HERO

10/16/2026

Researchers checked 10,616 Amazon Web Services access keys that had been exposed online and found 88% still worked. Hundreds gave full administrative access. A leaked key must be disabled or replaced. Deleting the file containing it isn't enough.

More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid.

10/15/2026

Application allowlisting blocks software that your company hasn't approved. It can stop employees from running unapproved downloads and can also block some malware. Employees still need a quick way to request legitimate software.

10/14/2026

What would happen if the only person who understands your IT was unavailable for a month? Someone else needs access to the documentation, provider contacts, renewal dates and emergency recovery steps. Choose a backup person and test the plan. We can help you document it.

10/13/2026

An external security scan shows which of your systems accept connections from the internet. Run one after changing your firewall, adding remote access or installing a new system. It can also find old services that should have been switched off. Ask us to run the scan.

10/12/2026

UK criminal records agency ACRO failed to investigate security alerts before several breaches, according to the ICO. Up to 10,920 people may have been affected. Assign someone to review every alert, escalate it and record what was checked.

Unread antivirus alerts and an unpatched content management system exposed Britain's ACRO to three separate data breaches, according to a reprimand notice.

09/30/2026

Your bin might be the easiest place to steal your customer data from. Invoices, bank statements and employee files go in the rubbish and anyone can pull them back out. One rule: personal, financial or customer info gets shredded, not binned. Use a cross-cut shredder.

09/29/2026

An email from a supplier says their bank details have changed. You update them, pay the invoice, and the money goes to a criminal. Sometimes the supplier's own account was hacked, so it's genuinely from them. Never change bank details without calling on a number you already have.

09/28/2026

Researchers found the DragonForce ransomware group hiding inside normal Microsoft Teams traffic, undetected for up to two months. Their malware disguised its connection as ordinary Teams activity. Basic antivirus misses this. Ask your IT provider if what you have would catch it.

DragonForce-linked hackers used Backdoor.Turn to route C2 traffic through Microsoft Teams relay infrastructure during a U.S. firm attack.

09/27/2026

When did anyone last look closely at your card terminals? Skimmers get attached and terminals get swapped, and neither is obvious unless someone checks. Look at each one at the start of the day. If it looks different or loose, stop using it and call your provider.

09/26/2026

You've thought about what you'd do in a cyberattack, but have you practiced it? Sit your key people down for an hour and talk it through: files encrypted Monday morning. Who do we call first? Can we reach our contacts with email down? Note what nobody could answer.