Cybersecurity Archives | Page 2 of 391 | Digital Watch Observatory

Japan and Australia deepen cybersecurity cooperation through policy dialogue

Japan and Australia held their seventh Cyber Policy Dialogue in Tokyo on 18 June, bringing together senior government officials to discuss cybersecurity strategy, emerging technologies and bilateral cooperation.

The whole-of-government meeting was co-chaired by Miyake Fumito, Japan’s Ambassador in charge of Cyber Policy and Deputy Director-General of the Foreign Policy Bureau at the Ministry of Foreign Affairs, and Jessica Hunter, Australia’s Ambassador for Cyber Affairs and Critical Technology at the Department of Foreign Affairs and Trade.

Officials from Japan’s Ministry of Foreign Affairs, National Cybersecurity Office, National Police Agency, Ministry of Defence, Ministry of Internal Affairs and Communications, and Ministry of Economy, Trade and Industry took part in the dialogue.

Australia was represented by officials from the Department of Foreign Affairs and Trade, the Department of Industry, the Australian Signals Directorate’s Australian Cyber Security Centre and the Department of Home Affairs.

The dialogue followed Japan’s enactment of the Cyber Response Capability Strengthening Act and the adoption of a new national Cybersecurity Strategy, providing an opportunity for both sides to exchange views on evolving cyber policy frameworks. Both sides exchanged views on their respective cybersecurity strategies and policies, as well as cooperation at bilateral and multilateral levels.

The meeting also built on the Japan-Australia Strategic Cyber Partnership, which Japanese Prime Minister Takaichi Sanae and Australian Prime Minister Anthony Albanese agreed to launch during their May summit.

Discussions covered defence and deterrence against cyber threats, capacity-building initiatives, public-private partnerships, AI-related security challenges and broader cybersecurity cooperation. Both governments reaffirmed their commitment to continued cooperation on cyber issues through bilateral mechanisms, including the Japan-Australia Cyber Policy Dialogue.

Why does it matter?

The dialogue reflects the growing strategic importance of cybersecurity in the Indo-Pacific region. As cyber threats increasingly target governments, critical infrastructure and advanced technologies, countries are placing greater emphasis on international cooperation to strengthen resilience, share expertise and coordinate responses to emerging risks.

The inclusion of AI alongside traditional cybersecurity issues also highlights the changing nature of digital security. AI is becoming both a tool for cyber defence and a potential source of new threats, making policy coordination increasingly important. Closer cooperation between Japan and Australia may help strengthen regional cybersecurity governance while supporting broader efforts to address technological and security challenges in multilateral forums.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

NCSC urges action after Fortinet firewall and VPN credential leak

The UK National Cyber Security Centre has urged organisations using Fortinet services to investigate whether they have been affected by a global campaign targeting firewalls and VPN gateways.

The NCSC said Fortinet firewalls and VPN gateways have been targeted globally, with some indications of potential impact in the UK. A threat actor has leaked a database of credentials following brute-force, dictionary and credential stuffing attempts against internet-facing FortiGate and VPN portals.

UK organisations using Fortinet edge devices with SSL VPN enabled have been advised to check whether their domains may be affected and to investigate potentially malicious activity on their devices.

The NCSC said organisations should review logs for indicators of compromise, including unauthorised account creation and unexpected activity. Where evidence of compromise exists, affected devices should be isolated from the internet and internal networks.

The agency also warned that changing credentials alone may not be sufficient if attackers have gained persistence on a device. It recommends factory resetting compromised devices after collecting logs, configurations and other investigation artefacts.

Organisations are also advised to investigate other edge devices that share credentials with compromised systems and to monitor reachable devices for signs of onward compromise.

The NCSC said organisations should harden recommissioned systems by ensuring management interfaces are not exposed to the internet, updating to the latest version, removing unsupported systems, changing default or reused administrator passwords and enforcing multi-factor authentication on VPN and device management logins.

Why does it matter?

The alert highlights how stolen or reused credentials can compromise perimeter security infrastructure. Firewalls and VPN gateways are high-value targets because a successful compromise can give attackers a route into internal networks. The NCSC guidance also shows why basic cyber hygiene matters: exposed management interfaces, reused passwords, unsupported systems and missing multi-factor authentication can turn credential leaks into wider network compromise.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

AI reshapes capital markets as efficiency gains meet governance challenges

AI is rapidly transforming capital markets, moving beyond experimental pilots and into core financial infrastructure. Trading systems, cloud-native platforms and machine-learning tools are reshaping liquidity formation, price discovery and operational workflows.

International institutions increasingly view AI adoption not only as a driver of productivity but also as a governance challenge affecting market integrity, transparency, and trust.

The European Stability Mechanism reports a sharp rise in electronic trading across sovereign and supranational bond markets, with electronic volumes reaching around 60% and executed trades accounting for up to 80% of activity. The European Securities and Markets Authority (ESMA) highlights AI’s role in enhancing market intelligence through the analysis of unstructured data, including news flows and market sentiment signals.

Meanwhile, the European Central Bank (ECB) estimates that AI could reduce trading execution costs by 20% to 30%. Despite efficiency gains, risks persist, including amplified volatility, reduced explainability of trading decisions, and increased exposure to cybersecurity threats.

The World Bank Group demonstrates how AI can be embedded across treasury functions through in-house systems such as SHASTRA and ASTRA, which automate bond data processing, investor targeting, and validation workflows.

Developed using existing infrastructure, these tools reduce operational costs, improve accuracy and allow staff to focus on higher-value activities. The approach also reflects a broader institutional preference for maintaining human oversight in all high-impact decisions.

Looking ahead, capital markets are expected to become increasingly automated, with AI-driven trading, distributed ledger technologies and advanced compliance systems operating within more stringent regulatory frameworks. Frameworks such as the European Union AI Act are reinforcing expectations around data governance and model transparency.

Why does it matter?

AI is becoming a foundational technology in financial markets, influencing how assets are traded, priced and monitored. By improving data analysis, automating workflows and reducing transaction costs, AI has the potential to increase market efficiency and liquidity while helping institutions process growing volumes of information.

However, the shift also creates new governance challenges. As financial decisions become more dependent on complex AI models, regulators and market participants must address issues related to transparency, explainability, cybersecurity and systemic risk. The evolution of AI in capital markets therefore raises broader questions about how innovation can be balanced with financial stability, accountability and trust in increasingly automated financial systems.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our chatbot!

Spain’s data protection authority issues privacy guidance for video game industry

The Spanish Data Protection Agency (AEPD) has published a new guide outlining data protection recommendations for the video game industry, urging companies to embed privacy safeguards throughout the entire game lifecycle.

According to the AEPD, modern video games have evolved into complex digital ecosystems that collect, analyse and process significant volumes of personal data. This may include account information, gameplay activity, behavioural data and other user-generated information, creating potential privacy and security risks.

The guide notes that AI-enabled and online gaming services increasingly rely on data-driven business models, making compliance with the General Data Protection Regulation (GDPR) particularly important. The agency emphasised that privacy protections are especially important for children and other vulnerable groups, given their significant participation in online gaming environments.

The recommendations span the entire development process, from pre-production and design to post-launch operations, covering transparency obligations, data minimisation, profiling controls and cybersecurity measures. Privacy and responsible data practices should be integrated into games from design through to end-of-life in Spain.

Why does it matter?

The guidance reflects the growing importance of data protection in the gaming industry as video games increasingly function as connected digital platforms rather than standalone entertainment products. Online services, in-game economies, AI-powered features and behavioural analytics have expanded the volume and sensitivity of personal data processed by game developers and publishers.

The recommendations also highlight broader regulatory concerns around children’s privacy and responsible data use. As gaming platforms become more immersive and data-driven, regulators are placing greater emphasis on privacy-by-design principles, transparency and user control. The AEPD’s guidance signals that compliance with data protection rules is becoming an integral part of game development, not simply a legal requirement applied after products are launched.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Ottawa strengthens role in quantum computing and cybersecurity research

Researchers and technology experts in Ottawa are contributing to advances in quantum computing, a technology that could transform fields such as drug discovery, clean energy and space exploration by solving highly complex problems beyond the reach of many conventional computers.

Researchers said quantum computing could accelerate scientific discovery and enable breakthroughs that may eventually translate into practical applications across a range of industries. However, the technology also presents significant cybersecurity challenges, as sufficiently advanced quantum computers could eventually undermine widely used encryption methods that protect digital communications and online services.

The University of Ottawa is conducting research into quantum communications and cryptography aimed at developing security technologies capable of withstanding future quantum-enabled threats. Researchers are working to better understand the fundamentals of quantum mechanics and future security systems.

Industry representatives said Ottawa’s concentration of cryptographic expertise has helped establish this city in Canada as an important centre for quantum cybersecurity research and innovation.

Why does it matter?

Quantum computing has the potential to become one of the most transformative technologies of the coming decades. Its ability to process certain types of complex calculations far more efficiently than conventional computers could accelerate advances in areas such as materials science, pharmaceuticals, energy systems and scientific research.

At the same time, quantum technologies present a major cybersecurity challenge. Many of today’s encryption systems were designed for classical computers and could become vulnerable to future quantum attacks. As a result, governments, universities and technology companies are investing in quantum-safe cryptography and secure communications. Ottawa’s growing role in quantum research reflects a broader international effort to prepare for both the opportunities and security implications of the quantum era.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Anthropic and South Korea partner on AI safety and cybersecurity

Anthropic has opened an office in Seoul and announced a series of partnerships across South Korea’s AI ecosystem, alongside a memorandum of understanding (MoU) with the Ministry of Science and ICT on AI safety.

The company said the Seoul office will serve as a long-term hub for collaboration with South Korean enterprises, startups, researchers and developers using Claude. Senior Anthropic leaders travelled to Seoul this week to open the office and meet partners, customers, and developers.

Anthropic said the MOU with South Korea’s Ministry of Science and ICT will support the safe and responsible adoption of AI across the public sector. The cooperation will focus on AI safety and cybersecurity, including Korean-language model safety evaluations with the Korea AI Safety Institute and information sharing on AI-enabled cyber threats.

KiYoung Choi, Representative Director of South Korea at Anthropic, said South Korean organisations understand that innovation and safety are linked. He said the Seoul office provides a long-term base for collaboration with organisations helping shape South Korea’s AI leadership.

Anthropic also highlighted broader adoption of Claude among South Korean companies. NAVER has deployed Claude Code across its engineering organisation, while Nexon engineering teams are using Claude Code to write, review, and ship code for live-service games.

Large South Korean business groups are also using Claude. LG CNS plans to deploy it across LG Group, Hanwha Solutions is using Claude through AWS Bedrock to meet in-region data residency and security requirements, and Samsung SDS is deploying Claude across Samsung Electronics for knowledge work, agentic workflows, and software development.

South Korean startups are also integrating Claude into products. Channel Corp uses Claude to power Channel Talk, a customer AI platform used by more than 230,000 companies across South Korea, Japan, and the United States.

Anthropic said it will also work with the National AI Research Lab, a consortium spanning KAIST, South Korea University, Yonsei University, and POSTECH. Anthropic will provide Claude access to up to 60 affiliated researchers to support work on AI safety, model evaluation, alignment, robustness and frontier AI research.

In the nonprofit sector, Good Neighbors Korea is deploying Claude to help staff analyse programme outcomes, navigate social welfare law and internal guidelines, and reduce administrative work for frontline social workers.

Anthropic said South Korea ranks among the top dozen countries globally for Claude.ai usage, with activity concentrated in technical and creative work. The company has launched Claude for Startups in South Korea and has held Claude Meetups for South Korean developers since September 2025.

The company also co-hosted Claude Build Day with BASS Ventures, bringing together more than 100 South Korean founders and developers. Anthropic will also co-host a Push to Prod hackathon with Replit, Korea Investment Partners, and Korea Investment Accelerator.

Why does it matter?

The announcement highlights South Korea’s growing importance in the global AI landscape. Beyond being a major market for AI products, the country is increasingly positioning itself as a centre for AI research, safety evaluation, enterprise adoption and public-sector deployment.

The expansion also illustrates how frontier AI companies are combining commercial growth with governance initiatives. Anthropic’s cooperation with the Ministry of Science and ICT and the Korea AI Safety Institute suggests that AI safety, cybersecurity and model evaluation are becoming integrated into broader ecosystem-building efforts. As competition among leading AI companies intensifies, partnerships that combine research, regulation, enterprise adoption and developer engagement are likely to play an increasingly important role in shaping national AI ecosystems.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

UK cyber agency warns of growing vulnerability risks from Frontier AI

The UK’s National Cyber Security Centre (NCSC) has issued guidance for network defenders on managing the growing risk associated with software vulnerabilities discovered using Frontier AI.

The guidance states that Frontier AI models represent the most advanced AI systems and have already demonstrated the ability to identify vulnerabilities in software products. According to the NCSC, this has significant implications for the threat landscape because Frontier AI can help both defenders and threat actors identify weaknesses at greater speed and scale. The UK’s National Cyber Security Centre has issued guidance for network defenders on managing the growing risk from software vulnerabilities discovered with Frontier AI.

The guidance states that Frontier AI models represent the most advanced AI systems and have demonstrated the ability to discover vulnerabilities in software products. The NCSC says this has implications for the threat landscape because Frontier AI can help both defenders and threat actors identify weaknesses more quickly.

The NCSC emphasises that organisations using AI for vulnerability discovery should do so within secure and controlled environments. It recommends limiting what the AI system can access, ideally using it only in testing or development environments, running it through a service account with only necessary permissions, and placing it in a sandboxed environment.

Organisations should also consider legal, contractual, and security obligations before using AI-as-a-service tools for vulnerability discovery. Sending source code, intellectual property or other sensitive information to external AI providers could introduce additional security, confidentiality and compliance risks.

The NCSC notes that AI-assisted vulnerability discovery is only effective if organisations have the processes and resources needed to manage the findings. That means having processes for patch management, vulnerability identification, prioritisation, validation, remediation, and reporting, as well as the ability to filter false positives and address root causes rather than only individual flaws.

The NCSC stresses that Frontier AI should complement, rather than replace, human cybersecurity expertise. Staff with experience in cybersecurity or the relevant IT systems should guide and validate AI-based vulnerability discovery to improve speed and accuracy.

The NCSC also warns that threat actors are increasingly using Frontier AI to identify and exploit vulnerabilities, potentially accelerating cyberattack timelines. Frontier AI may reduce the time between discovery and exploitation of newly published vulnerabilities, leaving organisations with less time to patch. The guidance says organisations should therefore adopt an assume-compromised mindset.

The NCSC recommends that organisations meet minimum cybersecurity standards, apply defence-in-depth principles, monitor networks and endpoints for suspicious behaviour and maintain a strong incident response plan.

The guidance also urges organisations to reduce the number of systems exposed to the internet, especially high-risk systems such as admin login panels, legacy systems, and operational technology. Organisations should identify internet-accessible systems and assess whether they need to remain exposed.

The guidance also highlights the growing importance of software supply chain security. Organisations should understand the commercial software, cloud services, open-source software, and dependencies they use, review supplier security and AI assurance policies, apply updates quickly, and use software bills of materials or similar tools to identify vulnerable dependencies.

The NCSC says Frontier AI is likely to be used extensively to discover vulnerabilities in open-source software because source code is accessible. It also notes that open-source supply chains have already been targeted through malware campaigns affecting major packages.

Why does it matter?

The guidance reflects a growing shift in cybersecurity as advanced AI systems become capable of identifying software vulnerabilities at unprecedented speed. While these capabilities can help defenders improve security testing and vulnerability management, they can also enable attackers to discover and exploit weaknesses more quickly, potentially reducing the time organisations have to respond.

The NCSC’s recommendations also point to a broader governance challenge surrounding AI adoption in cybersecurity. Organisations must not only defend against AI-enabled threats but also ensure that their own use of AI tools does not introduce new risks related to sensitive data, software supply chains or overreliance on automated systems. As Frontier AI capabilities continue to improve, cyber resilience will increasingly depend on combining AI-driven analysis with strong human oversight, secure development practices and effective incident response.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

EU’s 2026 State of the Digital Decade report highlights progress and remaining challenges

The European Commission’s 2026 State of the Digital Decade report shows that the EU continues to make progress towards its digital transformation goals, although significant structural challenges remain on the path to its 2030 targets.

The report highlights progress in digital infrastructure, business digitalisation and public services. Basic 5G coverage now reaches 96.8% of households, while nearly one in five businesses uses AI.

AI adoption accelerated significantly during 2025, increasing by 48% compared with the previous year. More than 60% of Europeans now possess at least basic digital skills.

Despite the progress, the Commission identified several areas requiring urgent attention. However, the EU currently accounts for only 9% of the global semiconductor market, well below its target of reaching 20% by 2030.

Europe also remains heavily dependent on non-EU cybersecurity suppliers and continues to face shortages of ICT specialists, particularly women in digital professions.

The report also revealed strong public support for digital sovereignty and technological self-reliance. According to a new Eurobarometer survey, most citizens support greater investment in local digital infrastructure, reduced dependence on foreign technologies and stronger regulation of AI.

Citizens also identified digital health, green technologies, connectivity and AI as areas likely to deliver the greatest benefits over the next decade.

Why does it matter?

The report provides one of the most comprehensive assessments of Europe’s progress towards its 2030 Digital Decade objectives and offers insight into the EU’s broader competitiveness agenda. Strong growth in AI adoption, connectivity and digital public services suggests that digital transformation is accelerating across the Union.

At the same time, the findings highlight persistent challenges related to technological sovereignty. Europe’s limited share of the global semiconductor market, continued dependence on foreign technology suppliers, and ongoing digital skills shortages could constrain its long-term competitiveness. As the EU increasingly links economic resilience, security and digital policy, addressing these gaps will be critical to achieving its 2030 ambitions and strengthening strategic autonomy in key technologies.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Finland links communications networks to security and digital growth

Finland’s Ministry of Transport and Communications has completed the first phase of the TUUTTI project, concluding that secure and reliable communications networks are essential to both national security and digital economic growth.

The report, published on 17 June 2026, provides an overview of Finland’s communications networks, markets and services, and identifies long-term decision points affecting network investment, security and future development.

The ministry said communications infrastructure underpins the functioning of society, security of supply, business investment and the growth of the data economy. It also said security and growth objectives can no longer be treated separately, because the same networks support both public resilience and digital competitiveness.

The report highlights resilience as a prerequisite for growth, warning that communications networks are increasingly linked to energy systems, cloud and computing services, supply chains, suppliers and skills. These dependencies make long-term planning and continuous monitoring essential.

The report also frames digital and technological sovereignty as a question of managing critical dependencies, rather than pursuing complete self-sufficiency. Finland aims to reduce lock-in risks, keep systems interoperable and maintain alternatives where security or economic impacts are greatest.

Future work will focus on preparedness, management of critical dependencies, joint development of networks, data and computing, investment predictability, skills and implementation capacity. Short-term measures identified in the report will be taken forward in autumn 2026.

Why does it matter?

Finland’s assessment shows how communications networks are becoming part of wider national security and economic strategy. Connectivity policy is no longer only about broadband access or market competition; it now includes resilience, supply chains, cloud and computing dependencies, interoperability and technological sovereignty. The report may also matter beyond Finland because its findings could feed into the EU advocacy, legislative preparation and standardisation work.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

University of Nottingham data breach exposes student and alumni records

The University of Nottingham has confirmed that an external third party accessed a significant amount of data in its student record system during a cyber incident.

The university said the incident affected current students and alums and that it is working with the third-party provider that maintains the affected platform to support a forensic investigation. It has reported the incident to Action Fraud and the Information Commissioner’s Office.

The university has not publicly attributed the attack, but the ShinyHunters extortion group has claimed responsibility. Have I Been Pwned said the breach affected 454,600 accounts and involved tens of gigabytes of data, which was later published online.

According to Have I Been Pwned, the exposed data included names, email addresses, phone numbers, physical addresses, passport numbers, citizenship statuses, dates of birth, academic records, ethnicity, disability information, IP addresses and information relating to enrolments and fee payments.

The university told affected individuals that it was operating on the precautionary assumption that contact information, university-related details, financial information and personal information may have been accessed.

The breach creates risks of identity theft, fraud and follow-up phishing attacks, particularly where exposed records include identity documents, financial data and sensitive personal characteristics.

The University of Nottingham Students’ Union advised students to monitor university communications, use the dedicated support line and remain cautious about unexpected emails, messages or calls.

Why does it matter?

The breach highlights the scale of cyber risk facing higher education institutions, which hold large volumes of sensitive personal, financial and academic data. Exposure of passport numbers, contact details, protected characteristics and payment-related information can create long-term risks for students and alums. The incident also points to the importance of third-party platform security and clear breach communication, especially when student record systems are involved.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!