Key points
- Denmark’s Central Register breach exposed data for 8.8 million people via a private supplier.
- ASO’s cyberattack involved stolen employee credentials and unauthorized push notifications to users.
- AI-assisted campaigns targeted South Korean banks and Ukrainian energy infrastructure using new toolkits.
Check Point Research published its threat intelligence bulletin for the week of 12 October, detailing several significant security incidents involving government bodies, retailers, and educational institutions. The report outlines how attackers leveraged third-party access, compromised credentials, and artificial intelligence tools to breach major organizations across Europe, Asia, and other regions.
Denmark’s government disclosed that unauthorized actors exploited access granted to a private supplier to breach the Central Register of Persons. This incident reportedly exposed names, addresses, and identification numbers for approximately 8.8 million individuals within the national registry, marking a significant exposure of citizen data through a supply chain vulnerability.
Supply Chain and Credential Risks
UK fashion retailer ASOS confirmed a cyberattack where stolen employee credentials allowed attackers to access third-party platforms. The threat group Xuanye claimed responsibility, stating they obtained customer names and contact details. Attackers also sent unauthorized push notifications to mobile application users, demonstrating how compromised staff accounts can lead to direct customer-facing disruptions and data leakage.
Ukraine’s largest grocery retailer, ATB, faced an attack that disrupted online services after extortion demands appeared on its website. The DataSuckers group claimed to have stolen records belonging to 7.9 million customers, including passport information and order records. Meanwhile, Osaka Metropolitan University in Japan sustained a suspected ransomware attack affecting 500 servers and potentially exposing data for 130,000 individuals.
AI-Augmented Threats and Vendor Patches
Researchers documented an AI-assisted intrusion campaign using the ARTEX toolkit against South Korean financial institutions. Exposed directories revealed Claude Code session histories and Chinese-language prompts, suggesting attackers used AI workflows to facilitate data theft for sale. Additionally, phishing campaigns now target AI-powered email assistants with hidden prompt injections in HTML comments to induce unauthorized information disclosure.
Veeam released updates for Backup & Replication version 12 to fix CVE-2025-64393, a critical remote code execution flaw rated CVSS 9.4. Citrix addressed CVE-2026-88779, a high-severity memory overflow in NetScaler ADC appliances, with confirmed targeted exploitation. Cisco and Atlassian also issued patches for critical vulnerabilities in NX-OS software and Data Center products, respectively.
Next steps
Security teams should monitor vendor advisories for the latest patches on Veeam, Citrix, Cisco, and Atlassian products. Administrators need to verify that their backup and network infrastructure versions are updated to the recommended builds to mitigate remote code execution and access control flaws. Organizations should also review third-party access permissions and employee credential hygiene to reduce supply chain and insider risks.
Background: Ransomware
Ransomware protection combines network segmentation, strict least-privilege access, and immutable backups to prevent encryption malware from spreading. You must detect initial access vectors like phishing or unpatched services, isolate infected systems immediately, and restore data from offline copies that attackers cannot modify or delete.
Read the full guide: What Is Ransomware Protection: How to Stop Encryption Attacks
What to do and how to stay safe: Check Point Research
- Audit third-party vendor access rights and enforce strict least-privilege principles for external suppliers.
- Rotate employee credentials immediately if any signs of compromise or unauthorized access are detected.
- Apply security updates for Veeam, Citrix, Cisco, and Atlassian products as soon as vendors release them.
- Monitor network logs for unusual activity associated with AI-assisted intrusion toolkits or prompt injection attempts.
Step-by-step guide: Advanced Persistent Threats: How to Spot Hidden Network Intrusions
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific CVE IDs were addressed in the October 12 report?
The report addressed CVE-2025-64393 in Veeam, CVE-2026-88779 in Citrix, CVE-2026-76455 in Cisco, and CVE-2026-21589 in Atlassian products.
How did the attackers breach the Danish Central Register?
Unauthorized individuals exploited access credentials that had been provided to a private supplier working with the Danish government.
What data was exposed in the Osaka Metropolitan University attack?
Personal information belonging to at least 130,000 individuals may have been exposed, alongside disruptions to 500 servers and administrative systems.
