BleepingComputer (15 September 2026) reports Houston-based utility CenterPoint Energy confirmed in an SEC filing that an unauthorized third party obtained personal information for a portion of its customers through an external-facing system. A threat actor alias “4d722e4d656f77” told BleepingComputer they exfiltrated about 7.49 million customer records (names, phones, service/billing addresses, account numbers, billing amounts, partial SSNs) by iterating IDs on a public API alleged to lack rate limiting/WAF. CenterPoint says electric and gas services were not impacted and does not expect a material business effect; it activated IR, engaged third-party experts, hardened systems, and notified law enforcement/regulators. Class-action complaints filed in US federal courts allege the incident window was about 17 August–1 September 2026. Company has not publicly matched the actor’s record count or data-type claims in the SEC text cited by the wire. Primary wire: BleepingComputer; company confirmation: SEC filing as cited there.
BleepingComputer — CenterPoint Energy confirms customer data stolen (15 Sep 2026)
breaches ot ics
BleepingComputer (15 September 2026) reports five alleged leaders of the Black Axe cybercrime syndicate — Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru — were extradited to the United States to face wire fraud and money-laundering charges. Prosecutors allege a Cape Town–based internet fraud campaign (about 2011–2021) using romance and advance-fee scams, aliases, dating sites, and VoIP numbers to target US victims, including coercion via threats to publish sensitive photos. US Attorney’s Office for the District of New Jersey press release linked from the wire: “Five Prominent Black Axe Members Extradited for Conspiring to Engage in Internet Scams and Money Laundering.” Law-enforcement action / charging story; not a fresh organisational data-breach notice. Primary: DOJ USAO-NJ PR; wire: BleepingComputer.
DOJ USAO-NJ — Black Axe members extradited (linked 15 Sep 2026 wire)
breaches
Spain’s Agencia Española de Protección de Datos (AEPD) blog (14 September 2026; Francisco Pérez Bes) reports the agency’s first notification of a personal-data breach in which the incident was allegedly executed by an AI agent using a known large language model. Per the notifier: the agent searched generic files for vulnerabilities, successfully logged in, then autonomously hunted application flaws, modified personal data, and accessed invoices. AEPD stresses the claim is from the organisation’s notification and still requires analysis; use of a given model does not imply the provider’s model or infrastructure was compromised or purpose-built for crime. Framing: shift from AI-assisted attacker tools (phishing copy, vuln search) toward agentic chaining of attack phases at machine speed — with implications for identity/credential controls, detection, and response timing. National Cryptologic Center (CCN) paradigm-shift context noted in wire coverage. Primary: AEPD blog; secondary: BleepingComputer 16 Sep 2026.
AEPD — primera notificación brecha por agente de IA (14 Sep 2026)
ai identity
Brevo status write-up (and BleepingComputer 17 September 2026) confirms that on 14 September 2026 an attacker used a compromised long-lived Cloudflare API key (hardcoded in Brevo application source; first misuse indicated late August) to deploy a Cloudflare Worker that rewrote responses at the CDN edge for about five and a half hours (approx. 16:07–20:30 UTC). Affected: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com, plus Brevo forms script, Conversations widget, and SDK loader that customers embed. The Worker stripped CSP and served a fake Cloudflare “verify you are human” ClickFix lure (Win+R / Ctrl+V / Enter) downloading malware on Windows; on WordPress sites with a logged-in admin, Sansec/Bleeping also report attempted silent install of a malicious “Web Media Optimizer” plugin backdoor. Not affected per Brevo: app.brevo.com, API, email delivery, and customer account data held in Brevo. Remediation: Worker/routes/hostnames removed, key revoked, hardcoded credential removed, Vault + Cloudflare audit alerting planned. Distinct from Brevo’s earlier 9–10 September SSO boundary incident (Trezor phishing wave). Primary: Brevo status write-up; wire: BleepingComputer; Sansec first flagged customer-site impact (up to ~100k sites cited).
Brevo status — Cloudflare Worker ClickFix write-up (14 Sep 2026 incident)
breaches cloud
Spain's Agencia Española de Protección de Datos (AEPD) blog (14 September 2026; wired by BleepingComputer and SecurityWeek 16 September) says it received the first notification of a personal-data breach in which the incident was allegedly executed by an AI agent using a known large language model. Per the affected organisation's notification (not yet independently verified by AEPD): the agent searched generic files for flaws, completed a successful login, then autonomously probed the application, modified personal data, and accessed invoices. AEPD stresses the report is from the notifier and must be analysed; use of a named model does not imply the model provider was compromised or that the tool was purpose-built for crime. Relevance for defenders: treat agentic chaining (goal → tools → adapt) as a qualitative speed/scale shift for risk analysis, credential/API hygiene, and detection/containment timing — not only for Spanish controllers. Primary: AEPD blog; wires: BleepingComputer, SecurityWeek.
AEPD — first notified breach allegedly via AI agent (14 Sep 2026)
ai identity
Ransomware.live’s Australia country feed lists Sydney-based hardware conglomerate Alchin Long Group (alchinlong.com; Doric/Cowdroy/Colonial Castings and related brands) under the The Gentlemen brand — published 14 September 2026, discovered 15 September 2026 on the feed. No company statement, OAIC notice, Webber Insurance list entry, or ACSC advisory was located on this 16 September 2026 desk pass, so treat the listing as an unconfirmed extortion claim until a primary notice appears. Distinct from desk card sharp-office-thegentlemen-20260907 (same brand, different victim). Australian manufacturers and hardware suppliers should verify backups, MFA, and remote-access exposure.
Ransomware.live Australia (Alchin Long Group / The Gentlemen; discovered 15 Sep 2026)
australia
Cyber Daily (14 September 2026) reports Victorian dealership Penfold Motors (Peter Warren Automotive Group; six Vic sites) is contacting customers after Storm ransomware operators listed the firm (listing dated 17 August; early leak post mis-attributed a similarly named UK organisation before correction). Company statement dated 7 September: contained incident involving an external software provider that stored some Penfold data; systems restored and dealerships operating; investigation with the provider and forensic specialists ongoing. Impact described as basic contact details plus vehicle and servicing information (VINs and tax invoices appeared in published samples per Cyber Daily); Penfold said there was no evidence identity documents or bank-account data were involved, and that it notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner. Cyber Daily also notes Sharp Motor Group and Macquarrie as other recent Australian automotive/machinery victims tied to third-party supplier incidents in the same Storm wave (Macquarrie desk card updated separately). UPDATE 15 Sep 2026: Cyber Daily names Auto-IT as that third-party software firm (see auto-it-storm-20260915). Primary: Cyber Daily exclusive with company quotes.
Cyber Daily — Penfold Motors / Storm (14 Sep 2026)
breaches australia
BleepingComputer (14 September 2026) reports that the verified Reddit account u/hbomax was hijacked and used to run about 108 malicious advertisements over roughly 48 hours. Ads used ClickFix social engineering (victims paste commands into Windows Run/PowerShell or macOS Terminal) and redirected to lookalike sites (including hbomaxx[.]us). Hudson Rock and ADAMnetworks link the activity to a broader campaign they call PasteSwitch delivering information stealers, loaders, crypto clippers, and fake wallets on Windows and macOS; one macOS chain referenced “AMOS helper” persistence under a .com.apple.accountsd-style directory. Some ads impersonated HBO Max; others pushed fake AI/developer/macOS utilities. BleepingComputer said HBO / Warner Bros. Discovery had not responded at publication. Distinct from prior desk ClickFix/EtherHiding cards. Primary/wire: BleepingComputer.
BleepingComputer — HBO Max Reddit ClickFix (14 Sep 2026)
breaches identity
Hunt.io (14 September 2026; The Hacker News same day) describes an intrusion against 3BB, a major Thai broadband provider. Researchers captured an attacker-operated server still live on 3 June 2026 that held tooling run from inside 3BB’s network, a MeshCentral deployment reporting to www.ayuthayatech[.]com under device group TH-3BB (agents with root), cleanup scripts that preserved MeshCentral, SSH password spraying against 55+ internal hosts, probes of agent.3bb.co[.]th, and scripts aimed at copying RADIUS subscriber credential databases (targeted; Hunt.io does not state confirmed exfiltration). The same cache held a complete exploit for FortiGate SSL-VPN CVE-2024-21762 aimed at mail.3bb.co[.]th and a valid 3BB VPN certificate plus Jasmine-network sessions (shared infrastructure; Jasmine breach not confirmed). Primary: Hunt.io; secondary: THN.
Hunt.io — 3BB FortiGate / MeshCentral intrusion (14 Sep 2026)
breaches network identity
SecurityWeek (14 September 2026) reports Telus is notifying some Canadian consumer telecom customers that attackers accessed their accounts between February 2025 and June 2026 using compromised credentials. Accessed data included names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. Telus says the stolen account information was used to push customers toward competitors and, in some cases, to make unauthorised service changes. Impacted credentials were reset and enhanced monitoring applied; Vancouver Police were notified and complimentary identity-theft protection offered. Headcount and exact credential source were not published; the description is consistent with credential stuffing or other account takeover using third-party credentials, which Telus has not explicitly confirmed. Distinct from the March Telus Digital / ShinyHunters incident. Primary/wire: SecurityWeek pending a public Telus notice URL.
SecurityWeek — Telus account breaches (14 Sep 2026)
breaches identity
TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain. SecurityWeek (17 September 2026) adds quantified scope: attackers impersonated an Italian government agency for about five months, obtained data from roughly 680 high-profile accounts, and are demanding a $3 million ransom. A Revolut spokesperson described a sophisticated external impersonation scam; the company blocked the mailbox, alerted the agency, law enforcement and regulators, and said systems and customer funds were unaffected. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity). Primary: TechCrunch with Revolut confirmation; NEW scope wire: SecurityWeek 17 Sep; secondary: BleepingComputer 14 Sep; not a core-system compromise.
TechCrunch — Revolut fake government-request disclosure (12 Sep 2026)
breaches identity
Japan's Digital Agency (news 11 September 2026; English wire coverage 14 September) says unauthorised access to Government Solution Service (GSS) may have exposed about 246,000 personal-information records. Detection on 25 June 2026 (large-scale file access via a maintenance/operations account); on 9 July investigators found a third party had used a vulnerability in a network-connected VPN device to enter the system. That day the agency suspended the account and cut external communication from the compromised equipment. Possible leaked fields include names, email addresses, phone numbers, and addresses of GSS-using agency staff, associated public officials, and contractors/individuals who worked with those agencies. Agency says My Number, bank accounts, and pension numbers were not in the exposed set; no secondary misuse confirmed at publication. Q&A: vulnerability was previously published (not a zero-day) with a medium CVSS rating; product/CVE withheld for security. Primary: Digital Agency notice; secondary: BleepingComputer.
Digital Agency (Japan) — GSS unauthorised access / possible personal information leak (11 Sep 2026)
breaches identity network
