Retail News CRM

Tag: cybersecurity

  • Macau Police Uncover 33,000 Fake Sites as Android Trojans Hit Wallets

    Macau Police Uncover 33,000 Fake Sites as Android Trojans Hit Wallets

    Malware syndicates across Southeast Asia are deploying fraudulent gambling applications to intercept digital wallet transactions, targeting systems run by Malaysian payment networks Touch ‘n Go and DuitNow. Instead of processing transactions through secure banking rails, malicious overlays draw counterfeit payment interfaces directly over mobile screens to capture personal identification numbers.

    The scale of the threat infrastructure emerged when INTERPOL concluded Operation Synergia III in March, taking down 45,000 malicious IP addresses and servers worldwide. Within that total, police in Macau alone uncovered more than 33,000 fraudulent websites operating as fake casino platforms and spoofed portals designed to harvest personal and financial credentials.

    Recent security investigations demonstrate how threat groups use localized mobile tools to penetrate devices across the region. In October, cybersecurity firm ThreatFabric documented Hirudo, an Android trojan that triggers a purchase before projecting an interface carrying counterfeit Malaysian bank and wallet branding.

    Spoofing Local Checkout Interfaces

    ThreatFabric documented a trojan called Hirudo, which operates by initiating a transaction and generating a transparent graphical overlay across the phone screen. The counterfeit screen replicates the checkout branding of major Malaysian banks and electronic wallet providers, intercepting the user’s personal identification number before presenting a falsified success notification.

    The mechanics exploit payment habits developed in regional commerce. Malaysian shoppers expect deposit screens to show Touch ‘n Go or DuitNow interfaces, rather than standard payment cards. In a review of PIN-approved e-wallet casino payments, a Malaysian comparison site that deposited with two local wallets at each operator found Touch ‘n Go accepted at all ten it listed and DuitNow at eight. Genuine transactions process verification inside the standalone payment app, with the merchant receiving merely a reference code.

    Hirudo alters that structure entirely. The malicious package renders the credential entry form within the host program itself. When a transaction completes, the software sends a forged confirmation notice back to the lure interface, even though no legitimate funds transfer occurred through the wallet system.

    Surveillance Disguised as Consumer Tools

    Technical analyses reveal identical delivery models elsewhere in Southeast Asia. Security firm PT ITSEC Asia dissected an Android application named Gacor Max, distributed across Indonesia via direct messaging campaigns that routed users to spoofed Google Play storefronts. The name borrows Indonesian slang for a slot machine paying out cash.

    The code requested immediate access to phone states, cameras, and local media storage before reaching any interactive interface. Devices running the package maintained persistent background wake locks, keeping the malware operational while freezing on an emulator loading screen. Similarly, threat monitors at Infoblox traced a fraudulent program named Universe Browser, circulated across regional gaming sites by a group tracked as Vault Viper. While marketed as a privacy platform, the software redirects web traffic through external servers in China and executes background payloads.

    The Proliferation of Interface Overlays

    Interface overlays have become standard infrastructure for financial malware operating across regional digital ecosystems. Group-IB documented RemControl, an Android banking threat that projects full-screen replicas of legitimate banking apps over consumer software. Related tracking of ToxicPanda revealed fake login interfaces designed for 349 financial institutions operating in 16 markets.

    For mobile commerce operators, these intrusions undermine user confidence at checkout. Digital wallets rely on end-to-end user confirmation, directing customers never to share one-time passwords or input credentials outside designated application boundaries. When third-party apps simulate checkout dialogues, the security perimeter established between merchants and payment gateways breaks down on the local client device.

    The current malware expansion builds on structural distribution networks uncovered during INTERPOL’s Operation Synergia III, which dismantled cross-border cyber infrastructure earlier this year. As regional mobile wallet adoption accelerates across consumer services, threat groups continue shifting away from general phishing links toward targeted, localized mobile payloads disguised as consumer entertainment software.

  • Doctor Anywhere Suffers Data Breach Exposing Identification and Bank Records

    Doctor Anywhere Suffers Data Breach Exposing Identification and Bank Records

    Telehealth provider Doctor Anywhere announced on Friday evening, Nov 6, that an unauthorized third party breached its systems and accessed users’ personal information.

    The intrusion, which the Singapore firm discovered on Oct 29, compromised customer names, email addresses, dates of birth, emergency contacts, bank account numbers, identity card digits and passport details.

    Doctor Anywhere stated that investigations have found no evidence showing passwords, account login credentials, payment card details or scanned identity card photos were compromised, though it has not disclosed how many users were affected.

    Corporate Benefits Exposure Through Adept Health

    Part of the compromised data involves corporate accounts held through Adept Health, a Doctor Anywhere subsidiary that manages employee benefits programs for corporate clients across Singapore. The platform keeps select personal records of corporate members inside its central architecture to administer employer coverage and process claims.

    Digital health providers across Southeast Asia rely on corporate medical coverage contracts to generate recurring cash flow alongside direct-to-consumer video doctor consultations. A breach across employer benefits architecture creates immediate legal and compliance questions for human resource directors managing corporate health data.

    Fixes Deployed with Ensign InfoSecurity

    The company engaged cybersecurity and digital forensics firm Ensign InfoSecurity to examine the network intrusion and apply corrective patches. Ensign confirmed that the discovered vulnerabilities were locked down and validated the fixes on Oct 30, according to the health operator.

    Medical treatment records remained untouched throughout the incident, the provider said following initial network scans. Its digital platform, outpatient clinics and walk-in facilities remain fully operational while customer notifications continue.

    Regulatory Reports and System Review

    Doctor Anywhere reported the breach to the Personal Data Protection Commission and lodged a formal report with the Singapore Police Force. The healthcare group must now handle regulatory inquiries under local personal data protection laws while notifying affected corporate accounts and private users.

    Telehealth and app-based clinic operators throughout the region face tighter scrutiny over data boundaries as medical services merge with insurance administration and electronic payment processing. Doctor Anywhere faces the immediate task of satisfying corporate clients on data segregation while keeping core clinic visits running on schedule.

  • Stolen Cloud AI Keys Hit Retailers and Tech Groups with Million Dollar Bills

    Stolen Cloud AI Keys Hit Retailers and Tech Groups with Million Dollar Bills

    Intruders who breach corporate cloud accounts are quietly activating dormant artificial intelligence tools and running models at company expense, running up bills exceeding 100,000 dollars in a day.

    Investigations carried out across 2026 by Mandiant and the Google Threat Intelligence Group revealed intrusions across Asia Pacific, North America and South America that reached cumulative costs of up to 1 million dollars before victims spotted the leaks. The compromises struck retail, transportation, financial services and technology companies that had adopted large language model architectures into their systems.

    How Illicit Resellers Drain Foundation Models

    The campaign, dubbed LLMJacking, relies on a distinct commercial division of labour within cybercrime rings. One group specializes in penetrating corporate environments to harvest credentials, while a separate tier operates illicit platforms known as LLM Mixers to resell that raw model compute to third-party subscribers.

    One service, trading under the name Jet Night, offered paying customers unlimited subscriptions for about 60 dollars a month to access premium foundation models. Comparable commercial access carries legitimate pricing between 100 and 250 dollars. Security investigators determined the syndicate could only sustain that price differential by powering the backend with stolen enterprise credentials.

    During a single intrusion linked to the network, an unauthorized actor channeled more than 500,000 queries to foundation models in under eight hours. The targeted enterprise absorbed an unauthorized token bill approaching 1 million dollars before discovering the drain. Jet Night subsequently recorded sudden outages on its Telegram broadcast channels whenever compromised businesses identified the breach and revoked the active keys.

    Another unauthorized syndicate set up a lookalike domain disguised as an internal corporate host, routing the victim organization’s application programming interface quotas into a commercial resale front operating as newapi.pro.

    The Shift From Cryptojacking to Token Hijacking

    Retailers and consumer tech operators have spent years guarding compute fleets against illicit cryptocurrency mining, but model hijacking works at vastly accelerated speed. Cryptojacking trickles away compute slowly to evade system detection, whereas LLMJacking generates massive spikes in fraudulent cloud charges in a matter of hours.

    Investigators noted that actors reach their goals through token proxying, automated model streaming and unauthorized graphics processing unit hardware provisioning. Rather than manipulating consumer-facing chatbots to spit out rogue lines of code, the attackers bypass the store front-end entirely to tap backend infrastructure.

    For retail and digital commerce platforms in Asia that connect real-time product search, automated customer query desks and dynamic inventory to foundation models, the financial exposure sits directly in the operating budget. Cloud quotas linked to corporate credit accounts or open enterprise billing agreements allow perpetrators to cash out instantly through black-market resale while the operator absorbs the invoice.

    Stolen Keys and Exposed Gateways

    Initial penetration rarely requires novel zero-day attacks. Threat groups scrape publicly exposed GitHub repositories for stray application programming interface keys, running minute test queries designed to avoid triggering usage alerts.

    Most intrusions stem from compromised cloud infrastructure credentials, including unprotected service account keys, active session tokens and corporate GitHub authorization tokens. A group tracked as UNC6993 gained access to a commercial cloud instance via a misconfigured service account credential, quickly bridging across into internal model endpoints. The same operators established a fraudulent registration portal for model developers, tricking visiting engineers into submitting live access tokens that circumvented multi-factor authentication controls.

    Once inside a corporate network, attackers search database tables and data warehouse systems for deeper administrative secrets, occasionally disguising backdoor accounts as internal cost-optimization utilities. In another instance, attackers targeted a vulnerability logged as CVE-2026-40217 inside a LiteLLM routing gateway, escalating basic user credentials into root administrative control.

    Dormant Services Turned on by Intruders

    In multiple forensic investigations conducted by Mandiant, the targeted companies had left their high-tier machine learning services deactivated. Intruders used administrative cloud credentials to switch on the dormant model engines, initiating high-frequency automated requests within minutes.

    The findings indicate that monitoring routine endpoint activity is no longer sufficient for digital commerce operators running hybrid cloud stacks. IT departments now face the operational reality that unmonitored API limits directly threaten gross margins, turning routine cloud administration into an immediate balance-sheet liability.

    Enterprises running production workflows across multiple public cloud providers must track anomalous model activation alerts and enforce hard spend caps on machine learning billing accounts to catch breaches before usage tallies reach six figures.

  • Hackers Hijack Corporate Cloud AI Accounts, Racking up $100,000 Daily Bills

    Hackers Hijack Corporate Cloud AI Accounts, Racking up $100,000 Daily Bills

    Cybercriminals are hijacking corporate access to large language models across the Asia-Pacific region, driving unauthorized cloud billing charges past USD $100,000 in a single day. The findings, released this week by Mandiant and the Google Threat Intelligence Group, revealed that victims spanned retail, financial services, transportation and technology across Asia Pacific, North America and South America.

    For some targets, aggregate billing reached almost USD $1 million before administrators discovered the breach and revoked access keys. The financial damage mounts much faster than conventional cryptojacking, which typically drains server capacity at a slow, continuous pace. In one investigated incident, attackers executed more than 500,000 API calls against advanced language models in less than eight hours.

    How Attackers Breach Cloud Accounts

    Intruders frequently exploit credentials leaked inside public GitHub code repositories or harvest access through compromised browser sessions and stolen identity tokens. In several documented breaches, the targeted companies had never activated machine learning or model features within their cloud accounts. Attackers simply logged into dormant environments, turned on the services themselves and began issuing high-volume automated requests.

    A threat group tracked as UNC6993 gained access to corporate systems in mid-2026 by exploiting a misconfigured service account key. The group also operated a fake web portal that prompted internal users to submit active session tokens alongside JSON payloads, allowing attackers to slip past multi-factor authentication checks and passwords entirely. Another cluster extracted API keys from public repositories and tested them using single-token queries to avoid tripping intrusion detection systems.

    Once inside a tenant, attackers escalated system privileges to secure their hold. Intruders created administrative backdoor accounts masked as legitimate billing optimization utilities and injected unauthorized SSH keys into corporate compute instances. Some attackers exploited vulnerability CVE-2026-40217 in the open-source LiteLLM gateway, elevating basic virtual keys into full administrative proxy permissions.

    Illicit Resale Through Discount Gateways

    Stolen model capacity feeds an organized underground market where criminal syndicates divide tasks between network infiltration and wholesale resale. Broker networks bundle compromised corporate keys into centralized routing proxies known as LLM Mixers. These illicit hubs rely on open-source utilities like new-api and gcli2api to manage traffic distribution.

    One illicit routing platform, operating under the name Jet Night, transferred nearly USD $1 million in artificial intelligence compute charges onto a single victim company. Jet Night resold unlimited model access to paying underworld customers for approximately USD $60 a month, undercutting legitimate commercial plans that cost between USD $100 and USD $250. Service interruptions announced on underground messaging channels like Telegram directly matched instances where breached corporate victims detected anomalies and cancelled their compromised access credentials.

    Other attackers expanded their operations by provisioning high-end graphics processing unit clusters across multiple cloud regions. Intruders submitted administrative requests for higher computing quotas, deploying persistent backdoors based on the Manus agent framework to automate operations at corporate expense.

    The Real Cost for Regional Retail Operators

    For Asia-Pacific retailers racing to deploy automated customer service bots, inventory forecasting and algorithmic pricing engines, the findings alter cloud risk calculations. Regional retail groups have rushed to integrate machine learning endpoints into e-commerce storefronts without auditing legacy cloud consoles or default cloud permissions. A compromised key can trigger hundreds of thousands of dollars in operational liabilities before month-end accounting reconciliation notices the discrepancy.

    The threat extends well beyond unexpected invoices. When criminal syndicates route unvetted third-party traffic through corporate model instances, retail operators face potential regulatory and data exposure liabilities across regional jurisdictions. Security teams must now treat unexpected cloud API activations as urgent containment priorities rather than routine billing errors.

    Containment Measures and What to Watch

    Defensive guidelines published in the investigation urge companies to monitor code repositories for exposed tokens, audit cloud consoles for unapproved model services, and enforce strict spending caps. Organizations should configure model-level rate limits and mandate hardware-backed, phishing-resistant multi-factor authentication across developer systems.

    Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties. Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks.

    John Hultquist, Chief Analyst at the Google Threat Intelligence Group, noted that companies must aggressively control access to the computing resources they are bringing online to stop external actors from exploiting corporate budgets. Cloud providers and enterprise clients are now monitoring whether upcoming security updates for tools like LiteLLM and automated API spending hard caps will curb unauthorized token abuse before enterprise cloud budgets reset for the next fiscal quarter.

  • Salesforce Finds No Vulnerability in AU Small Finance Bank Leak

    Salesforce Finds No Vulnerability in AU Small Finance Bank Leak

    Salesforce found no platform security vulnerabilities following a suspected customer data leak at India’s AU Small Finance Bank, the enterprise software company said on Saturday.

    AU Small Finance Bank opened an internal inquiry after extortion outfit ScarlettGroup claimed on Thursday to possess vehicle loan files hosted on external software.

    The lender confirmed that core banking infrastructure remains unaffected, isolating the inquiry to third-party software while branch operations continue normally across the domestic network.

    Disputed Access to Vehicle Loan Records

    Threat intelligence platform Hackmanac reported that ScarlettGroup threatened to leak sensitive records taken from the bank’s perimeter. The claimed haul covers customer identity paperwork including PAN and Aadhaar records, signed loan contracts, credit bureau evaluations, bank statements, and staff credentials.

    Salesforce maintains that the software platform itself shows no technical failure. The company stated that it does not discuss individual client deployments as a matter of policy, though technical teams are assisting the lender during the review.

    Verification of the stolen dataset remains unresolved. Threat actors frequently publicise sample files to force negotiations before corporate defenders assess whether the exposed folders came from active systems, older backups, or third-party brokers.

    Consumer Credit Exposure

    Vehicle financing represents one of the most document-heavy consumer lending categories in India. Lenders assemble physical identity proof, income validation, and collateral records for every vehicle financed on the road.

    A confirmed release of identity documents creates direct exposure for borrowers through identity fraud and fake account openings. For consumer retail finance desks, third-party software integrations represent an operational weak point because corporate security teams hold less visibility over vendor-managed environments.

    Lenders across the market increasingly deploy third-party cloud tools to speed up credit checks and field sales. That architectural shift cuts credit approval times at car dealerships, but it scatters applicant personal data beyond internal bank servers.

    Institutional Warning Over Financial Threats

    Indian authorities have stepped up scrutiny on digital finance infrastructure following recent breach reports across major retail lenders. Commercial institutions including State Bank of India and ICICI Bank faced suspected digital incidents during recent security reviews.

    Prime Minister Narendra Modi addressed the exposure on October 25, warning that cyber intrusions target financial system stability. The warning came during the launch of the Reserve Bank of India’s Rs 169-crore data facility and cybersecurity institute in Bhubaneswar.

    The central bank has pushed commercial lenders to run frequent perimeter tests and review vendor risk governance. Bank boards face stricter compliance requirements when consumer identity documents sit on hosted third-party services.

    Outstanding Verification by Security Teams

    Investigators from AU Small Finance Bank and external response teams continue examining server logs to establish how files were pulled from the system. The scope of customer accounts exposed during the incident remains unconfirmed by the lender.

  • Binance Says $2.54 Billion in Assets Frozen in Security Breach

    Binance Says $2.54 Billion in Assets Frozen in Security Breach

    Binance said on Thursday that $2.54 billion in cryptocurrency assets had been frozen as it investigated a potential security breach.

    Stablecoin issuers Tether and Circle froze related assets to halt illicit transfers, locking nearly $1.57 billion and more than $800 million respectively. Trading on the Binance Alpha platform was temporarily suspended as a precaution, while customer withdrawals were paused pending the outcome of security checks.

    Co-founder Yi He confirmed user funds remained safe and pledged that “Binance will cover all hacking losses.” Former chief executive Changpeng Zhao stated on X that the incident “looked like a hack,” while blockchain intelligence firm Arkham reported that outflows began around 4:30 p.m. EST on Thursday. Binance said the frozen total could rise as it works with law enforcement agencies, token issuers and blockchain investigators.

    Stablecoin Issuers Intercept Unauthorized Capital

    Third-party custodians and token networks stepped in quickly to limit the damage across decentralized pools. Ripple froze approximately $200 million in digital assets linked to illicit transfers, according to Yi. In addition, Donald Trump-backed crypto enterprise World Liberty Financial worked alongside digital asset custodian BitGo to immobilize $27 million in stablecoins and roughly $2 million worth of its proprietary tokens.

    The scale of immediate market intervention highlights how centralized stablecoin mechanisms operate as liquidity kill switches during large-scale security exploits. While Tether froze 1.567 billion USDT directly, secondary market tracking firm Arkham indicated that initial automated alerts flagged upwards of $5 billion in anomalous balance movements before the actual scope was confirmed. Digital asset markets reacted swiftly to the containment efforts, sending Bitcoin down 2.8 percent to $79,026, Ether down 3.6 percent to $2,275, and Binance’s native BNB token falling 6.9 percent to $704.

    Retail and Institutional Liquidity Impact Across Asia

    For institutional market makers, regional liquidity desks and high-volume crypto traders across Asia-Pacific, the emergency freeze creates immediate operational friction. Pausing client withdrawals on a platform holding roughly $160 billion in assets under custody forces liquidity providers to pull back buy quotes, draining order book depth across regional partner venues.

    The operational freeze leaves non-affected regional platforms such as Coinbase and Binance.US running on high alert while secondary clearing networks assess collateral risk. Unlike traditional payment clearing houses, cross-border digital asset conduits rely heavily on private token issuers to step in when exchange perimeters fail. The incident directly challenges institutional risk parameters for hedge funds and consumer trading apps that rely on Binance custody pipelines for client trade execution.

    Escalating Cyber Risks Across Centralized Trading Floors

    The scale of this security breach overshadows prior centralized platform losses across the sector. North Korean-linked cyber group Lazarus previously extracted $1.5 billion from rival exchange Bybit in 2025, which held the prior record for the largest centralized exchange theft. Across last year, cyber attackers stole an aggregate $2.9 billion in digital tokens across nearly 150 separate attacks, based on industry metrics compiled by TRM Labs.

    Security vulnerabilities at centralized exchange layers have steadily expanded alongside custody balances. In September, Bitget suffered an exploit that drained $350 million from its reserves, illustrating the persistent risk centralized exchanges face as their custody totals swell. With Binance serving more than 300 million registered users globally, platform defense failures immediately ripple into retail market confidence, putting regulatory focus firmly onto reserve segregation and exchange recovery capabilities.

    Binance engineers continue to review platform infrastructure logs before restoring outbound token transfers, while tracking partners work to verify whether the final illicit flow exceeds the initial $2.54 billion tally.

  • Park24 to Pay ¥3,000 to 1.46 Million Car-Share Breach Victims

    Park24 to Pay ¥3,000 to 1.46 Million Car-Share Breach Victims

    Tokyo-listed parking and mobility operator Park24 will pay ¥3,000 in cash or gift cards to 1.46 million car-sharing customers whose personal identification records were compromised in a cyberattack.

    The payouts will cost approximately ¥4.4 billion, forcing the operator to book an extraordinary loss of ¥5.5 billion for its fiscal year ending October 2026.

    Total unauthorized access hit 6.62 million user accounts on the group’s flagship Times Car network. Park24 confirmed that external actors extracted stored identification images, including driver’s licenses, from 1.46 million of those profiles. The company maintains that the files were encrypted and were not immediately readable at the point of extraction, pledging to review individual cases if verified financial damage emerges.

    The Cost of Driver Verification Failures

    Park24 restricted the ¥3,000 consolation sum strictly to the subset of members whose scanned identification documents were transferred outside its servers. The remaining 5.16 million affected account holders will receive no direct payout under the present scheme.

    For Japanese app-based mobility providers, digital know-your-customer data forms the core operational bottleneck. Fleet operators require high-resolution driver’s license scans to validate bookings and satisfy Japanese transport regulations. When those image repositories leak, consumers face identity theft risks that basic password resets cannot address.

    Settling customer goodwill for roughly $19 per compromised identity card represents a defensive maneuver. The flat payment aims to head off churn across urban hubs where Times Car competes against railway operators and leasing conglomerates for shared-fleet market share.

    Mounting Class Action Resistance

    Consumer acquiescence is far from guaranteed. Tokyo-based Makino Law Office confirmed plans to organize affected Times Car drivers and file a joint damages lawsuit against the mobility operator.

    Attorney Yuki Makino characterized the compensation plan as inadequate for the long-term administrative burden imposed on drivers. More than 90,000 vehicle-sharing members have already enrolled online to join the collective legal action.

    The legal push challenges the standard Japanese corporate playbook of issuing small fixed-value gift vouchers after systemic cybersecurity failures. If the lawsuit secures broader certification or forces higher restitution tiers, legal liabilities will spill over into the group’s 2027 accounts.

    Prior Intrusions Across Consumer Networks

    The incident traces back to September 2026, when security teams at Park24 initially spotted unauthorized access within Times Car network infrastructure.

    Corporate Japan has faced an intense run of consumer-facing breaches throughout 2026. Official tallies recorded over 19,000 personal data breaches nationwide during fiscal 2025, prompting trade bodies and digital agencies to tighten oversight rules.

    Park24 now enters its next financial reporting cycle with an open legal docket, as Makino Law Office prepares its court filings against the car-sharing operator.

  • Japan Forms AI Cyber Unit as PHP Flaws Disrupt Transport and Banks

    Japan Forms AI Cyber Unit as PHP Flaws Disrupt Transport and Banks

    Japan will set up a dedicated team to simulate artificial-intelligence cyberattacks after flaws in the PHP programming language forced corporate shutdowns across Tokyo.

    The disruption hit core consumer services across banking, aviation, rail and telecommunications on Friday as engineers scrambled to patch the open-source code underpinning major commercial platforms.

    Disruptions Hit Transport and Telecoms

    SoftBank suspended its mobile emergency alert system while it conducted system maintenance to fix the vulnerability. The outage meant mobile subscribers could not receive early warnings for earthquakes, tsunami alerts, or evacuation directives across the carrier’s network.

    East Japan Railway cut access to several internet services before restoring a portion of group operations on Friday. Carrier ANA, brokerage Nomura and lender Mitsubishi UFJ Financial Group also took web portals and service channels offline as emergency containment measures took effect.

    Public administration tools suffered parallel shutdowns. The Ministry of Finance, the National Tax Agency, and the Meteorological Agency all halted selected online public services while technicians tested internal systems against external exploit traffic.

    Corporate Exposure Across Japanese Operations

    Commercial operators in Japan maintain deep digital records that automated attack scripts can now probe without traditional Japanese-language friction. AI automation allows attackers to scan corporate stacks, draft tailored phishing attacks, and find exposed interfaces without human translation hurdles.

    Nippon Paint applied a security patch and restored its corporate web presence after pulling systems off the public internet. Most consumer-facing networks face immediate exposure because legacy internal infrastructure across Japan relies heavily on long-standing PHP deployments rather than modern isolated microservices.

    Trend Micro chief executive Eva Chen noted that companies in the market have relied on language barriers and perceived infrastructure stability that no longer protect corporate networks from rapid automated scanning.

    Coordinated Patching and State Response

    PHP developers released critical fixes on Wednesday after discovering that flaws had lingered undetected within the software for years. Maintainers urged enterprise users globally to patch running software immediately.

    “An attack can succeed by getting through just one hole … For that reason it’s important we shift our mindset and think from the perspective of the attacker,” Japanese industry minister Ryosei Akazawa said on Friday.

    Akazawa confirmed that state defense teams will mirror automated attacker methods to probe operational resilience before threat actors exploit remaining unpatched systems.

    The Next Restoration Steps

    Transport networks and commercial banks must clear remaining back-office systems before fully restoring external interfaces. JR East said the rest of its suspended group digital services will return to normal operation as individual units confirm their patches hold.

  • Data Breaches Hit 16% of Japanese Companies in Teikoku Survey

    Data Breaches Hit 16% of Japanese Companies in Teikoku Survey

    More than 16 per cent of Japanese companies suffered or suspected data breaches from cyberattacks and staff mistakes, according to research by Teikoku Databank.

    Large enterprises took the heaviest blow, with 30.2 per cent reporting actual or potential incidents compared to 14.3 per cent among smaller businesses.

    Breakdown of Enterprise Exposure

    The survey gathered responses from 1,328 companies across Japan between October 4 and October 14. Human error accounted for a substantial share of exposure, led by misdirected outbound emails and staff answering spoof messages from impostors posing as commercial clients.

    Another 14.8 per cent of respondents stated they did not know whether a breach had taken place at all. That knowledge deficit points to undetected intrusions across corporate networks where monitoring tools remain thin.

    The Supply Chain Vulnerability

    Large corporations in Japan face immediate exposure through their downstream commercial networks. While major operators invest in defensive software, their reliance on smaller suppliers creates entry points that bypass perimeter controls.

    Tier-two and tier-three vendors handle billing details, inventory files, and customer records without equivalent safeguards. When large buyers demand stricter security compliance, smaller contractors often lack the budget to implement required protocols.

    Funding and Personnel Gaps

    Small enterprises struggle to compete for specialized IT workers and allocate capital for cybersecurity overhauls. Upgrading data infrastructure requires dedicated hardware and ongoing monitoring contracts that squeeze thin operating margins.

    Many smaller suppliers report receiving direct mandates from key corporate clients to upgrade defensive protocols. Without financial subsidies or direct technical assistance from those buyers, smaller firms remain unable to fill basic staffing gaps.

    Corporate Defense Pressures

    Japanese commercial groups have tightened vendor audit rules following repeated unauthorized access disclosures across consumer and corporate databases. Regulators have pressed firms to identify third-party vulnerabilities faster.

    Enterprise buyers now weigh whether to subsidize technical support for their vendor rosters or drop non-compliant suppliers before the next reporting cycle begins.

  • Hackers Raise Fridge Temperatures Across 400 French Supermarkets

    Hackers Raise Fridge Temperatures Across 400 French Supermarkets

    A coordinated cyber attack struck roughly 400 French supermarkets in October 2026, forcing commercial freezers to 50 degrees Celsius overnight and destroying tens of millions of euros in refrigerated stock.

    The breach hit stores operated by Intermarché Coopérative U, Carrefour, Monoprix, and E.Leclerc, causing immediate inventory write-offs across fresh food and frozen aisles.

    How Hackers Infiltrated Cooling Controls

    Intruders targeted centralised refrigeration software supplied by Danish engineering group Danfoss, which enables remote monitoring and automatic temperature regulation across commercial networks. Rather than breaching individual retail units on site, attackers exploited outdated firmware to alter master temperature settings across hundreds of stores simultaneously.

    Les Mousquetaires, parent company of Intermarché and Netto, confirmed that cooling units across approximately 150 of its outlets were heated to 50 degrees Celsius for six consecutive hours. The chain disconnected another 100 stores from the network during the incident to prevent further damage. Carrefour reported compromised systems across 80 stores, while Monoprix lost inventory across 5 per cent of its locations.

    Supply Chain Exposure Across Asia-Pacific

    For supermarket operators across Australia and the wider Asia-Pacific region, the incident shifts operational technology from backroom maintenance into board-level risk. Australian grocers manage thousands of distributed stores using identical internet-facing refrigeration and building management systems to cut energy costs and meet emissions targets.

    Retailers in the region carry heavy exposure when third-party maintenance contractors retain direct administrative access to store controllers. An intrusion into a corporate facility network or a shared vendor management platform bypasses store-level alarms and ruins cold-chain compliance before morning shift managers enter the building.

    Legacy Systems and Unpatched Firmware

    The technical fault line sits in legacy hardware that operators rarely replace during routine store refurbishments. Danfoss stated that the compromised units in France ran outdated firmware that could not support current defensive updates. The manufacturer maintains that it has long advised commercial clients to update supported hardware and migrate obsolete systems.

    Cybersecurity researchers at Claroty documented critical flaws in the Danfoss AK-SM 800A controller in August, showing that attackers could bypass authentication protocols to execute remote code. Danfoss issued software patches following that disclosure, but independent franchise operators and decentralized supermarket networks frequently lag in deploying updates across thousands of field devices.

    Investigations Open as Retailers Audit Assets

    French prosecutors and national cybersecurity agency ANSSI have opened a formal investigation into the breach, treating the incident as a coordinated assault on commercial food infrastructure. Retailers across Australia and Asia-Pacific must now verify whether local cold-chain assets run unpatched Danfoss controllers or unprotected vendor links before investigators publish the final incident report.

  • HCLTech Partners with Anthropic to Form Agentic AI Business Unit

    HCLTech Partners with Anthropic to Form Agentic AI Business Unit

    India’s HCLTech signed a partnership with Anthropic on Monday to accelerate enterprise adoption of Agentic AI with a focus on safety, cybersecurity and governance.

    Under the agreement, the country’s third-largest IT services firm will establish a dedicated business unit with a centre of excellence to build Agentic AI solutions.

    Teams at HCLTech will develop industry solutions embedding Anthropic products such as Claude, Cowork and Claude Code, ahead of announcing its second quarter results later in the day.

    Embedding Claude Across Enterprise Software

    HCLSoftware will natively integrate Claude across its commercial enterprise product suite. Rather than offering basic API connectivity, engineers are building domain-specific automation. The goal is running routine business operations with minimal manual oversight.

    Target sectors include banking, healthcare, telecommunications, and industrial manufacturing. By baking safety guardrails and governance controls directly into the foundational layer, the partnership aims to bypass compliance hurdles that delay enterprise rollouts across regulated Asian markets.

    The Pivot Away From Headcount-Driven Services

    Indian IT exporters face structural pressure to replace billing models tied to engineering headcount with high-margin software orchestration. Global clients no longer buy generic digital transformation consulting at past volumes. They demand operational automation that delivers measurable productivity cuts within two to three quarters.

    By tethering its software division directly to frontier foundation models, the company seeks recurring software licensing and specialized integration fees. The strategy risks cannibalising traditional maintenance billings if client systems require fewer engineers to operate. Yet letting rival systems integrators capture model orchestration poses a far greater threat to long-term margins.

    Sovereign Infrastructure and Platform Expansion

    Building an enterprise model footprint requires significant capital alongside technical integration. Clients in highly regulated jurisdictions increasingly demand data isolation and strict compliance before handing critical records to third-party model providers.

    Strategic positioning allows the group to address sovereign computing demands while maintaining access to leading global foundation models. The Anthropic alliance covers multinational accounts requiring complex frontier capabilities. Meanwhile, domestic holdings provide local infrastructure for clients bound by strict national data residency mandates.

    Building the Foundation Layer

    This partnership follows a series of structured AI investments by the Bengaluru-based group over the past four months. On October 8, 2026, it unveiled a suite of 20 Industry AI Solutions for corporate implementations across financial services, telecom, and industrial manufacturing.

    Earlier capital allocations laid the groundwork in June 2026, when HCLTech invested $150 million for a 10 percent equity stake in domestic firm Sarvam AI to build out sovereign infrastructure.

    Second-quarter financial earnings arrive later today. Management faces immediate investor scrutiny over client adoption metrics for the Claude software suite and the capital expenditure needed to scale the dedicated AI unit.

  • AI Tools Used in Cyberattacks on South Korean Banks

    AI Tools Used in Cyberattacks on South Korean Banks

    Hackers used artificial intelligence agents to breach at least nine South Korean financial institutions in October 2026. The attack compromised personal data from more than 25,000 banking customers.

    Major domestic lenders bore the brunt of the intrusions. Shinhan Bank reported 25,000 compromised customer records, while KB Kookmin Bank confirmed 119 leaked customer profiles.

    Automated Penetration Tools In Action

    Running from late September to early October, the campaign relied on an open-source security tool named ARTEX paired with Anthropic’s Claude Code. A Chinese security researcher using the alias Autumn published ARTEX on GitHub earlier this year. The software functions as an automated penetration agent. It links directly into external large language models including ChatGPT, Claude and DeepSeek to run vulnerability tests across target servers.

    The software repository explicitly restricts use to local testing and research. Even so, the attacker weaponised the framework against live online banking infrastructure. Cybersecurity firm CrowdStrike tracked the interactive sessions. The firm found that the operator fed target environments directly into AI coding interfaces to accelerate intrusion paths and system mapping.

    Traces Left In Model Prompts

    During the operation, the operative inadvertently leaked personal information directly into model prompt logs. Session records show queries asking where threat actors sell compromised Korean databases and requesting specific Korean data-trading channels on Telegram. In a separate prompt, the attacker instructed Claude to compile a curriculum vitae. That document contained a personal Telegram handle, educational background, age and an address in Maoming, Guangdong province.

    Digital infrastructure and Chinese-language prompts pointed investigators toward a 26-year-old individual operating out of southern China. “While this activity has not been attributed to a named adversary, the threat actor is likely a Chinese speaker and financially motivated,” CrowdStrike stated in its findings.

    Operational Risks For Retail Banking

    Automated AI penetration shifts the economics of perimeter defense for financial institutions and retail digital banking platforms across the Asia-Pacific region. Attackers no longer need deep bespoke code writing. Open-source agents can autonomously test attack surfaces and parse enterprise firewalls around the clock at negligible cost. Traditional web application filters now face automated scanning that iterates faster than standard manual patch schedules.

    Commercial banks face compounding costs from consumer notification mandates, regulatory fines and identity theft remediation. Containment protocols must now focus on rapid API throttling and continuous identity verification rather than static perimeter defenses. Retail platforms managing high volumes of consumer payments and stored credentials represent immediate targets as autonomous agent frameworks lower execution barriers.

    Escalating AI Incursions In Asia-Pacific

    Earlier incursions set the stage. In June, an autonomous AI agent breached a government health portal in Australia in one of the region’s earliest documented cases of autonomous agent exploitation. Financial regulators in Japan and South Korea had heightened network surveillance earlier this year as code-generation tools expanded the volume of automated attack scripts circulating in private forums.

    Police in South Korea opened a formal criminal investigation into the nine targeted institutions this week following directives from President Lee Jae Myung for immediate security interventions. Regulatory authorities in Seoul are auditing network logs across commercial lenders to determine if secondary data exfiltration occurred before defensive patches took effect.

  • Asos Shares Fall 10% After Hackers Hijack App to Send Extortion Alerts

    Asos Shares Fall 10% After Hackers Hijack App to Send Extortion Alerts

    Shares in Asos dropped 10 per cent after hackers hijacked the retailer’s mobile notification network to deliver an extortion demand directly to shoppers’ phones.

    Global markets including Australia, Ireland, France and Sweden received the alert on Tuesday. Shares tumbled as low as 432 pence in London trade.

    The rogue push message hit customer devices around 10:00 BST. Addressed directly to the retailer’s data protection officer and technology teams, the notification read: “we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” It linked users to a Telegram channel run by a group calling itself Xuanye Group. In follow-up messages, the hackers claimed customer records were safe on their server and would not be touched for a set period. They also claimed payment data was untouched.

    Breakdown of customer data exposure

    Asos cut access to its third-party customer messaging systems once the broadcast went out. Core systems, the shopping app and regional websites continue to trade normally, management said. External forensic specialists are now investigating alongside regulators to determine the scope of the breach.

    Basic personal records including names and contact details were exposed, the group confirmed. Payment-card details and passwords remained secure. Cloud storage provider Snowflake said its internal review found no compromise of its underlying platform.

    Ransom notes on customer screens

    Hijacking a retailer’s push alert pipeline creates an operational headache for digital merchants across Asia-Pacific and Western markets. Intruders usually negotiate data ransoms behind closed doors. By weaponizing an app installed on over 10 million mobile devices, attackers force the victim into a public crisis before forensic teams can map the intrusion.

    Vendor integrations create direct exposure for consumer brands using automated tools for customer alerts and data lakes. Here, the commercial risk is not system downtime. The storefront remains live. Instead, the danger lies in app uninstalls, consumer hesitation and friction at the digital checkout during peak shopping quarters.

    Earlier data sprees and corporate recovery

    Cyber gangs have targeted cloud repositories relentlessly over the past two years. Google subsidiary Mandiant tracked an intrusion campaign targeting Snowflake credentials across at least 165 corporate clients in 2024. British operators have also suffered hits, with Marks & Spencer, the Co-op and Jaguar Land Rover enduring major operational disruption from security breaches.

    This breach hits Asos during a delicate corporate turnaround. Asset sales and an improved fiscal 2026 earnings forecast had lifted its share price by more than 60 per cent earlier this year. The group holds cyber insurance covering business continuity. Management noted it is too early to assess the financial impact on trading.

    Investigation underway with regulators

    Technical teams are now investigating how the payload bypassed internal controls on the notification platform. Asos has not disclosed how many of its 17 million active global customers received the message.

    Attention now turns to whether the UK Information Commissioner’s Office receives a formal breach filing once forensic checks conclude. Investors will look to the next trading update to see if customer orders softened after the scare.

  • StarHub Outlines 3 Priorities for Network Transformation

    StarHub Outlines 3 Priorities for Network Transformation

    StarHub has outlined three key priorities driving its network transformation, focusing on network experience, operational efficiency, and API-driven enterprise connectivity.

    Speaking at FutureNet Asia 2026, StarHub Chief Technology Officer Volkan Sevindik detailed the operator’s roadmap to enhance resilience and support emerging AI workloads across Singapore.

    SIM-based security for autonomous agents

    The telco aims to resolve authorization risks as businesses deploy AI software to negotiate contracts and trigger automated transactions. Because carriers control the underlying connectivity infrastructure, they can authenticate machine-to-machine traffic before data hits enterprise systems.

    Internal network automation follows a vetted deployment model rather than running millions of unmanaged bots. The carrier maintains a small pool of compliant AI agents bound by regulatory guardrails, protecting core routing systems from compromised code.

    Network operations rely on an observability layer that feeds into closed-loop automation. The system detects transport faults early. It then resolves packet drops before subscribers experience service degradation.

    Enterprise APIs and fraud controls

    Commercial application programming interfaces form the operational foundation of this enterprise push. Banks use the carrier’s location APIs to verify that a customer’s registered handset is physically near an ATM during cash withdrawals.

    Identity verification interfaces also flag recent SIM swaps to counter digital banking account takeovers. Healthcare networks use the same pipes to confirm patient contact records in real time.

    Cloud-native software and hybrid cloud environments process these queries alongside the carrier’s AI infrastructure. This setup cuts processing overhead across domestic enterprise workloads.

    Granular network slicing on 5G Standalone

    StarHub is expanding its 5G+ deployment by using machine learning models to slice its 5G Standalone core down to individual applications. Conventional network slicing assigns broad performance tiers to millions of consumer handsets at once.

    The updated architecture provisions isolated bandwidth and latency parameters for dedicated corporate tasks. In-country data centers host inference engines to keep enterprise compute traffic inside Singapore borders.

    Direct subsea cable routes connect these domestic facilities to regional hubs and the United States. This routing provides cross-border failover protection against core transport disruptions.

    Long-term modernization track

    Listed on the Singapore Exchange mainboard since 2004, the telco has steadily overhauled its legacy routing and data layers. It implemented data virtualization through Denodo in September 2020, consolidating siloed databases and eliminating shadow IT systems across consumer and corporate divisions.

    This shift toward API-driven enterprise security mirrors regional competition among operators seeking to monetize 5G Standalone investments beyond basic data bundles.

    Over the next three years, the operator will expand application-specific cybersecurity tiers, tailoring encryption and threat isolation to corporate risk profiles.

  • Indonesia Cyber Attacks Inflict US$6.2 Billion in Losses This Year

    Indonesia Cyber Attacks Inflict US$6.2 Billion in Losses This Year

    Cyber attacks caused an estimated US$6.2 billion in financial damage across Indonesia during 2026, Bank Indonesia Governor Destry Damayanti announced in Jakarta on Thursday.

    Central bank officials linked the losses directly to automated tools and artificial intelligence. These technologies multiply payment fraud, scam operations, and data theft across consumer networks.

    Surging Risks in Digital Payments

    Destry urged government ministries and commercial agencies to tighten payment security standards and enforce direct consumer protections. The central bank holds the statutory mandate to supervise and develop the country’s payment infrastructure.

    Digital networks expand domestic economic output. Still, the governor warned that interconnected systems leave merchant acquiring channels and retail banking endpoints exposed to automated intrusion. Joint security literacy programs with the Financial Services Authority are planned to train consumers and retail operators.

    ISP Group Pushes Security Bill

    Backing the central bank’s warning, the Indonesian Internet Service Providers Association (APJII) demanded swift passage of the Cyber Security and Resilience Bill. Commercial internet providers require uniform technical standards and legal clarity to defend national digital infrastructure against automated threats, according to APJII Chair Muhammad Arif.

    “Indonesian service providers need legal certainty to grow, not disruptive regulations,” said Arif.

    Monitoring data from APJII tracked 246.4 million connections to dangerous IP addresses between June 13 and August 28, 2026. A separate three-day network scan by the association recorded roughly 68 million distinct cyber attack events targeting domestic routes.

    Direct Pressures on Retail and Finance

    For retail merchants, digital lenders, and e-commerce platforms operating across Southeast Asia’s largest market, these financial losses raise basic operating costs. Acceptance of QR codes and instant transfer rails expanded rapidly over the past three years. Back-end defense budgets frequently lagged that growth.

    Platforms now face higher chargeback rates, elevated verification costs, and direct liability when account credentials leak. Operators that fail to upgrade transaction authentication face friction at checkout. Financial institutions risk regulatory penalties if compromised channels disrupt daily settlement flows.

    Escalating Breach Scale Since 2025

    The US$6.2 billion tally reflects climbing attack sophistication following major infrastructure breaches over the previous eighteen months. Regional lender Bank DKI suffered repeated network intrusions that produced over US$15 million in irregular transactions, showing how attackers breach core accounting ledgers.

    Parliamentary debate on the Cyber Security and Resilience Bill now enters committee reviews. Enterprise software providers and payment processors are tracking whether mandatory incident-reporting rules will carry statutory fines before the legislative session closes.