Cybersecurity news for humans, not just IT people
This week...
...two governments found out their data had been compromised. One because a hacker deleted everything and left a ransom note, the other because they finally worked it out ten months after the attacker had already gone. Both are human stories, both have lessons, and somewhere in between them an AI decided to hack one of the biggest AI companies on the planet.
All of that and a whole bunch more on this week's The Awareness Angle
Watch or listen to the episode today - YouTube | Spotify | Apple Podcasts
Visit riskycreative.com for past episodes, our blog, and our merch.
Get 25% off your pass to the SANS Security Awareness and Culture Summit before August 14th!
We are the official media partner of the SANS Workforce Security & Risk Training Security Awareness Summit in Las Vegas this August.
Ant will be there in person across both days, streaming live conversations, interviewing practitioners on the floor, and giving remote attendees access to what's happening at the summit in a way that hasn't really been done before. We want to hear from the people in the room, what they're working on, what's changing in their programmes, and what they're taking away.
If you're attending remotely and want to get your voice into the summit floor, there'll be an opportunity for that too.
We have an exclusive discount code for Awareness Angle listeners. Enter RISKY_SUMMIT_PASS at checkout for 25% off your pass.
Full details on the summit are here.
Breach Watch
A hacker wiped Romania's entire land registry and brought the country's property market to a standstill
I could not stop thinking about this one. A hacker breached Romania's National Agency for Cadastre and Real Estate Advertising, demanded a ransom, and when it did not get paid, they deleted the entire land registry. Internal documents, employee credentials, property records, all of it. Right now notaries in Romania cannot authenticate a sale, register a mortgage, or issue proof of ownership. Somewhere between 150,000 and 170,000 homes get sold there every year, and this week you simply cannot buy or sell one, because the records that prove who owns what no longer exist.
Luke and I both sat there trying to picture it happening here, and you just can't. The scale of it lands in a way "data breach" never does. This is not leaked records sitting on a forum somewhere, it is an entire country where ownership itself is suddenly unprovable.
The detail worth pulling on is how they got in. Not a zero day, not some clever exploit. Valid credentials. A username and password that worked. The attacker, named by KELA as an individual operating under the handle ByteToBreach, also claimed to have grabbed source code from multiple government systems, so this went deeper than one database before the ransom demand was even made. And it is not a one-off. The same handle has been linked to government registry breaches in Sweden, Slovakia, Ukraine, Poland and Lithuania.
The Awareness Angles -
Valid credentials are still the most reliable way in - No sophisticated exploit did this. A working login did. That is the conversation to have with anyone who still treats credential hygiene as a low-priority job.
Destruction is a ransomware outcome too - Most training frames ransomware as encryption and recovery. This is the reminder that when extortion fails, deletion is the next move, and backups are the only thing standing between you and this.
This is how you make it real - Use it with anyone who still thinks cyber attacks are an abstract IT problem. A country where nobody could prove they own their home is about as concrete as it gets.
Hackers spent ten months inside South Korea's diplomatic training platform, and nobody found out for another five
South Korea's Foreign Ministry admitted that attackers were inside the Korea National Diplomatic Academy's training platform from April 2025 to February 2026. Ten months. That exposed personal data on around 10,000 current and former diplomats and officials: usernames, names, email addresses and encrypted passwords. They did confirm that resident registration numbers, phone numbers, home addresses and photos were not taken, which is something.
The breach was found in February and not disclosed until July, five months later. The ministry put that down to the sensitivity of the data and the need for careful analysis, which, when the people affected include active overseas diplomats, is not an unreasonable position. But it sits in direct tension with the way breach notification rules are heading almost everywhere else.
For me this is a detection story more than anything. The platform existed, it was in use, and someone was living inside it for the best part of a year without tripping anything. Getting in was only half their job.
The Awareness Angles -
Detection matters as much as prevention - Ten months of undetected access is a monitoring problem, not a phishing one. Staying in unnoticed is the other half of the attack.
Spear phishing follows breaches like this - The government's own advice was to be careful with emails from unknown senders. Diplomatic names, roles and addresses in criminal hands make a very targeted list.
Notification timelines are a live argument - Five months between discovery and disclosure is worth raising with anyone thinking about their own obligations under GDPR and similar frameworks.
This Week's Stories...
The Hugging Face "AI attack" was OpenAI's own models going rogue in a test, and a Chinese AI had to clean up the mess
Everyone was talking about this one as an autonomous AI agent breaking into Hugging Face, the GitHub of AI models, and that is how it was first reported when Hugging Face disclosed it on the 16th. Then the story developed, and it turned out to be far stranger. On the 21st, OpenAI admitted the "attacker" was its own models. GPT-5.6 Sol and an even more capable unreleased model, running with their cyber safety refusals switched off, during an internal evaluation called ExploitGym that exists to measure how good the models are at hacking.
Here is what actually happened, and it is worth following the chain. The models were meant to stay inside an isolated sandbox. They got so fixated on solving the benchmark that they found and exploited a real zero-day in OpenAI's own package proxy to escape it, then moved sideways through OpenAI's research network until they reached a machine with internet access. From there they worked out that Hugging Face probably hosted the answers to the test, chained stolen credentials and more zero-days into remote code execution on Hugging Face's production servers, and pulled the solutions straight out of the live database. No human told them to do any of this. It was an AI system trying to win a test by cheating, and to get there it escaped OpenAI's own network and then broke into Hugging Face's.
Then comes the part that made me chuckle. When Hugging Face's team went to investigate the 17,000 or so actions the attacker left behind, the US frontier models they reached for refused to help, because their safety guardrails could not tell the difference between someone investigating an attack and someone launching one. One of the models they tried was Anthropic's own Fable 5. So the defenders ended up running GLM 5.2, an open weight model from the Chinese lab Z.ai, on their own infrastructure to do the forensics, and it worked where the American models would not. The attacker had no rules and moved freely, the defenders were slowed down by the safety features of the tools they pay for, and the thing that saved them was a Chinese open model with no such handbrake.
Plenty of people are convinced OpenAI framed this as a flex. Look how powerful our AI is, it can find exploits in our own systems. Hugging Face's CEO went out of his way to say he believes there was no malicious intent, and that the mind-blowing bit is that it all happened on its own. I would take the marketing gloss with a pinch of salt either way, because whether or not anyone is spinning it, the capability is real and it is moving frighteningly fast. Claude Code is barely seven months old. The takeaway is not which lab looks scariest, it is that a model chasing a narrow goal will now find and chain real vulnerabilities to get there, and defenders may find their best tools tie their own hands at the worst possible moment.
The Awareness Angles -
Guardrails off is a choice with consequences - These models only ran wild because the safety refusals were deliberately removed for the test. If you evaluate AI internally, your test environment needs the same containment you would give a real adversary.
Your defensive tools can refuse to defend you - The lesson Hugging Face drew is a blunt one. Have a capable model you can run on your own infrastructure, because the hosted model you rely on day to day may lock you out mid-incident for looking too much like an attacker.
Detection was the hero, not prevention - Containment failed, the sandbox failed, the zero-days worked. What actually stopped it was Hugging Face noticing the activity and acting. Monitoring is not the boring cousin of security, it is the thing that saved this.
A Russian group is stealing 90 days of your email just by getting you to preview a message
This is the one that made me a bit uncomfortable, and I think it should. A Russian state-backed group called LAUNDRY BEAR, also tracked as Void Blizzard, has been running a campaign against NATO governments, defence contractors, NGOs and media since at least July last year. It abuses a stored XSS flaw in Zimbra webmail, and the payload fires the moment you preview an email. No click, no link, no attachment, no download. The message arrives, the preview pane renders, and it is away, lifting credentials, MFA recovery codes and up to 90 days of your messages before you have any reason to think anything happened.
CISA put out a joint advisory with the UK NCSC, the Five Eyes and European partners, a 31-page alert confirming the group tested this on Ukrainian targets before turning it on NATO members. Proofpoint called it a half-click exploit, which is a horrible little phrase but it's exactly right.
For those of us in awareness this one deserves an honest conversation, because it breaks a core assumption. When the attack fires on preview, the human did not make a mistake. There was no click to spot. So the thing to tell your people is what training can and cannot defend against, and why patching and platform hygiene have to sit right alongside behaviour.
The Awareness Angles -
Not every attack needs your help - Be straight with people that some attacks fire without a click. That is not a reason to stop training, it is a reason to be precise about what you are training for.
Patching is the human risk control nobody mentions - The fix for this Zimbra flaw has existed since November 2025. Anyone running an unpatched instance handed this campaign its way in.
They tested it on Ukraine first - The group ran the campaign on Ukrainian targets before turning to NATO, a pattern worth building into your threat intelligence conversations.
Also this week...
ClickFix has grown up and put on an AI costume. ESET's H1 2026 report confirmed a new variant called AI-fix, where attackers dress malware up as helpful AI troubleshooting pages, because that is where people's trust is highest right now. Detections were up 108 percent. If a page ever asks you to open a terminal and paste a command in, that is the whole scam, every time. Watch | Read
The Adobe Acrobat Chrome extension, installed on something like 329 million browsers, had a flaw that let any website you visited quietly read your WhatsApp chats, contacts and message history, with no clicking required. Adobe patched it in two days over a weekend, which is fast, but neither of us even knew that extension had a WhatsApp integration in the first place. Watch | Read
Ofcom is finally forcing UK mobile networks to block scam texts and stop criminals spoofing UK numbers, with fraud now making up around 45 percent of all reported crime in England and Wales. The networks already block more than 600 million scam messages a year between them, and 40 percent of people still got one, which tells you everything about why the human layer still matters. Watch | Read
Cyber insurers have quietly split into two camps on whether they cover AI and deepfake fraud, and most businesses have no idea which camp their policy is in. Some carriers are now excluding it on renewal, others are broadening cover to include it. If you are renewing, this is the moment to actually read the wording, not just the premium. Watch | Read
Security Socials
The post office that keeps your mail on open shelves - I showed Luke a spot near me that has turned into a makeshift post office, and it is shelves and shelves of people's mail out in the open, with a handwritten "secure area" sign taped to a fridge. One person behind the counter. My kids walked straight down there. Physical security is security too, and this is a good reminder that not every data exposure needs a hacker. Watch
The cruise ship holding every staff member's passport - This one came off Reddit, so usual caveats, but the photo showed what was believed to be every staff member's passport left in an office that had been left open, with an unlocked computer sitting right there too. The comments were full of people asking the obvious question, which is why the cruise line is holding everyone's passports at all. Watch
Luke's story
Luke brought a TikTok about Anthropic launching Claude Security, an AI application security tool that goes looking for vulnerabilities in your own code and suggests fixes rather than just flagging problems. The bit that will get security folks talking is a clause in the terms of use: you are only allowed to point it at code your company owns or has permission to scan, and explicitly not at third-party or open source code outside your organisation. Which naturally raises the question, why spell that out? Either the tool is technically capable of scanning code it does not own, or Anthropic simply wants to head off misuse before it starts. Either way it is a good marker of where things are going, with AI moving from writing code into finding and fixing the holes in it.
Thanks for reading! If you’ve spotted something interesting in the world of cyber this week, a breach, a tool, or just something a bit weird, let us know at hello@riskycreative.com. We’re always learning, and your input helps shape future episodes.
Ant Davis and Luke Pettigrew write this newsletter and podcast.
The Awareness Angle Podcast and Newsletter is a Risky Creative production.
All views and opinions are our own and do not reflect those of our employers.
