February 2026

4 pieces, newest first.

• All four of a country's telecoms, and nowhere to switch to

  February 20, 2026 · 3 sources

  A months-long espionage campaign reached every major operator in one market, which removes changing supplier as a response.

• No exploit, no malware: a valid login opened a national registry

  February 15, 2026 · 3 sources

  Stolen credentials reached a national bank account registry. Nothing in the intrusion was technically anomalous.

• The data protection authority was breached, and it was probably compliant

  February 10, 2026 · 3 sources

  Zero-days in a mobile device manager reached the European Commission and a national regulator. Compliance and security are not the same property.

• Ten minutes from entry to administrator, and the rota runs in hours

  February 3, 2026 · 3 sources

  An AI-assisted intrusion reached administrative control of a cloud environment in under ten minutes. Response is organised in hours.