[EMEA] Metropolitan Police said a Wembley drug dealer was identified after investigators correlated seized phones with a public Wi-Fi connection that exposed his location despite his use of VPNs, leading to his arrest and a 12-year sentence. Subsequent phone analysis linked the “Bobby” line to nearly 250 contacts and more than 100 calls daily, illustrating how network artefacts and device evidence can converge to defeat location-concealment measures (Source: Metropolitan Police, 11-09-2026).

[APAC] Kochi Metro Police opened an investigation after Kochi Metro Rail Limited alleged unauthorised access to corporate systems, compromise of an IT email account and unlawful logins to desktops and mobile phones, followed by circulation of confidential documents online. The FIR says employee personal data and company financial information were exposed, leaving investigators to reconstruct access paths, account misuse and the provenance of material posted to social platforms (Source: ThePrint, 14-09-2026).

[APAC] Delhi Police arrested three people in Kolkata during an investigation into a suspected multi-state cybercrime racket, recovering eight point-of-sale machines, 62 ATM cards, 14 mobile phones and 10 SIM cards. Investigators are examining whether the seized payment infrastructure and communications devices connect the suspects to a wider organised-fraud network, making transaction records, device associations and SIM-account linkages central to establishing roles and money flows (Source: The Statesman, 12-09-2026).

[APAC] Mumbai Crime Branch arrested three suspects in an alleged cyber-fraud network after tracing bank accounts and SIM cards connected with large transaction volumes, seizing hundreds of ATM cards, cheque books, passbooks, phones and other electronic evidence. Investigators are following financial and technical trails across accounts, mobile numbers and complaint records to determine beneficiaries, link suspected mule infrastructure to specific frauds and establish whether the network extends beyond Maharashtra (Source: Free Press Journal, 12-09-2026).

[EMEA] Revolut confirmed that sensitive customer information was disclosed to an unauthorised party after fraudulent requests appeared to originate from the legitimate email domain of a government agency, while saying its systems and customer funds were not compromised. The fintech has notified the relevant agency, law-enforcement and regulatory bodies, and the investigation now centres on how trusted-channel impersonation bypassed disclosure controls and what customer records were exposed (Source: Reuters, 12-09-2026).

[EMEA] South African investment platform EasyEquities notified customers that a third-party verification provider had suffered a cybersecurity incident that may have affected customer information used during regulatory identity checks. The provider has begun a forensic investigation while EasyEquities says it has carried out internal security checks, leaving the scope, affected data fields and exposure pathway to be established before the incident’s customer and evidential impact can be fully assessed (Source: MyBroadband, 12-09-2026).

[AMER] Researchers reported that the BlueMoon exploit kit chained two recently patched Chrome V8 vulnerabilities with a Windows privilege-escalation flaw and was used by several espionage-focused groups, including against US NGOs and aerospace organisations. Proofpoint’s attribution and AI-development observations remain research assessments rather than independently proven facts, but the shared exploit chain provides investigators with common vulnerability, execution and post-compromise artefacts for correlating activity across otherwise distinct campaigns (Source: SecurityWeek, 12-09-2026).

[EMEA] The Debian Project released Debian 13.7, the seventh update to the stable “trixie” distribution, incorporating corrections for security issues alongside fixes for serious software problems already covered by published advisories. For investigators and defenders, the consolidated package changes provide a defined baseline for distinguishing patched from exposed systems, while retained advisory references support timeline reconstruction when determining whether a vulnerable component could have been exploited before remediation (Source: Debian Project, 12-09-2026).

[AMER] Six Nigerian nationals accused of participating in Black Axe-linked online romance fraud were extradited from South Africa to the United States to face wire-fraud and money-laundering charges over alleged losses exceeding $6 million. Authorities say more than 100 US women were targeted, making cross-border account records, communications, identity evidence and financial transfers central to proving individual participation while the allegations remain subject to US court proceedings (Source: The Guardian, 12-09-2026).

[APAC] Police in Durgapur arrested 10 people during coordinated raids targeting an alleged organised cyber-fraud operation, seizing laptops, mobile phones, bank passbooks and other documents from several locations and hotels. Investigators will need to associate the recovered devices, financial records and user accounts with specific transactions and victims, while preserving attribution between shared infrastructure and individual suspects as the wider structure and operating methods of the alleged network are examined (Source: The Statesman, 12-09-2026).

[EMEA] European Union Cyber Resilience Act reporting obligations took effect on 11 September, requiring manufacturers to notify actively exploited vulnerabilities and severe product-security incidents through ENISA’s Single Reporting Platform, beginning with an early warning within 24 hours and fuller notification within 72 hours. The regime creates new timestamped regulatory evidence around exploitation awareness, incident discovery and corrective action, giving investigators an additional chronology to compare with technical logs, vendor records and disclosure decisions (Source: European Commission, 11-09-2026).

[EMEA] ENISA published its new agency strategy on 12 September, setting seven objectives spanning cyber-policy implementation, Union preparedness, cybersecurity capacity, emerging-threat foresight, knowledge sharing and trust in secure digital solutions. The strategy places coordinated preparedness and common cybersecurity capability alongside policy delivery, providing investigators with useful context for how European institutions expect evidence, threat knowledge and operational learning to move between national authorities, private organisations and cross-border cyber communities (Source: ENISA, 12-09-2026).