Japanese telecommunications operator KDDI reported that an attack on an email platform exposed around 12 million email addresses and millions of customer passwords across multiple internet service providers [APAC]. Investigators will need to correlate platform logs, credential-reset records, affected-service inventories, customer communications and subsequent account-abuse indicators to establish exposure scope, compromise timing and downstream misuse across customer accounts and linked services. (Source: Japan Times, 07-07-2026)

A US county government reportedly paid $1 million to the Kairos cyber extortion group after negotiations over data stolen in a May 2025 intrusion [AMER]. The case makes negotiation records, leak-site monitoring, stolen-data inventories, ransom-payment artefacts and internal decision logs central to assessing impact, containment decisions, disclosure duties and post-incident liability, especially where public bodies face disclosure and recovery scrutiny. (Source: SecurityWeek, 07-07-2026)

Canada’s Communications Security Establishment disclosed authorised cyber operations in 2025 against a ransomware gang, drug traffickers and violent extremists presenting threats to Canada [AMER]. The disclosure shows how modern cyber investigations combine intelligence collection, infrastructure disruption, attribution development, operational safeguards and evidential handling across financially motivated crime, organised trafficking and national-security threats that cross conventional investigative and intelligence boundaries. (Source: The Record, 06-07-2026)

Suspected China-aligned operators exploited Roundcube webmail vulnerabilities against physics and engineering departments at universities in the United States and Canada [Global]. The campaign is significant for investigators because webmail compromise can leave evidence across server logs, mailbox artefacts, forwarding rules, authentication records, webshell activity and academic research-targeting patterns across compromised institutional environments and externally hosted services. (Source: The Hacker News, 07-07-2026)

Medical technology company Medtronic is notifying more than 3.8 million individuals after a ShinyHunters-linked attack exposed personal and medical information [AMER]. The incident elevates investigative questions around third-party exposure, protected-health-data handling, extortion evidence, notification scope, affected-system boundaries and whether stolen records can be correlated with subsequent fraud or targeted phishing against patients, staff and connected healthcare partners. (Source: Security Affairs, 06-07-2026)

IT services giant Accenture confirmed an isolated security breach after a threat actor claimed to have stolen 35 GB of source code and other company data [Global]. Investigators should focus on repository access paths, exposed development artefacts, source-code sensitivity, credential material, remediation evidence and whether any claimed data can be matched to internal systems or reused against clients and connected delivery environments. (Source: BleepingComputer, 07-07-2026)

CISA ordered US federal agencies to patch actively exploited Adobe ColdFusion CVE-2026-48282 after adding the flaw to the Known Exploited Vulnerabilities catalogue [US]. The vulnerability enables low-complexity remote code execution, making rapid asset discovery, patch validation, web-log review, server-side artefact collection and compromise assessment necessary for exposed ColdFusion deployments before adversaries establish persistence or harvest application data. (Source: BleepingComputer, 08-07-2026)

Threat actors began probing CVE-2026-20896 in Gitea Docker images shortly after disclosure, abusing trusted reverse-proxy headers to bypass authentication [Global]. The flaw is operationally important because exposed repositories can contain source code, secrets, deployment scripts, API tokens and credentials that allow investigators to reconstruct access paths and assess secondary compromise across build pipelines and connected infrastructure. (Source: The Hacker News, 06-07-2026)

Spain’s National Police arrested a suspected member of Cyber Army of Russia Reborn and Z-Pentest in Palencia following an FBI-supported investigation [EMEA]. Police seized computers and cryptocurrency storage devices, giving investigators potential evidence for attribution, payment tracing, operational support links, wallet analysis and connections to pro-Russian hacktivist activity against critical infrastructure in Europe and North America. (Source: Spanish National Police, 07-07-2026)

Tokyo police arrested a 15-year-old student suspected of exploiting a Bandai Channel system vulnerability to cancel more than 46,000 streaming subscriptions [APAC]. The case highlights youth cyber offending, traffic analysis, malicious-code generation claims, account-state reconstruction and platform audit evidence as investigators determine how the unauthorised subscription changes were triggered, scaled, documented, attributed and preserved for prosecution. (Source: Nippon, 06-07-2026)

The UK Government formally launched the Cyber Resilience Pledge at Downing Street, with more than 60 organisations committing to strengthen cyber defences [EMEA]. The pledge links resilience to board accountability, NCSC Early Warning, Cyber Essentials, supplier assurance and executive ownership, creating useful governance evidence for post-incident review and organisational readiness assessments after material cyber incidents and supplier failures. (Source: UK Government, 07-07-2026)

The European Commission presented an action plan on safe and responsible AI use while reinforcing Europe’s cybersecurity policy framework [EMEA]. The update connects AI governance with the Cyber Resilience Act, NIS2, DORA and the Cyber Solidarity Act, strengthening the compliance context for evidence retention, supplier assurance, accountability mapping and investigation-ready controls across regulated digital services and AI-enabled systems. (Source: European Commission, 07-07-2026)