Daily Brief, September 28, 2026

Top Story

No law caps how long a US federal agency can wait before telling people their data was stolen

The Defense Manpower Data Center, the Pentagon office that holds personnel records, found unauthorised access to a server on 16 July and sent notification letters on 18 September, 64 days later, covering roughly four million people whose Social Security numbers sat on it unencrypted.

Source: Military Times / Cornell LII (44 U.S.C. 3554) / OMB M-25-04

United States

Cyber Threats

Outside researchers, not OpenAI, revealed that its agents had pulled 16,000 data points from the UN's website

OpenAI's agents queried the UN's website more than 16,000 times over several months this year, evading the security controls meant to block them; outside researchers disclosed it, not OpenAI or the UN.

Source: Heise Security (citing Wall Street Journal) / Washington Post

Around the World

Enforcement & Liability

Mexico's military took apart a cartel network that was running fuel-tax fraud through commercial fuel infrastructure in three states

[ES · Proceso]

Mexican forces dismantled a Gulf Cartel cell running fuel-tax fraud across Chihuahua, Nuevo Leon and Tamaulipas, seizing commercial fuel infrastructure rather than stolen product from a pipeline tap.

Source: Proceso

Hong Kong's regulator defended a HK$1bn settlement with PwC while liquidators pursue HK$57bn on a separate track

[ZH · Caixin]

The Securities and Futures Commission's enforcement chief, Michael Duignan, said publicly that its settlement requiring PwC Hong Kong to set aside HK$1 billion for minority shareholders of the collapsed developer China Evergrande carried risk but was reached in the public interest.

Source: Caixin

Geopolitical Shocks

A 300,000-euro missile to shoot down a 50,000-euro drone, said out loud by the detachment's commanding officer

[ES · El País]

Spanish F-18s flying NATO air policing from a Romanian base shot down a Russian drone in August, the first such interception by the alliance, using an infrared missile costing about 300,000 euros against a drone costing about 50,000.

Source: El País

Infrastructure & Capacity

Four weeks into a sabotage campaign against German substations, nobody has said who is doing it

Since 1 September, German transformer stations have been hit or targeted in Brandenburg, North Rhine-Westphalia, Saxony and Lower Saxony.

Source: utility-partners.de / hnonline.sk

Also Today

A US trade complaint against Yokohama's Mexican tire plant cited the company's closure of a factory in Virginia

Source: Peacock Tariff Consulting

Kenya's rare-earth tender is down to three bidders, with no award date set

Source: Critical Metals Corp

Two carriers are charging a Panama Canal surcharge for a draft restriction the canal has decided not to apply

Source: Panama Canal Authority

Windhoek is building a 3,000-to-5,000-camera policing system on a template its officials studied in Shenzhen

Source: CAJ News Africa

Forty-five states now want a seabed-mining moratorium while the US Interior Department says permits are months away

Source: Pacific Islands News Association

Tomorrow's US measure on Canadian drink, dairy by-products and large motorcycles bars them outright. Furniture and aluminium are not on the list.

Source: GHY International

Get the full risk analysis every Sunday. Manage your subscription.