Check Point Report Details Breaches at Danish Registry, ASOS, and Osaka University
A weekly bulletin from Check Point Research outlines major data exposures in Denmark and Japan, alongside new exploits in enterprise software.
Key points
- Denmark’s Central Register breach exposed data for 8.8 million people via a supplier.
- ASOS and Osaka Metropolitan University confirmed significant data and service disruptions.
- Vendors Veeam, Citrix, Cisco, and Atlassian released patches for critical flaws.
Check Point Research published its threat intelligence bulletin for the week of October 12, detailing multiple significant cyber incidents and software vulnerabilities. The report highlights major data breaches affecting government registries, retail corporations, and educational institutions across Europe and Asia. It also documents new exploits targeting enterprise infrastructure.
Denmark’s government disclosed a security incident involving its Central Register of Persons. Unauthorized actors exploited credentials provided to a private supplier to access the system. The breach reportedly exposed names, addresses, and identification numbers for approximately 8.8 million individuals registered in the national database. This represents a substantial exposure of citizen data.
UK fashion retailer ASOS confirmed a cyberattack that compromised employee credentials. Attackers used these stolen credentials to access third-party platforms and obtain customer names and contact details. The group Xuanye claimed responsibility for the intrusion. Attackers also sent unauthorized push notifications to users of the company’s mobile application, disrupting normal service operations.
ATB, the largest grocery retailer in Ukraine, faced a cyberattack that disrupted its online services. The DataSuckers group posted an extortion demand on the retailer’s website. The threat actors claimed to have stolen records belonging to 7.9 million customers. These records include names, addresses, passport information, and order histories.
Osaka Metropolitan University, one of Japan’s largest universities, sustained a suspected ransomware attack. The intrusion disrupted classes, internal networks, email systems, and administrative functions. Approximately 500 servers were affected by the malware. Personal information belonging to at least 130,000 individuals may have been exposed during the incident.
Emerging Attack Techniques
Researchers documented an AI-assisted intrusion campaign targeting South Korean financial institutions. The attackers used the ARTEX toolkit to facilitate data theft. Exposed directories revealed Claude Code session histories and Chinese-language prompts. The operation allegedly involved AI workflows to streamline the theft, with plans to sell the stolen information.
A new phishing campaign targets both employees and AI-powered email assistants. Malicious emails combine traditional lures with hidden prompt injections in HTML comments. These invisible instructions attempt to induce unauthorized disclosure of information. The technique exploits the integration of AI tools in corporate communication workflows.
Researchers profiled CyberXero, an AI-augmented initial access broker. The group targets Ukrainian energy infrastructure and conducts automated attacks against WordPress sites. CyberXero has obtained information belonging to more than 628,000 Ukrainian individuals. The operation combines automated exploitation with AI agents to scale its activities.
Software Vulnerabilities and Patches
Veeam released security updates for Backup & Replication version 12. The patch addresses CVE-2025-64393, a critical remote code execution flaw rated CVSS 9.4. Low-privileged backup users can execute commands on affected servers. Versions before build 12.3.2.4934 are vulnerable to this exploit.
Citrix confirmed targeted exploitation of CVE-2026-88779, a high-severity memory overflow in NetScaler ADC and Gateway appliances. The flaw, rated CVSS 8.7, affects SAML authentication configurations. It could cause denial of service. Security updates are available for affected versions.
Cisco released updates for critical vulnerabilities in NX-OS software. CVE-2026-76455 is an improper access control flaw rated CVSS 9.8. Successful exploitation allows unauthorized access to affected network infrastructure. Atlassian also patched CVE-2026-21589, a critical arbitrary file access issue in self-managed Data Center products.
What should you do?
Organizations should audit third-party vendor access to sensitive registries and customer databases. Review authentication logs for unusual activity, especially from AI-assisted tools. Apply vendor patches for Veeam, Citrix, Cisco, and Atlassian products immediately. Monitor for unauthorized push notifications or service disruptions.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: Check Point Research
- Audit access permissions for all third-party suppliers connected to critical databases.
- Review logs for AI tool usage to detect prompt injection attempts.
- Patch Veeam, Citrix, Cisco, and Atlassian systems to mitigate known CVEs.
- Monitor customer communication channels for unauthorized notifications.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Danish registry breach?
Approximately 8.8 million individuals had their names, addresses, and identification numbers exposed.
Which threat group claimed responsibility for the ASOS attack?
The Xuanye threat group claimed responsibility for the cyberattack on ASOS.
Is there a fix for the Veeam remote code execution flaw?
Yes, Veeam released security updates for Backup & Replication version 12 addressing CVE-2025-64393.
