https://steelwise.uk/filings/ Practical thinking on security, infrastructure, and AI from Steelwise. en-gb Thu, 15 Oct 2026 07:30:10 GMT https://steelwise.uk/filings/master-of-malt-was-not-hacked-an-app-plugged-into-its-shop-was https://steelwise.uk/filings/master-of-malt-was-not-hacked-an-app-plugged-into-its-shop-was Thu, 15 Oct 2026 00:00:00 GMT Attackers took Master of Malt customers' names, addresses, phone numbers, and emails over four days. They never broke into the retailer. They stole a key held by a third-party app connected to its online shop. Most businesses have apps like that and no list of them. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/ask-who-pays-the-ransom-before-you-hire-a-recovery-firm https://steelwise.uk/filings/ask-who-pays-the-ransom-before-you-hire-a-recovery-firm Wed, 14 Oct 2026 00:00:00 GMT After a ransomware attack you will be offered help by firms you have never heard of, some promising to recover your files without paying the criminals. US prosecutors say one of them secretly paid the ransom and billed clients many times over. The questions to ask before you sign, and the people to line up before you need them. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/a-real-microsoft-page-a-real-code-and-a-stranger-in-your-inbox https://steelwise.uk/filings/a-real-microsoft-page-a-real-code-and-a-stranger-in-your-inbox Tue, 13 Oct 2026 00:00:00 GMT A phishing service called EvilTokens got into 12,000 inboxes at 10,000 organisations without stealing a single password. It asked people to type a short code into a genuine Microsoft sign-in page. Most businesses can switch that route off. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/a-billing-alert-is-not-a-spending-limit https://steelwise.uk/filings/a-billing-alert-is-not-a-spending-limit Mon, 12 Oct 2026 00:00:00 GMT Most cloud and AI services bill by usage and will keep billing until somebody notices. An email at midnight does not stop that. AWS and Google Cloud have both now added hard spending caps that pause the service when the money runs out. What they do, what they do not, and how to cap the services that offer nothing. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/the-backup-that-saved-the-data-and-lost-the-evidence https://steelwise.uk/filings/the-backup-that-saved-the-data-and-lost-the-evidence Fri, 09 Oct 2026 00:00:00 GMT An NHS Trust reused a script, pointed it at the wrong database, and overwrote 11 years of maternity records. The clinical data came back. The record of who had looked at it did not, and that is the part most businesses never back up either. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/one-borrowed-login-turned-the-asos-app-into-the-ransom-note https://steelwise.uk/filings/one-borrowed-login-turned-the-asos-app-into-the-ransom-note Thu, 08 Oct 2026 00:00:00 GMT ASOS says an attacker talked one employee out of their login, then used it on outside platforms the retailer relies on to reach its customers. Nobody broke into the shop. The question for every business is which outside services can message your customers or read your customer list, and whose login opens them. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/why-ai-defence-wont-cancel-out-ai-attackers https://steelwise.uk/filings/why-ai-defence-wont-cancel-out-ai-attackers Thu, 08 Oct 2026 00:00:00 GMT Attackers can point AI at a purely technical problem and let it run. Defence is held up by budget, change approval, and the fear of breaking production, which no product fixes. Why the answer to AI-assisted attacks is not an AI security product. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/the-test-site-that-holds-your-real-customers https://steelwise.uk/filings/the-test-site-that-holds-your-real-customers Wed, 07 Oct 2026 00:00:00 GMT Somebody needed to test a change, so they copied the live customer database into a test site. That was months ago. The test site is still running, still reachable, and still full of real people. Nobody owns it, because it was never meant to exist this long. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/what-septembers-microsoft-updates-broke-and-how-to-fix-each-one https://steelwise.uk/filings/what-septembers-microsoft-updates-broke-and-how-to-fix-each-one Tue, 06 Oct 2026 00:00:00 GMT September's Microsoft updates stopped backups, broke VPN connections, deactivated older copies of Office, and sent saved PDFs to the wrong place. Five problems, the workaround for each, and why the answer is still not to stop updating. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/four-ways-in-through-the-front-door-in-one-fortnight https://steelwise.uk/filings/four-ways-in-through-the-front-door-in-one-fortnight Mon, 05 Oct 2026 00:00:00 GMT In two weeks, attackers were found exploiting flaws in Citrix NetScaler, Fortinet FortiMail, Check Point firewalls, and MikroTik routers. All four sit at the edge of a network, facing the internet. The useful question is what sits at the edge of yours, and who patches it. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/the-supplier-that-stopped-existing-and-the-script-that-did-not https://steelwise.uk/filings/the-supplier-that-stopped-existing-and-the-script-that-did-not Fri, 02 Oct 2026 00:00:00 GMT Your website's page source still names companies that no longer exist. The script tag keeps working, or keeps failing quietly, and nobody notices either way. Then somebody buys the dead supplier's domain, and they decide what runs in your visitors' browsers. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/get-cyber-essentials-before-someone-makes-you https://steelwise.uk/filings/get-cyber-essentials-before-someone-makes-you Thu, 01 Oct 2026 00:00:00 GMT Cyber Essentials is still voluntary for most UK businesses. Supply chain pressure and new legislation are both closing that window, and certifying on your own timetable is cheaper and calmer than certifying on somebody else's. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/what-makes-a-backup-a-backup https://steelwise.uk/filings/what-makes-a-backup-a-backup Wed, 30 Sep 2026 00:00:00 GMT A mirrored disk is not a backup. A sync folder is not a backup. Four properties separate a copy of your data from something that will still be there after a bad week, and most inherited setups are missing at least two. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/four-in-800-recovered-on-time https://steelwise.uk/filings/four-in-800-recovered-on-time Tue, 29 Sep 2026 00:00:00 GMT An incident response firm's data from over 500 ransomware recoveries found almost nobody hits their own recovery target. The reasons are checkable: recovery plans depend on Active Directory, the same system attackers usually seize first, and 95% of clients had no real multi-factor authentication on the consoles used to manage their infrastructure. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/two-wordpress-plugins-two-compromises-one-week https://steelwise.uk/filings/two-wordpress-plugins-two-compromises-one-week Mon, 28 Sep 2026 00:00:00 GMT An unauthenticated remote code execution flaw in a WooCommerce plugin, and a backdoored update to a completely unrelated admin plugin, hit WordPress sites this week for different reasons. Neither has anything to do with WordPress itself. Here is what to check if you run a WordPress or WooCommerce site. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/your-chatbot-can-email-people-on-your-behalf https://steelwise.uk/filings/your-chatbot-can-email-people-on-your-behalf Fri, 25 Sep 2026 00:00:00 GMT A researcher earned over 50,000 US dollars finding ways to trick AI customer-service chatbots into emailing phishing messages from a company's own trusted address. The bug is not what the chatbot says. It is what you let it do. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/what-gdpr-still-requires-when-ai-does-the-processing https://steelwise.uk/filings/what-gdpr-still-requires-when-ai-does-the-processing Thu, 24 Sep 2026 00:00:00 GMT Staff are already pasting customer details into ChatGPT, Copilot, and Claude to draft emails and summarise documents. UK GDPR still applies to every bit of that personal data, and the law was written before any of these tools existed. Here is what a director is still on the hook for. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/the-verification-prompt-that-tells-you-to-open-run https://steelwise.uk/filings/the-verification-prompt-that-tells-you-to-open-run Wed, 23 Sep 2026 00:00:00 GMT A fake CAPTCHA or error message asks the visitor to copy a short command and paste it somewhere to prove they are human or fix a problem. It works on Windows and on Mac, and it does not need anyone to open a file. Here is what to tell staff, and what IT should check this week. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/parliament-says-uk-ai-rules-are-not-fit-for-purpose https://steelwise.uk/filings/parliament-says-uk-ai-rules-are-not-fit-for-purpose Tue, 22 Sep 2026 00:00:00 GMT A parliamentary committee has told the government that the UK has no AI law worth the name, just a patchwork of existing rules and voluntary promises from AI companies. For any business already using AI without a clear policy, that gap is the whole point. contact@steelwise.uk (Carl Heaton) https://steelwise.uk/filings/ai-agents-attacked-rubygems-and-nobody-noticed-for-months https://steelwise.uk/filings/ai-agents-attacked-rubygems-and-nobody-noticed-for-months Mon, 21 Sep 2026 00:00:00 GMT In May 2026, autonomous OpenAI agents flooded RubyGems.org with malicious packages and gained code execution on RubyDoc.info's servers. Nobody worked out who was behind it until September. What this means if your stack depends on a package registry. contact@steelwise.uk (Carl Heaton)