WhatsApp Breach Targets Australian Parliament in Suspected State-Backed Cyberattack A targeted cyberattack compromised the WhatsApp accounts of an Australian federal MP and three staffers earlier this year, prompting a temporary block on the platform’s web version within Parliament. The breach, disclosed during a Senate Estimates hearing on 20 May, occurred on 6 March when attackers used a phishing campaign to hijack personal accounts logged into both personal and Department of Parliamentary Services (DPS)-managed devices. The attackers tricked victims into sharing WhatsApp verification codes, allowing them to take control of the accounts and impersonate the users. By 9 March, DPS imposed a week-long block on WhatsApp Web across its IT network to prevent further unauthorized access, as officials could not immediately assess the scope of the compromise. The restriction was lifted on 16 March after mitigation efforts. Evidence suggests a foreign state actor was behind the attack, aligning with global trends of state-sponsored phishing campaigns targeting government officials. Similar incidents have been reported in the UK, US, Germany, and the Netherlands, with warnings issued about Russian-linked hackers exploiting messaging apps like WhatsApp and Signal. The FBI previously noted that such attacks had compromised thousands of accounts belonging to politicians, military personnel, and journalists. DPS collaborated with the Australian Signals Directorate (ASD) to investigate the breach, emphasizing the need for heightened cybersecurity measures among parliamentarians. While WhatsApp remains widely used, officials advised securing accounts and exercising caution with sensitive communications on the platform. The incident underscores the persistent threat of state-backed cyber espionage against high-value targets in government.

Cybersecurity Alert: Major Data Breach Exposes Millions of Records in Australia A significant cybersecurity incident has come to light, impacting millions of individuals in Australia. The breach, discovered earlier this month, involved unauthorized access to a database containing sensitive personal and financial information. While the exact timeline of the attack remains under investigation, initial reports suggest the intrusion may have occurred weeks before detection. The compromised data includes names, email addresses, phone numbers, and in some cases, payment details. Authorities, including the Australian Cyber Security Centre (ACSC) and affected organizations, are coordinating a response to assess the full scope of the breach. The incident has raised concerns about vulnerabilities in data storage practices, particularly among third-party service providers linked to the exposed systems. Security researchers have traced the attack to a sophisticated threat actor, though attribution remains unconfirmed. The breach underscores the growing risks of supply chain attacks, where attackers exploit weaknesses in interconnected systems to gain access to larger networks. Organizations across sectors are being urged to review their security protocols, though no specific mitigation steps have been publicly mandated. The fallout from the breach is expected to unfold in the coming weeks as affected entities notify impacted individuals and regulators. The incident serves as a reminder of the persistent threats facing digital infrastructure, with potential long-term consequences for data privacy and trust in cybersecurity measures.

Black Basta Ransomware Leader Added to EU and Interpol Wanted Lists The alleged mastermind behind the Black Basta ransomware group, Oleg Evgenievich Nefedov, a 35-year-old Russian national, has been added to the European Union’s Most Wanted list and Interpol’s Red Notice following a joint investigation by German and Ukrainian authorities. Nefedov is accused of founding and leading the group, which has carried out at least 525 ransomware attacks since its formation in 2022. German law enforcement describes Nefedov as the group’s "managing director," responsible for selecting targets, recruiting members, overseeing ransom negotiations, and distributing profits. Authorities also link him to the now-defunct Conti ransomware group. Two additional suspects, operating in Ukraine, were identified for their role in hacking protected systems and extracting passwords to gain unauthorized access to corporate networks. Their residences were raided, resulting in the seizure of digital devices and cryptocurrency assets. Black Basta, also known as Zirco Data hackers, gained notoriety in February 2024 after breaching Zirco Data, an Australian firm, and leaking 395GB of sensitive data, including financial documents and confidentiality agreements. The attack impacted clients such as Monash Health and the Department of Home Affairs. A month later, the group exposed over 700GB of data from more than a dozen Australian companies, including Advanced Catering Systems, Australian Textile Mills, and Optimum Health Services, following an attack on a local cloud hosting provider.