📝 Show notes
CyberAware Daily — 2026-10-09
- This week in review: China-linked email portal, Japan web data leaks, and the latest DarkWatch numbers
- Why stolen email data mostly comes back to password reuse and missing two-step verification
- What the Metabase and mobile API attacks mean for small businesses (and what they don't mean for homes)
- Understanding DarkWatch: 101,151 captures, 22,255 entities, 2,409 alerts, 10 active targets
- The weekend security checklist: updates, two-step verification, bank statements, and a family chat
- One takeaway: pick a single item and do it this weekend
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Friday, welcome to CyberAware UK. I am here with Alex, and today we're doing our weekend prep,
a look back at the week and a simple checklist you can run through in 10 minutes.
And a good week to do it, because a few things landed that are worth a calm look.
What's first?
The FBI says China-linked hackers ran a portal that gave other people access to stolen emails.
That sounds dramatic, but the practical bit is simpler. A lot of those stolen emails came from
people reusing passwords and not turning on two-step verification.
So for a normal household, what does that actually mean?
It means the same old thing still works. If your email password is unique, and you've got two-step
verification switched on, a leaked password from years ago can't be used to walk into your inbox
today. Right? And we've talked before about checking Haved. Still worth doing this weekend?
Yes, once. Pop your main email address in, see what comes up, and if anything looks familiar,
change that password and make sure it's not used anywhere else.
Now, the other story that caught my eye. Japan is seeing a sharp rise in web data leaks,
linked to mobile APIs and Metabase attacks.
That one's more of a business story, so most listeners don't need to panic.
If you run a small business or you're the person who looks after a website at work,
it's a nudge to check that any dashboards or admin tools aren't sitting open to the internet.
And the dark watch numbers this week. 101,151 captures, 22,255 entities,
2,409 alerts, and 10 active targets. The active targets number is the one to watch,
but it's 10 organizations, not 10 million homes. What we do with that is the same as always,
keep our own accounts tidy. There's also a capture floating around called Lockbit,
leaked, and one called Dragonforce Blog. Should listeners worry about those names?
Not directly. Those are criminal leak sites doing what they do.
The lesson for us is that the data on them got there because of unpatched systems and weak logins
somewhere. You can't fix someone else's server, but you can fix your own front door.
So let's get to the weekend checklist. Number one.
Update everything that connects to the internet, your phone, your laptop, your router, your smart
doorbell. If it's been nagging you about an update, do it tonight while you're watching telly.
Turn on two-step verification on your email, your bank, and your main social account.
It's the single biggest thing you can do, and it takes about two minutes per account.
Check your bank and card statements for anything you don't recognize.
Small odd amounts are often a test before a bigger one.
Have a quick chat with whoever else is in the house, especially older relatives,
about not clicking links in unexpected texts.
A two-minute conversation beats a two-week cleanup.
Pick one thing off that list and do it this weekend.
You don't have to do all four.
One is enough to make you meaningfully harder to scam.
Thanks for listening.
We're back Monday with a fresh look at what's landed over the weekend.
Stay safe and have a good one.
Bye-bye.
Stay safe.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.
Bye-bye.