This 48-hour roundup covers investigations into healthcare email compromise and cyber-enabled fraud, Norway’s government-service DDoS disruption, Nutex Health data exfiltration, actively exploited Gitea and macOS vulnerabilities, INTERPOL’s Operation Jackal IV arrests, and new guidance on agentic AI, privacy and runtime attestation. The focus remains on evidential integrity, traceability, attribution and cross-platform investigative readiness across sectors and jurisdictions for digital investigators.

French identity services faced potential data exposure, while New South Wales investigated unauthorised transfers of confidential Treasury files. Ukrainian police dismantled a Telegram bot farm supporting disinformation campaigns, and U.S. prosecutors secured guilty pleas in ransomware and phishing cases. Meanwhile, new .NET vulnerabilities and serial-to-IP device flaws highlighted ongoing exposure risks across connected infrastructure environments.

Vercel traced a customer-impacting breach to a compromised OAuth app, while investigators in India linked abusive Google Drive activity to specific IP records. Police dismantled mule-account fraud networks, and a Scattered Spider member entered a guilty plea. Meanwhile, Bluesky faced DDoS disruption and UK officials advanced board-level cyber-resilience expectations across major organisations nationwide.

UK NCSC urged organisations to tighten monitoring amid Middle East spillover risks, while Cloudflare reported session-token abuse. AkzoNobel confirmed a breach at a U.S. site after an extortion leak claim, and Russian government portals suffered a multi-vector DDoS. CISA warned VMware Aria Operations is being exploited, and California’s privacy regulator fined PlayOn Sports $1.1M. Supreme Court heard geofence warrant challenge.

Microsoft issued out-of-band Windows fixes for Outlook freezes and probed post-update boot failures as investigators tracked Cambodia-based scam networks repatriated to South Korea. ESET tied Sandworm to a DynoWiper power-sector attempt, while Fortinet and CISA warned on FortiCloud SSO abuse and exploited vCenter flaws. Policy moves spanned NHS supplier assurance, Australian smart-device rules, and Korean breach scrutiny in this window.