Cybersecurity Breach Roundup: Zelle Lawsuit, Romania Land Registry Hack, and Global Threats This week’s cybersecurity incidents highlight escalating fraud risks, destructive attacks on critical infrastructure, and regulatory crackdowns on data protection failures. ### Zelle Faces NY Lawsuit Over Fraud Controls A New York judge ruled that Early Warning Services (EWS), the bank-owned operator of the Zelle payment network, must face a lawsuit filed by New York Attorney General Letitia James. The complaint alleges EWS ignored security safeguards to compete with nonbank apps like PayPal and Venmo, enabling over $1 billion in fraud between 2019 and 2022. Judge Phaedra Perry-Bond criticized EWS for misleading consumers about Zelle’s security, noting that instant, irrevocable transfers left victims with little recourse. Major banks including JPMorgan Chase, Bank of America, and Wells Fargo are among EWS’s largest shareholders. EWS plans to appeal, calling the lawsuit politically motivated. ### Romania’s Land Registry Wiped in Destructive Cyberattack A cyberattack by the threat actor ByteToBreach destroyed Romania’s land registry database, halting real estate transactions nationwide. The attack, which began on July 14, used stolen credentials to bypass defenses, delete critical data, and disable backups after a failed extortion attempt. The outage paralyzed property records, affecting notaries, government officials, and citizens. Kela, a threat intelligence firm, reported that the attacker also stole sensitive data, including employee credentials and internal documents, later offered for sale on a hacking forum. Authorities are rebuilding the system using offline backups, with cybersecurity expert Andrei Avadanei calling it "the most severe incident in Romania’s digital public administration history." ### Spain Fines 23andMe $2.7M Over 2023 Data Breach Spain’s data protection authority imposed a $2.7 million fine on genetic testing company 23andMe for failing to secure user data during a 2023 credential-stuffing attack that exposed 6.9 million users’ information, including 2,600 in Spain. The regulator found that 23andMe lacked mandatory multifactor authentication and controls to limit suspicious access, violating GDPR. The company only learned of the breach after stolen data appeared for sale. Spain’s penalty follows a $46.75 million U.S. settlement with breach victims, part of 23andMe’s bankruptcy proceedings. ### Origin Energy Confirms Customer Data Breach Australia’s Origin Energy, serving 4.8 million accounts, confirmed a breach after a hacker leaked 50 customer records to The Australian. The attacker, claiming revenge for offshored jobs, accessed data including names, addresses, and partial payment details via a compromised employee account. The hacker alleged undetected access for three weeks and criticized the company’s response. Origin CEO Frank Calabria apologized and said the incident is under investigation with cybersecurity experts and law enforcement. ### U.S. Seizes 1,000+ Pirate World Cup Streaming Sites The U.S. Department of Justice seized over 1,000 websites and blocked 1,970 domains used to illegally stream FIFA World Cup 2026 matches. The operation, part of a global crackdown, aimed to protect copyrighted content and reduce malware risks tied to pirate platforms. Parallel actions in Latin America dubbed Operation Red Card led to arrests in Colombia, where four members of the Los Ciberinfiltrados group were detained for selling pirated streams. The FBI had previously warned of fake FIFA ticket scams, while Mexican authorities dismantled 44 domains linked to the PirloTV piracy network. ### Malware Abuses Microsoft 365 Calendars for Covert Operations Researchers uncovered Hollowgraph, a new malware strain using Microsoft 365 calendars as a command-and-control (C2) channel. The .NET-based malware, attributed to the Iran-aligned Cavern Manticore group, exploits the Microsoft Graph API to hide commands in calendar events scheduled for May 13, 2050 ensuring they remain invisible to users. It also uses DNS tunneling to refresh credentials and exfiltrate data via encrypted attachments. The campaign, active between June and July 2026, targeted 12 Israeli organizations, with possible ties to the Lyceum cyberespionage group.