[AMER] Thomson Reuters said an investigation found an unauthorised party accessed files in its C-Track court case-management environment, affecting appellate court records across multiple US jurisdictions and Ontario after activity detected on 30 June. External specialists and law enforcement are involved, while investigators and affected courts must distinguish exposed personal identifiers from publicly available court material and preserve cloud, access and notification records needed to establish the precise scope. (Source: Reuters, 03-09-2026)

[EMEA] Serbia’s SHARE Foundation reported that at least 14 civil-society figures received mercenary-spyware targeting warnings, with forensic work confirming Pegasus on one examined device and a NoviSpy variant on two others. The findings support specific device compromises but do not establish who ordered the surveillance, making exploit artefacts, infection timelines, Apple notifications and device-level forensic evidence critical to separating verified compromise from unresolved attribution claims. (Source: SHARE Foundation, 02-09-2026)

[AMER] The FBI opened an investigation after a dark-web service advertised more than 153 million US and Canadian driver-licence scans and other identity documents, with journalist Brian Krebs verifying several records including his own. The dataset’s source remains unconfirmed despite reporting that points towards an identity-verification provider, so investigators must correlate scan timestamps, customer transactions, provider logs and marketplace evidence before attributing the apparent continuing exposure to any organisation. (Source: Reuters, 02-09-2026)

[APAC] Singapore Police said Cyber Command and digital-payment-token providers used blockchain analysis during a July-August operation to identify more than 355 scam victims and prevent over S$8.94 million in potential losses. Investigators shared derived cryptocurrency intelligence with the FBI and New South Wales Police, illustrating how wallet tracing, customer records and cross-border referrals can connect victims and transactions while allowing intervention before suspected scam proceeds move further through the ecosystem. (Source: Singapore Police Force, 03-09-2026)

[EMEA] Swedish IT reseller Dustin identified unauthorised access to some internal systems and temporarily shut down parts of its environment, with the incident reported by Swedish financial outlet EFN on 3 September. External cybersecurity specialists were assisting the investigation, while the disclosed information left the intrusion route and data exposure unresolved, making identity, endpoint and network evidence central to establishing scope as systems are restored. (Source: EFN, 03-09-2026)

[AMER] US law firms Quinn Emanuel and McDermott disclosed separate breaches in which social engineering compromised a single user account at each firm and exposed files containing sensitive client or personal information. Both organisations involved cybersecurity specialists and notified law enforcement, making account activity, authentication records, accessed document sets and attacker communications central to establishing whether the incidents were narrowly contained or connected to wider targeting of legal-sector data. (Source: Reuters, 03-09-2026)

[APAC] Australia’s Cyber Security Centre issued a critical alert covering two Citrix NetScaler ADC and Gateway vulnerabilities, CVE-2026-19489 and CVE-2026-19490, after patches had been released on 19 August. The flaws depend on particular SIP ALG, SAML or VPN configurations, so investigation should first establish affected versions and enabled features, then examine authentication, configuration and network telemetry for evidence of abuse rather than treating product presence alone as proof of compromise. (Source: Australian Cyber Security Centre, 04-09-2026)

[EMEA] CERT-EU’s September Cyber Brief said its analysts reviewed 385 open-source reports for August, highlighting Russia-linked spearphishing, North Korea-linked activity, mercenary spyware notifications and a typosquatted Rust dependency among notable developments. Because the brief aggregates reporting rather than independently proving every underlying claim, investigators should use it to prioritise hypotheses and indicators while returning to primary telemetry, original advisories and case-specific evidence before drawing attribution or compromise conclusions. (Source: CERT-EU, 03-09-2026)

[APAC] Singapore Police said a 29-year-old Vietnamese man was due to be charged on 4 September after Cyber Command and immigration authorities identified him during an investigation into a government-official impersonation scam involving S$20,000 of jewellery. Police suspect he collected valuables for a transnational scam syndicate, leaving call records, identity data, movement evidence, victim communications and links to other participants as important material for testing that alleged role. (Source: Singapore Police Force, 03-09-2026)

[AMER] US prosecutors announced a federal indictment of a New Hampshire man on two possession charges after an FBI investigation linked a peer-to-peer file-sharing computer to an IP address registered at his home and a subsequent search. The case illustrates the evidential chain required when network observations lead to a physical device, including attribution of an IP address, lawful seizure, forensic examination and preservation of records that support or challenge the charging allegations. (Source: US Department of Justice, 03-09-2026)

[EMEA] The UK House of Lords completed the second day of committee scrutiny of the Cyber Security and Resilience Bill on 3 September, examining proposed changes to incident definitions and reporting duties for regulated organisations. The legislative detail matters to investigative readiness because future thresholds and notification rules will influence when evidence must be preserved, escalated and disclosed, placing greater importance on documented timelines, defensible incident classification and auditable records of decision-making. (Source: UK Parliament, 03-09-2026)

[AMER] NIST released draft SP 800-38E Revision 1 for public comment, updating the approved use of XTS-AES for storage confidentiality to reference IEEE 1619-2025 and clarify data-unit, key-scope and key-management requirements. For forensic and compliance work, clearer cryptographic boundaries help investigators interpret whether stored evidence was protected as claimed, while reinforcing the need to document encryption configuration and key handling separately from assumptions about data authenticity or provenance. (Source: NIST, 03-09-2026)