🇺🇸 🚨 CALIFORNIA SAYS ETS BREACH COPIED STATEWIDE TESTING DATA ON PUBLIC-SCHOOL STUDENTS Educational Testing Service (ETS), the nonprofit that runs California's statewide student assessments (CAASPP, ELPAC) under state contract, has begun notifying students and families, the California Department of Education said on Oct 16, 2026. An unauthorized party used a compromised login credential to copy files from an ETS SFTP site between May 22 and Sept 18, 2026. ETS identified the activity on Sept 25. The copied data covers students including, but not limited to, all those enrolled in the previous three school years. It may include names, birth dates, addresses, student IDs, demographics, disability/504 status and assessment results. No SSNs, financial data or passwords. No total count has been given. ETS says it has found no evidence the data was made public. Notices began Oct 16 and are expected to run through early November. cde.ca.gov/nr/in/ets-notific… #DataBreach #California

🇺🇸 🚨 FLORIDA DMV (FLHSMV) CONFIRMS BREACH OF DRIVER LICENSE AND VEHICLE RECORDS, INCLUDING DOCUMENT IMAGES The Florida Department of Highway Safety and Motor Vehicles said in an official Oct 16, 2026 notice that a malicious actor accessed department records on Sept 4, 2026 using compromised credentials. Key details: • FLHSMV attributes the breach to an "international cybercriminal organization" • Access came through credentials of a local Florida law enforcement agency employee, which FLHSMV says were improperly stored on an electronic device • Potentially affected: driver license and motor vehicle data, document images and other personal information • FLHSMV has not said how many people are affected and says it has no evidence of misuse so far • Letters are going out this week to current license and ID holders, with 1 year of Sontiq (TransUnion) monitoring and $1M identity theft insurance • Former license, ID or title holders may not get a letter and are covered by a substitute notice ⚠️ Analyst Note: License data plus document images is a strong kit for identity fraud and account takeover. Expect phishing that impersonates FLHSMV breach letters: check only via flhsmv.gov, and consider a credit freeze. One stored credential at a partner agency was enough to reach a statewide system. Sources: content.govdelivery.com/acco… flhsmv.gov/data-breach/ #DDW #DataBreach #Florida #FLHSMV #CyberSecurity

🚨 KILLSEC DISRUPTED — SUSPECTED MAIN OPERATOR IS JUST 16 YEARS OLD International law enforcement has struck the KillSec ransomware operation in a major coordinated takedown. And investigators say the group's suspected administrator and main operator is only 16 YEARS OLD. Operation KillSwitch resulted in: * 3 provisional arrests * 8 property searches across Spain, Greece, Romania and the UK * 5 central servers brought under law-enforcement control * KillSec's dark web leak site seized * KillSec-controlled domains seized * At least 110 TB of stolen data secured * Cryptocurrency and other criminal proceeds now being traced Europol says KillSec is linked to approximately 1,000 suspected cyberattacks worldwide. Around 500 have so far been identified as successful, although investigators say that number could change as seized evidence is analyzed. KillSec has operated since around 2024. The group allegedly exploited software vulnerabilities and poorly secured access points — particularly cloud storage — to compromise organizations and steal sensitive internal data. Victims were then listed on KillSec's dark web leak site and threatened with publication unless a ransom was paid. But there is another interesting detail: 🤖 KILLSEC WAS USING AI. Investigators found that members used AI to help: * Build ransomware infrastructure * Maintain that infrastructure * Identify potential victims The suspected administrator is 16. Another suspected developer turned 18 in August and was reportedly still a minor when some of the alleged offenses occurred. Authorities have also identified suspected negotiator and affiliate roles, while investigations into additional members continue. ⚠️ Analyst Note: The age of the suspects is remarkable, but the operational maturity is even more important. Cloud exploitation → data theft → extortion infrastructure → cryptocurrency → AI-assisted targeting. Capabilities that once required experienced cybercriminal teams are increasingly accessible to much younger and less experienced operators. Operation KillSwitch demonstrates the other side of that equation: international investigations can target the people, infrastructure, stolen data AND financial proceeds behind ransomware operations simultaneously. Official source — Europol: europol.europa.eu/media-pres… #DDW #KillSec #Ransomware #CyberCrime #Europol