Retriever said on 22 October that its technical review of a breach involving legacy Infomedia infrastructure had been completed and that affected stakeholders had been contacted while its current environment remained outside the identified scope. The Swedish information provider continues cooperating with police, data protection authorities and external specialists, but has not published the underlying forensic findings or a verified count of affected records, leaving independent assessment of the intrusion’s reach incomplete.

The UK government announced on 22 October an independent investigation into pre-Horizon Post Office computer systems alongside further changes to redress arrangements for people affected by the Horizon and Capture scandals. Examination of historic transaction records, software behaviour and disputed accounting evidence will require clear provenance and reproducible reconstruction, particularly where the underlying platforms and surviving records differ from those available during the original prosecutions or compensation decisions.

Microsoft researchers reported on 21 October that a China-aligned activity cluster tracked as Storm-0940 had used the ARTEX agentic framework during a wider campaign, linking the group to abuse of ConnectWise Cloud Backup application credentials affecting Microsoft 365 environments. The investigation documented suspicious service-principal authentication, permission changes and Microsoft Graph activity, while Microsoft cautioned that organisations must examine their own tenant logs before concluding that any particular customer environment was compromised.

ESET disclosed on 22 October that its Ukrainian grain investigation identified a backdoor, MythicRatatoskr, in an intrusion attributed to Russia-aligned UAC-0099 and followed by destructive activity attributed to Sandworm. Researchers linked phishing, established downloader tools and command traffic carried over the Yggdrasil network to the attack sequence, but did not establish operational consequences for the unnamed victim or prove that every observed component was operated by the same group.

US laboratory operator Quest Diagnostics disclosed on 22 October that it had discovered unauthorised access to its Quanum Lab Services Manager system, used by some healthcare clients to request tests and retrieve results, and believed patient records were accessed. Federal law enforcement and external specialists are assisting its investigation, while the company has not established the number or precise contents of affected records and says patient services remain operational.

Japanese games publisher Capcom disclosed on 22 October that unauthorised access to its CAPCOM ID platform exposed email addresses and account activity information associated with 11,774,247 accounts worldwide, with additional profile details affecting 43 accounts. The company also confirmed unauthorised password changes affecting 196 accounts, which it reset, while the route of access remains under investigation and Capcom reported no evidence that user-selected passwords or payment-card information were exposed.

The Node.js project published security releases on 21 October for supported 22.x, 24.x and 26.x versions, addressing weaknesses including certificate hostname-validation bypass and a Brotli decoding out-of-bounds write that could permit remote code execution. Its advisory describes affected release lines and associated CVE identifiers but does not establish active exploitation, making software inventory, dependency verification and preserved application logs preferable to inferring compromise solely from the presence of an outdated runtime.

India-based eMudhra announced on 22 October that it would withdraw from the global SSL/TLS certificate business after weaknesses in eight intermediate certificate keys prompted revocation and browser trust-store action. The company said the affected intermediates had not issued end-entity certificates and denied an infrastructure breach, while published cryptographic evidence of weak keys and the resulting distrust decisions highlight the need to distinguish certificate-forgery risk from evidence that fraudulent certificates were actually used.

INTERPOL announced on 22 October that authorities from 21 countries arrested 1,462 suspects during Operation Serengeti III, an African cybercrime crackdown conducted between late June and August targeting online fraud, extortion and malicious infrastructure. The organisation reported disruption of 10,909 networks and recovery of US$105 million, while remaining investigations must connect seized devices, financial transactions and infrastructure intelligence to individual conduct rather than treating aggregate operational figures as proof against any particular suspect.

Singapore Police said on 22 October that a two-week islandwide operation had identified 277 people assisting investigations into suspected scams and money-mule activity potentially linked to more than 883 cases and losses of around S$6.1 million. Officers from Cyber Command and seven divisions are examining cheating, laundering and unlicensed payment-service conduct, with records and communications needed to determine each person’s role and whether reported losses are attributable to the investigated activity.

The Council of the European Union agreed its negotiating position on 21 October for changes to privacy and cyber reporting rules, including national incident-reporting entry points rather than a single central European intake. The package remains a legislative proposal awaiting negotiations with the European Parliament, but the proposed notification architecture would affect how investigators preserve incident records, reconcile reports and demonstrate when material facts became known to the responsible organisation.

The UK government published proposals on 22 October for new legal safeguards covering critical undersea cables and pipelines, including stronger resilience duties for telecommunications operators and potential criminal penalties for damaging infrastructure. The consultation does not establish that a particular cable incident was sabotage, and attribution would require vessel-position evidence, physical inspection findings, maintenance history and time-correlated network telemetry to distinguish deliberate interference from accidental damage or technical failure.