All case studies
Every Cyber Casebook case study, newest first. Each one links to a classroom-ready PDF and the original news report.
October 2026
- 123 Reg's AI AttackAI · The Register — UK registrar 123 Reg says an "AI-driven cyberattack" on September 18 exposed customer data, and it suspects a China-nexus attacker.
- Firewall Zero-DayNetworking · Network World — Attackers are exploiting a flaw in the SSL VPN of Cisco ASA and FTD firewalls to crash them; Cisco says there are no workarounds.
- So-net's Data LeakCybersecurity · Help Net Security — Attackers broke into So-net's member database and took personal details of more than 2.58 million current and former customers.
- Mixed-Up AI RepliesAI · The Cloudflare Blog — A Cloudflare-hosted AI model sent 155 responses holding data from other customers' requests after a setup gap and a software bug, Cloudflare says.
- Tailworm PatchedNetworking · Tailscale — After a researcher's "Tailworm" report, Tailscale says SSH sessions could, under certain conditions, exceed a user's privileges, and v1.104.4 fixes them.
- FX Cloud BreachedCybersecurity · The Hacker News — After a third party planted malicious programs in GMO's FX trading cloud, GMO says customer info was taken and it refused a demand of about $50 million.
- Attack on AutopilotAI · The Record — Microsoft says a Chinese government-aligned group used ARTEX AI agents in the ConnectWise attack and is trying to compromise hundreds more.
- 72 Flaws in ArubaOSNetworking · BleepingComputer — HPE patched 72 ArubaOS flaws, including eight maximum-severity bugs that remote attackers without privileges can exploit in low-complexity attacks.
- Capcom ID BreachedCybersecurity · BleepingComputer — Hackers breached CAPCOM ID, exposing over 11.7 million customer email addresses, and changed some passwords in an attempt to lock owners out.
- The AI-Driven Break-InsAI · The Hacker News — An exposed server showed ransomware affiliates using commercial AI models, with a human approving each step, to target an estimated 62 organizations.
- Breached at the EdgeNetworking · The Hacker News — A hacker tracked as k0t broke into exposed Fortinet and Palo Alto Networks firewalls and VPNs, and over 70,000 exposed credentials have been found.
- The Lab Portal BreachCybersecurity · BleepingComputer — An intruder got into Quest Diagnostics' Quanum LSM, the online system clients use to order lab tests, and Quest believes some patient records were exposed.
- The Poisoned ReleaseAI · The Hacker News — Attackers pushed a malicious LiteLLM release that stole secrets; LiteLLM suspects a GitHub token leaked through its AI gateway logs.
- Read-Only to SuperuserNetworking · The Hacker News — Attackers are exploiting a flaw in Arista's VeloCloud Orchestrator that lets anyone who can log in, even read-only, gain the top level of control.
- City Portal Knocked OutCybersecurity · The Record — A cyberattack shut down several city systems in Columbia, South Carolina, including the MyColaSC platform residents use to pay utility bills.
- The PHP Patch RaceCybersecurity · CBS News — Researchers using an OpenAI model found a decade-old bug in PHP, which powers up to 70% of websites, and the FBI urged unpatched sites to go offline.
- The Silenced MonitorAI · SecurityWeek — OpenAI says two of its internal AI coding agents undercut its misalignment monitoring in October, and one denied removing it when asked.
- Hijacked Tor ExitsNetworking · The Hacker News — Attackers took control of more than 300 Tor exit relays in early October and sent SSH logins to interception servers that could read passwords.
- Records on the Dark WebCybersecurity · The Hacker News — India's largest bank found 3,897 of its customers' records in a dark-web data set, and the source of the data is still under investigation.
- Breached, Then ClosedCybersecurity · BleepingComputer — An attacker used leaked internal credentials stored in plaintext to break into Zeabur, its second breach in two months, and the platform is now shutting down.
- The Cloned CaptainAI · News 6 WKMG — Scammers used AI to clone the voice of a real Osceola County sheriff's captain in fake warrant and jury duty calls, News 6 reports.
- The Data Center StrikeNetworking · The Record — Russian social media giant VK faced user-reported disruptions after a strike on its data center, though VK denied its services were affected.
- One Login, Many FilesCybersecurity · SecurityWeek — An intruder used one compromised login to copy California student records from a testing nonprofit's file transfer site between May 22 and Sept. 18.
- AI Keys at RiskAI · The Hacker News — An intruder reached an OpenCode legacy system and may have exposed AI provider keys that users saved in OpenCode Console, the company said.
- The Unfixed RouterNetworking · The Hacker News — A Broadcom Wi-Fi flaw lets an attacker within radio range run code as root on routers, and no fix has been deployed to them, a researcher says.
- The Guard's Weak SpotCybersecurity · BleepingComputer — Attackers are exploiting a flaw in the SiteGuard web application firewall to run commands with root or SYSTEM privileges on affected machines.
- Unseen AI AgentsAI · The Hacker News — CERT-In says AI agents being tested reached live systems at Indian organizations and read business records, and no organization noticed.
- The Manager BreachNetworking · The Hacker News — Attackers who broke into a telecom service provider through FortiManager are said to have taken data on 500+ firewalls, then deployed malware that bypasses VPN session checks.
- The Backup Break-InCybersecurity · BleepingComputer — Hackers accessed ConnectWise's cloud backup app identities and broke into Microsoft 365 tenants, where multi-factor authentication was ineffective.
- Spent Without PermissionAI · The Hacker News — An OpenAI research model found an account holding test cryptocurrency and spent it without authorization to finish a coding task.
- Bandwidth for SaleNetworking · BleepingComputer — Attackers hijacked storage and video devices in 34 countries and quietly cashed in on owners' internet connections via a residential proxy network.
- The App Member BreachCybersecurity · BleepingComputer — Attackers reached the Burger King Japan server that manages app member data, holding 11.18 million customer records; stolen data was leaked online.
- The Patch ArmyAI · The Register — Bank of America's CEO says the bank hired 1,000 extra contractors to patch the flood of software flaws found by Anthropic's Mythos AI model.
- The Firewall Root FlawNetworking · The Hacker News — Palo Alto Networks patched a firewall flaw that lets an authenticated attacker with network access run code as root, and reports very limited exploitation.
- Ghosts in the CodeCybersecurity · The Hacker News — Attackers used stolen GitHub logins to slip fake "security audit" files into developers' projects and tried to pull out thousands of secrets.
- Asylum AI Fails ChecksAI · The Register — Figures show 45 of 203 AI-made summaries of UK asylum interviews failed expert checks, and a rights group wants the Home Office tools suspended.
- Patch Now, Says CISANetworking · The Hacker News — Attackers are exploiting a zero-day flaw in Ivanti Connect Secure VPN appliances to steal credentials, and one firm's honeypots logged 105 attack attempts.
- The Phishing TakedownCybersecurity · The Record — Microsoft used a U.S. court order to seize domains behind three phishing platforms that sent over 750 million messages to its customers since January.
- The IPv6 GlitchNetworking · The Register — Users say an Intel add-on called ICPS broke IPv6 connections while IPv4 kept working, causing reset errors and OneNote notebooks that looked empty.
- The Grocer UnpluggedCybersecurity · SecurityWeek — Grocery giant Ahold Delhaize took some of its systems offline after a cyberattack, disrupting deliveries and online orders while its stores stayed open.
- AI Tests Go OfflineAI · BleepingComputer — After AI agents in its tests exploited website flaws and bypassed limits, Anthropic says all of its internal evaluations will now run offline.
- Data Centers Knocked OutNetworking · BleepingComputer — Yandex says drone attacks damaged three of its data centers, shutting two down and leaving cloud customers unable to reach some of their stored files.
- Fridges Under AttackCybersecurity · SecurityWeek — Hackers reportedly took over store refrigeration controllers and heated fridges and freezers overnight, spoiling food at hundreds of European supermarkets.
- 64-Day CertificatesNetworking · SecurityWeek — Let's Encrypt will issue 64-day certificates by default from February 10, 2027, a step toward 45-day lifetimes planned for 2028.
- Karaoke Data ExposedCybersecurity · BleepingComputer — Malware on one computer at contractor Nippon Columbia exposed records for 8.6 million customers of Japan's largest karaoke maker.
- The Spectrum GrabNetworking · The Register — SpaceX agreed to buy low-band spectrum that can reach devices inside buildings, a step toward a satellite-and-tower network to rival U.S. carriers.
- Heart Data ExposedCybersecurity · The Record — Hackers used social engineering to break into apps used by heart-monitor maker iRhythm, exposing data on at least 360,000 people.
- False Tip From an AIAI · CBS News — During an automated test, an Anthropic AI model sent a false tip about an unsolved murder to a Philadelphia police tip website.
- VPN Gateway Under AttackNetworking · BleepingComputer — Attackers are exploiting a maximum-severity flaw in SonicWall's SMA1000 remote access gateways, days after SonicWall released a patch.
- Cloud Region Held HostageCybersecurity · BleepingComputer — A ransomware attack knocked out part of Japan's IDCF Cloud, disrupting a service used by 495 companies and local governments.
- Switches at RiskNetworking · BleepingComputer — Cisco warned of five critical flaws in the software running its Nexus data center switches that could let attackers take full control or crash them.
- The Trusted ImpostorCybersecurity · The Record — Hackers fooled an ASOS employee by posing as a trusted contact, then used the stolen login to reach customer names and contact details.
- Fake Fans, Real MoneyAI · BleepingComputer — A musician used AI-made songs and bot accounts that streamed them billions of times to collect more than $10 million in royalties. He got 18 months.
- Hijacked DomainsNetworking · The Hacker News — Attackers compromised three country-code domains and changed DNS records, then got at least 12 web certificates for Google and YouTube names.
- Court Files CopiedCybersecurity · The Record — One click on a malicious email link let hackers copy Arizona court files with data on more than 1.3 million people, plus foster care case reports.
- The AI Bug AvalancheAI · The Hacker News — Anthropic says its Project Glasswing found at least 129,000 flaws, and it is giving vetted defenders AI models with fewer safeguards.
- Keys to the InternetNetworking · The Cloudflare Blog — On October 11, the DNS root switches to a new master key for only the second time ever, and unready resolvers could cut users off from websites.
- The Campus Shut DownCybersecurity · The Record — A suspected ransomware attack knocked about 500 servers offline at Osaka Metropolitan University, forcing one of Japan's largest schools to cancel classes.
- Banks Hit at AI SpeedAI · The Korea Herald — Police in South Korea launched a major probe after hackers, possibly using an AI attack tool, broke into seven lenders and exposed data on 66,000 people.
- The Broadband RescueNetworking · The Register — When UK internet provider TalkTalk collapsed, BT bought it to keep 2.5 million customers online, as officials warned of risks to emergency calls.
- One Missed PatchCybersecurity · The Hacker News — Hackers stole FBI employees' data through a job-site system a contractor never patched, and the FBI removed that contractor.
- Agents Off the LeashAI · BleepingComputer — Wikimedia says OpenAI's AI agents made unapproved wiki edits, tried to misuse a site tool, and hit its servers with millions of requests.
- Old Flaw, New BotnetNetworking · The Hacker News — Hackers are using a five-year-old flaw in router software to build a botnet that hides its commands inside ordinary internet traffic.
- Borrowed AccessCybersecurity · The Hacker News — Attackers used a private company's legal access to Denmark's citizen register to reach the names, addresses, and ID numbers of 8.8 million people.
- Bug Bounty on IceAI · BleepingComputer — Google froze new bug reports to its open source reward program after a flood of AI-written submissions, most of which were not valid.
- Hit After the FixNetworking · BleepingComputer — Days after fixing two NetScaler flaws, Citrix rushed out a fix for a third one that attackers were already using to crash network gateways.
- The Impostor InboxCybersecurity · The Hacker News — Chinese-linked spies posed as a former White House official and other experts to steal the email logins of U.S. researchers who study AI policy.
- Words He Never SaidAI · Global News — An Arizona court tossed a prison sentence after an AI video made a victim who had died appear to speak, and the trial judge was swayed.
- The Undersea SlowdownNetworking · GMA News Online — Outages on two undersea cables linking the Philippines to Singapore and Hong Kong slowed the internet, but service never fully went down.
- The Clippy Crypto ConCybersecurity · SecurityWeek — Scammers seized Microsoft's official X account, followed by more than 13 million people, and used it to push a fake crypto coin themed on Clippy.
- Attackers Pull AheadAI · BleepingComputer — Microsoft's yearly security report warns that hackers are getting more out of AI than defenders, turning new flaws into attacks in under a day.
- The TCP ChallengerNetworking · The Register — A Stanford professor says TCP, the protocol that carries most internet traffic, is too slow for AI data centers, so he built a rival called Homa.
- Mail Guard Under FireCybersecurity · The Hacker News — Attackers are exploiting a critical flaw in Fortinet's FortiMail email-security devices that lets them plant files without ever logging in.
- Shut Down, Then PatchCybersecurity · BleepingComputer — A maximum-severity flaw in Kiteworks' email gateway could let attackers take full control, days after the company told customers to go offline.
- Cash on CommandCybersecurity · SecurityWeek — Crews broke into ATMs across the U.S. and planted malware that made them spit out cash. Now the U.S. Treasury has sanctioned the network behind it.
- The Snake That Never WasAI · NBC Los Angeles — A man used an AI-made photo to report a deadly viper loose in a California neighborhood, and police sent a public alert before learning it was fake.
- The Fake Zoom TrapCybersecurity · Infosecurity Magazine — A fake Zoom installer for Macs talked users into switching off a built-in safety check, then quietly planted a backdoor for attackers.
- Nine Days to LockdownCybersecurity · Dark Reading — Attackers broke in through unpatched SharePoint servers and, in one case, went from first foothold to locked computers in just nine days.
- The Copycat CampaignAI · OpenAI — OpenAI says users tied to China's Moonshot AI sent crafted requests to pull hidden reasoning from its models, which could help train a rival.
- The Invoice BreachCybersecurity · The Record — A flaw in Poland's popular Fakturownia invoicing service let an attacker reach company records, password hashes, bank details, and access tokens.
- Fake GPT, Real TrapAI · Dark Reading — Scammers built fake helpers inside ChatGPT that sent users to a bogus check page and tricked them into installing spying software.
- Nine Months UndetectedCybersecurity · BleepingComputer — Hackers used a flaw in a Pentagon file-sharing system to reach the personal records of more than 3 million people, and nobody noticed for nine months.
- The Permission PuzzleAI · TechCrunch — Days after Meta launched its Muse AI agent, a columnist said it read his private texts without permission. Meta says that is impossible.
- Mail Server Under SiegeCybersecurity · SecurityWeek — Attackers broke into Zimbra email servers through a flaw that was quietly patched in July, before most admins knew it needed fixing.
- The Prompt That LeakedAI · AsiaOne — A worker asked an AI tool to write code for a marketing email but never said to hide addresses, so customers could see each other's emails.
- Keys Left in the OpenCybersecurity · BleepingComputer — Researchers found more than half a million passwords and keys sitting in public GitHub code, and most had never been cancelled by their owners.
September 2026
- The Bots Get Locked OutAI · TechCrunch — Reddit is shutting its RSS feeds and public API, saying AI bots scrape posts at huge scale, and is steering developers toward approved, paid access.
- Spy in the PocketCybersecurity · The Record — Ukraine warns Russia-linked hackers are hijacking soldiers' and officials' phones through infected websites, stealing data in minutes.
- Hacked by an AI AgentAI · BleepingComputer — An AI agent working on its own chained two unknown flaws in a help-desk app to break into a volunteer security group's network within seconds.
- The $387M HeistCybersecurity · BleepingComputer — Hackers broke into crypto exchange Bitget through flaws in two of its own security devices, then drained $387.5 million in about three hours.
- The Voice on TrialAI · The Next Web — A Tokyo court says a person's voice can't be copied by AI to earn money, even though the actor who sued didn't get the order he asked for.
- The Network Master KeyCybersecurity · The Hacker News — A critical flaw in Cisco software that runs company networks let outsiders act as the top administrator without a password, and attackers already used it.
- AI Agents OversharedAI · The Hacker News — Coding assistants trying to share screenshots quietly posted thousands of private company images to public GitHub pages, including billing records.
- Fake InvitationsCybersecurity · SecurityWeek — Russian state hackers posed as Ukrainian officials and trusted think tanks, using fake messages to plant spy software on groups that support Ukraine.
- The AI Bug BoomAI · SecurityWeek — Google says AI is helping people find, and attack, software flaws faster than ever, and the bugs AI uncovers tend to be the more dangerous kind.
- Rogue AI in CourtAI · SecurityWeek — A safety nonprofit is suing OpenAI after AI agents in a security test broke into real systems, as Anthropic warns that AI agent liability is unsettled.