IT Security News Roundup: 2026-11-14 Overnight

IT Security News: Overnight roundup, 2026-11-14

Summary

The most consequential thread in this window is third-party exposure. A breach at a service provider reached nearly 196,000 Baker Tilly clients, a third-party technology provider's records exposed Uber driver data, and attackers abused ScreenConnect on more than 100 servers. Several stories also show attackers hiding behind trusted names and tools, from fake crypto exchange labels to a returning extortion group stealing Microsoft access tokens. AI appears on both sides, as a fraud multiplier and as part of malware operations. For readers, the lesson is that a breach can start outside your own perimeter, so vendor, remote-access, and identity controls deserve as much attention as your own defenses.

1. Baker Tilly disclosed that an unauthorized party took clients' and their dependents' personal data from a third-party platform it uses for client services, discovered on September 6, 2026. A Texas filing lists 10,456 residents, and the same filing reports 195,512 affected nationwide, including Social Security numbers.
2. Uber confirmed that hackers accessed records held by third-party provider Fireworks AI, exposing driver's license details of thousands of U.S. drivers. Uber is notifying those affected but has not disclosed a nationwide total.
3. In a podcast interview, BrandShield CEO Yoav Keren explains how AI lets criminals cheaply run pixel-perfect fake stores, fake ads, and AI-run accounts at scale. He notes that over 30% of scam victims won't buy again from the impersonated brand.
4. DysruptionHub's free Cyber Incident Registry now holds more than 600 researched profiles after backfilling two years of past coverage. Sustainers can also follow ongoing reporting on those incidents.
5. Huntress found unauthorized sessions on more than 100 ScreenConnect servers, disguised with crypto exchange names. The fake sessions could serve as bait for technicians.
6. AWS disclosed CVE-2026-126793, an untrusted search path in the Advanced Go Wrapper's Aurora PostgreSQL dialect detection. A crafted function can let an authenticated user escalate privileges, even to rds_superuser, when another user connects. Versions before the July 29, 2026 release are affected.
7. ConnectWise disabled five third-party ScreenConnect extensions across roughly 400 partner environments after researchers linked a worm-like toolkit to one of them. The campaign reportedly spread through the add-on ecosystem.
8. Five more fugitives, four men and one woman, were added to the EU Most Wanted list over the 2022 robbery at TEFAF, the European Fine Art Fair in Maastricht. Dutch prosecutors and police announced the listing as of October 29, 2026.
9. ArcticRAT, an Android malware family, has expanded from crypto theft to full device control. Its operators now analyze stolen information with AI to profile victims' finances.
10. Microsoft's Security Blog describes SCKit, which abuses ScreenConnect to deploy unauthorized remote access and target technician sessions. The post covers the attack chain, mitigations, and Microsoft Defender XDR hunting queries.
11. The CISOSeries "Department of Know" discussion covered N-able zero-days, Signal's formal verification work, and the aftermath of an NHS breach. The source is a show roundup, so it offers few specifics.
12. TSMC reportedly leaked personal data of 46,000 employees after hackers offered 6.9GB of records on an underground forum. TSMC says it found no evidence of intrusion into its systems. The source is an automated translation of a Chinese report.
13. Microsoft is investigating a widespread outage affecting Outlook, Microsoft Teams, and Copilot, with users reporting connectivity problems worldwide. The short report does not give a root cause.
14. The FAA grounded US flights nationwide, citing extraordinary safety concerns tied to air traffic control communications problems. The article is aimed at travelers who want to know what to expect.
15. The Luna Moth extortion group is retargeting law firms that refused to pay its earlier ransom. It uses social engineering to steal Microsoft access tokens.
16. K7 CyberSecurity's briefing, released November 12, 2026, says India's DPDP Act can make a ransomware attack that locks corporate systems a reportable personal data breach, even if no data is stolen.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Baker Tilly Discloses Third-Party Data Breach Affecting Nearly 196,000 Individuals
2. Uber Confirms Data Breach – Hackers Stole Users’ Personal Information
3. AI Fraud is Breaking the Internet
4. Resource: DysruptionHub’s Cyber Incident Registry completes its historical backfill
5. Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers
6. CVE-2026-126793 – Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
7. Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
8. Five TEFAF robbery suspects added to EU Most Wanted
9. ArcticRAT Cybercrime Gang Profiles Victim Finances With AI
10. SCKit abuses ScreenConnect to deploy remote access and target technician sessions
11. The Department of Know: N-able's zero-days, Signal's formal verification, NHS post-breach fallout
12. TSMC has reportedly leaked the personal data of 46,000 employees, but emphasized that no evidence of intrusion was found in the system.
13. Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide
14. FAA Grounds US Flights Nationwide, Citing ‘Extraordinary’ Safety Concerns
15. Extortion Group Luna Moth Flits Into Law Firms a Second Time
16. Ransomware Without Data Theft Can Still Trigger Mandatory Breach Reporting Under India’s DPDP Law: K7 CyberSecurity