Security news this week: LastPass users’ data has been stolen again

Wired investigation Offers this week Insight into predictive policing software in Bristol, England, which included 23 separate models over more than a decade, aimed to capture the probability that specific individuals would commit or be victims of various crimes. The investigation relies on data from public records requests and other reports to uncover a chaotic law enforcement apparatus that has real implications for the community — but which most people in the area know nothing about.

After identities Members of Peter Thiel’s “Dialogue” group Revealed last week, the organization claimed that a “criminal” hacker was behind the hack. But evidence shows that members’ personal information, including information… A White House intelligence official and an active-duty special operations officer-It was publicly available and likely It was detected as a result of a misconfiguration of the Dialog website.

As Anthropic and the White House continue to negotiate a path for the latest Claude Mythos 5 and Fable 5, the company’s critics have pointed out that Anthropic appears to… Power builds up quickly— a strategy the company says is essential for AI safety and responsible development. On Friday evening, the White House gave Anthropy permission Made Mythos 5 available again to select groups From US companies and government agencies.

Amid the turmoil, OpenAI this week launched an improved version of its limited-edition GPT-5.5-Cyber ​​model, as well as a large-scale effort called “Patch the Planet” — to fix the planet. Support open source projects on patching security vulnerabilities And other security issues as AI accelerates bug detection as well as exploit development. With the escalation of the arms race in the field of artificial intelligence between China and the United States, WIRED met with several of China’s top AI experts It found that both sides are concerned about the threat of a “Chernobyl moment.”

Meanwhile, with the knockout stage of the World Cup approaching, scams related to the huge football tournament are abound It is becoming more difficult to detect.

And there’s more. Every week we round up security and privacy news that we haven’t covered in depth ourselves. Click on the titles to read the full stories. And stay safe out there

Password manager LastPass has faced a series of significant data breaches over the years, and now there’s another hack to add to the list. This week the company Informed customers From the breach, it included names, phone numbers, email addresses, physical addresses, support status data, and sales-related data. The attack was the result of a Breakthrough at AI business company Klue. Attackers compromised access tokens for Klue customers, including LastPass, and then used them to obtain data from Salesforce and other integrated platforms. LastPass confirmed that the situation was not a breach of its infrastructure and did not affect password vaults.

“We recommend that customers remain vigilant about potential phishing attacks or social engineering attempts, which could take advantage of exposed contact details,” LastPass wrote in its customer notice. “Always exercise caution with unsolicited communications, including emails, phone calls, or requests for sensitive information.”

John Bolton, the former national security adviser, pleaded guilty Friday to one count of mishandling and unlawful retention of classified defense information. Bolton, 77, reached a plea agreement that could allow him to avoid prison time, although the agreement recommends a prison sentence of no more than five years. U.S. District Judge Theodore Chuang in Maryland is scheduled to decide on sentencing at a hearing scheduled for October 28. Bolton served in Trump’s first administration but later became a prominent critic of President Donald Trump. As part of the deal, Bolton also agreed to pay a $2.25 million fine, but can withdraw his guilty plea if Chuang decides to impose a larger fine or longer prison sentence than the deal recommends.

Microsoft, Europol and other partners Announce On Wednesday, they disabled the infrastructure of Amadey and StealC, malware considered central to the cybercrime ecosystem. This work was part of Operation Endgame, which targets platforms and tools that facilitate ransomware and other cybercrime. The action involved identifying, mapping, seizing and removing the malware infrastructure, including actions against 326 servers and 142 domains. The operation identified approximately $47 million in stolen cryptocurrencies and recovered up to 27 million stolen access credentials. Microsoft confirmed that the action was enabled by innovative technologies including AI-assisted analysis that showed that Amadey and StealC rely on the same back-end infrastructure and can be targeted together.

The Australian Security and Intelligence Organization (ASIO) said this week it is establishing teams focused on combating nation-state cyberattacks on critical infrastructure after actors were found within the country’s systems. “We have discovered that nation-state hackers have infiltrated the network of an Australian critical infrastructure provider,” Mike Burgess, director general of ASIO, said in remarks on Wednesday. “ASIO assessed that the hackers were preparing for sabotage…. They were mapping the network and maintaining access to it so they could disrupt it at a time of their choosing.”

Burgess spoke alongside ASIO’s release Annual threat assessment. “In this case, the state-sponsored group not only gained access to an Australian critical infrastructure provider, but succeeded in obtaining credentials – login details and passwords – of active users of the networks, including the IT professionals guarding them,” he added.