📝 Show notes
CyberAware Daily — 2026-09-30
- French tax data theft went undetected for seven weeks after staff passwords were stolen, a reminder that work logins need unique passwords and multi-factor authentication.
- DarkWatch has flagged a newly active dark web leak site this week. We do not name or link it. The practical advice is unchanged: assume old passwords are exposed and use a password manager.
- Russia's Star Blizzard group targeted more than a hundred organisations with fake event invitations carrying a backdoor. Check web addresses before you log in anywhere.
- A new variant of the Spectre attack, called Spectre BTR, can leak memory on some Linux systems despite existing defences. Relevant if you run a home server or NAS, not your everyday laptop.
- Tonight's one action: open your email account settings and switch on two-factor authentication.
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Wednesday, 30th September, and this is CyberAware UK, the show that helps British
families spot scams before they cost you. I am here with Alex. Morning, Alex.
Morning. Wednesday means midweek intel. So we're looking at what's fresh on the monitoring side
and the stories that actually matter to normal households.
Let's start with the one that hits closest to home. French tax authorities have confirmed a
data theft that went undetected for seven weeks. Seven weeks is a long time. How did they get in?
Stolen staff passwords. Someone got hold of login details belonging to employees,
used them to reach taxpayer records, and nobody noticed for nearly two months.
So this isn't a clever technical hack. It's someone logging in with a real username and a real
password. Exactly. And that's the pattern we keep seeing. If you work somewhere that holds other
people's personal data, your work login is a target, not just your personal one.
What should people actually do about that? Most of our listeners aren't running a tax office.
Two things. If your employer offers multi-factor authentication, switch it on and never approve a
login prompt you didn't start. And use a separate password for work, never one you've used on a
shopping site. Right, because if that shopping site leaks, the same password won't open your work
account. That's the whole idea. Now, our monitoring partners at Darkwatch have flagged a new leak
site coming online this week, with a fresh batch of stolen data being advertised.
Anything our listeners need to do differently?
Not directly. We won't name the site, and we won't repeat the address. The point is the data being
traded has to come from somewhere, usually a company that got broken into.
So the practical takeaway is the same as always. Assume your email and old passwords are out there,
and act accordingly. Which means a password manager, unique passwords, and turning on two-factor
authentication on your email first. That email account is the master key to everything else.
Let's talk about Russia's star blizzard, because that one has a hook a lot of people would fall for.
Fake event invitations. More than a hundred organizations targeted with convincing invites
that carried a hidden backdoor. So you get an email that looks like a genuine conference,
or a networking dinner, click the link, and that's it.
That's it. And the targets here are mostly organizations, think tanks, journalists,
defense suppliers. Not your average household.
But the lesson travels. If an invitation arrives out of the blue and asks you to log in somewhere,
check the actual web address before you type anything.
Or just go to the organization's website yourself and look for the event.
Two minutes of checking beats a clean-up job.
Before we go, one for the tech-minded listeners with a home server, or a Linux machine.
Researchers have found a new variation on an old attack called Spectre.
This one's called Spectre-BTR, rated serious by the researchers,
and it can leak memory on some Linux systems even with the usual protections in place.
Who's affected in plain terms?
People running Linux on a home server, a NAS box, a Raspberry Pi doing something sensitive.
Your everyday laptop and phone aren't the concern here.
The fix is simply keeping your system updated because the patches are rolling out.
And that's the takeaway for today.
Update your devices, but do it properly.
So tonight, open your email account settings and switch on two-factor authentication if it isn't already on.
Do that one thing tonight and you've closed off the root-most account takeovers use.
We'll be back tomorrow.
Stay sharp, stay calm, and keep it updated.