The week in breach news Sep 16, 2026

British fintech Revolut confirmed it mistakenly handed over sensitive data belonging to nearly 700 customers to scammers posing as government officials.

Revolut disclosed that a fraudster used a real email account on a genuine government agency's domain to send fraudulent data requests. The messages passed the bank's technical authentication checks and were processed as standard legal compliance requests, as Revolut's systems had no way of distinguishing them from legitimate ones. The accidentally disclosed information includes customer addresses, verification pictures, identity cards and bitcoin activity belonging to around 680 customers.

Hackers purporting to be behind the incident are now threatening to release the stolen information publicly unless Revolut pays a ransom.

Texas-based utility company CenterPoint Energy confirmed a customer data breach in a filing with the Securities and Exchange Commission (SEC).

The company said an unauthorized third party obtained personal information belonging to a portion of its customers through one of its external-facing systems. CenterPoint Energy stated it does not currently believe the incident is likely to have a material impact on its financial condition or results of operations and confirmed that its electric and gas delivery services have not been affected and remain fully operational.

The company also said it plans to notify impacted customers and regulatory authorities as required by law and has already reported the matter to law enforcement and certain regulatory agencies.

Security researchers say that AI agents being tested by OpenAI attacked software service RubyGems two months before they autonomously hacked open-source platform Hugging Face.

The cybersecurity industry was already grappling with the revelation that OpenAI's autonomous test models had escaped a sandboxed evaluation environment and independently targeted Hugging Face in a multi-stage cyber intrusion, widely regarded as one of the first publicly disclosed examples of an AI system autonomously compromising a real external system. Reports now suggest that two months prior, the same AI agents, typically tasked with routine assignments such as creating reports or filling out spreadsheets, appear to have used RubyGems to access publicly available data as part of a training run.

The latest revelation comes at a time of growing calls for tighter regulation of AI models and the environments in which they are tested and deployed.

On September 8, Microsoft patched a record 974 vulnerabilities across its products, including two zero-day flaws that were already being actively exploited in the wild.

The first exploited zero-day, CVE-2026-85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that could allow a local attacker to gain system privileges. The second, CVE-2026-81963, is an improper link resolution defect in the Windows Update Stack that similarly allows local attackers to elevate their privileges to the system level. Microsoft rolled out patches for 723 flaws in Windows and fixed 222 security bugs in its Office suite, including 111 in Office 2016.

Additional security issues were addressed across SQL (62 fixes), Developer Tools (22), SharePoint Server (16), Azure (12), Skype for Business (10) and Exchange Server (9).

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) announced it is investigating a data breach carried out by what it describes as an international cybercriminal organization.

In a statement posted on September 11, the FLHSMV said the breach was quickly mitigated and that no further breach is ongoing, though the department has not disclosed what data may have been accessed or stolen. The FLHSMV has notified the Office of the Attorney General and is working alongside the Florida Digital Service and the Florida Department of Law Enforcement in its response. A criminal investigation is ongoing, with further details to be released once it concludes.

The ShinyHunters ransomware group has reportedly claimed responsibility for the attack, giving the department a deadline of September 11 to negotiate a fee in exchange for not releasing the stolen files.