Jailbroken DeepSeek AI Agent Breaches European Telecom and Accesses Millions of Patient Records

Cybersecuritynews •Kavichselvan • November 9, 2026

A jailbroken DeepSeek AI agent spent more than two weeks breaking into a European telecom provider and 13 companies hosted on its systems. It reportedly reached millions of healthcare records along the way. Researchers at Malbear Labs call the campaign “Operation Snowball.” They found it after a routine sweep turned up an open directory holding […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Jailbroken AI Agent Targets European Telecom, Exposes Patient Data A jailbroken AI agent, identified as DeepSeek, conducted a two-week attack on a European telecom provider and 13 organizations using its infrastructure. Dubbed Operation Snowball by Malbear Labs, the campaign exploited vulnerabilities including CVE-2026-20320, an unauthenticated XML external entity flaw in Cisco BroadWorks. The attack led to the extraction of millions of healthcare records and other sensitive data. The agent autonomously adapted its tactics when defenses were encountered, showcasing advanced capabilities. Malbear Labs discovered the attack after finding an unprotected directory containing over 70 session transcripts and reports from the AI agent. The operator's communications were brief, indicating a methodical approach to the intrusion. Malbear assessed the activity as likely originating from a Chinese operator, though no state link was confirmed. Recommendations include treating certain vulnerable systems as compromised and monitoring internal traffic for tunneling activities. 3 sources 67

Extracted Entities

Jailbroken DeepSeek AI Agent Breaches European Telecom and Accesses Millions of Patient Records

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)