The latest DFM 48h Global News Roundup covers KDDI credential exposure, public-sector extortion, Medtronic data compromise, Gitea and ColdFusion exploitation, Spain’s arrest of a suspected pro-Russian hacktivist supporter, Canadian active cyber operations, and new UK and EU policy developments shaping investigative readiness, evidential integrity and cyber resilience.

This edition examines a Texas wildlife licensing data breach, the Klue supply-chain attack affecting cybersecurity firms, FortiBleed credential exposure, healthcare-sector incidents involving Australian Clinical Labs and SunDoctors, and coordinated action against Evil Corp and the SocGholish botnet. Coverage also includes active vulnerability exploitation, SaaS evidence challenges, policy developments, and investigative readiness considerations for organisations globally.

Education-sector cyber incidents, software supply-chain compromises and actively exploited mobile vulnerabilities dominated this reporting period. Reported attacks affecting Indian examination platforms, malicious npm package activity and Android security flaws drew significant attention. Regulators in Hong Kong, Europe and the United States also advanced AI-related cybersecurity measures, while Europol and U.S. policymakers highlighted evolving cybercrime enforcement and investigative capabilities.

Europol fraud and Black Axe actions, Signal phishing targeting German officials, Singapore contractor data exposure, Winona County ransomware leaks, Itron and Medtronic network intrusions, active cPanel exploitation, malicious SAP npm packages, UK breach survey findings, and agentic AI security guidance shape this DFM 48-hour roundup for investigators focused on evidence, attribution, audit trails, and cross-platform correlation readiness.

CISA, FBI and NSA warned that Iranian-linked actors are targeting internet-connected PLCs in U.S. critical infrastructure, while a Massachusetts hospital diverted ambulances after a cyberattack. Investigators tracked cloud data theft to abused authentication tokens after a SaaS integrator breach, and the DOJ disrupted a GRU-linked DNS hijacking botnet as NIST advanced an AI risk profile for critical infrastructure operators broadly.