Social engineering breaches expose data at major US law firms
Holland & Knight says a threat actor used social engineering to gain remote access to a firm computer, exposing Social Security numbers in a small number of files. Squire Patton Boggs disclosed a separate limited data exposure, while Nelson Mullins said attackers copied documents accessible from one user's laptop.
Why it matters to you
Remote access should require verified ticket context, phishing-resistant MFA and explicit approval for privilege elevation. Limit local document access, record support sessions and retain identity and endpoint telemetry outside the affected account so a single persuaded user cannot silently expose an entire workspace.
Contractor admits helping divert $2.5 billion of restricted AI servers
A contractor linked to Super Micro pleaded guilty to charges involving the illegal export of servers containing Nvidia B200, H100 and H200 accelerators to China. Prosecutors say the scheme used false records and staged dummy servers to conceal the diversion of approximately $2.5 billion in technology.
Why it matters to you
Infrastructure custody needs cryptographic serial-number records, purchaser and destination verification, exception approval and physical audits. Reconcile shipping, rack-discovery and network telemetry so exported or resold hardware cannot disappear behind paperwork alone.
Only 3.6% of reviewed Chinese AI releases disclosed model-specific safety tests
SemiAnalysis reviewed 857 releases from nine major Chinese developers and found public model-specific safety results for 31 of them. Only nine had results available at or before launch; the study measures public disclosure and does not establish whether the remaining models were tested privately.
Why it matters to you
A general safety statement is not deployment evidence. Before using a model in SaaS workflows, require version-specific evaluation results for privacy, jailbreak resistance, tool use and dangerous capabilities, then reproduce the tests against your own data, permissions and failure modes.
EU says its AI Act already covers rogue-agent risks
EU technology chief Henna Virkkunen says the AI Act covers the full lifecycle of capable models and can address risks from autonomous agents. The Commission is assessing safety, transparency and copyright information requested from more than 30 AI companies, with potential fines reaching 7% of global annual turnover.
Why it matters to you
European SaaS builders need continuous evidence, not a one-time launch review. Maintain model and tool inventories, approval and revocation records, post-deployment monitoring, incident logs and a documented owner for every agent that can access customer data or external systems.
A second Yandex data-centre strike leaves a cloud backup unreachable
A second consecutive drone attack partly disabled Yandex's Kaluga data centre after the previous day's shutdown in Sasovo. One SaaS operator told Reuters that its 8,000 users remained locked out and its backup database could not be reached or restored elsewhere through Yandex Cloud.
Why it matters to you
A backup inside the same provider is not a complete recovery strategy. Keep immutable copies in an independently administered account or provider, export the metadata and keys needed for restoration, and regularly prove that a clean environment can recover without the primary cloud's control plane.