French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

thehackernews.com Sep 29, 2026

French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

Curated by Shubham · TechCapsules · Sep 29, 2026

AI-summarised brief · reviewed before publication

An attacker exploited stolen staff passwords to access France’s tax administration data, extracting information on roughly 350,000 individuals and 250,000 businesses between June and July. The breach went unnoticed for seven weeks, revealing weaknesses in login protection, network segmentation, and monitoring. The stolen data included tax IDs, contact details, income references, and message logs, but not taxpayers’ own online credentials. The incident was disclosed after the attacker posted claims online, prompting an ANSSI audit and a ministry review of security protocols.

💡 Why It Matters

· The breach exposes systemic gaps in government cybersecurity, undermining public trust in digital tax services and highlighting the need for stricter access controls and real‑time threat detection.

Capsules Cybersecurity

Read full article on thehackernews.com

Quantum eMotion to Acquire Plurilock for C$33.8M ($23.8M USD) to Commercialize Quantum-Safe…

Quantum eMotion Corp. has agreed to acquire Plurilock Security Inc. for about C$33.8 million (US$23.8 million). The deal, approved by court, gives Quantum eMotion an established enterprise customer base and public‑sector procurement channels in Canada, the U.S., and NATO. Plurilock shareholders receive C$0.084 cash and 0.0763 QeM shares per share, a 100 % premium over the 20‑day VWAP. The transaction is 30 % cash, 70 % equity, and includes a C$2 million bridge loan at 8.5 % interest. The merger will combine Quantum eMotion’s quantum random number generation hardware with Plurilock’s AI‑driven risk‑analysis engines to deliver adaptive access control for defense, healthcare, and critical infrastructure.

💡 The acquisition merges quantum‑generated entropy with AI‑driven cybersecurity, creating a first‑of‑its‑kind platform for dynamic key management in high‑security sectors. It positions Quantum eMotion to accelerate deployment of quantum‑safe solutions across government and defense networks.

helpnetsecurity.com · Sep 29

Hottest cybersecurity open-source tools of the month: September 2026

The September 2026 roundup from Help Net Security highlights six open‑source cybersecurity tools gaining traction. Sift, created by Stratus Security, is a command‑line scanner that locates passwords, API keys and other secrets across Microsoft 365, Slack, Jira, SharePoint, OneDrive, local disks and Active Directory domains. ToolHive, released by Stacklok under Apache 2.0, enables secure self‑hosting of Model Context Protocol (MCP) servers in containers with a Kubernetes operator and registry. Tencent’s Zhuque Lab contributes AI‑Infra‑Guard, a scanner that fingerprints AI services such as Ollama, vLLM and ComfyUI, cross‑referencing them with over 1,600 CVEs and testing for jailbreak vulnerabilities. Permify offers a centralized, runtime authorization‑as‑a‑service to evaluate access decisions outside application code. DeepZero automates hunting for exploitable Windows kernel drivers by parsing binaries and consulting language models for attack feasibility. Finally, Gopass provides a command‑line password manager for teams, positioned as a drop‑in replacement for the Unix “pass” utility.

💡 By delivering free, community‑maintained solutions for secret discovery, AI risk assessment, and access control, these tools lower the barrier for organizations of any size to harden their attack surface without costly proprietary software.

thehackernews.com · Sep 29

Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M

Bitget disclosed that a hacker stole roughly $388 million by exploiting a zero‑day flaw in a third‑party security product used by the exchange. The vulnerability granted the attacker high‑level internal credentials, allowing fraudulent withdrawal commands to be injected into Bitget’s wallet backend on September 24. Two small test transfers bypassed risk controls, followed by larger moves from the exchange’s hot and warm wallets; cold wallets remained untouched. Bitget revoked and reissued credentials, disabled the compromised functionality, and is working with vendors and investigators Mandiant and SlowMist. Customer balances were not affected and the exchange’s Protection Fund will cover the loss. Withdrawals are being restored gradually, and a formal incident report is expected this week. The breach prompted review of third‑party security tools.

💡 The incident proves that a single supply‑chain weakness can undermine sophisticated internal safeguards, compelling crypto platforms to tighten oversight of external security solutions.

thehackernews.com · Sep 28

IAM for AI agents: A Practical Enterprise Framework

The article outlines a new identity‑and‑access‑management (IAM) framework tailored for AI agents, treating each autonomous actor as a distinct non‑human identity with a human owner, defined purpose, scoped permissions, expiration, and continuous monitoring. It explains how conventional IAM systems fail to bridge the intent‑to‑execution gap, exposing agents to excessive agency and untracked activity. The framework divides into lifecycle, authorization, and runtime components, emphasizing workload‑identity federation, short‑lived credentials, and audit evidence to ensure accountability.

💡 By enforcing traceable, agent‑specific identities, the framework closes a critical blind spot in enterprise security, enabling regulators and auditors to verify that autonomous systems act strictly within approved boundaries.

thehackernews.com · Sep 28

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Microsoft’s technical analysis revealed that the malware family NeedyMantis has been used by attackers to maintain long‑term access in a handful of targeted intrusions, including telecoms, universities, medical nonprofits, intergovernmental bodies, and government contractors. First identified in October 2025, NeedyMantis arrives as a bundle of a legitimate program, a malicious DLL, and an encrypted archive, employing DLL sideloading. The malware connects to a command‑and‑control server via HTTPS and WebSocket, allowing operators to load additional modules. Microsoft linked the activity to the Storm‑3069 group, likely originating in China, and noted its presence in the DAEMON Tools supply‑chain attack.

💡 The discovery shows how sophisticated adversaries can embed persistent footholds in high‑value sectors, complicating detection and removal. It underscores the need for vigilant monitoring of DLL sideloading and encrypted payloads in seemingly benign software.

iomtoday.co.im · Sep 28

CyberIsle 2026 brings cyber security experts to Isle of Man

CyberIsle 2026, the Isle of Man Government’s flagship cyber‑security conference, will convene at the Comis Hotel & Golf Resort in Santon on Thursday, 15 October. The event marks the eighth edition and will host more than a dozen leading cyber‑security organisations, government officials, and island businesses. Speakers will address the theme “Cyber Security for an Uncertain Future,” focusing on anticipating change, strengthening digital infrastructure, and safeguarding critical systems amid rapid technological evolution and geopolitical tension. The conference aims to equip business leaders, IT professionals, and policymakers with actionable insights to counter emerging cyber threats.

💡 By spotlighting AI‑driven attacks and supply‑chain vulnerabilities, the event underscores the urgency for proactive, cross‑sector collaboration to protect the Isle of Man’s digital economy.