AI Weekly Malaysia

Framework disclosed that a zero-day in Metabase's cloud service (affecting versions 1.58 and later) let an attacker inject arbitrary SQL, gain admin access, steal credentials for connected databases, and export customer data including names, emails, phone numbers, physical addresses, and login IPs. Metabase patched the bug on August 3 and notified Framework on August 6; Framework rotated all connected database credentials and hired a forensics firm. The breach affected 'all customers' according to TechCrunch.

Why: If you run Metabase (or any BI/analytics tool) connected to production databases, this incident is a concrete reminder that those tools are a high-value attack surface with broad data access. Check your Metabase version immediately if on 1.58 or later, and audit whether your BI tool's database connections have least-privilege scopes rather than blanket read access to every table. Malaysian startups using Metabase Cloud should confirm they're patched and rotate connected DB credentials as a precaution.

A cyberattack on CEVA Logistics between July 29 and August 1 disrupted eight European warehouses and exposed customer data from major clients including Valve, Bol, ING, and Ajax. Valve confirmed attackers likely stole names, addresses, phone numbers, emails, and order details for Steam hardware customers, though no payment info or passwords were exposed since CEVA doesn't hold them. Bol halted data exchanges with CEVA and took affected fulfillment center products offline, with some orders canceled or delayed.

Why: If you ship physical products through a third-party logistics provider, this is your template for what goes wrong: your fulfillment partner holds customer PII you can't fully control, and a breach there becomes your customer communication problem. The practical move is to audit what data your logistics/fulfillment vendors actually retain and for how long — Valve noted CEVA keeps it for 90 days — and push contractually for shorter retention and minimal data fields. Also worth reviewing whether your vendor risk process covers the phishing fallout scenario Valve described, where attackers quote real order details back to customers.

Ceva Logistics, a France-headquartered shipping giant with $18.3B revenue and over 1,000 warehouses, was hacked starting July 29, affecting at least 8 European warehouses and causing shipping delays. Customer personal data (names, addresses, phone numbers, emails) was stolen for clients including Bol, De Bijenkorf, Ajax, ING, Ace & Tate, and Valve/Steam, with Valve notifying customers on August 7.

Why: If you ship physical goods through third-party logistics providers, this is a concrete reminder that your customer PII lives in systems you don't control — and that a breach at your warehouse partner becomes your breach notification problem. Review what customer data your fulfillment or shipping vendors can access and whether you're contractually obligated to notify customers when that vendor is compromised, as Bol and Valve had to do here.

A hacking and extortion group called Helix claims to have breached Uber Freight, exfiltrating mailboxes, cloud storage, accounts payable files, and dispatch documents dated around mid-June. Uber Freight says operations are unaffected and has not confirmed the breach. Google tracks Helix under the umbrella UNC6671 and reports the group has made at least $10.6 million in ransom payments between January and May 2026, primarily using voice phishing against IT helpdesks to reset employee passwords.

Why: The practical takeaway is the attack vector, not the victim: Helix gains cloud access by calling IT helpdesks and socially engineering password resets. If your team or startup operates a helpdesk or identity reset workflow, this is a concrete reason to enforce callback verification or MFA re-authentication before any password reset, rather than relying on the caller's claimed identity.

Trezor confirmed that a breach at its logistics partner ShipMonk exposed personal data of over 13,000 customers who ordered hardware wallets between May 10 and August 8, including names, email addresses, phone numbers, and shipping addresses across the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal. ShipMonk was subject to Trezor's 90-day data retention policy, but earlier orders may also be affected, and Trezor warned affected customers to expect increased phishing attempts.

Why: If your SaaS or startup uses third-party logistics or fulfillment partners that handle customer PII, this is a concrete reminder that your vendor retention policies are only as good as your vendor's enforcement. The breach specifically shows that even a 90-day retention clause did not prevent earlier-order data from being exposed, meaning founders shipping physical products should audit whether partners actually delete or anonymize data on schedule rather than assuming contractual terms are followed.

Scotland's prosecution service warned 300 staff that names, roles, and work emails may have been exposed through a supplier breach detected on August 5, tied to an online data maturity assessment. The supplier is unnamed and the intrusion method is unclear, though The Register notes it may be connected to a recently disclosed Metabase cloud zero-day that allowed admin access to connected databases—Framework was also affected.

Why: If you run Metabase Cloud, check whether you were exposed to the zero-day disclosed this month and review what connected databases an admin-level attacker could have reached. The Scottish incident itself is a reminder that data collected for seemingly low-stakes assessments (surveys, maturity exercises) still becomes a breach surface when stored by third parties.

France's tax authority (DGFiP) confirmed an intruder extracted taxpayer data in June 2026 after a cybercriminal using the alias 'ZeroBytes' advertised a database of 2 million French taxpayers on a cybercrime forum, claiming access via stolen credentials and an MFA bypass. DGFiP disputes the attacker's claim of continued access, says the breach was severed at end of June during an audit, and is investigating the exact scope while notifying CNIL and affected users.

Why: The breach vector—stolen credentials plus an MFA bypass—is a reminder that MFA alone is not sufficient if session tokens or bypass techniques are in play. Builders handling authentication should review whether their systems are vulnerable to token theft or MFA fatigue/bypass, but this incident has no direct operational impact on Malaysian builders.

A European distributor for Steam hardware was hit by a cyberattack, resulting in theft of customer personal information and hardware purchase details. Valve has warned affected customers to expect fake messages as a consequence.

Why: Minimal practical impact for this audience. This is a regional hardware supply-chain breach affecting European Steam customers, not something developers, AI builders, or SaaS founders need to act on. No Malaysian or SEA relevance is indicated.