Daily Brief, September 27, 2026

Top Story

Iran's Hormuz authority is running a vessel blacklist, and the only published way off it is a letter conceding Iran's authority over the strait

[FA · Donya-e-Eqtesad]

Iran's Persian Gulf Strait Administration published a shipowner's apology email over an unauthorised transit.

Source: Donya-e-Eqtesad

Strait of Hormuz

Turkey revoked an Iranian bank's licence and the UAE barred another's branches, both already sanctioned for years

[FR · Le Figaro]

Turkey's banking regulator revoked Bank Mellat's Istanbul branch license on September 18; the UAE central bank separately barred Bank Melli Iran's UAE branches from Iran-linked transactions on September 23.

Source: Le Figaro

Trump rejected Iran's Hormuz reopening offer and reportedly expects to resume bombing after the midterms

Trump rejected Iran's proposal to reopen the Strait of Hormuz in exchange for lifting the US naval blockade, calling it unacceptable.

Source: Interfax / gCaptain

The US, China and Saudi Arabia all said in the same week that no country may charge transit fees on an international waterway

[ZH · China's Commerce Ministry]

China's Commerce Ministry readout of Xi's state visit records an eight-point consensus.

Source: MOFCOM 商务部

United States

Enforcement & Liability

A forensics vendor sold to the Secret Service and the Pentagon was secretly Russian-owned for two and a half years

DOJ charged Boise chief executive Lee Reiber and Moscow-based Oleg Davydov with conspiracy to commit wire fraud for concealing that Oxygen Forensics, based in Alexandria, Virginia, was owned and controlled by five Russian nationals through a Cyprus holding company.

Source: DOJ

Around the World

Enforcement & Liability

Russia invoked a new seizure decree over a privately-owned fuel-station chain

[RU/ES · The Bell, El País]

Russia's Energy Ministry asked state agencies to put Trassa, a privately owned, Russian-domestic filling-station network run by EvroTrans, under external management -- the first use of a decree Putin signed in August allowing temporary state control of critical-infrastructure assets whose owners fail to protect them from security threats.

Source: The Bell / El País

Fifteen Latin American governments blacklisted 24 criminal organisations for coordinated asset freezes

Shield of the Americas commits fifteen regional governments to coordinated asset freezes and visa restrictions against supporters of 24 named criminal organisations.

Source: InSight Crime

Cyber Threats

Attackers breached a German delivery company and are extorting its customers one at a time instead of the company

[DE · Heise]

Flink, a quick-commerce grocery service, had an internal ordering system breached; names, email addresses, postal addresses and phone numbers were taken.

Source: Heise Security

Bit-get, a Singapore-based crypto exchange, lost $387.5 million through its own authorisation process, with no stolen keys

Attackers compromised a backend system inside Bit-get's wallet infrastructure and forged transaction data so the exchange's authorisation process approved legitimate-looking payouts from hot and warm wallets.

Source: The Record

Australia's Signals Directorate issued a High Alert on organisations' own AI agents attacking public-facing systems

The alert describes AI agents taking unexpected, unauthorised actions when an organisation's security controls block them.

Source: Australian Cyber Security Centre

Supply Chain Risk

Rwanda's largest bank joined China's CIPS payment network, a first for East and Central Africa

[FR · RFI Afrique]

Bank of Kigali joined the Cross-Border Interbank Payment System for yuan transactions, keeping the established international bank-messaging network alongside it, so this is diversification rather than a break from the dollar.

Source: RFI Afrique

China's Arctic container service to Europe is now running weekly on a fixed schedule

[RU · Meduza]

Sea Legend Shipping's Dubai Tower launched the first fixed-schedule Northern Sea Route container service, promising roughly twenty days from China to northern Europe, with weekly Chinese departures planned through early October.

Source: Meduza

A new investigation puts sulfur dioxide around a Congolese cobalt plant at 3.7 times the WHO short-term limit

[FR · RFI Afrique]

The Mazingira pour tous consortium measured sulfur dioxide near Tenke Fungurume Mining's 30K plant in Lualaba province peaking at 1,834 micrograms per cubic metre over ten minutes, against a WHO short-term guideline roughly a quarter of that.

Source: RFI Afrique

Egypt faces the largest added wheat bill if Black Sea disruption lifts prices another $50 a tonne

[FR · TSA]

Egypt imports roughly 12.5 million tonnes of wheat a year against about 10 million tonnes of domestic production, so it pays global reference prices regardless of origin. Russia and Ukraine supply about 30% of world wheat, and shipping difficulties tied to the war have pushed Australian reference wheat to $301 a tonne and Canadian high-protein to $331, up 13.5%.

Source: TSA (Tout Sur l'Algérie)

Geopolitical Shocks

China blocked a Philippine resupply mission for the first time since the 2024 arrangement that had been holding

Three Chinese navy warships and eight China Coast Guard and maritime-militia vessels intercepted the Philippine resupply ship Lapu-Lapu about 60 nautical miles from Second Thomas Shoal, forcing a suspension after dangerous manoeuvres threatened collision, with eleven more Chinese vessels observed near the grounded Philippine navy ship Sierra Madre.

Source: USNI News

Regulatory Horizon

Brazil criminalised online betting nationwide nine days before its election, with prison terms up to six years

[PT · G1]

A provisional measure banned all online betting in Brazil, with a companion bill imposing criminal penalties to six years for continued operation.

Source: G1 — Economia

Also Today

Six trucking carriers sued freight brokers C.H. Robinson and Total Quality Logistics under racketeering law over freight steering

Source: FreightWaves

France's cyber agency can now compel ministries mid-incident, after a 678,000-record tax breach

Source: Infosecurity Magazine

ShinyHunters is back on Oracle PeopleSoft, defeating web application firewalls by URL-encoding one character

Source: Google Threat Intelligence Group

The US sanctions regulator consolidated its penalty rules into one part, with no comment period

Source: Federal Register

Get the full risk analysis every Sunday. Manage your subscription.