[AMER] Novocure said an investigation supported by independent forensic specialists found unauthorised access to some systems in mid-August, exposing internal patient identifiers for more than 1,400 US patients and additional identifying information for fewer than 50 others. Treatment devices were not accessed and operations were unaffected, giving investigators a bounded compromise scope while notification work continues and preserving an important distinction between exposed administrative records and clinical treatment infrastructure (Source: Reuters, 01-09-2026)

[EMEA] Attackers hijacked BGP routes serving Softaculous infrastructure and redirected Virtualizor update traffic to an attacker-controlled server, enabling a malicious update to reach a small number of installations during two diversion windows. Because those requests bypassed Softaculous logging, affected operators cannot rely on a definitive victim list and must correlate routing evidence, package artefacts, credentials, accounts and outbound connections to establish whether individual servers were compromised (Source: BleepingComputer, 01-09-2026)

[APAC] Mumbai Police arrested six people after tracing ₹33.25 lakh from a ₹74.26 lakh online investment fraud into an account tied to an alleged shell-company network operating from rented city offices. Investigators say recruits’ identity documents were used to register companies and open bank accounts, making corporate filings, KYC records, SIM data and transaction chains central to identifying controllers and mapping the wider laundering structure (Source: Mid-day, 01-09-2026)

[APAC] Authorities in Sihanoukville detained 37 people during a raid on a villa suspected of supporting online scam activity, seizing five desktop computers, 110 mobile phones and a vehicle for further examination. The device volume creates a substantial correlation task across subscriber identities, messaging accounts, financial records and victim communications, while immigration records and physical-location evidence may help investigators distinguish local operators from wider cross-border scam networks (Source: Agence Kampuchea Presse, 01-09-2026)

[AMER] Aesto Health’s breach notification expanded to 9,540,683 people after its investigation found personal and protected health information had been taken from portions of its AWS environment during December 2025. The revised scale follows forensic investigation and document review, illustrating how breach scope can change materially months after containment as investigators connect archived datasets, healthcare clients and affected individuals rather than treating an early estimate as final (Source: SecurityWeek, 01-09-2026)

[EMEA] Greek authorities are investigating a cyberattack on the State Legal Council after electronic files were reportedly stolen and attackers demanded a cryptocurrency ransom, amid a wider series of attacks on public bodies and companies. Available reporting does not establish the complete data scope or attacker identity, so investigators must separate confirmed system access and stolen-file evidence from extortion claims while correlating activity across other targeted institutions (Source: To Vima, 01-09-2026)

[GLOBAL] Threat actors are exploiting CVE-2026-0768 in Langflow, an unauthenticated remote-code-execution flaw, with observed probing seeking environment variables, administrative credentials, SSH access and cloud or OpenAI keys from exposed systems. Reported attack volume has risen quickly, but exploitation telemetry does not establish compromise of every reachable instance, so investigators should correlate vulnerable versions, process execution, secret access and outbound activity before concluding credentials were stolen (Source: BleepingComputer, 01-09-2026)

[AMER] Canada’s Cyber Centre warned that CVE-2026-82329 affects multiple JFrog Artifactory release branches and noted open-source reporting that the authentication-bypass vulnerability is being exploited in the wild. The flaw can lead to administrative access, making version evidence, authentication logs, newly created accounts and repository activity important investigative artefacts, while organisations should distinguish internet exposure from confirmed exploitation and apply available fixed releases (Source: Canadian Centre for Cyber Security, 01-09-2026)

[GLOBAL] Europol said an international operation led by US authorities disrupted the Sality peer-to-peer botnet, targeting infrastructure linked over its lifetime to more than 11 million unique IP addresses across multiple jurisdictions. The action combined domain measures, sinkholing, cyber-intelligence exchange and victim-notification support, providing investigators with a cross-border model for correlating malware infrastructure and infected hosts while avoiding the unsupported assumption that historical IP totals equal currently active infections (Source: Europol, 02-09-2026)

[AMER] US prosecutors unsealed an indictment against Russian national Searzhudin Aktulaev after his extradition from Cyprus, alleging a campaign that used fake freelance-platform accounts and malicious Excel attachments to distribute remote-access malware to thousands of users. Investigators linked command-and-control infrastructure, virtual-currency payments, victim callbacks and stored credentials to the alleged scheme, creating multiple evidential layers that can be tested against account, hosting and device records as the prosecution proceeds (Source: US Department of Justice, 01-09-2026)

[EMEA] Ireland’s Data Protection Commission fined the Health Service Executive €645,000 after an inquiry found serious deficiencies in the retention, security and governance of historical paper medical records stored at external facilities. The case began after unauthorised access at two disused psychiatric hospitals, demonstrating that evidential integrity and data-protection obligations extend beyond digital systems to physical records whose location, condition, access history and retention decisions must remain auditable (Source: Data Protection Commission, 02-09-2026)

[AMER] NIST opened a pre-draft call for comments on revising SP 800-213A, the IoT Device Cybersecurity Requirement Catalog used to support federal connected-device security requirements. The revision is intended to incorporate implementation lessons and align with Cybersecurity Framework 2.0 and the latest SP 800-53 revision, potentially changing the control baseline and documentary evidence organisations use when assessing IoT products, recording security decisions and demonstrating compliance (Source: NIST, 31-08-2026)