India’s Bank of Baroda confirmed that a compromised employee email account was linked to an alleged data leak, while stating that its core banking systems remained unaffected [APAC]. Investigators must establish mailbox access, forwarding rules, attachment movement and authentication history, then correlate those artefacts with any published samples to determine the true volume, provenance and customer impact of the claimed one-terabyte disclosure. (Source: The Record, 28-07-2026)

Researchers identified more than 24,000 internet-exposed server management controllers leaking password hashes through a decades-old authentication weakness [AMER]. The investigative priority is to inventory affected interfaces, preserve access and network logs, test whether hashes were collected or cracked, and distinguish routine internet scanning from successful administrative access before deciding whether downstream server activity represents exploitation, credential reuse or unrelated compromise. (Source: BleepingComputer, 28-07-2026)

Indian officials rejected reports of a cyber incident affecting the Defence Research and Development Organisation, describing the circulating claims as incorrect and unverified [APAC]. Investigators evaluating the alleged dark-web listing would need to authenticate samples, establish whether records originated from DRDO or a contractor, reconstruct collection dates and access paths, and avoid treating a seller’s description or repeated media coverage as evidence of a confirmed intrusion. (Source: Times of India, 29-07-2026)

The ShinyHunters extortion group claimed responsibility for the previously disclosed compromise affecting professional-services firm EY and threatened to publish data unless paid [EMEA]. Attribution remains a hypothesis until investigators correlate the group’s evidence with EY’s third-party access records, stolen-data samples, identity events and exfiltration telemetry, while preserving the distinction between a credible possession claim, responsibility for initial access and control of the entire intrusion. (Source: Cyber Daily, 28-07-2026)

Australian energy supplier Origin Energy said its initial review found that personal information linked to approximately 900,000 current and former customers had been accessed [APAC]. The investigation must reconcile the confirmed population with the attacker’s earlier two-million-record claim, trace the route from initial access to extraction, document which financial fields were partial, and preserve evidence supporting notification, fraud monitoring and any later criminal proceedings. (Source: news.com.au, 28-07-2026)

Minnesota officials said a coordinated cyberattack targeted more than 30 community water systems on 26 and 27 July, with some operational controls disrupted but no confirmed impact on drinking-water safety [AMER]. Investigators must preserve controller logs, remote-access records, engineering-workstation images and network telemetry to establish common access methods, determine whether the attacks shared infrastructure, and avoid inferring state attribution before federal and local evidence is correlated. (Source: Reuters, 28-07-2026)

Arista Networks patched CVE-2026-16812, a critical command-injection flaw in VeloCloud Orchestrator that the company said had been exploited as a zero-day [AMER]. Defenders should retain appliance logs, configuration changes, spawned processes and outbound connections before remediation, because successful exploitation may provide privileged access to centrally managed network estates and complicate scoping where orchestration credentials, templates or downstream administrative channels were subsequently used. (Source: SecurityWeek, 28-07-2026)

Researchers warned that attackers are exploiting CVE-2026-16723, an unauthenticated remote-code-execution flaw affecting Fastjson deployments packaged as Spring Boot executable applications [APAC]. Investigation should combine application, Java runtime, container and network telemetry to identify crafted requests and post-exploitation activity, while recognising that shared libraries can create a wide and poorly inventoried exposure surface in which vulnerable code persists inside otherwise independently maintained services. (Source: SecurityWeek, 28-07-2026)

Delhi police used a stolen-card transaction trail to identify suspects accused of purchasing high-value jewellery through fraudulent online orders [APAC]. The evidential chain depends on correlating payment authorisations, merchant records, delivery addresses, device and account identifiers, CCTV and communications data, while documenting how each digital trace links particular individuals to the transactions rather than merely to reused accounts, compromised cards or shared infrastructure. (Source: Times of India, 28-07-2026)

Ireland’s Garda National Cyber Crime Bureau reported identifying 65,000 previously unknown child-abuse images and videos for submission to Interpol’s international database [EMEA]. Investigators must preserve hashes, acquisition context and provenance while using cross-border image comparison, metadata and victim-identification workflows to separate duplicates from new material, connect seized devices to distribution activity and ensure sensitive evidence remains controlled throughout international referral and prosecution processes. (Source: The Irish Sun, 26-07-2026)

CISA, Australia’s ASD and international partners published guidance urging critical-infrastructure operators to prepare methods for physically isolating vital operational technology and enabling systems [AMER]. The advice has direct evidential consequences because isolation plans should preserve time sources, logs, volatile state and secure acquisition routes, enabling investigators to contain adversary movement without unnecessarily destroying the telemetry needed to reconstruct pre-positioning, persistence and attempted operational manipulation. (Source: CISA, 28-07-2026)

The UK National Cyber Security Centre published a recovery framework for organisations facing highly disruptive cyber attacks [EMEA]. Effective adoption requires recovery decisions to remain tied to verified evidence, with clean-system criteria, dependency mapping, preserved forensic copies and documented restoration sequencing, so that operational pressure does not erase indicators, reintroduce compromised assets or leave investigators unable to explain how confidence in restored services was established. (Source: NCSC, 28-07-2026)