Regular internet users and corporations are not the only victims of malicious hackers.
Over the last few decades, several mysterious hackers have captured the public’s imagination, but none quite like Phineas Fisher. A decade after their most famous hack, Phineas remains, by most accounts, the most prolific and public hacker never to have been caught.
As part of our series on the biggest cybersecurity mysteries of all time,
we’re delving into the enigma of Phineas, the hacktivist who hacked controversial spyware makers FinFisher and Hacking Team. The latter, an Italian startup, was among the first to turn government spyware into a viable global business, paving the way for spyware makers such as the Israeli NSO Group. Phineas’ hack against Hacking Team eventually led to the startup’s demise years later.
Apart from Anonymous, an amorphous amalgam of hacktivists with a mixed track record of mostly stunt hacks designed to gather publicity rather than have real impact, Phineas is perhaps the most well-known hacktivist in history. Their story is made of impressive hacks and endless unanswered questions.
Who is Phineas Fisher?
Variously called an anarchist, a cybercriminal, a hacktivist, and a vigilante, the hacker has said they “use a lot of different names” for different hacking escapades.
The hacks we know about were big enough to turn Phineas into a legend among hackers. “I would like to meet Phineas Fisher so that I could buy them a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock,” a well-known security researcher once wrote on Twitter. There’s even a song about them.
Phineas first emerged in August 2014, when they announced they had hacked Gamma Group, the makers of the FinFisher spyware — which is where the nickname comes from. They publicized the hack via a Twitter account cheekily called @GammaGroupPR, leaking stolen data including mobile spyware, product manuals, and a price list. The damage was limited, and FinFisher carried on. Phineas published a post-mortem that doubled as a leftist manifesto, then vanished.
A year later, they came back with a bang, hacking Hacking Team, another spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico, and Panama. Years later, Hacking Team’s CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’ hack was the beginning of the end.
Phineas went on to hack the union of the Mossos d’Esquadra, which is the police force of Catalonia, publishing a post-mortem and a 39-minute tutorial video — consistent with their stated anti-police ideals. Their next victim was the ruling party of Turkey’s authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria that Turkey was fighting against.
Phineas’ last known victim was Cayman National Bank’s branch in the Isle of Man, a self-governing island between England and Ireland. The hack hinted at a different side of Phineas. “I look for illegal ways to make money in order to free my time so I can do something useful with it. Once I had that figured out, I started scaling it up and making more money than I need and giving the extra away,” Phineas said in an interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)
Phineas kept the hack — which happened in 2016 — quiet for three years later before announcing the “Hacktivist Bug Bounty Program,” an initiative to reward hacktivists who expose companies’ illegal and unethical activities. When Cayman National Bank confirmed the hack, it claimed it “was amongst a number of banks targeted.” Phineas confirmed they had been hacking several banks for years.
That was their last public appearance. Their Twitter and Reddit accounts have long since been
The U.S. government is warning that Iranian state-backed hackers are actively breaking in and disrupting industrial control systems at American water and energy providers. This new alert comes months after federal agencies warned of an escalation in hacking from Iranian actors amid the ongoing war.
In an advisory updated Wednesday, the FBI, the NSA, the Department of Energy, and CISA said Iranian hackers were targeting programmable logic controllers on internet-connected operational networks, allowing them to manipulate data on their displays, causing outages and disruption.
The Iranian hackers were initially discovered earlier this year to be targeting controllers made by Rockwell, but the advisory has now expanded the types of industrial control systems under attack to include products from Schneider Electric and Siemens.
The agencies warn that “potentially all internet exposed” industrial control systems may be affected, and urged critical infrastructure owners to take action. Per the advisory, the Iranian-backed hackers were “conducting this activity to cause disruptive effects within the United States,” likely in response to the ongoing war between Iran, and the U.S. and Israel.
According to the FBI, the hackers broke into one critical infrastructure provider and changed the controllers’ programming logic to disabled processes that handled critical shutdowns and alarms. The feds said this allowed “systems to enter unsafe conditions without notifying operators of the anomalies.”
This is the latest in a series of cyberattacks launched by Iranian government hackers and their proxies across the region since the start of the war in February.
The hacks have ranged from the country’s typical espionage and hack-and-leak operations, such as leaking the contents of the FBI director Kash Patel’s personal email account, to more atypical destructive hacks that have caused large-scale damage or disruption. Among the more notable incidents was a hack on the U.S. medical tech giant Stryker, which allowed the Iranian hacking group “Handala” to remotely wipe tens of thousands of employee devices.
Handala also took credit for a data breach affecting California water provider Cal Water in June, and claimed it could have disrupted the water supply (without providing evidence). The water provider said that it saw no evidence of unauthorized access to its operational networks, which control the water supplies. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.
View Bio
It turns out that even San Francisco Mayor Daniel Lurie, who once declared that the city should be a testbed for emerging tech, has his limits. Especially when that emerging tech creates a massive hours-long traffic jam that leaves thousands at a standstill.
Mayor Lurie has asked state regulators to bolster rules for autonomous vehicles nearly two weeks after Waymo robotaxis became immobile in heavy July 4 traffic, ran out of power, and blocked key streets, further compounding the gridlock. The traffic jam, which trapped municipal shuttles, became a citywide problem that affected thousands of people.
In his letter to the state Department of Transportation, which was viewed by TechCrunch, Lurie pointed to two events — a widespread power outage in December and the Golden Gate Bridge fireworks show on July 4 that attracted 100,000 spectators — both of which led to dozens of stranded Waymo vehicles and paralyzed traffic. The San Francisco Chronicle first reported on the letter.
The events, he said in the letter, “demonstrated that California’s current regulatory framework does not adequately address how autonomous vehicles operate during major incidents, planned or not. California’s challenge now is not just whether autonomous vehicles can operate safely under normal conditions, but also whether they can perform reliably during extraordinary ones.”
Lurie said autonomous vehicle manufacturers should be able to demonstrate four “core operational capabilities” and asked the California Department of Transportation to establish statewide standards to prevent future problems like the July 4 gridlock incident. Under Lurie’s vision, companies would be required to immediately remove or relocate robotaxis from active travel lanes to keep people moving and be required to be able to adapt in real time, adjusting their routes, service area, and pick-up and drop-off locations. Companies would also have to share real-time operations data with local agencies, including service disruptions, the locations of immobile robotaxis, and recovery efforts as well as demonstrate through testing that they can handle large influxes of people and traffic.
TechCrunch has reached out to Waymo for comment. The article will be updated once the company responds.
Any company that wants to operate a robotaxi service in California has to successfully navigate two testing and deployment permit processes, one administered by the state’s Department of Motor Vehicles and the other by the Public Utilities Commission. California’s existing regulatory framework is stricter than that of other states like Texas and Arizona, but that hasn’t dissuaded companies from trying to operate there.
San Francisco and the wider area that stretches south into Silicon Valley have long been a testbed for autonomous vehicle technology. Six companies, including Nuro, Waymo, and Zoox, hold driverless testing permits, which allow the vehicles to drive without a human safety operator behind the wheel.
But the area has also become the launch point for commercial services, which requires other permits from the DMV and CPUC.
Waymo is the largest, with an estimated 1,000 robotaxis operating in the Bay Area today. But there are plenty of others either testing or poised to launch commercial operations, including Amazon-owned Zoox as well as a premium robotaxi service that will be operated by Uber. Tesla has a branded robotaxi service but it doesn’t use driverless vehicles, nor does it have the permits to do so. Instead, Tesla has a charter transportation permit, which allows its own drivers to pick up and drop off riders throughout San Francisco in vehicles equipped with its advanced driver assistance system rather than fully autonomous software.
Waymo’s scale has made it the focal point for regulators in San Francisco, and beyond. The company now operates in 11 cities and has said it completes more than 500,000 paid rides every week. In San Francisco, Lurie noted that Waymo had agreed to re
Vinton Cerf will step down from his role as Google’s chief internet evangelist next week, marking the conclusion of one of the most influential careers in technology history.
While speaking at the Open Frontier conference hosted by the Laude Institute, Cerf was recognized by Dave Patterson, the UC Berkeley professor best known for co-developing RISC processor architecture.
“Vint…has been at Google more than 20 years, and he is retiring a week from today, and so I think we ought to give him a round of applause for a relatively good career,” Patterson said, to cheers from the room.
Google did not respond to a request for comment by publication time.
Cerf, 83, and collaborator Robert Kahn are credited as the architects of the networking protocols that became the internet we know it today. His work developing and popularizing TCP/IP — the basic set of rules that lets different computer networks talk to each other — beginning in the 1970s has been recognized with numerous honorary degrees, the Presidential Medal of Freedom, and a Turing Award, among other honors.
Since 2005, Cerf has served as a vice president and chief internet evangelist at Google. (At this point, we can safely say the internet is fully evangelized, for good or ill.)
Cerf was speaking on a panel alongside other computer scientists known for their work on durable open source projects, including Patterson; François Chollet, creator of the Keras deep-learning library and co-founder of Ndea; John Ousterhout, the Stanford computer scientist behind the Tcl programming language, who also co-founded Electric Cloud; and Matei Zaharia, who is Databricks’ co-founder and chief technologist. They offered advice about what it takes to build open source systems that survive — advice that’s increasingly relevant as founders bet on open infrastructure for the next wave of AI products.
Much of the conference’s discussion focused on the problems with the centralization of advanced models in a handful of well-resourced labs, in contrast to the decentralized world of the open internet that made Cerf’s own protocols so durable. However, Cerf predicted that the rise of AI agents — software that can act autonomously and coordinate with other software — would push tech companies back towards standardized protocols.
“The agentic model of AI, with multiple agents from multiple sources interacting with each other, is going to force composability, and a requirement for interoperability and standardization,” Cerf said.
If he’s right, the companies that define those interoperability standards early could end up with outsized influence over how the agentic economy actually works — a dynamic not unlike the early internet protocol wars.
While other panelists speculated that natural language communication between LLM agents would be sufficient, Cerf predicted formal standards would be required.
“I don’t think English is going to be the best choice. There’s a flexibility in it, but there’s ambiguity, and I think precision for interagent interaction is going to be very, very important. An agent really needs to be sure the other agent understands what it is that they just agreed to do together,” Cerf said.
“Remember the old telephone game where you wish you’d whispered in somebody’s ear and then by the time it got to 10 people away the message was totally different? Imagine a bunch of agents talking to each other in natural language, you know, that’s kind of terrifying.”
In a more light-hearted moment, Patterson recalled meeting Cerf, known for his wardrobe of three-piece suits, as a grad student in the 1970s.
“He’s always been the best dressed computer scientist I’ve ever met,” Patterson said. “My memory of Vint is that he came as a grad student with a shirt and tie in the 70s.”
“It absolutely is true,” Cerf said. “I even had a vest, and for some reason I always wanted to stick out, and instead of having long hair, and something in my nose, I thought just dressing differently was one
Proton, the privacy-focused productivity app company, released a public AI chatbot, Lumo, last year. On Tuesday, the chatbot received an upgrade.
Lumo 2.0 gives the chatbot a variety of newfound powers including image recognition and image generation capabilities. Users can now upload pictures into Lumo, then use the chatbot to analyze or edit them. Similar to other LLMs, Lumo can also generate imagery based on a user’s prompt.
2.0 also expands Lumo’s capabilities for Projects — the widget that allows users to upload documents and conduct work via Proton’s other products like email, cloud storage. Projects now come with user-controlled persistent memory, which is a function that allows Lumo to recall a user’s preferences across various conversational sessions.
Additionally, the company says Lumo’s update makes it significantly more powerful than its previous version. The 2.0 version responds to most queries up to 76 percent faster than its previous iteration, the company says. The chatbot also comes with a new “thinking mode” for more complex problems or questions.
“Lumo 2.0 has been re-engineered from the ground up and the introduction of thinking mode gives it powerful new capabilities,” said Andy Yen, Founder and CEO at Proton. “Lumo 2.0 demonstrates that users no longer need to choose between powerful AI capabilities and meaningful privacy protections.”
The public version of Lumo appears roughly equivalent to other major chatbots in terms of usefulness. It answers questions in a similar format as Gemini and ChatGPT, with approximately the same level of detail and context.
Yet, Proton distinguishes Lumo from other chatbot providers with its privacy protections. It uses what it calls zero-access encryption architecture, which encrypts users data in transit and at rest, only allowing access to the user. The company also claims that no server-side logging of sessions is retained, so nobody at Proton can see the contents of conversations. Proton also promises to never use customer data for AI training or share it with third-parties.
Lumo 2.0 is available immediately. In addition to the free public version, Proton offers paid tiers (Plus and Professional) that give those users significantly more access and resources.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Lucas is a senior writer at TechCrunch, where he covers artificial intelligence, consumer tech, and startups. He previously covered AI and cybersecurity at Gizmodo.
You can contact Lucas by emailing lucas.ropek@techcrunch.com.
View Bio
Pinterest on Wednesday announced a new experimental app called “Ask Pinterest” that will allow the company to explore a more conversational approach to shopping and product discovery that could eventually find its way to the main Pinterest app. It also introduced other AI initiatives, including Pinterest Model Context Protocol (MCP), designed for advertisers running campaigns on Pinterest’s platform, and other AI ad tools.
The news comes just ahead of the adtech industry’s annual gathering at Cannes Lions, which is this year mainly focused on how AI can serve the needs of advertisers and marketers.
The “Ask Pinterest” online application gives the company another way to utilize its “Taste Graph” — its internal data mapping people to their interests and aesthetics. It will initially be available in limited access, the company said.
The AI-powered experience is designed to expand the visual discovery experience Pinterest is known for beyond the main app to a conversational, chatbot-like interface where consumers can ask questions using natural language to get more personalized recommendations and inspiration.
It also arrives as AI chatbots are increasingly competing with traditional search engines for consumers’ attention. Google has already put AI to work to help online shoppers find what they need, track prices, and check out. ChatGPT also experimented with agentic shopping, as have Meta, Shopify, and others.
Rather than turning itself into a source of product recommendations that other AI services could leverage through licensing deals, Pinterest has largely focused on using its own data to train AI models and power its AI products.
Image Credits:Pinterest
Plus, by making Ask Pinterest a standalone app, the company has a way to experiment with the technology without disrupting the main Pinterest experience.
The company explains that Ask Pinterest could work for more complex or multi-step queries that wouldn’t fit a traditional Pinterest search. For instance, you could use the app to ask for help planning a dinner party or furnishing a room over time. The idea, says Pinterest, is to test and explore how AI could better support people’s shopping experiences while retaining the user’s context across sessions.
Ask Pinterest can also leverage users’ own saved Pins and Boards to personalize its answers.
In time, these results will help Pinterest when building more AI-powered experiences for the company’s flagship app, the company believes.
Image Credits:Pinterest
Pinterest’s new app was announced alongside the updates aimed at marketers, including the introduction of an AI assistant, still in beta, in its Ads Manager in the U.S.
A new AI model, Performance+ creative, was also introduced globally to help advertisers pick between different ad creatives to find the one that’s likely to perform best each time the ad is shown. And the MCP infrastructure layer that Pinterest announced will allow advertisers to manage and monitor their campaigns using other third-party agentic tools in a standardized way.
In an announcement sharing the news, Pinterest’s Chief Business Officer, Lee Brown, gestured towards the changing nature of web search, remarking that, “the future of discovery won’t be driven by keywords alone. It will be shaped by context, taste, and trusted recommendations” — an area where Pinterest feels it has a “unique advantage,” Brown said.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Sarah has worked as a reporter for TechCrunch since August 2011. She joined the company after having previously spent over three years at ReadWriteWeb. Prior to her work as a reporter, Sarah worked in I.T. across a number of industries, including banking, retail and software.
You can contact or verify outreach from Sarah by emailing sarahp@techcrunch.com or via encrypted message at sarahperez.01 on Signal.
View Bio
Oracle warned its corporate customers that there is a critical-rated vulnerability in its PeopleSoft software, which is used by large companies to manage payroll and human resources, a day after a cybercrime group took credit for abusing the flaw as part of a mass-hacking campaign.
The company published the security advisory on Thursday after the hacking group ShinyHunters claimed to have breached more than 100 organizations that use PeopleSoft servers.
Mandiant, the Google-owned security unit that investigates cyberattacks, warned in a blog post that the new Oracle flaw is the same bug that the ShinyHunters group is abusing in its hacking campaign targeting PeopleSoft customers.
Oracle, which has not released a patch for the vulnerability at the time of writing, said in the advisory that the bug can be exploited over the internet without needing any authentication, such as a password.
The tech giant recommended that customers who use PeopleSoft software apply its mitigations to prevent exploitation.
On Wednesday, a ShinyHunters member told TechCrunch that the gang compromised the companies by abusing an unpatched flaw in PeopleSoft servers. The bug is known as a zero-day because the company affected, in this case Oracle, had no time to fix it before it was discovered and exploited.
Mandiant confirmed that it has also notified more than “100 global organizations,” most of them in the United States, in an effort to restrict access to their potentially vulnerable systems. The cybersecurity group said that about two-thirds of these organizations are in higher education, which aligns with what ShinyHunters previously claimed.
“While several organizations successfully blocked the activity or remediated the vulnerabilities, others experienced compromise, resulting in stolen data being published on the ShinyHunters [Data Leak Website],” Mandiant wrote.
Oracle did not respond to TechCrunch’s request for comment.
Contact Us
Do you have more information about this hacking campaign? Or other data breaches? We’d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.
The ShinyHunters member told TechCrunch this week that some of the hacked organizations are universities and colleges.
The hacker shared a message they said was sent to one of the victim schools, in which the hackers claimed to have stolen “hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and student ID across all campuses,” among other data.
PeopleSoft, and its customers, are the latest victims in a long series of hacking campaigns where the ShinyHunters gang targeted organizations that all share the same vulnerable software.
In the last year, the group targeted several companies that use Salesforce, Gainsight, and software provided by education giant Instructure, and among others.
Once the hackers identify vulnerable software and companies that use it, they try to steal corporate or customer data, and then threaten to release it unless the victims pay a ransom.
Earlier this year, education tech company Instructure said it paid the hackers after they breached the company’s systems twice. As part of the hacking campaign, ShinyHunters defaced the login pages of several schools that use Instructure’s popular school information portal Canvas. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Lorenzo Franceschi-Bicchierai is a Senior Writer at TechCrunch, where he covers hacking, cybersecurity, surveillance, and privacy.
You can contact or verify outreach from Lorenzo by emailing lorenzo@techcrunch.com, via encrypted message at +1 917 257 1382 on Signal, and @lorenzofb on Keybase/Telegram.
View Bio
For years, your phone’s Camera Roll has served dual purposes. In addition to helping you revisit special moments, it has also served as an archive for all sorts of things you find online, like recipes, fashion inspiration, travel ideas, interesting quotes, funny tweets, product recommendations, and more. Today, a new app called Pool is arriving to help you finally make sense of this digital clutter.
Image Credits:Pool
To get started with Pool, you simply give it permission to access your photos, which are moved into categories it calls “pools.” The pools created in the app are entirely dependent on the products, places, or things that you’ve saved over time, making them specific to you.
The app is one of many reinventing bookmarking in the AI era. Startups like mymind, Fabric, and Raindrop help users organize links, images, or other saved content, but Pool focuses specifically on screenshots and then uses AI to help users rediscover and act on things they intended to revisit later.
Image Credits:Pool
Once imported, Pool is able to track down the original link associated with a given screenshot. For instance, if the screenshot was of a product you were thinking of buying, it would link to the retailer’s website. If it were a recipe you saw on Instagram, it could pull up the ingredients and instructions the creator had shared. And so on.
The idea, explained Pool co-founder Maxime Junique, came about because both he and his co-founder Piet Terheyden had faced the same problem: they would screenshot things they wanted to remember, but then could never find them again.
“It sounds pretty obvious, right now, when we say it, but it’s something that we do so naturally — you don’t notice it, necessarily,” said Junique. The founders, who met years ago in a co-working space, asked their friends about the issue. The friends agreed that they would often screenshot and forget things, too, like design ideas or other types of inspiration.
Image Credits:Pool
The app was actually the first product to emerge from Spinoff Studio, the founders’ product and design studio, around three years ago. The first version was built in Lisbon over a couple of weeks while the founders lived out of a van, cranking out the landing page, website, and initial build. But they soon realized they needed to build some products that made money first, so they pivoted to B2B SaaS and shelved Pool.
The studio went on to build other products, including the CRM software Waitless, which was acquired last year.
What brought Pool back to life was the maturation of AI. Suddenly, its core idea of making sense of personal, largely unstructured datasets seemed feasible.
“We were like, it seems like a perfect time to go after this idea,” Junique told TechCrunch. “And it also seemed to us like it’s a super untapped, unexplored data set for AI. Everyone goes after emails, bank transactions, chat logs — all of those productivity-first datasets. Who is going after this really, deeply emotional data set we all own?”
Image Credits:Pool
Pool’s app also treats your screenshots like memories, meaning some of them are more relevant at the moment, while others disappear over time.
For example, if you screenshot the barcode to an event ticket, it could disappear later on after the event has taken place. Meanwhile, if you screenshot a flyer on Instagram about an upcoming event, Pool’s AI agents can help you find where to buy the tickets and link to the ticketing site.
To find things in Pool, you can search or ask its built-in AI assistant for help.
Image Credits:Pool
Next up, the founders plan to take this concept into a second, separate app that will operate as a personal assistant of sorts. Pool’s mascot — the little rubber duck you press and drag across the screen to enter Pool at launch — will become part of the brand for this agentic AI app they’re planning.
The founders were in Lisbon when we chatted — no longer in a van! — but headed to San Francisco in late May to mee
A new report by cybersecurity giant CrowdStrike found North Korean hackers posing as remote IT workers and online recruiters made up about half of all documented “hands-on-keyboard” intrusions at U.S. tech companies over the past year.
The company’s latest annual report on the cybersecurity landscape highlights the growing threat from North Korean operatives, which have become a significant source of cyber intrusions across the tech industry. Hackers associated with the Kim Jong Un regime continuously target companies and developers with schemes aimed at stealing information and cryptocurrency to fund Pyongyang’s nuclear weapons program, which is banned under international law.
CrowdStrike said that during period covered by the report — April 2025 to May 2026 — the North Korean hacking group that the company calls “Famous Chollima” accounted for 47% of all state-backed activity targeting the tech sector.
The security giant keeps track of hands-on-keyboard intrusions because they typically represent real human hackers conducting malicious and evasive cyber activity, rather than automated malware that traditional security tools can catch. These attacks generally begin with stolen passwords or credentials, followed by the abuse of legitimate tools already present in the target’s systems to maintain persistent access over time.
Famous Chollima is known for posing as tech workers, such as developers, coders, and IT, then applying for remote jobs at U.S., European, and Asian tech companies under false pretenses. To pull it off, the hackers use AI to generate real-time deepfake images to spoof the faces of real people, and pair those with fraudulent identity documents like stolen passports and driver’s licenses to pose as Americans or other foreign nationals. This is because North Korea is heavily sanctioned by the West and the United Nations for its ongoing development of nuclear weapons.
Once in, the hackers also earn a salary from the companies they infiltrate, which gets funneled back to the North Korean regime, all while stealing intellectual property and other sensitive corporate information. That stolen information is frequently weaponized; when the operatives are eventually caught, they often threaten to expose what they’ve taken unless the company pays a ransom.
The hackers also target blockchain developers with the intention of stealing large amounts of crypto, which the Kim regime uses to skirt its broad inability to use the Western banking system. North Korea has netted billions of dollars in stolen crypto over the years, with some $2 billion during 2025 alone. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.
View Bio
If anything, 2026 has made clear that cybersecurity is no longer a background concern — it’s front and center, woven into almost every major story of the year. Yes, wars are still raging, the climate keeps worsening, and we’re seemingly one dodgy sneeze away from the next global pandemic.
But running beneath all of it is a digital current that touches everything: wars being fought on digital fronts as well as physical ones, governments weaponizing citizens’ own data against them, botnets quietly undermining democratic institutions, nation-state hackers targeting civilian infrastructure from power grids to water systems, and ransomware gangs holding companies and institutions hostage for massive payouts. The attacks are getting bolder, more destructive, and harder to contain.
As we’re halfway through this already horrendous year of digital attacks and hybrid warfare, we look at some of the worst hacks and breaches so far, and how they might affect us going forward.
Questions remain over DOGE’s massive swipe of Social Security data
A year on, after operatives with the Elon Musk-led band of government destroyers known as the Department of Government Efficiency (or DOGE) swept through and dismantled federal agencies from the inside out, we’re still learning about the data lapses that happened under their watch.
After DOGE entered the Social Security Administration, it remains unclear as to what happened with some of the nation’s most sensitive data, as lawsuits battle on in federal court. The most alarming whistleblower’s claim is that DOGE uploaded a live copy of the Social Security database to an unsecured third-party server, leading to a scramble to understand what was stored in it. This database allegedly contained the Social Security numbers and associated personal information of most living Americans.
In court filings, the Social Security Administration doesn’t know for sure what was on the server, but said that the DOGE signed an agreement with an outside political advocacy group under the guise of finding evidence of voter fraud, something that President Trump continues to claim without any evidence. The fears are that the database could be misused to target Americans for spurious reasons.
Two of the top House Democrats investigating some of DOGE’s activities at the Social Security Administration said that the exposure of the government’s Social Security database “could very well be the largest data breach in our nation’s history.”
Image Credits:Bryan Dozier/Middle East Images via AFP / Getty Images
Hackers are increasingly targeting water systems and energy grids
A rash of cyberattacks across Europe targeting civilian energy and water supplies, like power plants and water dams, has set a troubling trend of late. Several hacks attributed to (or at least in part blamed on) Russia have risked real-world harm to communities and populations.
Poland’s energy grid was targeted with computer-destroying malware at the tail end of last year, as well as a Swedish thermal plant and a Norwegian dam that spilled swimming pools’ worth of water. Hackers targeted Poland again earlier this year, this time its water treatment plants, showing that Russia’s hybrid war antagonism continues to extend beyond the digital realm.
Now, thanks to the recent war between the U.S. and Israel against Iran, there are warnings that Iranian hackers are targeting critical infrastructure in the United States. This includes privately owned water utilities, which remain a soft target for hackers, often lacking basic cybersecurity protections.
Iranian government hackers struck Stryker with a destructive device hack
Speaking of Iran, a cyberattack on a U.S. medical tech company, Stryker, in March saw Iranian hackers break in and remotely wipe tens of thousands of employee devices in one fell swoop, causing widespread disruption to the company’s operations for several days.
The breach was a marked shift in Iranian hacking tactics at a time of ongoin
Discussion (0)