Google Cloud’s London outage disrupted Revolut payments and ATM withdrawals, while ING Germany reported online banking issues. Multiple Google Cloud services went offline in the London region this morning, according to Google’s status page, and the disruption didn’t stay contained to infrastructure dashboards. BREAKING: Revolut's app and cards have stopped working across Europe. Google Cloud's London region is affected by network failures. Revolut, and many other services, runs on Google Cloud. Revolut says money and data are safe but has not named a cause. pic.twitter.com/kyxOMlVaak — International Cyber Digest (@IntCyberDigest) October 20, 2026 British digital bank Revolut reported a widespread service outage at roughly the same time, and a person familiar with the matter told Reuters the two events were directly connected. “Multiple Google Cloud services experienced disruptions in the company’s London region on Tuesday, according to its service status page, while British digital bank Revolut also reported a service outage.” Reuters states, “A person familiar with the matter told Reuters that Revolut’s service outage was related to the Google Cloud service disruption.” The outage affected Google’s europe-west2 data center, its main facility in London. Google’s engineering team said they were investigating the problem. Alphabet did not immediately respond to Reuters’ request for more information. This is common during an ongoing incident, but it leaves customers unsure when their cards will work again. Revolut’s own status page showed most services as unavailable or partially unavailable, including card payments and ATM withdrawals. For a bank that exists entirely as an app with no physical branches to fall back on, that’s not a minor inconvenience. “We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience.” the financial company wrote on X. We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience… — Revolut (@Revolut) October 20, 2026 That last sentence is the right thing to say, and it’s also exactly what every bank says during an outage regardless of whether the underlying cause is confirmed. Money and data being safe is a different question from whether you can pay for your coffee. ING Germany also reported problems on Tuesday. Customers had trouble logging into online banking and the mobile app because of a technical issue. Reuters did not link these problems to the Google Cloud outage, and ING has not explained the cause. Two major financial services companies experiencing problems on the same morning could be a coincidence. However, it also raises questions about how much European banks depend on a small number of cloud providers. Google Cloud’s europe-west2 region in London supports many UK and European fintech services. Revolut alone serves tens of millions of customers across Europe. When a major data center goes down, the impact can quickly reach customers, preventing them from paying or accessing banking services before the cause is fully understood. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Revolut)
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from the Chinese AI company's affiliates and third-party products and services built using DeepSeek technology. DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd) develops large language models and offers a chatbot, API services, and models suitable for coding and reasoning tasks. Its AI tools became extremely popular early on, but were but were soon followed by reports of security risks [1, 2, 3, 4] and concerns about the potential for Chinese authorities to access users’ conversations. The DHS is now taking regulatory action to limit the use of DeepSeek and derivatives on critical systems in the United States, and has issued a notice of order for agencies to:
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness.
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. 40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung) has pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France to the United States in August 2025. "Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes," said US Attorney Jamie McDonald in a Monday press release. "Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical. International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026. According to the summaries ICD relayed, Gauland, the party’s 85-year-old honorary chairman and former co-leader, forwarded a 2018 email about a “Hitler pilgrimage” by a former judge on the party’s internal court in Thuringia.” AfD told told Bild. “A district board member sent a Christmas card with a swastika and the words “Heil Hitler”. Staff at the party’s Berlin headquarters discussed luring a photographer to an event and throwing him out by force, in a thread signed off “hail and victory”. The AfD’s statement gave a limited account of the incident. The party said the attackers copied parts of a few mailboxes, most of which had not been used for years, and did not access the leadership’s current accounts. However, the online index includes messages dated as recently as September 12, 2026, raising questions about the party’s account. The website hexane.cc does not publish the emails themselves. Instead, it provides AI-generated summaries grouped into categories such as racism and antisemitism, with severity ratings from Low to Critical. The site operators have not identified the AI software used to create them. When users try to open a record, the site displays the message “source text not published for this record.” So far, none of the summaries has been linked to an original email that can be verified. That’s an important detail that’s getting lost in the coverage. The summaries describe swastikas, Nazi greetings, Christmas cards bearing Heil Hitler, and a thread at the federal party headquarters signed off with “hail and victory.” If authenticated, some of this material would matter significantly in ongoing court proceedings about whether the party can be banned. But right now all of it is filtered through an anonymous operator’s software, and the original texts remain unpublished. Bild is the only German news outlet confirmed to have examined files from the archive directly, although it reviewed only a very small sample. The files appeared to be genuine party records, including identity documents, invoices, bank statements, membership applications, and regional member lists. They also included the identity card of Markus Frohnmaier, deputy leader of the AfD’s parliamentary group in the Bundestag. Berlin-based security researcher Lilith Wittmann, who exposed a flaw in the CDU’s campaign app in 2021, wrote on X that she believed the leak was genuine and the reported attack method was plausible. The hacker reportedly told the International Cyber Digest account on X that they gained access through “a single unpatched party website” and then reached the mail servers. The AfD has confirmed that its hosting provider was targeted, but the reported entry method has not been independently verified. The archive’s own file names offer another clue: one server is labeled “afd_exfil.” The term “exfil” is commonly used for a system that stages stolen data before attackers transfer it out of a network. The AfD is currently contesting in court its classification as a confirmed right-wing extremist organization by Germany’s domestic intelligence agency. Lawmakers in the Bundestag and Thuringia are separately debating whether to seek a formal party ban, which under German law can only come from the Federal Constitutional Court. The leak appeared on October 19, while the Cologne Administrative Court is actively weighing whether the intelligence agency may publicly apply the extremist designation, and two months before the AfD plans to seek the election of one of its leaders as state premier in Saxony-Anhalt. Within two hours of the first posts about the archive on X, some accounts were using it to argue that the AfD should be banned. If authenticated, the most legally relevant emails would be those showing how the party’s national headquarters operates and handles internal disciplinary cases. This is because a ban case focuses on the party as an organization, not on individual members. So far, none of the summaries has been linked to an original email. The website describes itself as an independent archive published in the public interest and claims to have minimized personal data. However, Bild found that the files it reviewed included membership applications and member lists containing full names and home addresses of people whose only apparent connection to the story was their party membership. By the afternoon of October 19, the site’s About, Method, and Support pages were returning server errors, leaving visitors unable to access its own explanations of how the archive was created and managed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AfD)
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. Since the incident began, thousands of users on the Downdetector outage tracking platform have reported issues with the Revolut app, mobile banking services, and transferring funds between accounts. In a statement today, the company said the outage has affected its services since Tuesday morning and added that customers' data and funds are safe. "We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers' money and data are safe," Revolut said. "We've been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience caused." On its official status page, the company says the outage affects 28 services, including sign-ins, card payments, transfers, currency exchange, stock trading, and live support chat, which are now flagged as partially unavailable.
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info. The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records. The remaining 1.68 million records contain no identifiers, the company said, and no credit card information was exposed. Nikkei Inc. is a major Japanese business news and financial information group, owner of Financial Times, the country’s largest business-focused media company. The company employs over 10,100 people and has an annual revenue of $2.5 billion (¥393.8 billion).
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts.
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks. CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one, AI models under research and evaluation exceeded their assigned tasks and accessed live Indian systems without authorization. In the other, attackers deliberately weaponized open-source AI agent frameworks to run financially motivated intrusions. “CERT-In has observed different categories of cyber incidents in which the attacker was an AI agent, that is, a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods. In some incidents, AI agents under research and evaluation exceeded their assigned task authorization and made unauthorized access to Indian information and communication technology (ICT) assets. In others, cyber attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and financially motivated intrusions.” CERT-In states. “The incidents came to light through voluntary disclosures by AI model providers, CERT-In’s forensic analysis of suspicious activities, and CERT-In’s own proactive threat hunting. The affected organizations could not detect the unauthorized access on their own.” What makes these incidents especially concerning is that the affected organizations didn’t detect the unauthorized access. None of the affected organizations detected the unauthorized access; in every case the incident was disclosed by the AI model providers after their internal review. The organizations only learned about the incidents from the AI companies. The agents accessed Indian systems using exposed credentials and connection settings found in configuration files, public code repositories, and cloud accounts with excessive permissions. They then accessed business records containing personal and confidential information. CERT-In didn’t name the AI companies, models, or affected organizations. It also didn’t say whether the agents copied or kept any data, or whether the affected organizations had been notified. “Further, victim entities in the campaign that remediated incompletely were attacked again within days, at greater scale.” continues the advisory. “In the voluntarily disclosed incidents, agents were observed re-deriving and re-using the same exposed credential in separate operations.” That’s worth reading carefully. It means an agent that encountered a leaked key once didn’t just use it once, it came back to it. CERT-In’s own threat hunting found a separate campaign against Indian entities using publicly available offensive AI frameworks. These tools have been misused, rebranded, and redeployed across infrastructure in multiple countries, and CERT-In describes a large number of active deployments. The attackers ran multiple agents in parallel for hours to days, and victims who only partially remediated the initial access were hit again within days at greater scale. The biggest concern is how quickly these attacks can happen. These frameworks can reportedly reduce the time between gaining access and causing damage from several days to just a few hours. In September, Google Threat Intelligence Group reported a similar case in which attackers used a compromised cloud resource to run an AI-driven campaign that stole thousands of credentials from other services in less than six hours. CERT-In puts the strongest emphasis on this point. In every incident, the weaknesses were common security problems: credentials and keys stored in source code, commit histories, CI/CD variables, configuration files, and public web pages. Other issues included unused APIs that had never been disabled, payment API keys stored in plain text, cloud roles allowing anonymous or regular users to read and change data, and management interfaces exposed to the internet with weak or no multi-factor authentication. CERT-In’s conclusion is clear: AI found and exploited these common weaknesses “faster, more exhaustively and at greater scale than human attackers.” That’s the real change. The vulnerabilities themselves are nothing new. What has changed is how quickly attackers can find them and combine them to carry out attacks. The advisory’s list of recommended actions for organizations covers ground that should already be standard practice, but clearly isn’t. Audit every repository and build pipeline for exposed credentials. Rotate and purge anything you find. Keep a full API inventory and shut down anything old or unused. Remove management interfaces from the internet. Keep logs for at least 180 days and watch API traffic for bulk reads and automated registrations in real time. For organizations running their own AI agents, CERT-In adds a specific requirement: give each run its own short-lived, least-privilege identity, block outbound traffic to anything outside the task’s defined scope, and maintain a tamper-resistant log of every agent action touching production systems. The advisory also cross-references an earlier October 9 warning on payment and disbursement API abuse, which CERT-In says BFSI and fintech entities should apply alongside the measures here. AI developers and testing labs should block all outgoing network connections from test environments at the infrastructure level, rather than relying on instructions given to the AI model. If an AI agent tries to connect to an external system or finds credentials it should not have access to, the test should stop automatically, and the affected organization should be notified immediately. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agents)
Confirm this action.
Leaving now will discard your changes.