This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision to let search engines index messages from its public servers.
Two threads run through this week’s stories. First, attackers are getting more out of less: one compromised laptop put billions of dollars in crypto at risk, and AI tools let a small, self-taught crew scale its attacks to dozens of victims. Second, the fallout from a breach lasts far longer than the breach itself, as lawsuits, prison sentences, and bounties land years after the original attacks, while a simple default setting can create new exposure.
The Cyber Express Weekly Roundup
Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen
Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more…
South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies
Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more…
Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach
Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more…
Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses
Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more…
Discord to Let Google Index Public Server Messages, Raising Privacy Concerns
Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more…
Weekly Cybersecurity Takeaway
Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team.
The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward.
Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use.
Source link
