[EMEA] The UK Information Commissioner reprimanded ACRO Criminal Records Office after investigating unauthorised access to its website and content-management system between August 2022 and March 2023, with up to 10,920 people potentially affected. ACRO could not determine conclusively whether staged personal data was removed, while the regulator identified patch-management failures and security alerts that were not adequately investigated (Source: ICO, 12-08-2026)

[GLOBAL] Trezor said shipping provider ShipMonk suffered unauthorised access that exposed order data for 11,742 customers with full details and 1,947 with partial details across seven countries. Trezor said its own systems and devices were not compromised, while the ongoing investigation and exposure of names, addresses, emails and phone numbers create evidence trails relevant to subsequent phishing, impersonation or targeted fraud (Source: Trezor, 13-08-2026)

[APAC] Taiwan’s Ministry of Digital Affairs said government agencies were targeted in July by overseas attackers combining manual activity with AI-agent assistance, with national cyber monitoring issuing warnings during the investigation. Wider reporting described more autonomous behaviour, but Taiwan did not attribute the operation to China, making recovered workspaces, account activity and agency telemetry important for distinguishing confirmed compromise from researcher assessments about the agents’ independence (Source: Channel NewsAsia, 13-08-2026)

[AMER] The FBI warned that attackers are breaching adults’ and children’s social-media and personal accounts to steal explicit material, using password guessing, customer-service impersonation, password-reset abuse and cloned login pages. Investigators can correlate recovery events, device and IP histories, phishing domains and marketplace postings because stolen material is also being paired with personal information and used for harassment, sextortion, stalking and further targeting (Source: The Record, 12-08-2026)

[EMEA] France’s Finance Ministry confirmed that a malicious actor accessed the public-finance information system in late June and consulted and extracted data relating to individual and professional taxpayers. Investigations are still determining the specific records and exact number affected, so external estimates approaching 680,000 should remain provisional while access logs, query histories, exports and notification records establish the verified scope of the compromise (Source: Reuters, 14-08-2026)

[GLOBAL] Cl0p claimed it stole data from nearly 50 companies including Philips, Shell, GE and Fiserv, while Philips confirmed an attempted server compromise and Shell acknowledged a possible incident. Coverage across multiple outlets largely repeats the group’s claims, so victim-side logs, patch histories, server images and confirmed samples remain more reliable than extortion-site volumes for establishing which organisations were compromised and what data actually left their environments (Source: Reuters, 13-08-2026)

[GLOBAL] FortiGuard Labs documented Evooo1Bot, a Mirai-derived Linux botnet observed exploiting multiple vulnerabilities in internet-facing devices and deploying architecture-specific binaries through a loader script. The malware combines distributed-denial-of-service functions with persistence, credential sniffing and SOCKS5 proxying, while its campaign labels and callback infrastructure give investigators artefacts for correlating exploit attempts, infection chains and compromised edge devices across different vulnerability sets (Source: FortiGuard Labs, 13-08-2026)

[APAC] Cisco Talos documented the JWR phishing framework in campaigns using SMS lures impersonating toll, postal and courier services across Southeast Asia and the Middle East. Its operator-driven client maintains an encrypted WebSocket, renders dozens of phishing pages and can collect payment data, credentials, identity documents, two-factor codes and device fingerprints, giving investigators network, browser and exfiltration artefacts that can connect individual sessions to common infrastructure (Source: Cisco Talos, 13-08-2026)

[EMEA] Kaspersky reported a new Armored Likho cyber-espionage campaign targeting organisations and individuals in Russia through donation-themed applications that install a Rust-based toolkit. The Still Sync component steals Telegram session data while Still Audio records speech, and Kaspersky attributes the activity to Armored Likho with high confidence from code overlaps and technical artefacts, providing investigators with malware, infrastructure and account evidence for correlation (Source: Kaspersky, 13-08-2026)

[APAC] Singapore Police said 270 people are assisting investigations after a two-week islandwide operation targeting suspected scammers and money mules linked to more than 660 reported scam cases. Officers from Cyber Command and seven Police Land Divisions are examining suspected cheating, money laundering and unlicensed payment activity, with bank records, devices, SIM credentials and transaction histories providing routes to map participants and proceeds across the alleged networks (Source: Singapore Police Force, 13-08-2026)

[APAC] Ludhiana Rural cybercrime police arrested a man from Mohali accused of using female identities on social media to defraud a Jagraon resident of ₹239,750 through a fake Australian visa offer. The inquiry traces Snapchat contact, staged phone conversations and IMPS, NEFT and UPI transfers, while police suspect additional participants and can use account, device and payment records to test the wider network (Source: Hindustan Times, 13-08-2026)

[AMER] A White House memorandum directed creation of a programme allowing vetted United States companies to conduct federally controlled cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organisations. The framework places participating companies under government direction and oversight, making authorisation records, targeting parameters, operational logs and handling of unintended access important evidence for later review of attribution, proportionality and compliance with approved mission boundaries (Source: The White House, 12-08-2026)

[EMEA] Germany’s cabinet approved measures that would give the BND and BfV broader powers to access digital communications, collect data and conduct active operations against hostile activity, including the use of artificial-intelligence tools. The proposals still require parliamentary approval, so future investigative and oversight practice would depend on auditable authorisations, targeting records and technical logs capable of showing what systems were accessed, altered or disrupted and under whose authority (Source: Reuters, 12-08-2026)