Weekly Cyber Briefing 14.08.2026
The ICO reprimands ACRO for a historic CMS breach; US authorities investigate a mid-air Wi-Fi incident; the Polish CERT releases details on an energy plant attack; hackers scrape data from Salesforce and ServiceNow customers; and logistics firms Uber Freight and Ceva Logistics are breached.
The UK’s data protection watchdog has reprimanded the country’s Criminal Records Office (ACRO) after a 2023 incident which stemmed from multiple security failings. Between August 2022 and March 2023, a hacker gained unauthorised access to ACRO’s website and CMS, potentially exfiltrating documents on over 10,000 people. These included highly sensitive personal and financial information, such as data related to International Child Protection Certificates, and victims of domestic violence. ACRO’s customer-facing portal was left unpatched for four years before the breach.
ACRO’s failings were twofold. Although its web development supplier was responsible for applying patches to the CMS, ACRO was responsible for identifying when patches were required. Second, although ACRO had security in place to “detect and quarantine malware”, it didn’t act on alerts, which could have prevented further malicious activity.
Define who is responsible for identifying, assessing and deploying patches across all systems. Ensure security alerts are actively monitored. Put patch and vulnerability management programmes and regular security testing in place.
Authorities in the US are investigating an unauthorised Wi-Fi network that appeared on a Delta flight returning from the DEF CON hacking conference. Passenger safety was not affected. However, reports suggest some people on the plane launched a Wi-Fi deauthentication attack mid-flight, disconnecting others from the aircraft’s in-flight network. There are claims a rogue network subsequently appeared which took users to a phishing page designed to harvest credentials.
This is a reminder of the risks of “evil twin” Wi-Fi attacks in public spaces designed to steal logins/sessions and install malware. The risk is especially acute where there is a captive audience, as there is on board an aircraft.
Revisit corporate Wi-Fi policies for business travellers. The default should always be to connect via mobile broadband. And to always use a corporate VPN/ZTNA product if using public Wi-Fi. Update wireless configuration for corporate devices via MDM (eg disable auto-join for unknown networks). Ensure all devices have phishing-resistant MFA.
CERT.PL has released details on another Russian attack on a combined heat-and-power (CHP) plant, which took place during a major campaign against the country’s energy infrastructure in December 2025. The report details a series of novel techniques which enabled attackers to switch three Siemens programmable logic controllers (PLCs) to STOP mode. This caused a temporary outage at the plant, which serves 50,000 residents.
The attackers compromised a FortiGate VPN + firewall, then used a Teltonika router on the same network to target a private APN network via an SSH tunnel. They scanned the APN repeatedly and found a WAGO PFC200 programmable logic controller (PLC) at the CHP plant. Its web interface was accessible and protected only by default admin credentials. They pivoted from here to the OT network before finding the Siemens PLCs.
The report is useful reading for OT and IT security bosses at industrial facilities. Segmentation between the APN network and other facilities failed. Supply chain components were not properly vetted/secured. And basic credential hygiene was missing.
Map potential attack paths from edge devices to OT networks and PLC/SCADA endpoints. Audit private APN configurations and treat them as untrusted with respect to the OT environment. Monitor comms between the OT network and private APNs, and limit communications. Eliminate default OT credentials and remove unnecessary services (eg exposed SSH and Telnet admin services). Run penetration tests and reviews on private APNs and the devices that connect to them.
An ongoing data theft campaign tracked as City-Forum has been systematically extracting data from misconfigured Salesforce Experience Cloud and ServiceNow portals since at least March 2025, according to Reco. Salesforce Experience Cloud and ServiceNow use guest accounts to give unauthenticated visitors access to specific portal functions. The City-Forum actor has built custom tooling to exploit a misconfiguration where organisations have not correctly restricted what anonymous users can query. All confirmed activity originates from a single IP address hosted by a German VPS provider and uses the default Go-http-client/1.1 user agent, rather than browser traffic.
Telecommunications companies, financial services firms, enterprise software vendors, security companies and public-sector portals are among the identified victims so far. The campaign is ongoing, and activity is increasing, putting highly sensitive enterprise data at risk.
For Salesforce customers, audit guest profile permissions, disable API access for guest users, and check the guest user profile does not have the “API Enabled” permission set. For ServiceNow customers, review which search sources are accessible through Service Portals and ensure anything sensitive requires authentication. Reco recommends checking logs for the source IP 158.220.87.79 and the Go-http-client/1.1 user agent as immediate indicators.
A data breach impacting logistics giant Ceva Logistics has impacted countless clients across Europe. A few days later, the extortion group Helix claimed responsibility for a similar breach targeting Uber Freight. Initial access methods have not been disclosed in either case, but the Ceva incident affected eight warehouses. Stolen client data includes names, postal addresses, phone numbers, email addresses and order details. Impacted clients include Valve, Bol, De Bijenkorf, Ajax, ING and Ace & Tate. Helix claims to have stolen nearly one million files from employee mailboxes, OneDrive accounts, accounts receivable systems and other repositories. Google links the group to UNC6671, whose operators typically use voice phishing.
Why it matters
Logistics providers are an increasingly popular target given their large number of corporate clients and the sensitive information they manage. Invoices, payment instructions, customer identities, and shipment details stolen from Ceva and Uber Freight could be reused to execute convincing payment-diversion (BEC) attacks. The breaches are also causing operational problems (eg delayed shipments) for clients.
Assured’s recommended action
Security teams should review unusual device-code authorisations, new OAuth grants, suspicious Microsoft 365 sessions, bulk OneDrive downloads and helpdesk-led credential resets. Finance teams should independently verify any request to change supplier banking details, particularly when it references genuine shipment or invoice information.
Features 11.08.2026
A massive credential exposure highlights a wider perimeter security failure
Weekly Cyber Briefing 07.08.2026
Hackers exploit N-central vulnerability; ChainDrop worm wreaks havoc across the software supply chain; prompt injection remains the biggest LLM risk; and utilities come under attack from Iran.
Weekly Cyber Briefing 31.07.2026
Russian hackers target hotel and conference centre Wi-Fi; Cl0p is back with another extortion campaign; OpenAI and Anthropic models go rogue; and the Health-ISAC warns of intensifying Shiny Hunters campaigns.