Crédit Mutuel Arkéa said attackers accessed it through a service provider’s platform and used the bank’s own account to execute fraudulent transactions through other banking organizations. Reported losses ranged from around €100 million to as much as €118 million ($133 million), but Arkéa did not confirm the reported figure and validated only the order of magnitude.
Why it matters
The attack reportedly converted funds into cryptocurrency; a report said the lack of public disclosure allowed approximately $30 million to be laundered by November 3, potentially limiting authorities’ ability to freeze it.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Incident · Arstechnica Security
What happened
An Estonian newspaper reported that British soldier Daniel Barton-Kennedy refused an order to remove his cellphone SIM card before deployment to part of Estonia about 90 miles west of the Russian border. The report states that Barton-Kennedy’s phone was hacked, nude photos were stolen, and the images were used to blackmail him.
Why it matters
The refusal was described as a failure to follow an element of operational security, followed by phone compromise and blackmail.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
AI & Agents · The Hacker News
What happened
Passwords and API keys entered into commands approved in Claude Code were found in public GitHub repositories, making them readable to anyone. Selecting “Yes, and don't ask again” can cause Claude Code to save an approved command verbatim, including a secret, in a project settings file.
Why it matters
Approval workflows can become a repository-exposure concern when project settings preserve commands containing credentials.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Evidence is visible. Uncertainty stays visible too.
Baitaphish separates source records from interpretations, labels AI-assisted enrichment, and avoids turning ingestion volume into unsupported claims about threats, prevalence, or risk.
