Home/Digest/Transportation/Past issues
Transportation digest,
Transportation: Volt Typhoon's Silent Train Network Targets US… (+4 more)
Breaches
BCD Travel Data Breach Exposes 700,000 Records Amid Investigation
BCD Travel Services B.V. reported a data breach stemming from a third-party vulnerability affecting personal information of travelers. The breach, linked to the hacking group ShinyHunters, has led to claims of over 700,000 records being compromised, though BCD has not confirmed this number. The company activated its cybersecurity incident response team and took the affected application offline, while also notifying law enforcement. So far, BCD has not found evidence of misuse of the exposed data. The compromised data may include names, contact details, and travel-related information, raising concerns about identity theft and fraud. Edelson Lechtzin LLP is investigating potential class action claims on behalf of affected individuals. BCD is offering one year of complimentary credit monitoring to those impacted. The breach occurred between May 22 and May 26, 2026.
APT · 2 sources · score 52 · ShinyHunters
Threat actors and malware
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure
The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access sensitive systems undetected. The identified zero-days include CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127, and CVE-2026-16812, affecting critical platforms like Cisco's SD-WAN and N-able N-central. Hundreds of victims across telecommunications, government, defense, and critical infrastructure sectors have been reported, particularly in California, Texas, and Hawaii. The operational tactics include post-operation cleanup to erase all traces of the attack, making detection challenging. The campaign is ongoing, with confirmed. Researchers from Lumen Technologies' Black Lotus Labs have been tracking this activity since late 2023.
APT · 13 sources · score 81 · CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20127
LLMJacking: Threat Actors Rack Up $1M in Fraudulent Cloud Charges
Mandiant and Google Threat Intelligence Group reported multiple incidents of 'LLMJacking' in 2026, where attackers hijacked enterprise access to large language models (LLMs), resulting in fraudulent cloud charges exceeding $100,000 in a single day. Victims, including organizations in North America, South America, and Asia-Pacific across various sectors, faced cumulative charges reaching $1 million before access was revoked. Unlike cryptojacking, LLMJacking can generate rapid spikes in costs. Attackers primarily exploited exposed or stolen cloud identity tokens, such as service account keys and GitHub personal access tokens, to gain initial access. A notable group, UNC6993, compromised a cloud instance through a misconfigured service account key and created a fake portal to harvest access tokens. The report highlights a growing underground market for LLM credentials and emphasizes the need for organizations to secure their cloud infrastructure against these threats.
APT · 3 sources · score 69 · CVE-2021-3129, CVE-2026-40217, CVE-2026-47101, UNC6993
Also worth knowing
Ukraine Accuses US of Throttling Starlink Amid Russian Attacks
Ukraine's military operations have been severely disrupted due to sudden restrictions imposed on SpaceX's Starlink satellite communication system, which limits connectivity for drones traveling over 100 mph. This limitation was implemented without prior warning and coincided with intensified Russian missile strikes that left 600,000 people without power. Ukrainian President Volodymyr Zelensky has accused the US of failing to provide timely intelligence on incoming attacks, further straining relations between Kyiv and Washington. The restrictions on Starlink are believed to be linked to US President Donald Trump's recent decisions regarding Russian diesel imports and calls for Ukraine to halt strikes on Russian energy infrastructure. Ukrainian officials express concerns that these developments could jeopardize their military capabilities and overall defense strategy against Russian aggression.
Other Threats · 20 sources · score 68
Timely Cyber Incident Reporting Critical for Infrastructure Security
Cyberattacks on critical infrastructure sectors such as healthcare, banking, and energy pose significant threats to national security and public safety. Recent regulatory changes in the U.S. and EU require organizations to report cyber incidents within strict timeframes, with the U.S. Computer Emergency Response Team mandating reporting within six hours for certain incidents. Delayed reporting can lead to increased risks, including operational losses and regulatory penalties. Organizations must establish clear incident response procedures and maintain accurate records to comply with these regulations. The evolving regulatory landscape emphasizes the need for timely reporting to enhance cybersecurity resilience and incident response capabilities.
Critical Infrastructure · 2 sources · score 55
New on leak sites
11 victims listed on ransomware leak sites by 7 groups in the 7 days before this issue. The most active:
Get the next one by email
The transportation digest is free and arrives on Tuesdays. One click to leave.
Subscribe to the transportation digest
A free account turns the digest into a personal watchlist: choose what you want to follow.