October 6, 2026 by sig9

Hacker Wars - October 06, 2026

Your daily dose of infosec chaos

Top billing goes to Denmark, where attackers abused a single private company’s lawful access to walk off with the names, addresses, and CPR numbers of essentially the entire population, living and dead. The FBI is meanwhile showing an Accenture contractor the door after a patch failure let ShinyHunters make off with details on thousands of bureau employees. The patching desk pulls double duty with a critical unauthenticated file-read flaw across eight Atlassian products and active mass scanning of Rejetto HFS servers, with a $7.8 million Italian privacy fine as the compliance chaser.

Denmark Leaks Its Entire Population Register Through One Company Account

Attackers compromised a private Danish firm’s lawful access to the national population register and pulled names, addresses, and CPR identity numbers for about 8.8 million people - living and dead, which is to say, everyone. When your threat model is “a data partner with legitimate access got owned,” the perimeter was always a polite fiction.

What to do: Treat partner API credentials as tier-zero secrets - per-consumer rate limits, anomaly alerts, and least-privilege scopes are the bare minimum.

FBI Shows Accenture Contractor The Door After ShinyHunters Breach

The FBI has cut ties with an Accenture contractor after a breach by the ShinyHunters crew stole personal details of thousands of bureau employees, reportedly tracing back to a patch that simply never happened. Third parties inherit your attack surface, and nobody patches what they cannot see - a lesson that keeps costing eight figures to relearn.

What to do: Put patch-compliance SLAs with real teeth in vendor contracts, then verify them independently instead of trusting the status dashboard.

Atlassian Ships Critical Unauthenticated File Read Flaw Across Eight Products

A critical flaw in eight self-hosted Atlassian Data Center products lets attackers with no login at all read known files from each product’s web application root - exact name and path required, no directory listing included. Arbitrary file disclosure sounds tame right up until you remember where configs, credentials, and forgotten backup artifacts like to live.

What to do: Patch every Data Center installation now, and check whether anything sensitive ever sat in the web application root directory.

Attackers Race To Exploit Rejetto HFS Before The Patch Lands

Hackers are mass-scanning for CVE-2026-61500, a weak signing key vulnerability in Rejetto HFS that enables session forgery, account takeover, and full remote code execution. An HFS box is usually someone’s forgotten file-sharing experiment running in a corner of the network - which is exactly what gets popped first.

What to do: Inventory your edge for anything speaking HFS, patch or decommission it, and treat anything exposed before the patch as compromised.

Italy Slaps IQVIA With $7.8 Million Fine Over Health Data Anonymization

Italy’s data protection authority fined IQVIA EUR 7 million after finding data-processing practices so sloppy that roughly one million patients’ records risked exposure and de-anonymization. “Anonymized” is not a checkbox, it is a mathematical claim - and regulators have started checking the math.

What to do: Treat pseudonymized health data as personal data, and have someone who actually understands re-identification risk sign off on every “anonymous” dataset.

That’s the roundup. Stay vigilant, stay patched.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.