DDoS: US DoJ disrupts Aisuru, Kimwolf, JackSkid and Mossad IoT botnets — 3M+ hijacked devices behind record ~30 Tbps attacks (DoJ, Mar 2026) DDoS: Record 31.4 Tbps hyper-volumetric attack lasted just 35 seconds — Aisuru-Kimwolf botnet of hijacked Android TVs and home routers (Cloudflare) DDoS: Operation PowerOFF sweep seizes 53 booter services and 3M user accounts — DDoS-for-hire under sustained law-enforcement pressure (Europol, Apr 2026) Ransomware: Operation KillSwitch — KillSec leak site seized with 110+ TB of data; 3 arrests across 4 European countries; ~1,000 attacks attributed (Europol, 30 Sep 2026) OT Security: Colorado water utilities hit — attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles (SecurityWeek, 21 Sep 2026) Maritime OT: US Coast Guard and FBI board oil tankers after confirmed malicious cyber activity on VL Prosperity (Sep 2026) OT Security: Only 13% of OT network segments fully isolated; just 21% of industrial security leaders hold a complete OT asset inventory (Forescout / Honeywell, Sep 2026) ICS Patch Tuesday: Siemens, Schneider Electric, AVEVA and Rockwell Automation fix critical industrial control system flaws (Sep 2026) OT Guidance: NIST operational technology security guide Rev. 4 draft open for public comment until 30 Nov 2026; CISA/FBI issue advice on ICS integrators (Sep 2026) AI Security: OpenAI pauses GPT-6.1 release after the model continued tasks without user approval and used tools beyond its intended scope (Sep 2026) AI Security: Agentic AI is the new insider threat — prompt injection, over-permissioned agent identities and unsanctioned tool access top 2026 risk registers (KuppingerCole, 2026) IT Security: Warlock threat actor exploiting on-premises SharePoint against utilities and universities in Portuguese- and Spanish-speaking countries (Sep 2026) Data Breach: US Defense Manpower Data Center exposure — SSNs and service details of 2.76M living and 294K deceased individuals (30 Sep 2026) Data Breach: IDScan — driver's licences, government IDs and photos of 150M+ people stolen from cloud systems (10 Sep 2026) Critical Infrastructure: CenterPoint Energy — 7.49M utility customers' SSNs and account data allegedly stolen (16 Sep 2026) Legal · EU Cyber Resilience Act: actively exploited vulnerability and severe incident reporting mandatory since 11 Sep 2026 via ENISA Single Reporting Platform; full requirements apply 11 Dec 2027 (ENISA) Legal · EU AI Act: Digital Omnibus moves Annex III high-risk AI deadline to 2 Dec 2027 and Annex I (regulated products) to 2 Aug 2028 (European Parliament / Council, Jun 2026) Legal · NIS2: Germany's BSI in active supervision of ~29,000 entities; Dutch Cyberbeveiligingswet in force 15 Aug 2026; Ireland, Spain and France referred over late transposition (Jul 2026) Legal · UK: Cyber Security and Resilience Bill progressing through the Lords — brings managed service providers and data centres into NIS scope for the first time (2026) 900 Peer-reviewed governance frameworks · Retained across Tier-1 boards · Contract-winning evidence chains
DDoS: US DoJ disrupts Aisuru, Kimwolf, JackSkid and Mossad IoT botnets — 3M+ hijacked devices behind record ~30 Tbps attacks (DoJ, Mar 2026) DDoS: Record 31.4 Tbps hyper-volumetric attack lasted just 35 seconds — Aisuru-Kimwolf botnet of hijacked Android TVs and home routers (Cloudflare) DDoS: Operation PowerOFF sweep seizes 53 booter services and 3M user accounts — DDoS-for-hire under sustained law-enforcement pressure (Europol, Apr 2026) Ransomware: Operation KillSwitch — KillSec leak site seized with 110+ TB of data; 3 arrests across 4 European countries; ~1,000 attacks attributed (Europol, 30 Sep 2026) OT Security: Colorado water utilities hit — attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles (SecurityWeek, 21 Sep 2026) Maritime OT: US Coast Guard and FBI board oil tankers after confirmed malicious cyber activity on VL Prosperity (Sep 2026) OT Security: Only 13% of OT network segments fully isolated; just 21% of industrial security leaders hold a complete OT asset inventory (Forescout / Honeywell, Sep 2026) ICS Patch Tuesday: Siemens, Schneider Electric, AVEVA and Rockwell Automation fix critical industrial control system flaws (Sep 2026) OT Guidance: NIST operational technology security guide Rev. 4 draft open for public comment until 30 Nov 2026; CISA/FBI issue advice on ICS integrators (Sep 2026) AI Security: OpenAI pauses GPT-6.1 release after the model continued tasks without user approval and used tools beyond its intended scope (Sep 2026) AI Security: Agentic AI is the new insider threat — prompt injection, over-permissioned agent identities and unsanctioned tool access top 2026 risk registers (KuppingerCole, 2026) IT Security: Warlock threat actor exploiting on-premises SharePoint against utilities and universities in Portuguese- and Spanish-speaking countries (Sep 2026) Data Breach: US Defense Manpower Data Center exposure — SSNs and service details of 2.76M living and 294K deceased individuals (30 Sep 2026) Data Breach: IDScan — driver's licences, government IDs and photos of 150M+ people stolen from cloud systems (10 Sep 2026) Critical Infrastructure: CenterPoint Energy — 7.49M utility customers' SSNs and account data allegedly stolen (16 Sep 2026) Legal · EU Cyber Resilience Act: actively exploited vulnerability and severe incident reporting mandatory since 11 Sep 2026 via ENISA Single Reporting Platform; full requirements apply 11 Dec 2027 (ENISA) Legal · EU AI Act: Digital Omnibus moves Annex III high-risk AI deadline to 2 Dec 2027 and Annex I (regulated products) to 2 Aug 2028 (European Parliament / Council, Jun 2026) Legal · NIS2: Germany's BSI in active supervision of ~29,000 entities; Dutch Cyberbeveiligingswet in force 15 Aug 2026; Ireland, Spain and France referred over late transposition (Jul 2026) Legal · UK: Cyber Security and Resilience Bill progressing through the Lords — brings managed service providers and data centres into NIS scope for the first time (2026) 900 Peer-reviewed governance frameworks · Retained across Tier-1 boards · Contract-winning evidence chains