A brutal month in cybersecurity: Shell, Salt Typhoon and the fight for your data

Every breach has a story, and my job is to report on the hackers, the defenders and, above all, your data caught in the middle. Some months are quiet, and some are relentless, and I have to tell you that this past month was one of the brutal ones, with a run of attacks that hit household names and exposed just how high the stakes have become for all of us.

I want to walk you through the biggest moments, not to scare you, but because understanding how these attacks unfold is the first real step toward protecting yourself. The pattern this month was clear, with criminal gangs chasing money, nation states chasing secrets, and defenders scrambling to slam doors shut before the intruders could slip away with the crown jewels.

When the giants get hit

The headline that stopped me cold was the ransomware group known as Cl0p claiming it had stolen eighty-nine gigabytes of corporate data from Shell, one of the largest energy companies on the planet. Adding a target of that size to its growing list of mass-extortion victims is a stark reminder that no organization, however powerful, is truly beyond the reach of a determined attacker.

Shell was far from alone, because a mass credential-theft campaign built around stolen Azure logins swept up other huge names, including McDonald's and Vodafone. What makes this kind of attack so dangerous is its simplicity, since once criminals hold a valid username and password, they can often walk straight through the front door without triggering any of the alarms we rely on.

This is exactly why I keep repeating the same unglamorous advice to anyone who will listen, which is to use unique passwords and turn on multi-factor authentication everywhere you can. It feels tedious, I know, but that extra step is frequently the single barrier standing between a stolen password and a full-blown breach of your accounts, your money and your identity.

A ghost in the phone network

If the criminal gangs were loud, the nation-state story was chillingly quiet, and it involved a group known as Salt Typhoon lurking inside telecom infrastructure. The response was so dramatic it almost sounds physical, because T-Mobile reportedly went as far as cutting a cable to finally evict the intruders, a vivid image of just how deeply these attackers can burrow in.

This kind of intrusion worries me more than any single ransom demand, because the goal is not quick money but long-term, silent access to sensitive communications. When a sophisticated group can hide inside the networks that carry our calls and messages, the threat stops being about one company and starts being about national security and the privacy of millions of ordinary people.

Meanwhile, the defenders were working overtime on a mountain of technical fixes that rarely make the headlines but matter enormously. Authorities warned about actively exploited flaws in widely used software, Microsoft patched a critical vulnerability in its identity system, and researchers even used AI agents that reportedly uncovered more than a hundred bugs in just two days.

What it means for you

It is easy to read a month like this and feel powerless, but I genuinely believe the opposite is true if you focus on the basics. The same techniques that breach a giant corporation, namely stolen passwords and unpatched software, are the ones you can defend against at home by updating your devices, being skeptical of strange links, and locking down your logins.

I will keep following these stories as they develop, because the attackers never rest and neither do the people working to stop them. Every breach really does have a story, and the more we understand those stories, the harder we make life for the people trying to steal our data, which is exactly why I will keep reporting them clearly and without the fear-mongering.