The short version
Today in 8 stories
- Seven-nation advisory: China-linked hackers steal data via scans and persistent accessSeven nations warn China-linked hackers exploit old flaws and remote-access tools for persistent entry.
- ASOS warns of data exposure after extortion notification sent through its own appASOS app pushed a fake extortion notice; names and contacts may be exposed.
- FBI and Secret Service warn FortiBleed attacks are locking out Fortinet adminsStolen credentials are being used to lock admins out of Fortinet VPN gateways.
- Alert fatigue flagged as a continuing driver of missed threatsRising alert volumes keep contributing to missed detections, a digest reports.
- Data of 8.8 million Danish citizens exposed in major breachA breach exposed personal data of 8.8 million Danish citizens, a digest reports.
- Hijacked ccTLD registries used to obtain unauthorized Google certificatesAttackers hijacked three country domain registries to get fake Google HTTPS certificates.
- YouTube creators targeted in fake sponsorship phishing for Google credentialsFake brand-sponsorship offers trick YouTube creators into handing over Google logins.
- EY breach exposed Goldman Sachs and Man Group client data via Checkmarx flawA software flaw in an EY platform exposed tax and personal data of client firms.
Seven-nation advisory: China-linked hackers steal data via scans and persistent access
The FBI, CISA, NSA and agencies from the UK, Australia, Canada, Japan, New Zealand and Spain say China-based Integrity Technology Group enables hackers who combine public scanning tools, legitimate remote-access software and custom utilities to breach networks, harvest email and Active Directory data, and keep access open through SoftEther VPN. The exploited vulnerabilities span 2014 to 2023 and affect widely used products such as Apache Struts and GitLab. The agencies recommend MFA, tighter privilege reviews and active threat hunting rather than relying on a single password reset.
ASOS warns of data exposure after extortion notification sent through its own app
ASOS said customer names and contact details may have been accessed after an unauthorised notification, alleging a Snowflake environment compromise, was pushed through its mobile app; it does not believe payment card data or passwords were affected. The UK's NCSC has told ASOS customers to assume they are affected and to watch for suspicious follow-up messages. Snowflake says it has no evidence its platform was breached, and the wider extortion claim remains unverified.
FBI and Secret Service warn FortiBleed attacks are locking out Fortinet admins
A joint advisory describes ongoing attacks against internet-facing FortiGate firewalls and SSL VPN gateways using previously leaked and cracked credentials; attackers create new accounts and then delete or change passwords on existing ones, locking out legitimate administrators. Cited research found over 86,644 compromised device credentials across 194 countries, and access has been passed on to ransomware affiliates including INC/Lynx and Payload. Fortinet says the activity stems from credential reuse and weak password practices rather than a new product vulnerability.
Alert fatigue flagged as a continuing driver of missed threats
A trade digest's top story highlights rising alert volume as a factor behind analyst fatigue and missed detections in security operations. No further detail on causes or scale is given in the source.
Data of 8.8 million Danish citizens exposed in major breach
A trade digest reports a major breach exposing personal data belonging to 8.8 million Danish citizens. No further detail on the cause or source of the exposure is given.
Hijacked ccTLD registries used to obtain unauthorized Google certificates
Threat actors compromised the .gh, .sl and .as country code top-level domain registries to obtain unauthorized HTTPS certificates for several Google domains and other sites. Google said its own systems were not breached, blocked the certificates using CRLSets, and worked with certificate authorities to revoke them.
YouTube creators targeted in fake sponsorship phishing for Google credentials
Threat actors pose as brands such as Hollyland, Nike and Spotify offering sponsorships, directing creators through fake collaboration platforms to a convincing website that prompts a Google sign-in under the guise of channel verification, stealing their credentials.
EY breach exposed Goldman Sachs and Man Group client data via Checkmarx flaw
Ernst & Young disclosed a breach, attributed to a vulnerability in Checkmarx software, that exposed personal and financial data of clients linked to Goldman Sachs and Man Group through a platform supporting EY's tax services, not the financial firms' own systems. Exposed data includes names, addresses and tax identification numbers.
The takeaway
What to do this week
Review certificate transparency monitoring and third-party software dependencies this week, and remind staff to verify unsolicited sponsorship or partnership requests before signing into any account.
Where this comes from
Compiled by Cyentrix from 8 newsletters received 6 to 9 October 2026 (isaca_cyber@smartbrief.com, ISACA, Cyber Security Hub Newsletter, ISACA SmartBrief on Cybersecurity). Summaries are drafted with AI assistance from the newsletter text and edited for length; follow the source links for the full reporting. Cyentrix is not the original reporter of these items. Updated 20:49 Dubai time with 3 new items.