Cybercrime Archives | Page 3 of 143 | Digital Watch Observatory

Five Eyes agencies urge action on AI cyber risk

Five Eyes cybersecurity agencies have urged business and technology leaders to act quickly as AI transforms the cyber landscape.

In a joint statement issued on 22 June, the leaders of the Five Eyes cybersecurity agencies said AI is already changing both offensive and defensive cyber capabilities. They said AI can strengthen cyber defence capabilities, but it is also increasing the speed, scale and sophistication of cyber threats.

The agencies said frontier AI models could surpass current industry expectations and fundamentally reshape cyber capabilities within months rather than years. They warned that AI is lowering barriers for malicious actors and shrinking the time between vulnerability discovery and exploitation.

The statement was signed by cybersecurity leaders from Australia, Canada, New Zealand, the United Kingd o m, and the United States. Signatories included the heads of the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand’s National Cyber Security Centre, the UK’s National Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency, and the US National Security Agency’s Cyber Security Directorate.

The agencies said cyber resilience should be treated as a strategic business risk and leadership responsibility rather than solely a technical concern. Boards and executives should ensure that cyber controls are in place and can operate effectively under pressure during real incidents.

The statement urged leaders to assess organisational risk, preparedness and accountability while ensuring cybersecurity remains integrated into broader business decision-making. It also called on organisations to prioritise foundational cybersecurity practices, give cyber leaders sufficient authority and resources, and remain engaged as threats and guidance evolve.

The agencies said secure-by-design and secure-by-default must become standard practice rather than an aspiration. They also said resilience cannot depend on a single technology, making defence in depth essential as AI systems evolve.

The statement warned that new, previously unknown vulnerabilities, including zero-day exploits, will continue to emerge. It said breaches will occur, but preparedness can help organisations contain them quickly and prevent escalation into major operational and financial crises.

The Five Eyes agencies recommended five practical actions for leaders. Organisations should reduce their attack surface by limiting unnecessary access and external connectivity, and should question whether systems need to be exposed at all.

They should also accelerate patching processes because AI is shortening the time between vulnerability discovery and exploitation. Delays in patching can increase risk, especially for operational systems with long update cycles.

The statement also urged organisations to address legacy systems, describing unsupported systems as strategic liabilities rather than only technical debt. Leaders were also told to review and strengthen identity and access controls, enforce strong authentication, and regularly review permissions.

Incident preparation was another priority. The agencies said organisations should test response plans, train teams, and assume breaches will happen, with a focus on fast containment and recovery.

The agencies also encouraged organisations to deploy AI as a defensive tool, using it to identify vulnerabilities, strengthen monitoring and accelerate incident response. Organisations that integrate AI tools into security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour and respond faster to incidents.

The statement said success will not come from having the most tools. Instead, it said organisations should focus on getting the basics right, acting quickly and integrating cyber security into core business strategy.

The Five Eyes agencies said leaders who act now will reduce exposure, strengthen resilience, and build confidence with customers, partners, and investors. Those who delay, they said, will face growing, avoidable risks.

Why does it matter?

The statement reflects growing concern among major cybersecurity agencies that AI is changing the balance between attackers and defenders. By accelerating vulnerability discovery, automating reconnaissance and lowering technical barriers for malicious actors, AI could significantly reduce the time organisations have to identify, patch and mitigate emerging threats.

The warning also signals a broader shift in cybersecurity governance. Rather than treating cyber risk as a technical issue delegated to IT departments, governments increasingly expect boards and senior executives to view cyber resilience as a core organisational responsibility. As AI capabilities advance, secure-by-design systems, rapid patch management, strong identity controls and tested incident response plans are becoming central elements of national and corporate cyber resilience strategies.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Digital harms and child protection drive major Criminal Code reforms in Canada

Canada has enacted new criminal justice legislation aimed at strengthening protections for children, restoring mandatory minimum sentences for serious sexual offences and expanding legal tools to combat online exploitation and digital abuse. The Protecting Victims Act has been presented as a major update to the Criminal Code.

The law increases penalties for offences including sexual abuse, voyeurism, sextortion and the non-consensual sharing of intimate images, including AI-generated or digitally manipulated sexual deepfakes. Authorities have also been given enhanced powers to pursue offenders operating across borders.

Additional provisions extend investigative timeframes and require internet service providers to retain certain data for longer periods, improving access to evidence in cases involving online exploitation and abuse. The legislation also introduces a new criminal offence targeting the recruitment of minors into criminal activity.

Officials said the reforms are intended to strengthen enforcement capabilities and promote greater consistency in sentencing for serious offences, while preserving limited judicial discretion where mandatory penalties would be clearly disproportionate.

Why does it matter?

The reforms reflect how child protection laws are evolving to address increasingly digital forms of exploitation. Offences such as sextortion, non-consensual image sharing and AI-generated sexual deepfakes have created new challenges for law enforcement and courts, requiring legal frameworks that can respond to technology-enabled harms as effectively as traditional offences.

The legislation also highlights a broader policy trend towards stronger investigative powers and cross-border enforcement cooperation in cases involving online abuse. As criminal activity increasingly relies on digital platforms and international networks, governments are seeking new tools to obtain evidence, identify offenders and protect victims while balancing privacy, due process and judicial oversight.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Cybercriminals exploit World Cup hype with phishing schemes

Cybercriminals are exploiting World Cup interest through fake streaming platforms, phishing campaigns, counterfeit online stores and betting-related scams, according to Kaspersky researchers.

The security company said it had identified more than 336 fake websites designed to imitate official World Cup pages. Many scams target fans looking for cheaper tickets, free match streams or tournament merchandise.

Some fake streaming sites ask users to register and pay for access to matches, sometimes using cryptocurrency. Others collect personal data that can later be used in further phishing attacks.

Kaspersky also identified counterfeit merchandise shops, fraudulent betting schemes and phishing emails promoting fake offers or paid predictions. Some scams rely on urgency, limited-time claims and professional-looking websites to pressure users into sharing payment or personal information.

The company warned that AI-generated websites and more polished scam designs are making fraudulent pages harder to distinguish from legitimate services during high-demand events.

Kaspersky advised fans to use official sources, check website addresses carefully and avoid offers that promise free access, unrealistic discounts or guaranteed betting results.

Why does it matter?

Major sporting events create ideal conditions for online fraud because demand, urgency and emotion are all high. World Cup scams show how criminals combine phishing, fake e-commerce, streaming fraud and social engineering to steal money and personal data. The use of polished or AI-generated websites also reflects a wider challenge for consumer protection: scams are becoming easier to create at scale and harder for users to recognise.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Sweden warns of growing criminal exploitation of digital payment systems

Sweden’s financial regulator, Finansinspektionen, has warned that organised criminal networks are increasingly exploiting weaknesses in payment systems and digital banking infrastructure. The assessment points to a more challenging risk environment driven by faster transactions, cross-border financial flows and increasing technological complexity.

Financial institutions across the Nordic region are expected to adopt more proactive and intelligence-led compliance approaches.

Retail banks remain primary targets because of their high transaction volumes and role in the initial placement of illicit funds. Criminals rely on shell companies and layered ownership structures to conceal beneficial ownership and bypass standard due diligence.

Regulators now expect stronger analytical capabilities and more robust identity verification processes, particularly within automated onboarding systems that may be vulnerable to fraud and mule-account creation.

Payment service providers and crypto-asset platforms are facing increased scrutiny because they enable the rapid movement of funds across jurisdictions. Authorities stress that real-time screening is now essential, as post-transaction analysis is no longer sufficient.

Crypto-related risks are amplified by mixing tools and decentralised systems, requiring strict origin-of-wealth checks and full compliance with travel rule standards.

Supervisory findings also highlight risks from professional enablers and compromised SMEs used to bypass controls. Insider involvement and distressed businesses can mask illicit activity through seemingly legitimate operations.

Finansinspektionen said stronger sanctions screening, continuous monitoring, and executive-level compliance oversight are essential to address evolving money laundering and illicit financing risks.

Why does it matter?

The warning reflects a broader shift in financial crime, where criminal organisations increasingly exploit the speed, scale and interconnected nature of modern financial systems. As digital payments, instant transfers and crypto-assets become more widely used, traditional compliance approaches based on retrospective reviews may struggle to keep pace with rapidly moving illicit funds.

The assessment also highlights the growing convergence of financial regulation, cybersecurity and digital governance. Financial institutions are increasingly expected to deploy advanced analytics, real-time monitoring and stronger identity verification controls to detect criminal activity before transactions are completed. Similar regulatory trends are emerging across Europe and other jurisdictions as authorities seek to strengthen resilience against money laundering, fraud and sanctions evasion.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

UK cyber agency warns of growing vulnerability risks from Frontier AI

The UK’s National Cyber Security Centre (NCSC) has issued guidance for network defenders on managing the growing risk associated with software vulnerabilities discovered using Frontier AI.

The guidance states that Frontier AI models represent the most advanced AI systems and have already demonstrated the ability to identify vulnerabilities in software products. According to the NCSC, this has significant implications for the threat landscape because Frontier AI can help both defenders and threat actors identify weaknesses at greater speed and scale. The UK’s National Cyber Security Centre has issued guidance for network defenders on managing the growing risk from software vulnerabilities discovered with Frontier AI.

The guidance states that Frontier AI models represent the most advanced AI systems and have demonstrated the ability to discover vulnerabilities in software products. The NCSC says this has implications for the threat landscape because Frontier AI can help both defenders and threat actors identify weaknesses more quickly.

The NCSC emphasises that organisations using AI for vulnerability discovery should do so within secure and controlled environments. It recommends limiting what the AI system can access, ideally using it only in testing or development environments, running it through a service account with only necessary permissions, and placing it in a sandboxed environment.

Organisations should also consider legal, contractual, and security obligations before using AI-as-a-service tools for vulnerability discovery. Sending source code, intellectual property or other sensitive information to external AI providers could introduce additional security, confidentiality and compliance risks.

The NCSC notes that AI-assisted vulnerability discovery is only effective if organisations have the processes and resources needed to manage the findings. That means having processes for patch management, vulnerability identification, prioritisation, validation, remediation, and reporting, as well as the ability to filter false positives and address root causes rather than only individual flaws.

The NCSC stresses that Frontier AI should complement, rather than replace, human cybersecurity expertise. Staff with experience in cybersecurity or the relevant IT systems should guide and validate AI-based vulnerability discovery to improve speed and accuracy.

The NCSC also warns that threat actors are increasingly using Frontier AI to identify and exploit vulnerabilities, potentially accelerating cyberattack timelines. Frontier AI may reduce the time between discovery and exploitation of newly published vulnerabilities, leaving organisations with less time to patch. The guidance says organisations should therefore adopt an assume-compromised mindset.

The NCSC recommends that organisations meet minimum cybersecurity standards, apply defence-in-depth principles, monitor networks and endpoints for suspicious behaviour and maintain a strong incident response plan.

The guidance also urges organisations to reduce the number of systems exposed to the internet, especially high-risk systems such as admin login panels, legacy systems, and operational technology. Organisations should identify internet-accessible systems and assess whether they need to remain exposed.

The guidance also highlights the growing importance of software supply chain security. Organisations should understand the commercial software, cloud services, open-source software, and dependencies they use, review supplier security and AI assurance policies, apply updates quickly, and use software bills of materials or similar tools to identify vulnerable dependencies.

The NCSC says Frontier AI is likely to be used extensively to discover vulnerabilities in open-source software because source code is accessible. It also notes that open-source supply chains have already been targeted through malware campaigns affecting major packages.

Why does it matter?

The guidance reflects a growing shift in cybersecurity as advanced AI systems become capable of identifying software vulnerabilities at unprecedented speed. While these capabilities can help defenders improve security testing and vulnerability management, they can also enable attackers to discover and exploit weaknesses more quickly, potentially reducing the time organisations have to respond.

The NCSC’s recommendations also point to a broader governance challenge surrounding AI adoption in cybersecurity. Organisations must not only defend against AI-enabled threats but also ensure that their own use of AI tools does not introduce new risks related to sensitive data, software supply chains or overreliance on automated systems. As Frontier AI capabilities continue to improve, cyber resilience will increasingly depend on combining AI-driven analysis with strong human oversight, secure development practices and effective incident response.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

University of Nottingham data breach exposes student and alumni records

The University of Nottingham has confirmed that an external third party accessed a significant amount of data in its student record system during a cyber incident.

The university said the incident affected current students and alums and that it is working with the third-party provider that maintains the affected platform to support a forensic investigation. It has reported the incident to Action Fraud and the Information Commissioner’s Office.

The university has not publicly attributed the attack, but the ShinyHunters extortion group has claimed responsibility. Have I Been Pwned said the breach affected 454,600 accounts and involved tens of gigabytes of data, which was later published online.

According to Have I Been Pwned, the exposed data included names, email addresses, phone numbers, physical addresses, passport numbers, citizenship statuses, dates of birth, academic records, ethnicity, disability information, IP addresses and information relating to enrolments and fee payments.

The university told affected individuals that it was operating on the precautionary assumption that contact information, university-related details, financial information and personal information may have been accessed.

The breach creates risks of identity theft, fraud and follow-up phishing attacks, particularly where exposed records include identity documents, financial data and sensitive personal characteristics.

The University of Nottingham Students’ Union advised students to monitor university communications, use the dedicated support line and remain cautious about unexpected emails, messages or calls.

Why does it matter?

The breach highlights the scale of cyber risk facing higher education institutions, which hold large volumes of sensitive personal, financial and academic data. Exposure of passport numbers, contact details, protected characteristics and payment-related information can create long-term risks for students and alums. The incident also points to the importance of third-party platform security and clear breach communication, especially when student record systems are involved.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

India imposes temporary Telegram ban over exam security concerns

India has restricted access to Telegram until 22 June 2026 ahead of the NEET (UG) 2026 re-examination, citing concerns over exam security and alleged paper leak networks. The decision followed recommendations from the National Testing Agency (NTA), which sought to prevent the misuse of messaging platforms during a high-stakes national examination.

The Ministry of Electronics and Information Technology (MeitY) acted under Section 69A of the Information Technology Act, 2000, citing risks associated with organised cheating networks. Authorities also ordered Telegram to temporarily disable editing of the previously posted messages until 30 June 2026, arguing that the feature had been used to create misleading evidence of alleged paper leaks.

Enforcement efforts follow ongoing investigations coordinated by the Indian Cyber Crime Coordination Centre and state police units, which have previously dismantled multiple fraudulent channels and bot networks. Officials said groups operating under names suggesting exam leaks had demanded significant sums from students and families in exchange for false information.

Why does it matter?

The case illustrates how digital platforms have become a central battleground in efforts to protect the integrity of high-stakes examinations. Messaging applications can facilitate the rapid spread of misinformation, fraudulent schemes and alleged leak networks, prompting authorities to consider increasingly interventionist measures during sensitive national processes.

The decision also raises broader questions about digital governance and platform regulation. By restricting access to a major communication platform and temporarily limiting specific platform features, Indian authorities are signalling a willingness to use digital policy tools to address risks associated with public trust and institutional integrity. The move reflects a wider global debate over the balance between security objectives, platform accountability and access to digital communications.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

INTERPOL report warns of rising cybercrime across Asia-Pacific

INTERPOL has published its 2025/2026 Asia and South Pacific Cyberthreat Assessment Report, covering the period from January 2024 to March 2025. The report documents a rise in cybercrime across the region, attributing the trend to expanding digital infrastructure, the adoption of new technologies and increasingly organised criminal networks.

More than half of the countries surveyed reported that cybercrime accounts for over 30% of all crimes recorded nationally. Phishing and related online scam techniques were identified as the most common and financially damaging forms of cybercrime, with 33 % of surveyed countries recorded over 10,000 such cases.

Neal Jetton, INTERPOL’s Cybercrime Director, said the findings demonstrate how cybercriminals are increasingly exploiting AI, ransomware-as-a-service models and sophisticated social engineering techniques. He noted that operational cooperation, information sharing, and cyber resilience are factors relevant to protecting communities and infrastructure as digital adoption in the region increases.

Growth in internet connectivity, mobile banking, cloud computing, and digital financial services has accompanied this cybercriminal activity, according to the report.

Survey respondents also highlighted challenges for law enforcement, including gaps in specialised forensic tools, cybercrime training and technical capacity. The report also notes differences in cybersecurity capacity across countries.

Some countries have established cybersecurity frameworks and institutional capabilities, while others, including developing countries and small island states, reported resource and capacity constraints.

The report identifies jurisdictions with fragmented enforcement structures, limited technical capabilities, and weaker legislation as more exposed to exploitation by cybercriminal actors.

The report was prepared through the Asia and South Pacific Joint Operations against Cybercrime (ASPJOC) project, funded by the United Kingdom’s Foreign, Commonwealth & Development Office (FCDO). It draws on information submitted by 18 INTERPOL member countries in the Asia and South Pacific region, along with contributions from private sector partners, operational case studies, and analysis of emerging cyber threat trends.

It is one of several regional cyber threat assessments produced by INTERPOL, alongside similar reports covering regions such as Africa. The full report is available from INTERPOL.

Why does this matter?

The report highlights how cybercrime is becoming a major security, economic and governance challenge across Asia and the South Pacific. As countries expand digital infrastructure, online banking, cloud services and digital government initiatives, cybercriminals are finding new opportunities to exploit vulnerabilities and target individuals, businesses and critical sectors.

The findings also illustrate the growing role of AI in cyberspace. While organisations increasingly use AI to strengthen cybersecurity, threat actors are adopting the same technologies to enhance phishing campaigns, generate deepfakes and automate attacks. This accelerating technological competition underscores the importance of international cooperation, cyber capacity-building and information sharing to strengthen resilience across the region.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

US FTC reveals record losses from imposter scams in 2025

The US Federal Trade Commission said consumers reported losing $3.5 billion to imposter scams in 2025, nearly tripling from 2020.

The FTC said imposter scams were the most reported fraud category last year, accounting for nearly one in three fraud reports. Consumers were targeted through text messages, phone calls, email, social media, search engine results and other channels.

Some of the costliest scams began with fake security alerts that often appeared to come from banks. Victims were persuaded to move money to ‘protect’ it, with losses often limited only by the funds they had available.

Consumers reported losing nearly $1 billion to business impersonators in 2025, with the highest losses linked to bank impersonators. Reported losses to government impersonators reached about $920 million, up from $789 million in 2024.

The figures form part of a wider rise in reported fraud losses. The FTC said consumers reported losing about $16 billion to all types of fraud in 2025, the highest figure on record and around 25% higher than in 2024.

The data were released as the FTC, the Department of Justice, the Department of Health and Human Services and members of the Elder Justice Coordinating Council launched the Never Ever campaign. The public-private campaign aims to raise awareness of government and business imposter scams, including scams affecting older adults.

The FTC also pointed to its 2024 Impersonation Rule, which gives the agency stronger tools to pursue scammers impersonating government agencies and businesses. Since the rule was finalised, the FTC said it has brought a dozen enforcement actions and obtained more than $70 million in redress for consumers.

Why does it matter?

Imposter scams exploit trust in digital communications, financial institutions and government services. Fake bank alerts, official-looking messages and multi-channel fraud campaigns can push consumers to act quickly and transfer money before they verify the request. The FTC’s response shows how consumer protection is increasingly combining fraud data, enforcement tools and public education to address digital trust risks.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Anthropic forced to disable Fable 5 after US directive

Anthropic has disabled access to Claude Fable 5 and Claude Mythos 5 after receiving a US government export control directive citing national security authorities.

The company said the directive requires it to suspend access to the models by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. Anthropic said the practical effect is that it must remove access to Fable 5 and Mythos 5 for all customers to ensure compliance. Access to its other models is not affected.

According to Anthropic, it received the directive on 12 June at 5:21 p.m. ET. The company said the order did not provide specific details of the national security concern, but that it understands the government believes it has become aware of a method for bypassing, or jailbreaking, Fable 5.

Anthropic said it reviewed a demonstration of the technique being used to identify a small number of previously known minor vulnerabilities. The company argued that those vulnerabilities appeared relatively simple and could also be identified by other publicly available models without requiring a bypass.

Anthropic said Fable 5 had been red-teamed before launch by its internal teams, the US government, the UK AI Safety Institute and third-party organisations. The company said no tester had found a universal jailbreak capable of broadly bypassing the model’s safeguards.

The company said it is complying with the directive but disagrees that a narrow potential jailbreak should justify recalling a commercial model. It also argued that applying such a standard across the industry could effectively halt new frontier model deployments.

Anthropic said governments should be able to block unsafe AI deployments through a transparent and technically grounded statutory process, but said the current action does not meet those principles. The company said it is working to restore access as soon as possible.

Why does it matter?

The case shows how national security and export-control powers can directly affect access to frontier AI systems after deployment. It raises a major governance question: when should governments be able to suspend access to advanced models, and what evidence, transparency and due-process safeguards should apply? The dispute also highlights the growing tension between frontier AI safety, commercial deployment, cross-border access and government intervention in dual-use technologies.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!