Federal investigators are assessing a Chinese-linked intrusion into an FBI system tied to surveillance operations. The FBI confirmed last week the attack was a “major incident,” indicating that it has national security implications.
Early details indicate the breach affected infrastructure used to support law enforcement monitoring capabilities, raising concerns about whether adversaries may have gained visibility into active cases, sources or technical collection methods. Authorities have not publicly outlined the full scope of access, but the classification of the event suggests a level of compromise beyond routine network intrusions.
A Politico report, citing a Congressional staffer, said lawmakers were briefed on the incident on March 4. Officials warning that the intrusion could carry national security implications depending on what data was accessed and how long attackers maintained a foothold. The episode adds to mounting pressure on federal agencies to secure investigative and intelligence systems that are high-value targets for espionage campaigns.
Lloyds Banking Bug Leaks Transaction Data of Nearly 450,000 Users
A software glitch in Lloyds Banking Group’s mobile app exposed sensitive financial data of nearly 450,000 customers, raising concerns about the resilience of digital banking systems.
Up to 447,936 customers across Lloyds, Halifax and Bank of Scotland were affected by an IT failure on March 12, allowing users to view other customers’ transaction histories and associated personal data, Jasjyot Singh, customer relationship CEO at Lloyds, said in a letter addressing inquiries from the Treasury Select Committee.
The breach stemmed from an overnight IT update that introduced a flaw in an API, triggering data leakage when multiple users accessed transaction data simultaneously within fractions of a second.
The issue persisted for roughly four hours before being contained. At least 114,182 users clicked into detailed transaction views, exposing data including sort codes, account numbers and, in some cases, national insurance numbers embedded in payment references.
Lloyds said customers couldn’t move funds or take over accounts, and it has not identified fraud linked to the incident.
Treasury flagged the incident as an “alarming breach of data confidentiality.” Committee chair Dame Meg Hillier said the convenience of real-time mobile access comes with a “trade-off” – dependence on complex systems prone to failure.
The incident adds to a broader pattern of instability. U.K. banks logged at least 158 IT incidents over two years, with many tied to system changes and internal software faults.
Dutch Finance Ministry Disables Treasury Portal After Systems Breach
The Dutch Ministry of Finance took its “Mijn Schatkist” treasury banking portal offline following a cyberattack that led to unauthorized access to internal systems.
The breach was detected on March 19 after a third-party alert flagged suspicious activity, triggering an investigation and containment measures, Minister of Finance Eelco Heinen said in a statement to the Dutch House of Representatives. Officials later shut down multiple systems on March 23, disrupting internal operations tied to core policy processes.
The ministry cut off digital access for roughly 1,600 public sector entities, including ministries, agencies, educational institutions, social funds and local governments. Users cannot view balances or initiate financial instruments such as loans or deposits through the portal. Funds remain accessible, and payments continue through standard banking channels, the statement says.
The incident affects systems used by the ministry’s policy department and has impacted a portion of employees, though the full scope is unclear.
Critical public-facing systems, including tax, customs and benefits services, were not affected, and citizens can continue filing tax and receiving payment returns as usual, Heinen said. Authorities have not disclosed how the attacker accessed the network or whether data was compromised.
Citrix NetScaler Bug Exploited to Leak Session Data
Attackers are actively exploiting a critical Citrix NetScaler vulnerability that can leak sensitive session data from device memory, prompting the U.S. Cybersecurity and Infrastructure Security Agency to add the flaw to its Known Exploited Vulnerabilities catalog and mandate immediate remediation.
The flaw, tracked as CVE-2026-3055, affects Citrix NetScaler ADC and NetScaler Gateway devices and stems from insufficient input validation that results in an out-of-bounds read condition. The flaw carries a CVSS score of 9.3.
The bug can be triggered through specially crafted requests, allowing attackers to read portions of device memory. According to analysis by watchTowr Labs, repeated exploitation can return different chunks of memory, increasing the likelihood of exposing sensitive data such as authentication tokens and active session information.
Citrix said the vulnerability can be exploited in configurations where NetScaler functions as a SAML identity provider. In such scenarios, crafted requests can trigger memory overreads, potentially exposing session tokens and other sensitive authentication data.
Security researchers observed exploitation activity within days of disclosure, with scanning and attack attempts emerging as early as March 27. The vulnerability has drawn comparisons to earlier “CitrixBleed”-type flaws that were widely exploited for session hijacking and credential theft (see: Citrix NetScaler Devices Yet Again Under Attack).
NetScaler appliances are widely used in enterprise environments for remote access and traffic management, and a large number of systems remain exposed online.
Iran-Linked Pay2Key Uses Ransomware as Cover for Disruptive Attacks
Iran-linked threat actors are increasingly using ransomware as a cover for disruptive cyber operations, with the Pay2Key group blurring the line between financial crime and state-backed activity.
Researchers at cyberthreat intelligence company Kela warn that Iranian state-sponsored actors have moved beyond traditional espionage, weaponizing the cybercriminal ecosystem to advance geopolitical objectives. Rather than building standalone ransomware operations, these groups embed within existing criminal infrastructure – acting as initial access brokers, collaborating with ransomware affiliates and deploying what Kela terms “pseudo-ransomware” to disguise destructive activity as routine extortion.
Pay2Key emerged in late 2020 and is attributed to the Iranian state-aligned group Fox Kitten. The group’s early campaigns targeted Israeli organizations, combining extortion with information warfare, including public taunts and data leaks aimed at inciting panic.
Unlike conventional ransomware groups, Pay2Key incorporates explicit state-aligned incentives. Affiliates are offered higher profit shares – up to 80% – for attacks targeting Iran’s adversaries, including the United States and Israel. Researchers describe this bounty system as Iran “effectively outsourcing geopolitical retribution to the global cybercrime talent pool.”
The pseudo-ransomware tactic follows an established playbook. The Agrius group previously used Apostle malware – initially a wiper – repackaged as ransomware to mask destructive intent.
TrueConf Zero-Day Used to Target Southeast Asian Governments
A Chinese-nexus threat actor exploited a zero-day flaw in the TrueConf video conferencing client to compromise government entities in Southeast Asia, Check Point Research said in a Tuesday blog post.
The vulnerability, tracked as CVE-2026-3502 and rated 7.8 CVSS, affects TrueConf’s updater validation mechanism and lets an attacker controlling an on-premises TrueConf server push and execute arbitrary files across connected endpoints.
The campaign, dubbed “Operation TrueChaos,” abused the trusted update channel of a centrally managed TrueConf server used by a government IT department serving dozens of agencies in one Southeast Asian country. Victims received what appeared to be a legitimate client update, but the package had been weaponized to install malicious components alongside the real software.
Researchers said the malicious update dropped poweriso.exe and a rogue 7z-x64.dll, which was loaded through DLL sideloading. The attackers then carried out reconnaissance, downloaded additional tools from an FTP server, modified the user PATH variable and abused the Windows iSCSI Initiator Control Panel utility for UAC bypass and privilege escalation.
Check Point said network traffic and infrastructure linked the activity to havoc, an open-source post-exploitation framework increasingly seen in real-world intrusions.
Russian Court Sentences Carding Kingpin Stroganov, 25 Others Sentenced in Fraud Case
A Russian court sentenced 26 members of the Flint24 cybercrime group to prison terms ranging from five to 10 years for large-scale payment card fraud, Russian state news agency Tass said Sunday.
Those convicted include alleged group leader Alexei Stroganov, known as “Flint,” along with multiple co-conspirators. Stroganov is a prominent figure in the carding ecosystem, with ties to multiple underground marketplaces distributing compromised payment data at scale.
Investigators said the group trafficked stolen payment card data, including magnetic stripe “dumps” and CVV codes, enabling fraudulent transactions and online purchases.
The case traces back to a 2020 crackdown in which Russia’s Federal Security Service charged more than two dozen suspects tied to a sprawling carding operation linked to roughly 90 online shops selling stolen card data.
U.S. authorities separately charged Stroganov in connection with fraud, identity theft and related offenses tied to the theft of hundreds of millions of payment card records.
Cyberattacks, Disinformation Campaigns Target Romania at Scale
Romania is facing a sustained wave of cyberattacks and disinformation activity linked to broader hybrid operations, with officials pointing to Russia as a key threat actor, according to media reports.
Defense Minister Radu Miruță said state institutions are hit by more than 10,000 cyberattacks daily, part of a wider campaign targeting government systems and public perception. He warned that the threat goes beyond network intrusions, with digital platforms being used to spread fake news and influence national debates.
These operations are not isolated. Romanian authorities have previously identified coordinated “hybrid” campaigns combining cyberattacks, ransomware and online disinformation tied to pro-Russian groups, aimed at influencing voters and weakening institutions.
The risk to critical infrastructure is also evident. In December 2025, the national water management authority Administrația Națională Apele Române was hit by a ransomware attack that used the Windows BitLocker encryption feature, affecting approximately 1,000 IT systems across its central structure and 10 regional basin administrations.
Officials repeatedly warned that Russia is conducting cyber and influence operations across Europe, including Romania, as part of a broader strategy to destabilize institutions and shape political outcomes.
Miruță said such operations rely on algorithms to rapidly create and scale content across thousands of accounts, making manual countermeasures ineffective.
Unpatched Software Flaws Leave Majority of Firms Exposed to Cyberattacks
Most organizations globally remain vulnerable to cyberattacks due to unpatched software flaws, with exposure shaped by sector, geography and digital footprint, according to a proprietary assessment by debt rating agency Moody’s.
Around 60% had at least one known exploited vulnerability in 2025. Nearly 40% carried unresolved flaws older than 45 days – beyond the typical window attackers need to exploit them – while more than a quarter left critical vulnerabilities unpatched for over a year.
Attack timelines are tightening. The average time from vulnerability disclosure to exploitation fell to 44 days in 2025, but organizations still take a median of 87 days to fix KEVs and 107 days for other flaws.
Education, telecommunications and technology sectors show the highest prevalence of unpatched vulnerabilities, often exceeding 60% of organizations. Banking, utilities and oil and gas report lower exposure, reflecting stronger controls and regulatory oversight.
The survey found that Japan and Korea show higher levels of long-standing vulnerabilities, while North America and Western Europe perform better, particularly in financial services.
Organizations with larger internet-facing systems face the greatest risk. Nearly 80% of those with the biggest digital footprints had unpatched vulnerabilities older than 45 days, compared with fewer than 10% among the least exposed.
Higher exposure correlates with more cyber incidents, reinforcing that even a few unpatched flaws can enable breaches. Moody’s said the gap between vulnerability disclosure and remediation continues to favor attackers.
Nacogdoches Memorial Hospital Notifies 257,000 After Cyberattack
Tennessee-based Nacogdoches County Hospital District – which operates under the name Nacogdoches Memorial Hospital – is notifying more than 257,000 people that their personal information was potentially compromised in cyberattack.
NMH told state regulators on Tuesday that it discovered on Jan. 31 a data security incident as a result of a cyberattack in which an unauthorized party compromised the hospital’s computer network and IT systems.
NHM said it notified law enforcement and immediately launched its incident response plan and an investigation into the event.
The hospital’s investigation determined the hackers may have accessed patient information including name, address, phone number, email address, Social Security number, date of birth, medical record number, account number, health plan beneficiary number and possibly a full face photograph image, if taken.
NMH said it has no evidence that any of affected personal or health information has been misused as a result of the incident.
The hospital said that following the incident, it has taken steps to harden and enhance its IT and network security to prevent a similar event in the future. That implementing remediation measures to prevent recurrence, bolstering its cyber preparedness through additional awareness training and updating its procedures.
NMH did not immediately respond to ISMG’s request for additional details about the incident.
Other Stories From This Week
With reporting from ISMG’s Marianne Kolbasuk McGee in the Boston suburbs and Chris Riotta in the Washington, D.C. environs