Czech automation provider Apify said on 12 November that an intruder used a compromised credential to obtain further account credentials and access associated customer accounts following unauthorised entry to its internal systems earlier in the week. Its continuing investigation has led to customer notifications, internal secret rotation and precautionary OAuth revocations, while investigators must distinguish accounts demonstrably accessed from integrations disabled without evidence that those connections enabled the intrusion.

Singapore’s Agency for Integrated Care disclosed on 12 November that information relating to as many as 4,064 healthcare and community-care employees might have been accessed through its Advance Care Planning system, which was taken offline during investigation. The organisation said medical records and patient information were not indicated as compromised, leaving examination of access logs, compromised identities and the specific records viewed essential to establish the actual exposure rather than the possible maximum.

Romanian police arrested seven suspects on 12 November during searches supported by HM Revenue and Customs as investigators examined the phishing theft of UK tax professionals’ information and alleged fraudulent repayment claims. HMRC said related offending indicators extend to tax authorities in Ireland, Canada, Australia and New Zealand, making correlation of account access, communications, repayment applications and financial transfers important to demonstrating individual involvement across several national jurisdictions.

The US Justice Department announced on 12 November that investigators had seized cloud infrastructure associated with the alleged North Korean FaceStealer social-engineering operation and obtained court orders affecting cryptocurrency linked to another major theft investigation. Authorities describe tracing through wallets, exchanges and laundering services and say substantial assets have been restrained, but forensic attribution and recoverable proceeds require distinguishing government allegations, blockchain transaction evidence and final judicial determinations.

Microsoft investigated a widespread service disruption on 12 November affecting Exchange Online, Teams, SharePoint and other Microsoft 365 functions, with users across several regions reporting failed connections or degraded access. Reporting on the company’s service advisory attributed the incident to unexpected server unavailability and associated load on remaining systems, so this was an availability event rather than evidence of malicious intrusion, and precise service timelines remain important to affected organisations.

Reporting published on 11 November described a malware campaign in which compromised ScreenConnect environments at managed service providers were used to install unauthorised remote-access clients on customer devices in the United States and elsewhere. ConnectWise disabled several extensions as a precaution while Huntress reported six affected providers and hundreds of endpoints, figures that should be treated as observations at publication rather than a definitive count of compromises or a confirmed common entry route.

Check Point Research published an analysis on 12 November describing exploitation activity targeting a PHP-related weakness on Check Point gateway systems and examining the attacker behaviour observed during its investigation. The technical findings provide indicators and execution details for defenders to test against gateway evidence, although exposure of a vulnerable component alone does not establish that a particular organisation was breached and conclusions require examination of device-specific logs and artefacts.

Aikido reported on 12 November that attackers used stolen GitHub account credentials to submit probes to more than 61,000 repositories and inject workflows designed to extract build-system secrets and cloud credentials. Its research estimated thousands of compromised accounts but identified a smaller subset where malicious workflows actually executed, making the distinction between attempted repository access, successful workflow execution and verified credential exfiltration essential for accurate victim scoping and remediation.

Europol announced on 12 November that international partners had targeted the infrastructure supporting Gootloader, CastleRAT and StealC, taking action against 235 servers and 257 domains used in criminal malware distribution. The operation also secured victim datasets and created opportunities to correlate seized infrastructure, malicious delivery chains and affected systems, although infrastructure seizure does not itself establish that every identified individual or organisation experienced a completed compromise.

Europol reported on 12 November that authorities from 14 countries had arrested 354 suspected vendors and buyers after an international investigation into illicit activity associated with major dark-web marketplaces. The operation linked marketplace intelligence, searches and asset seizures across jurisdictions, but individual allegations remain subject to prosecution and investigators must preserve the chain of custody connecting seized devices, payment records and marketplace identities to each specific suspect.

Singapore’s Cyber Security Agency said on 13 November that the average monthly number of reported cyber incidents since September was three times the January to August average, prompting an advisory urging organisations to strengthen exposed systems. The agency cautioned that the observed incidents did not appear to constitute a coordinated campaign against Singapore, a distinction that matters when converting reporting trends into attribution, risk assessments and decisions about evidence retention.

Australian reporting on 12 November described the prudential regulator’s intention to introduce stress tests covering artificial-intelligence-related disruption risks for banks, insurers and superannuation institutions as frontier models become more capable. The proposed assessments concern preparedness and service continuity rather than a finding that particular institutions have suffered AI-enabled attacks, and their investigative value lies in defining the records, system dependencies and decision trails needed to explain any future incident.