The vulnerability

The flaw, tracked as CVE-2026-0257, affects the GlobalProtect portal component of PAN-OS, the operating system that runs Palo Alto’s PA-Series and VM-Series firewalls. Attackers abuse an authentication bypass vulnerability that allows them to circumvent multi-factor authentication and establish a foothold on networks connected to vulnerable appliances. Unit 42’s investigation, which began in early June, identified two ransomware groups — Qilin and Inc — as the primary operators leveraging the bug. Both groups have previously targeted critical infrastructure in the UK and Europe, raising alarms among British security agencies.

How the attacks unfold

Once inside a compromised network, the attackers use stolen credentials to perform lateral movement through RDP and SMB protocols, accessing domain controllers and VMware ESXi virtualisation hosts. A custom tool was found dumping credentials directly from ESXi VMDK files, giving the groups persistence across reboots and the ability to deploy ransomware payloads hours or days later. The attacks have affected organisations across education, finance, healthcare, technology, hospitality, manufacturing, professional services, government, transport, utilities and retail — sectors that handle sensitive data and cannot afford prolonged outages.

UK exposure

British organisations running PAN-OS GlobalProtect portals are advised to patch immediately, as the National Cyber Security Centre has added the threat to its security advisories. The NCSC’s latest alert notes that UK healthcare trusts, local councils and transport operators have been among the most aggressively targeted, with attackers exploiting remote access configurations that became ubiquitous during the shift to hybrid working. The vulnerability is particularly dangerous because firewalls sit at the network perimeter — compromising them can expose entire downstream infrastructures, including systems that were otherwise air-gapped or segmented.

Why it matters

For British citizens, the implications extend beyond corporate boardrooms. NHS trusts that process patient records through vulnerable endpoints, local councils managing social care data, and energy grid operators protecting critical systems all face elevated risk. The ransomware groups behind these attacks have shown willingness to leak sensitive personal data publicly when negotiations break down, which means medical records, council files and utility customer databases could end up exposed. The UK government is reportedly preparing updated cyber insurance guidelines in response to the wave of incidents.

What happens next

Palo Alto Networks released patches for CVE-2026-0257 in September, but Unit 42 warns that many organisations have not yet applied them. The NCSC expects the attack rate to persist through the end of the year as groups continue to exploit laggard deployments. Organisations that remain unpatched should disable GlobalProtect portals where possible, enforce network segmentation, and implement additional monitoring for unusual RDP and SMB traffic. Security researchers note that the sophistication of these attacks — particularly the ESXi credential dumping tool — suggests state-sponsored actors may be providing support to the ransomware groups, blurring the line between criminal and geopolitical threats.

What happened

NHS England said an internal audit identified fifteen members of staff across three trusts who accessed the records of the Nottingham victims without clinical justification. The records were viewed in the days and weeks after the attacks, which targeted Nottingham College students. None of those dismissed have been reported to the police, and NHS England said it would refer any potential criminal conduct to the Crown Prosecution Service where appropriate. The incident echoes a series of smaller breaches reported throughout the year, in which staff accessed the records of celebrities, politicians and crime victims.

Why it matters

For patients, the breaches are a direct betrayal of the confidential relationship that underpins the NHS. For ministers, they are a fresh embarrassment on the home front even as the government focuses on wider security threats. The health service has introduced smart-card access systems in recent years, but the Nottingham case shows that technical controls alone cannot stop determined insiders. With the Information Commissioner’s Office already examining whether the dismissed staff breached the Data Protection Act, the scandal is likely to accelerate a planned review of NHS data governance — and could lead to a criminal offence for patient-record snooping.

Beyond the NHS

Security researchers note that insider threats are the hardest to detect because the users already hold legitimate credentials, and that healthcare systems worldwide struggle to balance rapid access in emergencies against routine oversight. The UK’s National Cyber Security Centre has repeatedly warned that health data is a high-value target, both for criminals who sell it on dark-web markets and for foreign states that seek to map British society. Any new safeguards will have to work within a service that is under intense pressure to let clinicians see records instantly, even as it tries to stop casual snooping.

What happens next

The Health Secretary pledged this weekend that his department will bring forward proposals to toughen penalties for unauthorised access to patient records, with options including criminal sanctions, before the autumn conference season. The Information Commissioner is expected to issue guidance on whether the fifteen dismissals are sufficient, and NHS England will conduct a fresh audit of access logs at every acute trust next month. For the families of the Nottingham victims, the sackings offer little comfort beyond confirmation that someone was watching — but they signal that the breach of trust will not be tolerated.

Source: BBC UK.

The scale of the breaches

The 15 staff members dismissed on Saturday were found to have inappropriately accessed the medical records of Nottingham attack victims and other patients, according to the trust. Dr Manjeet Shehmar, NUH medical director, said there was “simply no excuse for accessing the records of a patient without a legitimate reason.” The trust said it had informed the Information Commissioner’s Office and Nottinghamshire Police of the investigation, along with relevant professional regulators including the Nursing and Midwifery Council and the General Medical Council.

The dismissals follow an earlier round in May, when 11 staff members were sacked. The breaches extend beyond the Nottingham attacks — Yorkshire Ambulance Service has also confirmed that the medical records of William Chapman, a 24-year-old killed by a tiger at Yorkshire Wildlife Park, may have been accessed illegitimately. Students Barnaby Webber and Grace O’Malley-Kumar, and grandfather Ian Coates were stabbed to death on 13 June 2023 by Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020.

Why this matters

The breaches strike at the core promise the NHS makes to every patient: that personal medical information will be treated with the utmost confidentiality. When staff access records without clinical justification — whether out of curiosity, voyeurism, or gossip — it erodes public trust in the health service at a time when the NHS is already under intense pressure. For families grieving the loss of loved ones, the added trauma of knowing their private medical details were viewed by strangers compounds an already devastating loss.

Government response

Speaking to the BBC’s Sunday with Laura Kuenssberg, Cooper said she expected swift action against any NHS worker found to have breached data and privacy standards. “Let me be really clear about this,” she said. “There are proper data and privacy standards across the NHS. There’s got to be proper respect for patients.” She added that where breaches occur, staff should be suspended while investigations take place rather than allowed to continue in post.

What happens next

NUH said a new system, currently under testing, is being implemented to protect patient records in future and alert the trust to potential breaches. The Information Commissioner’s Office is expected to assess any evidence provided and consider its next steps. For the grieving families, the priority is accountability — and a guarantee that such breaches will not happen again.

Why it matters

A candid admission of vulnerability

BBC Technology noted that Narayan’s assessment — delivered during a parliamentary briefing — marked one of the most direct acknowledgements yet from a senior UK minister that a significant cyber attack on British systems is not a question of if but when. For IT managers in NHS trusts, energy grid operators and the owners of the thousands of small businesses that keep British high streets running, the warning landed at a moment when artificial intelligence is simultaneously being pitched as both the threat and the solution. The minister argued that AI-powered threat detection can identify anomalies faster than human analysts, potentially shaving hours or days off the window in which attackers lie dormant inside networks. That argument mattered to voters in constituencies from Cambridge’s science park to Edinburgh’s financial district, where jobs depended on the UK’s reputation as a safe and secure digital economy. Prime Minister Andy Burnham’s government has framed AI leadership as a post-Brexit economic opportunity, and the minister’s focus on defence — rather than only on cutting-edge research — signalled that the technology was being positioned as a shield as much as a sword.

What happens next

Parliament’s science and technology committee was expected to summon the Digital Secretary for further questioning once the autumn session fully resumed, and opposition parties had already signalled their scepticism about whether the promised AI tools are sufficiently mature to deliver the improvements ministers describe. For now, organisations across the public and private sectors are reviewing their own resilience plans, with particular attention to supply-chain vulnerabilities and the growing use of cloud services hosted by overseas providers. The National Cyber Security Centre has not issued new mandatory standards, but sources close to the briefing told the BBC that a refreshed code of practice for critical-infrastructure operators is likely by spring, with AI-based monitoring tools at its core. The minister’s honesty about likely breaches — rather than the usual government assurances of readiness — has been welcomed by some security researchers who argue that transparent acknowledgment is the first step toward genuine preparedness.

For ordinary citizens, the implications are already visible: banks are rolling out AI-driven fraud alerts, insurers are adding cyber cover to home policies, and employers from Birmingham tech firms to NHS hospitals are rolling out new authentication systems. The minister’s warning, while uncomfortably frank, has at least removed the pretence that British networks are impenetrable — a shift that security professionals say is long overdue.

Source: BBC Technology — AI minister warns ‘likely’ UK’s cyber defences will be breached

Why it matters

For Manchester’s Market Street, London’s Oxford Street and the online shoppers who browse Phase Eight’s floral dresses and Hobbs’ tailored coats from flats across the UK, the incident was a stark reminder that a single breach can shut down the checkout experience for thousands of customers in minutes. BBC Technology noted that TFG London attributed the disruption to what it called a “cybersecurity incident,” without specifying whether customer data was exfiltrated. What is clear is that the attack hit at a critical moment: the autumn retail season, when British consumers are replacing winter coats and preparing for the party season. A successful ransomware deployment against household-name retailers would also set a worrying precedent for the thousands of smaller boutiques and independent designers that rely on the same third-party payment processors and logistics platforms. Prime Minister Andy Burnham’s government, already under pressure to strengthen national cyber defences, now faced a high-profile incident involving two quintessentially British brands that employ thousands of people across the UK.

What happens next

TFG London has not confirmed whether customer payment data was compromised, but the company’s apology to affected customers suggested that some level of database access was gained. The National Cyber Security Centre was expected to issue guidance to retailers within days, and MPs on the business committee were likely to summon TFG executives for questioning once the company had a clearer picture of the damage. H&M’s separate investigation, which the BBC reported was being treated as a precautionary review rather than a confirmed breach, may reveal whether the two incidents are linked. For now, shoppers hoping to complete autumn purchases online were being directed to call-centre queues or to visit physical stores, where point-of-sale systems appeared to remain unaffected. Customer service teams were overwhelmed with inquiries from people unable to track recent orders, and consumer watchdogs had already begun fielding complaints about the lack of real-time communication during the outage.

The incident also added urgency to ongoing parliamentary discussions about introducing mandatory breach disclosure rules for consumer-facing businesses. Under current UK law, companies that suffer a breach affecting personal data must report it to the Information Commissioner’s Office within 72 hours, but the threshold for what constitutes “personal data” in a retail context remained a grey area that campaigners hoped this incident would clarify.

Source: BBC Technology — Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim

What the US prosecutors allege

According to The Register, US Department of Justice prosecutors last week accused Oxygen Forensics chief executive Lee Reiber and Russian national Oleg Sergeyevich Davydov of concealing the firm’s true ownership and the location where its software was actually written. The Department of Justice says the Alexandria, Virginia-based company was owned and controlled by five Russian nationals through a Cyprus-based holding structure, while the code itself was produced by Moscow-based MKO Systems, previously known as Oxygen Software.

MKO reportedly sold the same technology in Russia under different product names to customers including the Federal Security Service, the Russian Investigative Committee and the Ministry of Internal Affairs. Oxygen’s US customer list has included Homeland Security Investigations, the Department of Homeland Security Office of Inspector General and the Secret Service’s National Computer Forensics Institute.

How much of the Met’s work is affected

The Met signed a three-year agreement with Oxygen in December 2023. The software is used by digital forensics teams to extract and analyse data from phones and other devices seized during investigations. The force said the software runs on a closed IT system that is not connected to the internet, and that it was used in fewer than 0.2 per cent of the more than 23,000 actions carried out by its digital forensics team over the past year. The Met said it does not share investigation data with Oxygen Forensics Inc.

Wider fallout across Europe

The National Police Chiefs’ Council confirmed that other UK forces also use Oxygen products and have been encouraged to carry out their own proportionate assessments, stressing that the US authorities are not alleging the software contained malicious code or that customer data was accessed without authorisation. Romanian authorities have begun terminating their use of the products, while Latvia’s State Police has suspended the software pending an assessment.

Oleg Sergeyevich Davydov, 52, was arrested at Heathrow Airport last month while preparing to fly to Turkey. He appeared at Westminster Magistrates’ Court on Tuesday, where a judge declined to grant bail, and the US is seeking his extradition.

Why it matters

For UK policing, the case raises uncomfortable questions about supply-chain trust in the forensic tools that underpin criminal investigations. Even where no malicious code is alleged, the concern is about who ultimately controls a tool used to read seized devices, and whether any backdoor or undisclosed access route exists. Evidence obtained with such tools has to withstand scrutiny in court, and an unresolved question about provenance is exactly the kind of issue defence solicitors will press.

What happens next

The Met’s review is expected to establish whether any Oxygen-built software touched material in live investigations and whether re-examination is required. Other UK forces are expected to complete their own local assessments, and a decision on whether to terminate or replace the contracts will follow. Meanwhile the US extradition case against Davydov continues, and Oxygen Forensics has not responded to The Register’s request for comment.

The MI5 warning on Chinese-linked research

The security service has flagged the China General Technology Research Institute as an organisation linked to the Chinese Ministry of State Security, the foreign intelligence arm of the Chinese Communist Party. According to the warning, British universities receiving funding from the institute are at risk of seeing their research diverted to Beijing’s intelligence apparatus, raising serious questions about academic collaboration, intellectual property, and national security.

The MI5 intervention reflects a broader and intensifying concern within the UK security establishment about the exploitation of open academic environments for espionage and technology transfer. Universities have long been attractive targets for foreign intelligence services because of their international collaborations, the breadth of cutting-edge research they conduct, and the relative openness of their staff and students. The specific focus on a state-linked Chinese institute signals that the Government is treating the issue not as a general risk but as a targeted activity.

What the China General Technology Research Institute is alleged to do

The institute at the centre of the warning is reported to be tied to the Chinese Ministry of State Security, which is responsible for foreign intelligence and counterintelligence activity abroad. The allegation is that research funded through the institute does not remain within the academic collaboration it may have been presented as, but instead feeds into Chinese state intelligence interests.

That accusation carries weight because it links financial support for research to a specific foreign intelligence service rather than to commercial or general academic exchange. Where funding comes from a state security body, the concern is that the research priorities, access to findings, and participation of staff may be shaped by intelligence objectives rather than by scientific or educational goals. The distinction matters because it changes the nature of the risk from one of commercial competition to one of national security.

What universities are being urged to do

The security service is urging British universities to cut ties with the China General Technology Research Institute. That means reviewing existing partnerships, grants, and collaborations involving the institute and, where appropriate, ending them. For universities, the decision is not straightforward: research funding is competitive, international collaboration is a normal part of academic life, and the line between legitimate partnership and problematic entanglement can be difficult to draw.

The MI5 warning is intended to help universities make that judgment by giving them a clearer picture of the specific risk attached to this institute. But it also places institutions under pressure to act, particularly where sensitive research areas such as advanced materials, dual-use technologies, or capabilities with defensive and offensive applications are involved. Universities will have to weigh the funding they receive against the potential exposure of their work and the reputational and security consequences of maintaining links.

Why this matters

The warning matters because it sits at the intersection of higher education, technology, and national security. British universities are among the world’s leading research institutions, and the work done in their laboratories has significant economic and strategic value. If foreign intelligence services are systematically accessing that research through funding channels, the implications extend beyond individual institutions to the broader UK research base and the country’s technological competitiveness.

It also matters because the issue is politically sensitive. Relations between the UK and China have become more strained in recent years across a range of areas, and academic collaboration has emerged as one of the arenas in which those tensions play out. Too great a distance and UK universities risk being cut off from valuable partnerships; too little and they risk exposure to intelligence exploitation. The MI5 warning is an attempt to help universities navigate that balance, but the judgment about where to draw the line is not an easy one.

What happens next

Universities are expected to review their links to the institute in light of the warning. Some may decide that existing collaborations should be wound down; others may conduct their own risk assessments before deciding how to respond. The process is likely to be uneven across institutions, depending on the nature of their research, the funding they receive, and their existing relationships with Chinese partners.

At the Government and security service level, the warning is likely to be followed by further engagement with the higher education sector to clarify the risks and the steps institutions should take. The issue may also feed into broader policy discussions about the oversight of sensitive research, foreign funding in universities, and the protections around intellectual property and dual-use technology.

Source: BBC News. Read the original report at BBC News.

The breach affected medical records connected to Noah Woods, whose case has already attracted public attention for other reasons. According to the trust’s statement, the breach caused the family additional distress at a difficult time, and the trust has accepted responsibility for the failure that led to the information being exposed. The apology was issued alongside the announcement of a formal investigation, which is intended to establish how the breach happened and what steps need to be taken to reduce the chance of a repeat.

What the trust has said

The trust’s statement made clear that it was sorry for the impact on the family and that it was treating the matter seriously. An unreserved apology is a significant phrase in this context: it signals that the organisation is not attempting to minimise the incident, and that it accepts at least some responsibility for what occurred. The trust has also said that an investigation is underway, which is the standard next step in NHS data incidents where there is a question about how a breach happened and whether existing safeguards were adequate.

Data breaches involving medical records are particularly sensitive because the information they contain is both personal and potentially damaging if disclosed. The NHS holds some of the most detailed personal data available about patients, and trusts are expected to have controls in place to limit access, monitor usage, and secure records against accidental or unauthorised disclosure. When those controls fail, the result can be more than an administrative problem; it can mean that an individual’s private medical history becomes visible to people who should not see it.

Why NHS data breaches are treated seriously

Health data is categorised as special category data under data protection law, which means it receives a higher level of protection than ordinary personal information. That reflects both the sensitivity of the content and the potential harm that disclosure can cause. A breach of medical records can expose details about a person’s diagnosis, treatment, mental health, or family circumstances — information that many patients would not want shared beyond their care team.

For the NHS, the stakes are also institutional. Trust-level data breaches can lead to regulatory scrutiny, reputational damage, and questions about whether the measures in place at the time of the incident were sufficient. Where a breach affects a high-profile case, as with Noah Woods, it can also attract public and media attention that amplifies the pressure on the trust to show that it understands what went wrong and is acting on it.

Why it matters

This case matters because it brings together two things that do not always receive enough attention together: the technical question of how a data breach happens, and the human question of what that breach means for the people it affects. Data incidents in the NHS are often reported in terms of record counts, categories of information, and compliance steps. Those details matter, but so does the immediate impact on the individuals involved. An apology that recognises the added distress caused to a family is a reminder that behind the technical language of data protection are real people whose privacy has been compromised.

The case also reinforces the broader point that NHS data security is not an abstract compliance exercise. The information held by trusts is deeply personal, and the safeguards around it need to work in practice, not just on paper. When they do not, the consequences can be severe for patients and their families, and the trust responsible has to be able to show that it has learned from the incident rather than merely acknowledging it.

What happens next

The trust’s investigation is expected to examine the circumstances that allowed the breach to occur and to identify any weaknesses in process, access controls, or staff handling of information. Depending on what it finds, there may be further updates from the trust, changes to internal procedures, or referral to the appropriate regulatory or oversight bodies. The family are likely to be waiting for the outcome of the investigation and for confirmation that the steps promised are actually being taken.

In the meantime, the case remains a live reminder of the responsibility that NHS organisations carry when they hold sensitive patient information, and of the importance of transparency when something goes wrong.

What AFRINIC does

AFRINIC is one of the world’s five regional internet registries, responsible for allocating and recording the IP addresses that keep networks, banks, governments and mobile operators online. Its decisions affect the basic plumbing of the internet across an entire continent. In recent years the organisation has been dogged by governance and operational problems, including a long-running legal dispute with one of its members, Cloud Innovation, over AFRINIC’s power to terminate users who breach its rules. That fight left the registry unable to convene a board for several years and placed it under court-ordered receivership in Mauritius.

The allegations

According to details reported by The Register, South Africa’s Internet Service Providers’ Association raised two specific irregularities after the vote. In one case, a representative of a resource holder arrived to vote only to be told another person had already cast a ballot on their behalf using a power of attorney they said they had never issued. In another, a power of attorney recorded by AFRINIC staff had mysteriously vanished from the record by the time a copy was requested. The Nomination Committee overseeing the vote became concerned during the in-person session in Mauritius and halted the election; the receiver later annulled it.

Mauritius Police confirmed to The Register that two cases tied to the 2025 AFRINIC elections remain under investigation by the Central CID, both alleged forgery. The Central CID handles sensitive and public-interest matters.

Why it matters

An internet registry may sound obscure, but its integrity is foundational: if the record of who controls addresses is compromised, the consequences reach every website, bank transfer and government service that relies on them. The episode also shows how organisational instability at a critical technical body can spill into the criminal-justice system, and why reform of how the internet’s numbering is governed matters well beyond the tech sector.

What happens next

AFRINIC has named South African lawyer Mike Silber as its next chief executive, due to take up the role on 1 January 2027, and is consulting on bylaw changes including a dispute-resolution clause. The police inquiry continues in Mauritius. Your News will follow developments as the criminal investigation and the registry’s governance reforms progress.

Source: Original report. Rewrite for Your News Website.

The data seized from 8.7 million customers included email addresses, phone numbers, vehicle registrations and postcodes, Manchester Airport Group (MAG) said.

The company announced the “cyber security incident” relating to Manchester, Stansted and East Midlands airports at around 1pm on Thursday.

“Manchester Airports Group has been subject to a cyber security incident by an unauthorised third party,” an MAG spokesperson said. “A quantity of customer data has been obtained that relates to car park, lounge and Fast Track bookings and in-airport WIFI sign-ups at Manchester, Stansted and East Midlands airports.”

“At no point has passenger safety or aviation security been compromised,” MAG added. The system accessed did not hold customers’ bank or payment details, and airport operations and customer parking continue uninterrupted.

Cyber attacks targeting public infrastructure have been on the rise. In September 2025, Heathrow was among several major European airports hit by a cyber attack, and in 2022 the Advanced Computer Software Group ransomware attack disrupted critical NHS services — prompting a £3m fine from the Information Commissioner’s Office.

Originally reported by Sky News.

Read the original report at Sky News →