The Record
Cybersecurity: Threats and Defences
What we told you to watch, what each side claimed, and what we got wrong. Every verdict shows its evidence.
Open 60 · Corrections 120
What we told you to watch
Still open · 60
Show the 10 most recentWhether peers vote through frontier AI incident reporting or data-centre shutdown powers at the bill's Lords report stage on 26 October.
From the 12 Oct briefing · Deadline: 26 October
How large a revenue hit Boston Scientific puts on the outage at its third-quarter call on 28 October.
From the 12 Oct briefing · Deadline: 28 October
Whether CISA turns another named-actor advisory into same-day three-day KEV deadlines, which would make the 8 October pairing a method rather than a one-off.
From the 12 Oct briefing · Deadline: 8 October
Whether CISA lists a sixth NetScaler flaw since late August, or tells agencies to rotate the directory bind passwords the September attacks exposed.
From the 12 Oct briefing · Deadline: late August
Whether CISA publishes any Phase II compliance signal, or opens Phase III preparation, under BOD 26-04.
From the 5 Sept briefing
ReliaQuest's next assessment of the FrostArmada tradecraft overlap on the hotel WiFi domain name system campaign.
From the 5 Sept briefing
The September three-day share of KEV additions, after August's fall to 71 per cent.
From the 5 Sept briefing
Whether Italy holds third place in leak-site claims or reverts towards its July position.
From the 5 Sept briefing
Whether the UAE Cyber Security Council makes a third consecutive monthly disclosure.
From the 5 Sept briefing
Whether BlackFog's July report, when it lands, confirms the leak-site inversion or names a monthly leader other than The Gentlemen .
From the 3 Aug briefing
Whether the KEV catalogue resumes additions and at what deadline length: a return to 14-day clocks weakens the compression finding, more three-day entries harden it .
From the 3 Aug briefing
Whether Phase III of BOD 26-04 in mid-December produces any public compliance signal that Phase II's 9 August checkpoint does not.
From the 3 Aug briefing · Deadline: mid-December
Whether ReliaQuest, or any other named firm, firms up or retracts the FrostArmada overlap on the hospitality campaign.
From the 3 Aug briefing
Whether CISA names a non-compliant agency at the BOD 26-04 60-day checkpoint in early August, its first enforcement test.
From the 24 Jul briefing · Deadline: early August
Whether the Lords adopts Alton's transnational-repression amendment, forcing Commons-Lords ping-pong before Royal Assent.
From the 24 Jul briefing
Whether LAUNDRY BEAR pivots from Zimbra to other webmail platforms, as AA26-204A predicts.
From the 24 Jul briefing
Whether River Financial's fifth filing finally determines materiality and PII scope, or the loop stays open.
From the 24 Jul briefing
Whether the FortiSandbox KEV ransomware-association field flips from Unknown as a crew adopts it.
From the 24 Jul briefing
Whether CISA names any non-compliant agency at the BOD 26-04 60-day checkpoint in early August, the directive's first enforcement test.
From the 14 Jul briefing · Deadline: early August
Any confirmed intrusion at a named UK critical-infrastructure operator traced to the FSB Centre 16 SNMP campaign.
From the 14 Jul briefing
What each side claimed
Claims are what a named side said at the time. We record them as said and judge them only against later evidence.
No claims recorded yet.
What we got wrong
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.
- SignificantCorrected 12 Oct 2026We said
Europol seized First VPN servers across 27 countries; the service was used by at least 25 ransomware gangs including Phobos and Avaddon; no arrest was announced
What was trueFrench and Dutch authorities led Operation Saffron with Europol and Eurojust support. 33 servers were dismantled on 19-20 May 2026 and the administrator was searched and interviewed in Ukraine (Europol's headline calls it an arrest). 18 countries took part; a 16-country taskforce analysed the seized data. The Paris prosecutor says the service ran since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases such as Phobos. No first-party source gives 27 participating countries, 25 gangs or Avaddon.