The past month brought notable cyber incidents across government, transport, policing, and retail. Several involved confirmed data exposure, while others disrupted critical business systems. These cases demonstrate how routine administrative processes and third-party access points can quickly become operational vulnerabilities.
Data Exposure and Extortion
Berlin State Administration: Berlin’s state administration faced one of the month’s most serious incidents. After attackers stole data from two departments, the Rhysida ransomware group published a large cache of files following an extortion attempt. Berlin confirmed that data had been stolen, but noted that the attackers’ claims regarding the full volume and contents had not been independently verified. Personal information relating to public employees, residents, and businesses may be affected.
Times Mobility (Japan): Times Mobility reported that an unauthorised party accessed data associated with approximately 6.6 million current and former Times Car and Times Business Service accounts. The company stated that roughly 1.6 million documents were accessed, including images of identity-verification records. The access route was blocked, and notification of affected users began while the investigation continued.
Bee Cheng Hiang (Singapore): Retailer Bee Cheng Hiang disclosed that an employee used AI-generated code for a marketing campaign, inadvertently exposing the email addresses of 95,364 customers to other recipients. Singapore’s Personal Data Protection Commission noted that the tool itself had not malfunctioned; rather, the generated script and the pre-deployment checks were at fault. The company halted the mailing, corrected the underlying code, and established additional review protocols for bulk email dispatches.
Disruption to Operational Services
Keio Corporation (Japan): Keio Corporation confirmed a ransomware attack on its group servers on 26 September. The company shut down its network to contain further damage, disrupting several business systems and affecting payment-related services in parts of its hospitality and retail operations. Keio confirmed that train operations remained unaffected and initiated an investigation into potential customer or business-partner data access.
Dyfed-Powys Police (UK): Dyfed-Powys Police identified a cyber incident on 14 September that disrupted non-emergency systems. The force remained fully operational, confirming that emergency 999 and non-emergency 101 call services were unaffected. An investigation was launched to determine whether staff information had been accessed, with no evidence found that personal data belonging to members of the public was compromised.
Key Cyber Security Priorities for Business Leaders
These recent incidents highlight three clear, practical priorities for modern business infrastructure:
Actionable Risk Controls
- Treat Data Access as a Core Risk: Restrict third-party and employee access strictly to what is required for their specific roles. Regularly review data retention schedules to ensure legacy records are safely deleted when no longer required.
- Test Automation Before Live Deployment: AI-generated scripts and automated tools require code review, test data validation, and manual oversight before being exposed to live production environments or customer communication channels.
- Plan for Operational Resiliency: Maintain clear incident response procedures to isolate affected systems quickly, ensure essential business operations continue during an outage, and maintain transparent communications while an investigation is underway.
The Wider Ransomware Landscape
The broader ransomware landscape adds vital context to these operational threats. Research from Comparitech recorded 2,627 ransomware attacks claimed globally in Q3 2026, representing a 27% increase compared to the previous quarter. However, only 247 of those claims were independently confirmed by affected organisations, demonstrating that raw extortion claims should not be treated as fully verified incidents without formal investigation.
Secure Your Business Operations
We help UK organisations evaluate access controls, test automated workflows, and build resilience against operational cyber threats.
Neil Campbell is owner and operator at SME Cyber Solutions Ltd and a member of the Crimes Against Biz Policy Group for the FSB. He writes about AI, automation and practical technology infrastructure for UK SMEs.