[APAC] Police trace fake Mahanagar Gas APK fraud — Kandivali police arrested three men after two Mumbai residents lost ₹6.25 lakh through a malicious APK sent under the guise of a Mahanagar Gas meter-reading request on 31 August. Investigators followed financial transactions to Olpad in Gujarat, linking stolen funds to repayment of a gold loan and recovery of pledged jewellery, creating a clear device-to-payment evidential trail. (Source: Hindustan Times, 31-08-2026)

[AMER] DOJ narrows QTFY victim claims after review — The US Justice Department updated its QTFY disruption release on 28 August, changing references to the Senate, Federal Reserve, NASA and others from confirmed victims to targets after checking the supporting seizure affidavit. The distinction materially narrows verified compromise scope, while the affidavit still documents successful intrusions at three Energy Department laboratories, NIH and an HHS agency, preserving a more defensible attribution baseline. (Source: Department of Justice, 28-08-2026)

[APAC] Bharatpur police trace 165-day digital arrest — Bharatpur Cyber Police arrested a 35-year-old man accused of keeping a retired education officer under a “digital arrest” for 165 days and inducing transfers totalling ₹66 lakh. A special team traced bank transactions and call records to an account opened for a purported construction firm, where police say ₹22 lakh was withdrawn, while three earlier arrests indicate investigators are still mapping the wider network. (Source: Times of India, 30-08-2026)

[APAC] Haryana police arrest reward-points fraud suspect — Haryana Police arrested a 28-year-old suspect at Delhi’s IGI Airport after a Lookout Circular linked him to a Faridabad case in which a victim lost ₹221,501 through a WhatsApp reward-points phishing link. Investigators say stolen card details were used to buy mobile phones that were sold through an identified shopkeeper, while the suspect is also being examined in connection with other cybercrime complaints. (Source: United News of India, 30-08-2026)

[AMER] Hasbro notifies employees after data exposure — Hasbro is notifying current and former employees that personal information may have been accessed during a cyber incident, with a Massachusetts filing identifying 436 affected residents and data potentially including national identifiers and financial information. The company has not confirmed whether the notification is linked to its March cyberattack, and says it is not aware of misuse, leaving total victim scope and incident linkage unresolved. (Source: SecurityWeek, 29-08-2026)

[EMEA] Berlin refuses ransom as data scope remains under review — Berlin authorities said they would not pay an extortion demand following an attack on the city-state network, while the Rhysida ransomware group claimed it had stolen 5.79 terabytes of data. Police and prosecutors are investigating, election systems were reported unaffected, and the city said the full extent of any data theft was still being assessed, so the attacker’s volume claim remains unverified. (Source: Reuters, 28-08-2026)

[GLOBAL] PaperCut flaws gain exploitation details and IOCs — New reporting on exploited PaperCut vulnerabilities CVE-2026-82078 and CVE-2026-81578 describes an unauthenticated chain that can bypass authentication, alter configuration and lead to remote code execution, prompting a second emergency patch. Updated technical information identifies post-compromise artefacts and command activity that investigators can use to hunt for exploitation while distinguishing vulnerable exposure from confirmed compromise. (Source: SecurityWeek, 31-08-2026)

[GLOBAL] MyHome Core flaw enables account takeover — CVE-2026-15980 in MyHome Core versions through 4.4.5 can allow unauthenticated attackers to generate an activation token and obtain a valid authentication cookie for an unconfirmed account, potentially including an administrator. The reported exploit path depends on specific site conditions, including legacy theme mode, enabled frontend registration and an account not already marked confirmed, giving investigators concrete prerequisites to test before asserting exposure. (Source: Security Intel Hub, 30-08-2026)

[APAC] Panjim police arrest suspect in UPI theft — Panjim Police arrested a Kerala man accused of hacking a Panaji resident’s mobile phone and transferring ₹7.54 lakh through multiple unauthorised UPI transactions. The case is being investigated under theft and cheating provisions, and police say further examination is aimed at establishing how the phone was compromised and whether other people were involved, leaving the intrusion method and wider network unresolved. (Source: Herald Goa, 31-08-2026)

[APAC] Mumbai police arrest two over USDT fraud — Andheri Police arrested two men accused of cheating a 42-year-old stock-market professional of ₹19.78 lakh after offering USDT cryptocurrency from Dubai at a price below the prevailing market rate. Police say investigators traced the suspects and set a trap before the arrests, while the alleged use of cryptocurrency trading as the lure creates a financial-evidence trail requiring correlation between communications, payments and account ownership. (Source: Mid-day, 31-08-2026)

[GLOBAL] FSB flags frontier AI cyber risk to G20 — Financial Stability Board chair Andrew Bailey told G20 finance ministers and central bank governors that the most immediate concern from frontier artificial intelligence for the financial system is cyber risk. The letter warns that AI could change the speed, scale and economics of attacks, and calls for safe model deployment alongside response, recovery and critical third-party resilience, making evidential visibility across dependent services increasingly important. (Source: Financial Stability Board, 31-08-2026)

[EMEA] UK cyber bill enters Lords committee stage — The Cyber Security and Resilience Bill is moving into detailed House of Lords committee examination, with the first sitting scheduled for 1 September and amendments covering data-centre incidents, scope and senior-executive accountability. The legislation is intended to strengthen protection of essential services including healthcare, water and energy, and the amendment process will determine which organisations and incidents fall within future reporting and governance duties. (Source: UK Parliament, 28-08-2026)