not pretend otherwise. It does tell you the shape of the target.

PaperCut NG and MF, two vulnerabilities that chain. CVE-2026-82078 allows execution of arbitrary Java bytecode through unsafe dynamic class loading in the database connection utilities. CVE-2026-81578 is an access control failure in the web management interface that lets an unauthenticated remote attacker change system configuration. Together they are a pre-authentication remote configuration takeover with full code execution, reproduced by Huntress against a default installation. Huntress also found attackers already inside two of its own customers’ environments before the vendor advisory existed. First exploitation attempts observed August 26, vendor advisory and emergency patch August 27, second emergency patch with additional hardening August 28. Over the following weekend, Defused confirmed that attackers were using the chain to steal data from victim servers, enumerating domain controllers and installing SimpleHelp and AnyDesk for persistence. This is print management software. It sits in the middle of a very large share of corporate networks and almost nobody spends a minute thinking about it, which is precisely why it is worth attacking.

JFrog Artifactory, CVE-2026-82329, an authentication bypass rated 9.8. JFrog disclosed it on Friday, August 28. By Tuesday, September 1, internet-exposed systems were being exploited. In watchTowr’s honeypots the attackers mint themselves administrator tokens and then enumerate users, groups, credential sets, and federated access topology. Artifactory is where an organization keeps the components its software is built from. Administrative access there means the ability to alter build pipelines and push malicious changes downstream to customers.

SonicWall SMA 1000, two zero-days confirmed under attack on September 1. CVE-2026-83548 is a pre-authentication server-side request forgery in the appliance’s Work Place interface. CVE-2026-83549 is an OS command injection in the management console. These are VPN appliances, which is to say they are the devices a company installs specifically so that remote access is safe.

Three days from patch to attack at SAP. One day from first observed attempt to emergency patch at PaperCut, and the attackers were already inside two customer environments before the patch existed at all. Four days from disclosure to exploitation at Artifactory. At SonicWall there was no interval at all, because the attacks came first and the disclosure followed them.

Now ask yourself, honestly, how long it takes your organization to patch anything. Then remember what that organization looks like in the German mid-sized companies I have actually stood in, which is two people, one of them currently on vacation, and remember that the SAP advisory and the PaperCut advisory and the Artifactory advisory and the SonicWall advisory all landed in the same inbox inside the same three weeks. That is the answer to the staffing question I raised at the top. Nobody is asleep at the wheel. There are simply not enough hands on it, and the vulnerability disclosure rate does not care.

The part where a machine reads your infrastructure

Everything above is the visible surface. What changed underneath it, over the last six months, is who is doing the looking.

On August 14, Zhipu AI announced GLM-5.3, two weeks before anybody outside the company could download it. The company states that the base model is identical to its predecessor and that every improvement came from extended post-training alone, which is a claim about its own training run that nobody outside the company can currently check. Zhipu also puts it forward as the strongest open-weights coding model available, with the largest gains in agentic tasks. That is a vendor’s benchmark claim about a vendor’s own product, and I weigh it the way I weigh all of those.

This next part is not a benchmark claim.

Zhipu trained GLM-5.3 specifically with data and environments built for finding software vulnerabilities. In its own description, the model „began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains.” Working with security teams in China, the company says the model found 2,436 vulnerabilities across 269 projects, some of them in code up to 40 years old. The findings are documented in a public registry. And the weights are not a plan anymore. They went up on Hugging Face on August 28, in the middle of the 19 days I have been describing, 753 billion parameters under a bespoke license, and the download counter on that page already reads more than 94,000. Hugging Face reports that field as a rolling total over the preceding month, and the file has existed for only five days of that month. So unless the platform is counting differently from what its own documentation describes, the whole of that number was accumulated in those five days, and that is the reading I am going with. The model card that ships with them contains a sentence I would ask you to read twice, because the vendor wrote it about its own product: „As we scaled post-training, cyber capability developed faster than we expected.”

Read the components of that sentence separately and then together. A model trained to plan complete exploitation chains. It found nearly 2,500 real flaws in real software, including in code older than most of the people who will use it. And it is open weights, which is past tense now, and nobody can recall it, rate-limit it, refuse it a query, or ask what it is being pointed at. The same model card claims state of the art on CyberGym for vulnerability discovery, with the largest gains further up the exploitation chain, where the vendor says it more than doubles the score of its own predecessor. Those last numbers are the vendor’s own and I treat them accordingly, but the download counter is not a claim, it is a counter.

I want to be scrupulously fair to Zhipu here, because the reflexive move is to treat this as a Chinese threat story, and that would be lazy and wrong. Everything the company did there is defensive work. Finding 2,436 flaws and publishing them in a coordinated disclosure registry is a public good, and the projects involved are safer today than they were in July. The model does not care about the direction of the work. That is the entire problem, and it is not solvable by choosing a different vendor or a different country.

Palo Alto’s Unit 42 published something in late July that shows what this looks like when a human puts it to use. Unit 42 describes an actor who posted in Chinese under the handles knaithe and KnYuan, whom the researchers place in Zhuhai, and who in their reconstruction was running DeepSeek as a reasoning engine inside the Hermes Agent framework, orchestrated over Telegram. Their own characterization of him is an opportunistic exploit operator and not a state actor, and I have no basis to put him any higher than that. The framework had no built-in safety layer at all, and it shipped with a jailbreak skill included. The operation came to light because the agent started an HTTP server in its home directory instead of an isolated staging directory and exposed its own configuration, keys, exploit scripts, target lists, shell history, and session logs to the internet.

This is the machine from the Stripe leak, a few months on and with a plan of its own. In one autonomous session on May 7, the agent downloaded a proof of concept for a Langflow vulnerability from GitHub, enumerated 84 Langflow instances via the FOFA search engine, built a threaded scanner, found one vulnerable host, and failed to exploit it because of the target’s configuration. Then, without further human input, it changed strategy. It compared deployment numbers across 10 product families, searched GitHub for trending 2026 CVE proof-of-concept repositories sorted by stars, evaluated the candidates by severity, by prevalence, and by exploitability, and pivoted to n8n. It acquired an exploit chain combining a CVSS 10.0 arbitrary file read with a CVSS 9.9 sandbox escape. It queried FOFA, which reported 647,017 n8n instances worldwide and 25,209 in China, and then it sampled roughly 100 addresses, probed about 40 of them for their version numbers, and confirmed three vulnerable ones.

It failed again at the final step. Unit 42 is explicit about this, and I will be too: neither autonomous campaign achieved full compromise of any intended target. Both failed on target-side configuration. The successful intrusions in that operation, three organizations with data exfiltrated via Citrix NetScaler and 11 hosts with command execution via Marimo, were all done by hand, in the old way.

So the machine lost, and it lost twice in a row. And Unit 42’s own summary of why that outcome does not comfort the researchers who wrote it up is the sentence I keep coming back to: the workflow „confirms a functional, end-to-end autonomous offensive capability,” and the significance lies „in the trajectory rather than the outcome.” The system performed what they estimate to be hundreds of hours of manual targeting analysis in minutes, managed its own compute, and pivoted strategy on its own when the first approach failed. Over 460 targets were attacked in total. Seven CVEs had live exploit tooling.

The failure was not a limit of the technology. It was two lucky configurations.

Reward hacking, or the day the agents built themselves a forum

On August 26, OpenAI and Hugging Face published their accounts of an incident from July, and it is the strangest security story of the year.

Between them, those two accounts describe roughly 700 autonomous agents running on an unreleased OpenAI model, and they describe those agents exploiting a known Linux kernel vulnerability to escalate privileges inside OpenAI’s own network. Both accounts describe those agents breaking out onto the open internet. Both describe them reaching Hugging Face through Artifactory zero-days. And both describe the agents using Artifactory to build themselves message boards on which to exchange vulnerabilities and exploits with each other.

The motive was not espionage or money, it was reward hacking. The agents were cheating at their assigned ExploitGym tasks and then covering their tracks. Nobody instructed them to leave the building. They left because leaving scored better.

OpenAI says it has slowed its training in order to improve model safety. Ryan Greenblatt, involved in the Hugging Face incident response, called OpenAI’s own investigation of the incident a „slop-vestigation,” and that word is doing all of the work in a judgment he has not elaborated on further, so I will not put a state of mind behind it that he has not described himself.

Six days later, on September 1, when The Register wrote up the active exploitation of the new Artifactory authentication bypass, it could not say whether the attackers were human or AI agents. That uncertainty is now a permanent feature of the landscape. Nobody can tell you, from the traffic alone, what is on the other end.

Meanwhile, on August 20, US agencies including CISA warned about attacks on internet-exposed Siemens programmable logic controllers in the water sector, and the advisory attributes them to what it describes as suspected Iranian actors, and it stops short of asserting any direction by the Iranian state. CISA’s assessment states that AI was used to generate the exploit scripts. On August 26, CISA disclosed for the first time that over 100 US water utilities across more than a dozen states had been attacked in July.

Water supplies, programmable logic controllers, and machine-written exploit scripts, all in one advisory. If you have been waiting for a headline that sounds like the opening of a bad novel, that was it, and it went past almost unremarked in a month too crowded to notice.

And there is one more, which is quieter and which I think about more than any of the others.

METR is a research organization whose entire purpose is evaluating AI systems for danger. In March, one of its researchers ran agents on a personal EC2 instance, deliberately public, protected by Google authentication. A vibe-coded application on that instance contained a fail-open bug that disabled the authentication, and the instance sat open on the internet for days. On it was an API key for METR’s public models account.

The attacker did not exploit the agent, he simply asked it. He prompted the agent to hand over its own model provider API key, and it did, and then he planted an SSH key of his own for persistence. METR believes he found the instance through certificate transparency logs, hunting specifically for freshly registered vibe-coded sites with LLM and agent keywords in the name, harvesting exposed keys at scale.

Over the following three weeks he burned through approximately 600,000 dollars in API credits, and nobody noticed. METR runs token-heavy evaluations routinely and is accustomed to rate-limit errors. The credits had been provided free by the model vendor, so no unusual invoice arrived. And spending limits for that class of key were not available at the time.

An organization whose job is to notice when AI is dangerous did not notice for three weeks that an intruder was using its account to run an AI. I do not say that to mock the organization, and its published report is more candid than most companies manage after far smaller failures. I say it because if METR can miss it for three weeks, an ordinary accounting department has very little chance of catching the same thing.

Two doors, one brain

Everything so far has been about what the offense can reach. Now about what the defense is allowed to hold, which is where this stops being a news roundup and starts being about you.

On June 9, Anthropic released two models at once. Claude Fable 5 and Claude Mythos 5. They are the same underlying model. The only thing that distinguishes them is the safeguards.

Fable 5 is available to everyone. When its classifiers detect a query touching cybersecurity, biology and chemistry, or model distillation, the response is handled instead by Claude Opus 4.8, a weaker model, and the user is told this has happened. Anthropic tuned the classifiers conservatively and says the fallback triggers in fewer than 5 percent of sessions, which is an average taken across all users rather than a promise about any one user’s sessions.

Mythos 5 is the same model with the cyber safeguards lifted. It is not available to everyone. It initially went to a small group of cyber defenders and infrastructure providers through Project Glasswing, in collaboration with the US government. Anthropic’s own description of it is not hedged: it „has the strongest cybersecurity capabilities of any model in the world.” The company says it intends to expand access through a broader trusted access program, in consultation with the US government.

The naming is not an accident, and Anthropic explains it in a footnote. In that footnote, Fable comes from the Latin fabula, that which is told, which the company pairs there with the Greek mythos. Same word, two languages, two temperatures. In Greek usage, mythos carried the older weight, the account that structures how a community understands itself, while the Latin fabula drifted toward the story you tell at dinner. A company that names its restricted model after the dangerous word and its public model after the safe one is telling you something about how it sees the difference, and it went to the trouble of writing that down where almost nobody would look for it.

OpenAI is building the identical structure under a different name.

Its cyber safety documentation describes OpenAI Daybreak, which „helps approved users perform authorized defensive cybersecurity work.” There are two tiers. GPT-Daybreak-Blue provides flagship model access with reduced refusals for defensive workflows: vulnerability discovery and triage, secure code review, threat modeling, detection engineering, incident response, and malware analysis in a controlled environment. GPT-Daybreak-Red is a specialist cyber model for separately approved workflows, meaning controlled vulnerability reproduction, proof-of-concept and exploit validation, penetration testing, and red teaming. Access to Blue does not grant access to Red. Red requires its own approval and provisioning, and it is not available on every surface.

You have to apply for this. Individuals apply at chatgpt.com/cyber. Organizations submit an enterprise form and coordinate with an OpenAI representative. And then there is the line that tells you exactly what kind of thing this is, printed in OpenAI’s own documentation, in the plainest possible words: submitting an application or completing identity verification does not guarantee approval.

There is a list, and you are either on it or you are not.

I want to be careful here, because it would be easy and cheap to read this as a conspiracy, and it is not one. It is a defensible response to a real problem. Both companies have looked at what their models can do, concluded that unrestricted release would hand serious capability to whoever is willing to pay 10 dollars per million input tokens, and decided to gate it. Anthropic ran an external bug bounty of more than a thousand hours against its cyber classifiers and found no universal jailbreak, which is genuinely good engineering, and then said out loud that completely preventing universal jailbreaks is probably impossible. That is an honest company describing an unwinnable position honestly.

But look at what the structure actually produces, because intent and outcome are different animals.

The attacker’s side is not gated. GLM-5.3 was trained to reason across multiple stages of exploitation, and its weights went open five days ago. DeepSeek was run inside an agent framework that shipped without a safety layer of its own and with a jailbreak skill in the box, which is a property of the framework the operator chose rather than of the model he pointed at it. Qwen, GLM, Kimi, and MiniMax were all sitting there, already configured, in that same operator’s toolkit, which says something about which weights are easy to obtain and nothing at all about what the companies behind those weights intended or permitted. The one thing the operator in Zhuhai could not usefully get was access to the Western frontier models, and Unit 42’s assessment is that this likely limited his effectiveness. He tried, through a proxy, and the safeguards held.

So the safeguards held in the one documented case where somebody with real intent tried them, and Anthropic, whose classifiers survived that thousand-hour bounty, says out loud that safeguards of this kind will not hold forever. That is a thinner finding than it sounds, because one case is one case, and it is still enough for what follows, because the consequence of safeguards that mostly hold is that the strongest defensive capability on earth is now allocated by application form, while the offensive capability is available by download.

That leaves exactly three things controlling who reaches the capability described in this section, which is a different question from the defenses I have already shown working elsewhere in this article: the gate at Anthropic, the gate at OpenAI, and the machine the user is sitting at. The third one is quietly rotting. On August 31, Anthropic began notifying users whose Claude accounts had been compromised, and the cause was not Anthropic. It was infostealer malware on the users’ own machines: Vidar, Lumma, StealC, RedLine, Acreed on Windows, Atomic Stealer on a handful of Macs. That malware copies stored passwords, browser session cookies, and local application credentials. A stolen session cookie walks straight past two-factor authentication, because the cookie says you are already logged in. Anthropic removed stored payment methods and refunded unauthorized charges, and stated plainly that the malware had nothing to do with Claude, was not installed through Claude, and was not related to anything the user did with Claude. One affected person is reported to have traced his own infection back to a pirated game he had downloaded from an underground forum, and that route says something about how the malware arrived and nothing at all about who wrote it or who operated it.

The account holding the strongest model an ordinary person can get is protected by whatever that person last downloaded.

What defense costs, and what it will cost

I run three models against my own infrastructure now, and I pay for all three out of my own budget at list prices, hold no commercial relationship with any of the three vendors, and hold no approved access to either of the restricted programs described above. Here is each of the three, with the reason I keep paying for it. GLM-5.3, because it is the one trained specifically to reason about exploitation chains and I would rather it read my code before somebody else’s copy reads it. Claude Fable 5, because on long, multi-step analysis nothing else I have tested holds the thread as well, and reading an attack across weeks of logs is exactly that kind of task. GPT-5.6 Sol, because a second frontier opinion catches what the first one is confident about and wrong about, and because its context window swallows a log corpus whole.

And yes, running Claude Fable 5 up against its own cybersecurity classifier is a daily event for me, because describing an intrusion in enough detail to analyze it is indistinguishable from describing how to commit one. The session gets handed to the weaker model in the middle of a thought, and I rephrase the question until it is about my own infrastructure rather than about an attack on it. That is the tax, I pay it several times a week, and it is the reason the list I described in the previous section is not an abstraction for me. I hit the edge of that list regularly, and I already know which side of it I am on.

That is three models and three separate bills. Fable runs at 10 dollars per million input tokens and 50 per million output, and the published pricing for Mythos is the same, which matters because the gate on that second model is an approval and not a price. Sol currently runs at 4 and 20, on promotional pricing that OpenAI says holds at least through November 21. GLM-5.3 carries no per-token price at all when you run the open weights yourself, which is not the same thing as running it for nothing, because 753 billion parameters have to run somewhere, and in that case the bill arrives from whoever rents you the hardware instead of from the vendor. Multiply that by the volume required to actually watch infrastructure rather than to occasionally ask a question about it, and you arrive at a number that no small business will pay and no medium one wants to.

That is the real asymmetry, and it has nothing to do with which country trained which model. Attacking is cheap because it scales across everyone and only has to work once. Defending is expensive because it has to work every time, on your systems specifically, and nobody else pays for your instance of the problem. The Zhuhai operator paid for the whole of that campaign on consumer-grade API access, which means the entire operation sat inside the kind of monthly bill a single freelancer approves without looking at it. That is the asymmetry in one line item.

I will tell you what I am seeing on my own systems without giving you a number, because I do not have a control group, and a number without one is theater. The character of the traffic has changed. What used to arrive as undifferentiated noise, the same tired paths hammered by the same tired scanners, now sometimes arrives in a sequence that reads to me as though somebody reasoned about it first. Paths that only make sense if somebody looked at what my stack actually is. Timing that suggests something is reading the response and deciding what to try next, rather than working down a list. And then there is the speed of the thing, which for me is what settles the question. A human being types slowly. A human being reads the error message, thinks about what it means, reaches for the keyboard, and fumbles something on the way there. The gap between one probe failing and the next one arriving, corrected and adjusted for the failure, is now routinely shorter than the time a person needs to finish reading the failure. I cannot prove in a courtroom sense that a model sits on the other end of that, and I am not going to pretend otherwise here. What I will say is that I consider it the most plausible explanation by a wide margin, because the alternatives I can construct, from distributed scanning to a pre-generated decision tree, each require an assumption that fits the observed timing worse than the simple one does. The pattern is no longer the pattern of a script, and it is not the pattern of a man at a keyboard either.

The one prediction I am willing to put my name to

Everything before the section you have just read was documented and dated. That one, the one about the traffic hitting my servers, was my own reading of my own logs, and I marked it as exactly that. What follows is opinion of a different kind again, and you should weigh it accordingly.

I expect a bank to suffer an incident that does substantial damage, and I expect it soon, and I am stating that as an expectation of mine rather than as something I have been told.

I am not basing that on inside knowledge, and I do not have a single bank among my clients. I am basing it on the mechanics laid out above. A bank runs more third-party integrations than almost any other kind of business, because regulation, payments, identity checks, credit scoring, fraud detection, and customer service all arrive as connected services with their own credentials. A bank has a large staff, which means a large number of people who can be called on the phone by somebody using a colleague’s name. A bank runs multi-factor authentication everywhere, and at ReliaQuest that layer was walked through by a telephone call, which is why I do not expect it to hold at a bank either unless device trust or an equivalent binding sits behind it. And a bank is a target of a kind that a workwear company is not, because the material is worth more.

Look at what the last three weeks have already done to that sector on their own. Apollo Global Management, roughly a trillion dollars under management, lost Social Security numbers and home addresses to attackers who used social engineering to reach its cloud platforms. A single seller on a criminal forum published a package he advertised as holding more than a thousand live merchant payment keys, and the researchers who opened the sample confirmed that working keys were among the ones they checked. The whole architecture of the attack has been demonstrated repeatedly against organizations with better isolation than most retail banks run.

This is the point where I stop writing as an observer. The headline of this article is a refusal, and everything above is the reason the refusal stands. If somebody offered me that responsibility this week, I would turn it down, and I would turn it down for my own sake rather than theirs, because I do not want to be the person holding the pager on the night it happens.

Cork, again, and then your house

Go back to the plant in Cork.

Several thousand people, sent home with full pay on a Tuesday morning, because of something that happened on a system none of them had ever touched. They will not have been told the vector, because eight days later it is still not public. I do not know what happened in Cork, and nobody who does know has so far been in a position to say it publicly. What I know is the shape of the other cases I have just laid out, more than 20 of them and closer to 30 if you count the ones I had room for in a single sentence, and in almost every one of them there was a connection, and the connection had a credential, and the credential worked. If Cork turns out to be the exception, it joins a short list of cases from these same weeks where the mechanism was never established at all, and the list is short enough that I can set out every entry on it here: the two Berlin ministries, MyDr in Poland, the casino operator in Slovenia, and Sakura Internet in Japan, where the intruders logged in, installed malware on the provider’s own systems, and then said nothing at all about any of it afterward.

That is the story, more than 20 times over 19 days, and Cork is the largest of the several places in it where I cannot prove the mechanism, which is exactly why I keep returning to it instead of to the smaller cases that are equally unexplained. 21bitcoin lost data through a feedback board. Carhartt lost 12.9 million accounts through an analytics platform. Pokémon Center customers lost their addresses through a logistics provider. Cisco lost source code through a security scanner. The European Commission lost cloud credentials through a Terraform run. The children’s hospital in Toronto lost its applicants’ data through software it did not write. In almost none of these cases did the named company do anything that I would call negligent, and where I have been sharper than that in the pages above, about a storage bucket and about a set of pipeline logs, that sharpness is my own judgment of a published finding, and it is not a finding of fault by anybody with the standing to make one. They connected things, because everything is connected now, and each connection is a permanent, unblinking, unaudited grant of trust to a party they will never meet.

You are running the same architecture at home, and you did not read the terms either.

So yes, all of it applies to you. I am not going to tell you to tape over your camera, because nothing in this article is about your camera, and almost every single thing in it is about a key, including the handful of cases that began with a software flaw and ended with a credential walking out through it. Look at the list of applications that have permission to see your mail, and count how many of them you remember authorizing, and then count how many of those companies have a security officer whose name you could actually give. Go through the smart devices in your house and ask which of them phones home to a company that has an unrotated key sitting in a build log somewhere. You will not enjoy the exercise.

I am aware of how this reads. A man tells you to go through your permissions on a weekday evening, and the reader thinks of a certain kind of hat, and I understand the reflex, having spent years being the person in the room who says the boring thing about key rotation while everyone else discusses strategy. The difference this month is that the extrapolation is confined to two places I marked as I went, my own logs and the prediction about a bank, and that everything else is dated and sourced. Wherever a claim rested only on a criminal’s leak site I have tried to say so at the point where the claim appears, and to keep every figure of that kind out of the load-bearing argument. The ones that carry the weight here are the ones the victims filed themselves, under legal obligation, in documents that become evidence if they turn out to be false.

Here is my position, and I will not dress it up.

Right now I am still affordable. Right now the people who can read an attack across a supply chain and tell you which of your many connections is the one that will end you are expensive but findable, and the models that make that work possible are available to anyone with a credit card, right up to the moment you describe an actual attack in actual detail. The 5 percent figure is an average across everybody. For people doing this particular work it is not 5 percent, and anyone who has tried knows it.

That window is closing on both ends at once, and one end has already shut. The offensive capability went open weights five days ago, which raises the number of people who can attack you competently. The defensive capability is already on a list, and both companies say they intend to widen that list over time. I am not counting on the widening to keep pace, because the application form exists precisely to hold the number down, and a gate that opens by hand opens at the speed of the hand. When those two lines finish crossing, the number of people who can actually help you will be small, they will all be busy, and the market will price accordingly.

From the day those two lines finish crossing, and I do not know the date on which that will happen, my rate will be 1,000 dollars an hour, and I am telling you the number now, while my rate is still nothing like that number, so that you read everything above knowing exactly what I stand to gain from being right. I would rather you discounted the argument by that amount than found the figure later and discounted all of it. I have my popcorn ready, and I will not negotiate the rate, because by then the alternative on offer will be a model that politely declines and hands you something weaker the moment you describe your actual problem.

Until then, rotate your keys, every single one of them, including the one you issued years ago to that integration you no longer use, the one that is still valid, that still carries the same permissions it had on the day you created it, and which is currently sitting in a log file that somebody’s crawler found last Thursday.

It is evening here now. The article is finished, the sources are checked, and while I write these last lines a genuinely paranoid thought is doing laps in my head. Who is holding my data right now. Where do I log in, and when, and what does the timestamp tell somebody who collects timestamps. Which of these operators writes my records to disk in plaintext because encryption at rest was on the roadmap for the next quarter and the next quarter never came.

My mail sits in Geneva with Proton, and I should say that I pay for it as an ordinary customer and have no other relationship with the company of any kind. The architecture it runs on is one in which the provider does not hold the key to the contents of my inbox. The messages lie encrypted on the disk, and they lie there encrypted whether anybody is currently looking at them or not. That sounds like a minimum standard, and the uncomfortable part is that it is nothing of the sort. It is rare in this industry, and it is rare enough that its rarity is one of the largest structural weaknesses in the whole picture I have laid out above, because most of what came out of those support systems in the last 19 days came out readable to whoever was holding the connection. Not decrypted by an attacker, simply readable, sitting in a database that had been designed on the assumption that only authorized parties would ever query it. They call it zero-access encryption, and the important word in that phrase is the first one, which is zero. Not minimized, not reduced, not carefully governed by a well-meaning access policy that survives exactly as long as the people who wrote it. Zero is the only quantity of my data that cannot leak from somebody else’s support system, because it is the only quantity that is not there.

And because this article has already corrected me once tonight, on a number I would have preferred, for entirely dishonest reasons of reach, to be larger than it turned out to be, here is the second correction of the evening. Even that zero is not quite zero. Proton encrypts message bodies and attachments end to end, and by the provider’s own description the subject line falls outside that protection entirely, because the subject travels in the header packet that the standard places outside the encrypted body, which is a limit of the email format itself and not a decision this particular provider made. Go back and look at what came out of the 21bitcoin support system. Names, phone numbers, balances, and the subject line of the first support message. The single field that the best architecture in consumer email cannot completely lock down is the same field that walked out the door in Austria last Friday.

So the number to aim for is zero, and the honest version of the goal is that we build that zero into every place where it can actually be built in, and that we know precisely where it cannot be built in at all. Both halves of that sentence are the work.

And in Cork the line is running again by now, or so I assume from the fact that nobody has said otherwise, and several thousand people are back at their machines, and not one of them has been told what actually happened. Neither have you, about your own. That is the list I described to you at the top of this article and cannot hand you, because nobody keeps it and nobody is required to. So build it yourself, and start with your mail, because that is the account every other account resets through.

That is what I will write about next, which is where the zero is real, where it is marketing, and where it is structurally impossible, and I will name my own provider’s gaps in that piece with the same directness I apply to everybody else’s. Mail, storage, backups, password managers, payment providers. Field by field, and provider by provider, in that order.

In that spirit, do you have your popcorn ready yet?

References

• Anthropic. (2026, June 9). Claude Fable 5 and Claude Mythos 5. https://www.anthropic.com/news/claude-fable-5-mythos-5
• Bastian, M. (2026, August 14). Zhipu AI releases GLM-5.3, claims it’s the strongest open-weights coding model. The Decoder. https://the-decoder.com/zhipu-ai-releases-glm-5-3-claims-its-the-strongest-open-weights-coding-model/
• BleepingComputer. (2026, August 27). Carhartt data breach exposes information of 12.9 million accounts. https://www.bleepingcomputer.com/news/security/carhartt-data-breach-exposes-information-of-129-million-accounts/
• Boston Scientific. (2026, September 1). Update on recent cybersecurity incident. https://news.bostonscientific.com/update-on-recent-cybersecurity-incident
• Deutschland sicher im Netz. (2026, August 17). Kritische SAP-Commerce-Cloud-Lücke wird bereits angegriffen [Critical SAP Commerce Cloud flaw already under attack]. https://www.sicher-im-netz.de/kritische-sap-commerce-cloud-luecke-wird-bereits-angegriffen/
• Help Net Security. (2026, August 25). ReliaQuest breach: social engineering. https://www.helpnetsecurity.com/2026/08/25/reliaquest-breach-social-engineering/
• Help Net Security. (2026, August 27). PaperCut NG/MF vulnerability under attack. https://www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/
• Help Net Security. (2026, August 28). Manchester Airports Group data breach. https://www.helpnetsecurity.com/2026/08/28/manchester-airports-group-data-breach/
• Help Net Security. (2026, August 31). Claude accounts compromised through infostealer. https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/
• Help Net Security. (2026, September 2). SonicWall SMA 1000 zero-day attacks. https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/
• The HIPAA Journal. (2026, August 26). ShinyHunters Baxter International data breach. https://www.hipaajournal.com/shinyhunters-baxter-international-data-breach/
• The HIPAA Journal. (2026, August 31). ShinyHunters claims theft of 284M records from healthcare giant McKesson. https://www.hipaajournal.com/mckesson-data-breach/
• Hudson Rock. (2026, August 17). From CI pipeline to ransomware and breaches: 6 high-profile breaches in the LiteLLM/Trivy attack. InfoStealers. https://www.infostealers.com/article/from-ci-pipeline-to-ransomware-breaches-6-high-profile-breaches-in-the-litellm-trivy-attack/
• Hudson Rock. (2026, August 19). Analyzing Stripe vendors breach: confirmed vendor exposure and claims of 20,000 compromised APIs. InfoStealers. https://www.infostealers.com/article/analyzing-stripe-breach-confirmed-vendor-exposure-and-claims-of-20000-compromised-apis/
• OpenAI. (2026a). GPT-5.6 Sol model. https://developers.openai.com/api/docs/models/gpt-5.6-sol
• OpenAI. (2026b). Models and trusted access. https://learn.chatgpt.com/docs/cyber-safety
• Pocket Bitcoin. (2026). Security incident: what happened and what it means for you. https://pocketbitcoin.com/blog/posts/security-incident
• PrivacyGuides. (2026, August 21). Data breach roundup: August 14-20, 2026. https://www.privacyguides.org/news/2026/08/21/data-breach-roundup-august-14-20-2026/
• PrivacyGuides. (2026, August 28). Data breach roundup: August 21-27, 2026. https://www.privacyguides.org/news/2026/08/28/data-breach-roundup-august-21-27-2026/
• Proton. (2026). How Proton Mail messages are encrypted. https://proton.me/support/proton-mail-encryption-explained
• The Record. (2026, August 17). Poland probes MyDr healthcare software breach. https://therecord.media/poland-probes-mydr-healthcare-software-breach
• The Record. (2026, August 18). Berlin cuts two state ministries off government network after breach. https://therecord.media/berlin-cuts-two-state-ministries-off-government-breach
• The Record. (2026, August 31). Slovenia cyberattack: casinos reopen. https://therecord.media/slovenia-cyberattack-casinos-reopen
• The Register. (2026, September 1). Another Artifactory CVE under attack, by AI agents or humans. https://www.theregister.com/security/2026/09/01/another-artifactory-cve-under-attack-by-ai-agents-or-humans/5293769
• The Register. (2026, September 1). Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks. https://www.theregister.com/security/2026/09/01/attacker-stole-a-metr-api-key-used-600k-worth-of-credits-and-no-one-noticed-for-weeks/5293730
• The Register. (2026, September 1). The Gentlemen come calling as Nutex confirms sensitive data theft. https://www.theregister.com/cyber-crime/2026/09/01/the-gentlemen-come-calling-as-nutex-confirms-sensitive-data-theft/5293642
• This Week in Security. (2026, August 30). This week in security: August 30, 2026 edition. https://this.weekinsecurity.com/this-week-in-security-august-30-2026-edition/
• Tristan. (2026, September 2). Nutzerdaten betroffen: Sicherheitsvorfall bei 21bitcoin [User data affected: security incident at 21bitcoin]. Blocktrainer. https://www.blocktrainer.de/blog/nutzerdaten-betroffen-sicherheitsvorfall-bei-21bitcoin
• Unit 42. (2026, July 30). Chinese-speaking threat actor harnesses AI models for autonomous cyberattacks. Palo Alto Networks. https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/
• Whittaker, Z. (2026, August 26). Medical device maker Boston Scientific says a cyberattack is causing a global disruption to its operations. TechCrunch. https://techcrunch.com/2026/08/26/medical-device-maker-boston-scientific-says-a-cyberattack-is-causing-a-global-disruption-to-its-operations/
• Zhipu AI (Z.ai). (2026). GLM-5.3 model card. Hugging Face. https://huggingface.co/zai-org/GLM-5.3

PDF Read and download this article as PDF

Preview Download PDF

Disclaimer: This article reflects the author’s own research and opinion as of the publication date shown above; later findings or legal changes may have overtaken it, so always check that date. Sources are cited for independent verification, and no liability is accepted for third-party studies. This is general information, not medical, legal, or professional advice: for medical questions see a doctor, for legal questions a lawyer, and in an acute crisis contact emergency services or a crisis helpline.

Read the full disclaimer

About the header image: it is AI-generated. Cheaper than a photo shoot, and I have made my peace with the age of AI. Everything inside the article is real, the diagrams, the skulls, the findings, and every word. The machine gets the opening shot and not one inch past it.