SentiLink has earned FedRAMP® Certification, boosting its identity intelligence solutions for government benefit program security and fraud prevention.

About 1.1 million people have sought credit warnings since personal data was stolen from Denmark’s CPR register, DR reports. The number with a warning has risen from nearly 250,000 to almost 1.4 million. The breach exposed the names, addresses and CPR numbers of around 8.8 million people. A credi…

Linda Geddes, a science journalist, has uncovered a sophisticated impersonation scheme where an individual is using her name and email to pitch articles to major publications, including Nature and Science. The fraudster, dubbed 'Fake Linda,' has successfully had articles published under her name, including one in the New York Post that was later removed after she raised concerns. Geddes discovered that the impersonator's email address linked to another journalist, Caroline Williams, who was also targeted with a similar scheme. The fraudster appears to be using AI-assisted writing for pitches, with some unsuccessful attempts to secure articles. The situation has raised significant concerns about the vulnerability of professional reputations in the digital age, particularly as AI tools make impersonation easier. Geddes notes that the motive remains unclear, as freelance science journalism is not highly lucrative, but the impersonator may be attempting to boost earnings by leveraging established journalists' reputations. The Society of Authors and Writers' Guild have warned of similar scams targeting writers, with some losing thousands of pounds to impersonators posing as literary agents. Publishers like Nature and Science are now implementing AI detectors and requiring video calls to verify new contributors. Despite these measures, the impersonator remains unidentified, and Geddes has reported the incident to UK fraud authorities. The case highlights the growing threat of AI-facilitated identity fraud in professional contexts, with potential consequences for both individuals and the credibility of media outlets.

National Police arrested 40 foreigners attempting to reach Algeciras from Ceuta using third-party ID cards in a targeted port crackdown.

AI voice cloning and deepfakes are transforming cybercrime. Discover how criminals can impersonate CEOs, public figures and trusted contacts, and learn how organisations can detect, prevent and respond to sophisticated AI-powered scams.

More than 700,000 people added credit alerts to their CPR records in the week after authorities disclosed a leak of 8.8 million CPR numbers, DR reports. The number of people with an alert rose from just under 250,000 on October 1 to about 970,000 on Wednesday. A credit alert is a voluntary flag i…

  A cyberattack on Polish healthcare software company Qbusoft has left patient records from its Medyc platform potentially in the hands of attackers, coming just weeks after a separate, larger breach hit another Polish medical software provider and rattled the country's entire health data infrastructure. The attacker exploited an SQL injection vulnerability in Medyc's application interface during late August, according to a breach notification published last week by the Addiction and Psychiatric Treatment Center in Inowrocław, one of the healthcare facilities running the platform. SQL injection is one of the oldest and best-documented attack techniques in security research, allowing an attacker to manipulate a web application into pulling data directly from its database. Despite decades of awareness about the flaw, it remains a recurring entry point in healthcare system compromises. Qbusoft confirmed on Friday that the attackers obtained names, national identification numbers, home addresses, phone numbers and email addresses. In Poland, the national identification number, called a PESEL, functions similarly to a Social Security number in the United States and is a standard credential for identity verification across government services, banking and healthcare. Its theft puts affected patients at real risk of identity fraud. The company said it had not confirmed the theft of clinical records. But the Inowrocław center told patients that Qbusoft found evidence the attacker ran scripts specifically targeting database tables containing medical information, making it "highly likely" that medical records were also pulled. The data in scope for that facility included hospital treatment records and discharge summaries from patients treated at its Day Treatment Unit for Addiction Treatment between July 2024 and August 2026. The intrusion occurred on August 22-23 and went undetected until the night of September 8-9, a gap of more than two weeks. By that point, the attacker had already transferred an encrypted archive of the database outside Qbusoft's systems. Some fields, including names and PESEL numbers, had been encrypted in the database. Qbusoft nonetheless advised the affected center to assume the attackers could decrypt that information without difficulty, given the specifics of how the protection was implemented. Qbusoft patched the vulnerability on the day the breach was detected, restricted database access permissions, rotated passwords and technical credentials, and introduced additional monitoring. The company has not publicly commented on the incident through any official statement. That silence drew a sharp response from Digital Affairs Minister Krzysztof Gawkowski, who said the Central Bureau for Combating Cybercrime had opened an investigation and criticized Qbusoft for failing to notify CERT Polska or the national incident response team for the healthcare sector before authorities reached out. "Hiding attacks by companies is the biggest mistake, as it always puts citizens at risk," Gawkowski said. Poland's data protection authority separately announced that its president had ordered a formal audit of Qbusoft. Medyc, which has operated as a cloud-based platform since 2014, is used across Polish medical practices and clinics for electronic medical records, patient scheduling, electronic prescriptions, referrals, sick notes, telemedicine and administrative billing. In a public notice, the company warned that its infrastructure had faced repeated attack attempts since the incident and that users might see temporary slowdowns or restricted access to certain modules. The Same Attacker? Polish cybersecurity publication Zaufana Trzecia Strona reported that a person or group using the alias "fingerprint" contacted the outlet claiming responsibility for the Medyc attack. The publication had previously linked that alias to the MyDr breach, a separate incident involving another Polish healthcare software vendor. Polish broadcaster RMF FM also reported that the same attackers behind MyDr were likely responsible for the Medyc intrusion, though Polish authorities have not formally attributed the attack to any individual or group. The alleged attacker claimed to have obtained records on 5 million patients and 8 million private photographs, some of which Zaufana Trzecia Strona said may depict patients in sensitive medical settings. Neither figure has been independently confirmed, and the stolen data has not been made public. The actor reportedly framed the operations as an effort to expose weak security rather than profit from the data. The MyDr breach, confirmed in August, potentially affected close to 19 million people across more than 12,000 healthcare facilities, involving over 2 terabytes of stolen data including names, PESEL numbers, prescription histories, diagnoses and appointment records. Poland has roughly 36.5 million residents, meaning the MyDr incident alone touched the records of nearly half the country's population. The Inowrocław treatment center caught up in the Medyc breach was also among the organizations affected by MyDr. Gawkowski said Polish authorities had observed a surge in criminal activity targeting healthcare organizations in recent weeks and were preparing new regulations in response, including mandatory security certification for healthcare technology companies and tighter controls on how private vendors handle medical data. Poland recorded a 144 percent year-on-year rise in reported cybersecurity incidents in 2025. The consecutive breaches of Medyc and MyDr, both software vendors connecting thousands of clinics to national health infrastructure, have made clear that the weakest link in Poland's health data chain is not the government platform but the private companies sitting in front of it.

✓ Darknet monitoring can help assess the alleged IDScan breach, the 153 million-license claim, identity theft risks, and practical exposure detection steps.

https://www.osintinvestigate.com More than 153 million U.S. and Canadian driver’s license images were reportedly offered on the dark web, alongside millions of other identity documents. In this episode, we examine the alleged Nexus data leak, the possible connection to identity verification company IDScan.net, the FBI investigation, and the growing risks surrounding digital identity verification. We also discuss what businesses should do to protect identity data and how individuals can reduce their exposure to identity theft and fraud.

ALT: a young boy wearing a blue shirt with a heart on it