Day: October 23, 2026

  • Bird Flu Is Raging on a Mink Farm. It Could Spark a Human Pandemic, Experts Say, but Officials Won’t Act.

    Bird Flu Is Raging on a Mink Farm. It Could Spark a Human Pandemic, Experts Say, but Officials Won’t Act.

    A close-up view of a white mink with red eyes and a pink nose baring its teeth and hissing, emerging from under a dark enclosure.
    A rescued mink from a Utah fur farm Julie Leopo for ProPublica

    The strain of bird flu that’s ripped through American barns for the last four years has killed two people who caught it from sick animals. But as far as anyone can tell, humans can’t spread it. The virus has remained a true “bird” flu, tailored to attach to avian cells, not invade human throats and noses, where coughing and sneezing reliably spew droplets. 

    Under the right conditions, however, that could change. A single mutation could give the bird flu a foothold in people and spark a pandemic that experts fear could be deadlier than COVID-19. 

    For that to happen, this bird flu would likely need to find an intermediate host — an animal vulnerable to viruses that infect both birds and humans. These animals would be crowded together, each infection raising the odds that a new strain could arise through mutation. Then, for that strain to jump across species, it would have to have access to humans and time to spread among them undetected.  

    That perfect petri dish exists right now, a ProPublica investigation found. For over two months, an outbreak of bird flu has raged uncontrolled on a Utah farm that raises thousands of mink for fur. Mink have lungs and airways that on a cellular level are remarkably similar to those of people; they have caught and spread other flus and infected some humans with COVID-19. 

    Instead of trying to stop the outbreak and prevent it from spilling into humans, state and federal officials have done little except try to keep its existence quiet, our investigation shows. The failure to act amounts to a cascade of missteps flu experts called “irresponsible” and “puzzling.” One called it “playing with fire.”

    A row of long, white-roofed agricultural buildings sits at the base of a large, barren brown hill under a cloudy sky, viewed across a dry, grassy field.
    C&T Fenn Farms, a mink fur farm west of Provo, Utah, on Sept. 25 Julie Leopo for ProPublica

    Utah agriculture officials learned in mid-August that mink were dying of bird flu on C&T Fenn Farms, about an hour’s drive south from Salt Lake City, according to communications released under the state’s public records law. 

    Had poultry been infected, the playbook would have been clear: The strain is so virulent that if a single chicken tests positive, the U.S. government requires farmers to kill the whole flock to protect other farms as well as public health. Poultry farmers are reimbursed for the loss.

    But there are no federal rules for how to deal with sick mink. 

    Handling Utah’s response was state veterinarian Amanda Price, who sought help from the U.S. Department of Agriculture, which takes the lead on bird flu outbreaks involving poultry and cows. 

    USDA officials said they didn’t regulate mink or have a vaccine that was approved to give them. And though officials with the Centers for Disease Control and Prevention spoke with Price’s health department counterparts who were less involved with the outbreak, they never talked to her, and she never reached out.

    The threat of spillover has been far from the minds of Utah officials, records and interviews show. Instead, front and center have been the interests of a business raising animals to skin for luxury pelts to ship overseas. 

    “It has been devastating,” Price told ProPublica of the outbreak and its impact on the farm’s owner. “This is his life’s work that he’s seeing be destroyed. I really hope that you understand the humanity behind this situation.”

    Flu experts were unequivocal that the government should have ordered the farm to cull its mink, as other countries have done. 

    But Utah never seriously considered it. A fur trade representative warned Price that doing so would kill the business and, ultimately, the industry. Farms spend decades breeding mink to develop unique genetic lineages. 

    “There’s just not a lot of options out there other than kind of sitting and waiting and seeing what happens,” Price said, noting that USDA officials did not urge her to kill the mink or make her feel like bird flu in mink was any riskier than infections in other animals that have caught it, like ducks and cows.

    Flu experts found that response surprising.

    “Every other country that I’m aware of that has had H5N1 in fur farms, depopulation has happened pretty quickly,” said Tom Peacock, an avian influenza researcher at the Pirbright Institute. “The fact that the first instinct wasn’t just to depopulate and figure stuff out later is very concerning to me.”

    And all the while, officials didn’t monitor the mink workers for symptoms, as guidance from the CDC urges. 

    Their exposure is significant: Mink sneeze. They escape. They attack. “The mink are fierce,” said a Spanish-speaking “minkero” who works on a nearby farm, showing the scars he got from the aggressive, solitary creatures. “You get scared because the fucking thing bites, and it claws at you.”

    A close-up view of a person’s bent arm, showing healed scars on the forearm against a bright blue sky with scattered white clouds.
    A mink farmworker, sometimes referred to as a “minkero” among the Spanish-speaking community, shows scars from mink bites and scratches in Payson, Utah. Workers typically wear long gloves to protect themselves but can still be bitten or scratched. Julie Leopo for ProPublica

    Right now in Washington state, officials are working to track down the contacts of a symptomatic person exposed to dairy cattle infected with bird flu. The patient is isolating at home. Utah public health officials used to do similar, proactive monitoring. But they stopped after complaints from their colleagues in the agriculture department that farmers were annoyed by it.

    “Us doing active monitoring was making it so that farms didn’t want to work with them,” said Pamela Gomez Pinedo, a respiratory disease epidemiologist for Utah’s health department. As a result, public health workers had a “pretty difficult time” getting details from agriculture officials, she said.

    As part of a 2025 agreement, the Utah Department of Agriculture and Food agreed to share information about bird flu outbreaks on farms — so long as the health officials didn’t do anything to track workers’ health. 

    “We will only do active monitoring in the case of evidence of human-to-human transmission,” Pinedo said in emails with a CDC epidemiologist. As the outbreak stretched to a month, CDC officials expressed concerns, asking how anyone would know if a worker had been infected if they weren’t getting tested.

    Price said the state’s policy not to monitor workers is meant to allow farmers to decide whether to contact the health department, rather than “forcing it on them.” “If we started seeing people actively dying from this, obviously that would change how we respond to this,” she said. 

    A telltale sign of bird flu infection in humans is eye redness. It is present in over 90% of cases and is often the sole symptom a person displays. 

    Last Saturday, a ProPublica reporter tracked down two people who worked at the Utah mink farm. One had a visibly red eye. 

    The CDC explicitly urges testing for the symptom. 

    After ProPublica reached out to the farm, its owner, Chad Fenn, contacted the Utah County Health Department about the red eye, which had cleared up by Monday, he told ProPublica. He said the worker got dust in his eye; the department didn’t recommend testing.

    “They’re not going to do anything,” Fenn said. “They said they don’t see that there’s a need.” He said the department recommended testing only if other symptoms, like a cough or sore throat, developed. 

    A half dozen flu experts had no shortage of adjectives to describe their disbelief at the government decisions not to cull the mink or monitor and test the workers. 

    “It’s amazing to me,” said Gail Hansen, a former Kansas state public health veterinarian and epidemiologist. “Utah doesn’t want to be the epicenter of the next human flu outbreak, right?”


    Most of the new viruses that have shaken humanity in the past century have spilled over from animals. Ebolas likely came from fruit bats; HIV, from chimpanzees. The leading theory for COVID-19 is that it jumped from bats to humans via an intermediate host mammal such as a raccoon dog. And all the modern flu pandemics have been bird flu viruses that mutated to spread in humans. 

    ProPublica reported extensively on spillover in a 2023 series called “Roots of an Outbreak.” To prevent more deadly spillovers, experts worldwide urge governments to take a “one health” approach to viral threats, treating dangers to animals as dangers to humans. 

    That’s not happening in Utah, experts said after reviewing ProPublica’s findings. Both the state and federal government are to blame.

    “There’s no leader of this ‘one health’ team to take charge,” said Erin Sorrell, a senior scholar at the Johns Hopkins Center for Health Security. “That is going to allow the virus to continue to circulate, potentially adapt and potentially spill over into another host, whether it’s avian, mammalian or human.”

    This strain of bird flu, which began ripping through American poultry farms in early 2022, has proved adept at jumping to other species. It took hold in cows in 2024 and since then has run rampant through dairies.

    Yet federal guidance to prevent the spread into mink farms hasn’t considered cows a threat. Farmers are encouraged to keep wild birds from infiltrating their barns and avoid feeding them raw poultry. It has said nothing about feeding beef parts to mink, which farmers commonly do in summer months to encourage the animals to put on weight and grow. 

    Dairy cows, which are not “depopulated” if exposed to bird flu, can still be slaughtered with the meat sold to farms and humans even though researchers have found the virus in the tissues of sick cows. USDA officials have insisted that beef for human consumption is free of bird flu, in part because the virus concentrates itself in sections of the cow people don’t usually eat. Fenn said that the mink are routinely fed raw organs of livestock, including cows. 

    The genomic data from the samples of mink lungs and brains sent from Utah to a USDA lab shows that the mink were stricken with the same strain of the virus that has spread in dairy herds. Officials said they didn’t know whether contaminated beef was the way the mink got infected.

    Several cattle graze in a dry, grassy pasture with silhouetted trees and a mountain ridge in the background.
    Cows graze in a field in Utah Valley, Utah. Julie Leopo for ProPublica

    In mink, the dairy strain of bird flu may have found a much better host for mutating into a human flu, because mink airways have an abundance of the type of cell receptors in people’s throats and noses that are a common pathway for infection.  

    A 2024 study of the dairy strain of the bird flu found that a single mutation could switch the virus from preferring the bird-type receptors to human-type receptors. And in studies using ferrets, a close relative of mink, the virus acquired mutations that let it attack human-type cell receptors. 

    It’s not clear to scientists just how much of an evolutionary leap would be needed for this strain of bird flu to spread among humans, or whether mink are the host that would allow that leap to happen. 

    How this ultimately plays out “really depends on what happens with the virus,” said Meghan Davis, an epidemiologist at Johns Hopkins University.

    “We might get lucky, and a response that is not robust may not have dire consequences,” she said. “But we may get unlucky.”

    There’s also a risk of something called “reassortment,” where another flu virus could infect the same cell as a bird flu virus and swap wide swaths of genetic code already adapted to humans. 

    When the outbreak in the mink farm started, there was very little seasonal flu it could mix with, but September saw one of the earliest starts to flu season on record, compared with November, when flu normally takes off.

    “The most likely scenario for a pandemic is that we have a virus that reassorts with another virus,” said Jennifer Nuzzo, director of the Pandemic Center at the Brown University School of Public Health. “Obviously, having this circulate amid human flu season is not great.” 

    Utah officials were far more responsive to the threat of spillover in 2020, when outbreaks of COVID-19 spread explosively on mink farms – including this very farm. They invited federal officials to the state to research how the virus adapted and moved.

    Given mink’s reputation as escape artists, wildlife experts set up traps around infected farms. The traps frequently caught mink carrying COVID-19 that had originated in the nearby barns. The virus infected both escaped mink and wild mink they had come in contact with. Mink and farmworkers were frequently tested, tracking the way that the virus was spreading and mutating. 

    As other states and countries took the same measures, they identified humans infected by the mink with COVID-19 and, ultimately, human-to-human transmission.

    There are no similar efforts now in Utah with bird flu. 

    A USDA spokesperson told ProPublica that it was more involved in 2020 because the virus that causes COVID-19 had “significant” potential to transmit between humans and animals and vice versa.

    Scientists with the USDA sequenced and published bird flu genomic data from the first samples of dead mink. Those sequences didn’t show any particularly concerning mutations, experts and the CDC told ProPublica. 

    But in the past two months, experts said, the virus is sure to have continued mutating as it spread – it’s only a question of whether those mutations could confer some advantage in infecting humans as well.

    “As long as it continues to go mink to mink, then it becomes more and more likely that it could jump to a human,” Hansen said.

    Fenn said new samples were taken two weeks ago. Price said she is still waiting for the results. 

    John Korslund, a retired USDA official who helped coordinate the response to COVID-19 on mink farms several years prior, was one of several experts who said officials need to look closely at newer genetic samples to see how the virus is evolving. 

    “I really want to know what the virus has done, from when it started to today,” he said. “Are we getting accumulated mutations making the virus more dangerous?”

    A close-up view of an albino mink with white fur, reddish eyes and a pink nose looking upward directly at the camera indoors.
    Mink have the type of cell receptors that a seasonal flu will target in human throats and noses. Julie Leopo for ProPublica

    ProPublica began reporting on the outbreak late this summer after the USDA updated a bird flu dashboard that showed seven captive mink had tested positive in Utah. But neither the USDA nor state officials had said anything publicly, and, when asked, they wouldn’t discuss what was actually happening on the farm.

    Communications obtained under the state’s public records law — first published by the Animal Welfare Institute and reported on by the Salt Lake Tribune — show Utah officials took pains to protect the farm’s privacy amid the outbreak. The state did not declare an emergency, because doing so, officials said, “may alert animal rights groups,” according to the messages.

    Willy Lanier, a public health veterinarian with the state health department, told colleagues to keep the outbreak under “closer hold” than outbreaks of bird flu on poultry and dairy farms. Keeping the information confidential was consistent with state protocol, a spokesperson in his department said, adding that it was still shared with local health officials. But when ProPublica reached out to the spokesperson for the Utah County Health Department about a possible bird flu outbreak, she said, “That would be news to me.”

    Price is so deferential to the family that owns the farm that she has not set foot on the property. 

    “We might get lucky, and a response that is not robust may not have dire consequences. But we may get unlucky.”

    Meghan Davis, Johns Hopkins University epidemiologist

    “I’m really the only one here at this facility that’s been dealing with the producer. They’re a very private bunch,” Price said. “A lot of what I’m going off of is what I’ve seen from Google Maps, what I’ve talked to the producer about, what I’ve talked to the vet about. I haven’t felt the need to go out there based on those conversations.”

    She said she “became very comfortable” in conversations with the owner that the virus wouldn’t spread off the farm. It doesn’t have animals moving on and off over the course of the year like on a dairy or poultry farm; mink leave only when they’re slaughtered and skinned for pelts at the end of the year. She also said that she was confident the owner would recapture any escaped mink.

    Short of a formal quarantine, Price gave the farm a “verbal hold” to not move any mink, or manure or carcasses, off the farm. “We haven’t seen spread off of this farm. We have not had additional cases in Utah that are linked to this, so thus far the verbal hold orders and the measures that have been taken look to be successful: There is not spread happening from this farm from this case.”

    Price’s assertion didn’t allay the concerns of experts that ProPublica spoke with. When poultry test positive for this strain of bird flu, all nearby farms are quarantined and tested for the virus. But the approach in Utah relies on farms reporting cases or the public calling in reports of dead birds in the area. 

    “If you’re not looking for something, you won’t find it,” Sorrell said. “Unless you’re doing active surveillance, you can’t claim that you haven’t had cases.”

    Fenn told ProPublica his conversations with state officials made him less worried about any kind of spread. When the outbreak started, Fenn said, he asked whether the bird flu could infect people. 

    “Right off the bat, the state people we reported to, they said you don’t need to worry too much,” Fenn said. “My guys wear masks every day. They have glasses they can wear,” Fenn said. “ Me? I don’t wear it at all. Never have, never will, because I’ve been doing it for 40 years.”

    Fenn said he wished he could vaccinate the mink for bird flu to keep the rest of his animals from catching it and dying; Price asked the USDA about a vaccine that had been used to save endangered wild species but said she got nowhere with that request. The USDA told ProPublica its division responsible for protecting animal health has no “species-specific regulatory authority or dedicated programs” for vaccinating mink, depopulating them or paying owners back for such a culling.

    Fenn told ProPublica he thinks concerns about mink as a particularly risky bird flu host are trumped up by anti-fur activists, the same forces that he believed were behind the reactions in Spain and Finland, which depopulated mink farms hit with bird flu. “Europeans are a little scared of everything,” he said. “They’re going to do what they’re going to do, and here in the United States, we’re going to do what we’re going to do.”

    Price said she was aware that Finland and Spain had depopulated their fur farms when the same strain infected them. “I didn’t really look much further into it,” she said, explaining that she was interested in those cases only for lessons about how to handle the outbreak, but not the particular reasons those countries chose to depopulate the farms. 

    A USDA spokesperson said Congress would have to specifically fund a program to depopulate mink. (The program to cull poultry to stop the spread of bird flu has cost well over $1 billion since 2022.)

    The events in Utah are a “clear warning sign” about the dangers of mink farms, said Neil Vora, executive director for the Preventing Pandemics at the Source Coalition.

    “Fur farms are to produce pelts purely for luxury goods, to make fancy coats,” he said. “It’s absurd that we’re willing to gamble with the lives of millions of people just to keep an industry alive.”

    The industry has struggled as American consumers increasingly reject fur. Though domestic farms peaked about a decade ago, selling luxury pelts that often ended up in China, foreign farms have sprung up, threatening the business. 

    While animal rights advocates have pushed for Congress to adopt legislation that would phase out the fur industry, buying out farmers over the course of a year to end the practice once and for all, winds in Congress are blowing the other direction. The Senate will soon weigh in on the latest Farm Bill, which now seeks to expand market opportunities for mink farmers by undoing a prohibition in federal law on subsidizing the fur trade. 

    The virus continues to spread on the Utah farm, said Fenn, though at a slower pace. Experts told ProPublica it still poses a risk.

    “I would want a full on hazmat suit if I were on that farm,” Peacock said. “Or, preferably, I’d rather not to be on that farm.”

    Source: ProPublica · 2026-10-23

  • CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access

    CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access

    Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator deployments. The flaw is being exploited in the wild and allows any authenticated portal user, including an Enterprise Read Only account, to gain local superuser operator privileges.

    Organizations should upgrade immediately to the fixed release for their branch, restrict the VCO web interface to trusted networks, and examine logs for activity identified in Arista’s advisory.

    What Is CVE-2026-114625?

    CVE-2026-114625 is an SQL injection vulnerability in VeloCloud Orchestrator On-Prem, the management platform for VeloCloud SD-WAN environments. Arista assigned a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4 and tracks the issue internally as BUG2043622.

    SOCRadar Vulnerability Intelligence card for CVE-2026-114625
    SOCRadar Vulnerability Intelligence card for CVE-2026-114625

    A successful attack can elevate a valid portal session to the local superuser operator role and expose functionality intended only for internal use. Arista warns that exploitation may affect the confidentiality, integrity, and availability of the orchestrator and the data it manages.

    Which Systems Are Affected?

    The flaw affects supported on-premises VCO releases in three branches. Arista-hosted and Dedicated VCO services were also affected, but the company says those environments have already been patched.

    Release train Affected releases Fixed release
    5.2 Earlier than 5.2.3.18 5.2.3.18 or later
    6.1 Earlier than 6.1.3.10 6.1.3.10 or later
    6.4 Earlier than 6.4.2.12 6.4.2.12 or later

    VeloCloud Gateway and VeloCloud Edge are not affected by this CVE. End-of-support releases were not assessed, so organizations running them should contact Arista TAC rather than assume they are safe.

    Earlier VCO updates are not enough. CVE-2026-114625 is the third actively exploited VCO vulnerability Arista has disclosed since July, following CVE-2026-16812 and CVE-2026-93952. Releases that addressed those earlier flaws still fall below the new fixed thresholds. Teams should verify the running VCO version against this advisory instead of relying on the date of the last upgrade.

    What Does an Attacker Need?

    Exploitation requires network access to the VCO web interface and a valid authenticated session. The minimum role is Enterprise Read Only, the lowest built-in tenant role. No user interaction is required.

    Unlike the actively exploited VCO vulnerabilities disclosed in July and September, CVE-2026-114625 requires an authenticated portal session. However, the privilege requirement remains low because an Enterprise Read Only account is sufficient to reach local superuser operator privileges.

    This makes credential hygiene part of the response. A low-privilege account that would normally have limited administrative value can become a path to full operator control. Internet-exposed VCO portals, shared partner access, stale accounts, and compromised credentials therefore deserve immediate review.

    Is the Vulnerability Being Exploited?

    Yes. Arista says it detected the vulnerability and confirmed active exploitation. The company has not publicly identified the attackers, the number of affected organizations, or the actions taken after privilege escalation.

    Arista observed attacks from 74.82.197.86 and 38.54.50.151. These addresses are useful hunt leads, but their absence does not establish that a system is clean because infrastructure can change.

    What Should Defenders Look For?

    Arista recommends reviewing VCO web access logs and preserving evidence before remediation when compromise is suspected. Investigate:

    • Requests with unusual URL-like path components or encoded characters
    • References to local or internal services in web requests
    • Unexpectedly high request rates or access from the two observed source IPs
    • Unexplained administrator changes, outbound connections, backdoor daemons, or webshells

    Preserve web access, backend application, system, database, and relevant file-system timestamp data where operationally feasible. Patching closes the vulnerability but does not determine whether an attacker already obtained operator access.

    What Should Defenders Do Now?

    • Upgrade immediately. Move to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12, or a later release within the same branch.
    • Reduce reachability. Limit the VCO web interface to trusted administrative networks. There is no VCO configuration that removes the underlying exposure.
    • Review authenticated access. Audit Enterprise Read Only, partner, customer, and administrative accounts; disable stale access and investigate unusual sessions.
    • Contain suspected compromise. Block the observed IPs, restrict unnecessary outbound ports, preserve evidence, and contact Arista TAC for response or unsupported-release guidance.
    • Validate hosted environments. Arista says Hosted and Dedicated VCO instances are patched, but customers should still confirm status through their normal service channel.

    Why This Flaw Deserves Priority

    The important risk is not SQL injection in isolation; it is the change in trust level that follows. A tenant account with the lowest built-in role can cross into operator-level control of a shared SD-WAN management plane. That creates a wider potential blast radius than an ordinary application account compromise.

    The disclosure also shows why patch programs should track fixed versions, not only CVE closure. A system can be patched for a recent VCO zero-day and still remain vulnerable to the next one because the corrected build threshold has moved again.

    How SOCRadar Can Help

    Actively exploited vulnerabilities like CVE-2026-114625 require teams to understand both whether affected assets are exposed and whether credentials that could enable exploitation have been compromised.

    SOCRadar’s Vulnerability Intelligence helps security teams track actively exploited vulnerabilities, affected products, and remediation information, while Attack Surface Management can help identify internet-facing VeloCloud Orchestrator instances and other exposed assets that require immediate attention. Identity & Access Intelligence adds another layer by helping organizations identify exposed or compromised credentials that could provide attackers with the authenticated access required to exploit CVE-2026-114625.

    SOCRadar’s Vulnerability Intelligence
    SOCRadar’s Vulnerability Intelligence

    Together, these capabilities can help defenders prioritize vulnerable and exposed systems rather than treating every affected asset with the same level of urgency.

    Conclusion

    CVE-2026-114625 is a critical, actively exploited VeloCloud Orchestrator vulnerability with a low privilege requirement and high potential impact. On-premises operators should verify their exact release, deploy the fixed build, reduce portal exposure, and review both authentication activity and host-level evidence for signs of compromise.

    Advanced Dark Web Monitoring

    Source: SOCRadar · 2026-10-23

  • Cambodia Cracked Down on Banks Allegedly Linked to Cyber-Scams. The IMF Says the Problem Persists.

    Cambodia Cracked Down on Banks Allegedly Linked to Cyber-Scams. The IMF Says the Problem Persists.

    Amid mounting international pressure to clean up its financial system, Cambodia’s central bank published a statement earlier this month accusing unnamed actors of waging a campaign of “economic sabotage” against the country.

    “Rumors and unverified information have been circulating on social media, claiming that a number of banking and financial institutions are facing issues or heading toward collapse in the near future,” the National Bank of Cambodia (NBC) said.

    The NBC did not clarify who might be behind such a campaign, or which institutions were targeted. But the regulator warned that such “baseless” information could undermine “trust in the overall banking system.”

    The banking system has taken a beating recently, as international attention turned to Cambodia’s role as a major hub for cyber-scams targeting victims around the world. Proceeds from scams have allegedly flooded into financial institutions.

    The government has lurched into damage control, forming an “Ad-Hoc Commission for Combating Online Scams” which recently stated that a year of law enforcement actions had achieved “the complete eradication of large-scale online scam operations.” The NBC has shut down half a dozen banks since last year.

    But the blows just keep coming. 

    In its annual review of Cambodia, published last month, the International Monetary Fund (IMF) flagged “persistent scam activities” as a threat to economic growth.

    “The authorities need to urgently identify and address potential links between criminal activity and banks and close significant gaps in the licensing frameworks,” the IMF said, using uncharacteristically strong language. 

    The U.S. Treasury Department has also flagged such links, slapping sanctions over the past year on Cambodian financial institutions it alleged were laundering money from cyber-scams. Five of those sanctioned institutions were among the six closed down by the NBC. 

    But at least two other major lenders continue to operate, despite having been owned by well-known Cambodian businessmen accused of links to cyber-fraud operations. 

    ‘Limited Reform’

    Kok An is a Cambodian senator and tycoon whose business interests have included casinos and resorts, as well as Anco Specialized Bank Ltd. The U.S. Treasury Department sanctioned Kok An in April, alleging that his properties housed “scam centers whose occupants have stolen money from Americans.”

    Kok An owned 70 percent of the shares of Anco Specialized Bank, according to the financial institution’s 2021 annual report. Reporters were unable to obtain more recent documentation showing current ownership of the bank, which is named after him.

    Anco Specialized Bank operates today, and official records show that it holds an active license from the NBC. An Anco representative hung up the phone after being asked about the bank’s operations post-sanctions. 

    Reporters were unable to reach Kok An through phone numbers listed for him in corporate records. Speaking to RFI’s Khmer-language service following the U.S. sanctions, Kok An reportedly rejected the allegations and said he did “not know about scamming.” 

    Another institution under scrutiny was previously called B.I.C (Cambodia) Bank Plc, but rebranded last year as iBank (Cambodia) Plc. It was acquired in 2020 by Cambodian tycoon Yim Leak, who is facing allegations of money laundering in neighboring Thailand.

    Thailand’s Anti-Money Laundering Office earlier this year froze about $590 million in assets linked to Yim Leak and an associate as part of an ongoing investigation. The country’s Securities and Exchange Commission separately filed criminal complaints against Yim Leak in June and August, accusing him of failing to disclose a share acquisition and a sale within the required deadline.  

    Neither Yim Leak nor iBank responded to requests for comment. 

    The NBC did not respond to questions about U.S. sanctions, the IMF allegations of potential links between Cambodian banks and criminal groups, and the roles of Kok An and Yim Leak in the financial sector.

    Yim Leak has hired Seiden Law, a U.S. firm that said he and his family “are the apparent victims of guilt by association and political persecution.” The firm said in a June statement that Yim Leak had also been falsely identified to the U.S. Congress “as being associated with scam centers in Asia.” 

    Separately, the U.K. Treasury named B.I.C. Bank as a subsidiary to a Cambodian company sanctioned for alleged involvement in cyber-scams and human trafficking.

    “Mr. Yim has never been convicted of a crime in any country and is repulsed by illegal cyber-crime centers in Asia. Mr. Yim is also not sanctioned,” Seiden Law stated. 

    Cambodia’s business registry shows that Yim Leak remains chairman of iBank. Since the rebrand, branches carry iBank signage and the commercial license has been transferred to that name. But the institution’s SWIFT code remains unchanged.  

    The ongoing presence in the financial system of banks that have been backed by people facing arrest warrants or international sanctions highlights the limits of Cambodia’s clean up efforts, said George McLeod, a partner at the security and intelligence advisory firm Critical Risk Team.

    “The United States and other countries continue to pressure Cambodia to strengthen oversight of its banking sector, but meaningful reform has been limited,” he said.

    ‘Criminal Links’

    While the NBC has not moved against iBank and Anco Specialized Bank, six other Cambodian institutions have been shuttered amid accusations of dirty money in the financial system.

    In August, the NBC pulled the licenses and ordered the liquidation of CCU Commercial Bank Plc., HH Bank (Cambodia) Plc. and Heng Feng (Cambodia) Bank Plc.

    The U.S. had sanctioned HH Bank in September 2025. The Treasury Department added Heng Feng to its sanctions list in April this year, and CCU Commercial Bank in June.

    The Treasury Department cited alleged links to cyber-scams for each of the banks it sanctioned. However, the NBC did not mention such links when announcing the banks would be delicensed and liquidated. The central bank said only that the “decision is based on non-compliance with applicable laws and regulations.”

    Earlier this year, the NBC revoked the license for Panda Bank, saying its “financial condition” had “continuously deteriorated, leading to an inability to provide normal banking services.”

    Panda Bank had not been sanctioned, but the U.S. did target two other institutions that the NBC shut down last year: Prince Bank Plc. and Huione Pay.

    Both institutions were targeted as part of sweeping sanctions related to the Prince Group, a Cambodian conglomerate that the U.S. alleged ran “industrial scale cyberfraud operations” out of “compounds reliant on human trafficking and modern-day slavery.”

    The Prince Group has adamantly denied allegations of any illegal activity. A spokesperson previously told OCCRP that the conglomerate was “not a criminal syndicate but a collection of legitimate businesses serving millions of people and employing tens of thousands of people across the globe.” 

    The U.S. accused the conglomerate’s companies, including Prince Bank, of laundering the proceeds of scams. Prince Group companies mixed “illicit revenues with the legitimate Cambodian economy,” the U.S. Treasury Department alleged.

    While the Huione Group was sanctioned alongside “146 targets within the Prince Group,” the Treasury Department did not allege that it was part of the Cambodian conglomerate. Huione Pay, also known as H-Pay, was part of the Huione Group, which the U.S, alleged had laundered the proceeds of “virtual currency investment scams.”

    The NCB stated it had ordered the liquidation of Huione Pay after having “observed transactions involving the purchase, sale, or payment using crypto assets,” which violated Cambodian regulations. The NBC did not provide a specific reason for its decision to liquidate Prince Bank.

    Rath Sophoan, chairman of the Association of Banks in Cambodia — which includes all licensed lenders in the country, but not crypto institutions like Huione Pay — argued that accusations against a handful of institutions should not be overstated.

    He noted that the four lenders on the U.S. sanctions list accounted for less than 1 percent of the roughly $100 billion in assets held across the country’s 59 commercial banks as of December.

    “Allegations involving individual institutions should not be generalized to Cambodia’s wider banking sector, which remains broad, diverse, and subject to licensing and supervision by the National Bank of Cambodia,” Rath Sophoan said.

    In its statement earlier this month, the NBC attempted to counter what it said was “the dissemination and intentional fabrication of false information aimed at causing economic sabotage.”

    But the IMF and others are urging the NBC to do more to build trust in the financial sector.

    “An immediate priority is for the NBC, with support of other regulators, to identify banks with potential links to criminal activity and take action to address them,” the IMF said in its review last month.

    Jacob Sims, a visiting fellow at Harvard University’s Asia Center and a leading expert on transnational crime in Southeast Asia, was even more direct in comments to OCCRP.

    “The National Bank of Cambodia can complain about unfair reputational damage, but the most effective way to defend the reputation of the sector would be to show that regulations and enforcement standards are being applied seriously,” he said. “That simply hasn’t occurred.”

    Source: OCCRP · 2026-10-23

  • Heather Godwin v. Yolanda Brammer

    her phone, which informed her that whoever hacked her phone to create the flashing LED and alarm

    Original document

    Source: CourtListener — Breach & Hacking Opinions · 2026-10-23

  • T. R. and P. M. v. Texas Department of Family and Protective Services

    set up listening devices throughout the home, had hacked her Wi-Fi, had hacked her phone, hacked almost

    Original document

    Source: CourtListener — Breach & Hacking Opinions · 2026-10-23

  • Kimber v. Cook County Health and Hospitals System

    Associates, Inc. (PJA), following an April 2023 data breach of PJA’s systems, which compromised personally

    Original document

    Source: CourtListener — Breach & Hacking Opinions · 2026-10-23

  • Tiktok and Instagram

    In the past I used very much:

    site:instagram.com intext:”<user>” and was able to see many posts that this user was mentioned or commented.

    Idk why, bur is not more working. Any suggestions to achieve the same result ?

    submitted by /u/TaxApprehensive5402
    [link] [comments]

    Source: Reddit r/OSINT · 2026-10-23

  • State Bank of India Suffers a Customer PII Data Leak

    State Bank of India Suffers a Customer PII Data Leak

    Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.

    Source: Dark Reading · 2026-10-23

  • Privacy Act of 1974; System of Records

    This system maintains information that is used to establish the U.S. nationality and identity of persons for a variety of legal purposes including, but not limited to, the adjudication of passport applications and requests for related services, social security benefits, voter eligibility, employment applications, estate settlements, and Federal and state law enforcement and counterterrorism purposes.

    • Agencies: State Department
    • Document type: Notice
    • Document number: 2026-21695

    Source: Federal Register — Cybersecurity · 2026-10-23

    Documents

  • Agency Information Collection Activities: Proposed Information Collection; Submission for OMB Review; Reporting Forms and Instructions for Permitted Payment Stablecoin Issuers Subject to the Jurisdiction of the Office of the Comptroller of the Curren

    The OCC, as part of its continuing effort to reduce paperwork and respondent burden, invites comment on a new information collection, as required by the Paperwork Reduction Act of 1995 (PRA). In accordance with the requirements of the PRA, the OCC may not conduct or sponsor, and the respondent is not required to respond to an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. The OCC is proposing a new information collection titled “Reporting Forms and Instructions for Permitted Payment Stablecoin Issuers Subject to the Jurisdiction of the Office of the Comptroller of the Currency,” that would include weekly and quarterly reporting forms that must be completed by permitted payment stablecoin issuers and foreign payment stablecoin issuers. The OCC is seeking a new OMB control number for this information collection. The OCC also is giving notice that it has sent the collection to OMB for review.

    • Agencies: Treasury Department, Comptroller of the Currency
    • Document type: Notice
    • Document number: 2026-21705

    Source: Federal Register — Cybersecurity · 2026-10-23

    Documents