This cybersecurity news edition covers five Australian and global developments reported or materially updated on 11 November. Sources checked at 12:08 Sydney on 12 November 2026. Earlier incident dates are separate. Some primary sources provide a date only; exact rolling-24-hour eligibility cannot be proved for every item. Images are original generated editorial illustrations, not incident photographs or genuine product screenshots.
1. Australian ransomware survey finds faster payment decisions despite preparedness
Australia
Report or update: 2026-11-11
Incident timing: Survey conducted 28 August to 14 September 2026; responses describe earlier attacks, not a new incident today.
McGrathNicol's 11 November research reports that 78% of surveyed Australian organisations that experienced ransomware in the previous five years paid a ransom. Of those who paid, 40% did so within 24 hours. The release draws on 1,000 business leaders surveyed with YouGov. These are reported experiences, not a claim that 78% of all Australian businesses paid criminals.
Cyber Daily reports that the survey covered organisations with at least 50 employees and ran from 28 August to 14 September. That limits how directly the results describe microbusinesses. The news is the new research release, not a wave of attacks that all happened this week. The primary report's 40% figure concerns organisations that paid, an important distinction from all victims.
For an Australian business owner, the decision is whether recovery evidence and escalation contacts are ready before an extortion deadline arrives. The technology lead should demonstrate which critical services can be restored and how quickly; finance and management should own any payment decision with appropriate specialist advice. A working restore does not prove stolen customer files are confidential, and paying does not prove copies have been deleted.
2. Maersk confirms data extraction from a legacy system
Denmark / global customers
Report or update: 2026-11-11
Incident timing: Intrusion date undisclosed; threat-actor claim appeared over the preceding weekend.
Maersk confirmed on 11 November that an attacker accessed and extracted data from a local legacy system inherited through a previous acquisition. It says the incident is isolated, it has found no indication of impact on other Maersk systems or connected customer and partner systems, and it does not anticipate customer operational disruption. The investigation remains ongoing.
BleepingComputer reports that the WhiteArmor group is demanding US$5 million and claims to hold about 100GB of information. Those are attacker assertions, not independently established data volumes or proof of which records were exposed. Maersk says its findings so far strongly suggest that no sensitive data has been disclosed. That is the company's current assessment, not a final forensic clearance.
For Australian importers, exporters and logistics customers, shipment access continuing normally answers an availability question, not every data-risk question. The supplier relationship owner should monitor the company's official notice, confirm whether their information is implicated, and verify unusual requests through their established Maersk contact. For acquirers, the incident also makes a concrete point: a retired or local application can retain valuable data even when the main platform is well protected.
3. Researchers link an AI agent to theft from Tajik government document systems
Tajikistan / Central Asia
Report or update: 2026-11-11
Incident timing: Activity reconstructed from April to October 2026; railway access from mid-August, document-system intrusion later in August.
CloudSEK published research on 11 November describing an exposed server it attributes to the Silent Lynx espionage group. Reuters reports the researchers found evidence of more than 2,000 national-security-related documents stolen from Tajikistan, with an AI agent assisting reconnaissance, collection and organisation. This is a new disclosure of earlier intrusions, not evidence that the theft began today.
According to CloudSEK, a compromised railway employee account could retrieve government correspondence beyond the railway's own documents. The researchers describe an automated agent using mainly DeepSeek models through the open-source Hermes framework to help run operations and organise collected files. The underlying risk is excessive reachable data and weak permission boundaries; the report does not show AI breaking encryption or making access controls irrelevant.
CloudSEK assesses a Kazakhstan connection with medium confidence. Reuters says government officials did not immediately respond, so attribution remains a research assessment rather than an official finding. For Australian organisations, the application owner should test which records an ordinary account can actually retrieve and alert on abnormal bulk collection. A legitimate login is not proof that every requested document should be accessible, while AI can accelerate misuse of permissions already available.
4. Notion reviews exposed AI chats and revokes discovered API keys
United States / global workspaces
Report or update: 2026-11-11
Incident timing: Fireworks intrusion reported as 23 October; Notion stopped traffic by 3 November, received affected dataset 8 November; API-key revocation update 11 November.
Notion's 11 November incident update says it revoked exposed Notion API keys discovered during its investigation into the Fireworks AI supplier breach. Its help centre says the incident affects fewer than 1% of Notion workspaces. BleepingComputer reports that exposed material included Notion AI chat transcripts used for the Insights feature. The new development is the investigation and response, not another intrusion on 11 November.
Notion says it had disconnected Fireworks, deleted data there and stopped traffic and training runs by 3 November. It also says Fireworks had contractually committed to zero retention, but its investigation found retained data at the endpoints it used. A contractual promise and an application's stored chat history are distinct controls. Removing names or workspace labels also does not prove that the contents of a conversation cannot identify a person or business.
Australian workspace owners who receive a notice should use Notion's desktop Security incident review to inspect affected data and coordinate credential rotation. Vendor revocation of discovered Notion keys is not proof that every password or third-party secret pasted into chats has been replaced. Notion says no action is currently needed if neither the user nor workspace owner has been notified, while its investigation continues. The business data owner should assess the actual exposed content rather than infer risk from the workspace percentage.
5. ScreenConnect campaign turns remote support into a route between customer and technician devices
United States / global managed-service customers
Report or update: 2026-11-11
Incident timing: Huntress observed campaign beginning approximately 11 November 17:48 UTC.
ConnectWise's 11 November advisory says it is investigating unauthorised access to ScreenConnect partner accounts and deployment of unauthorised remote-access software in customer environments. It identified about 400 partner environments with one or more of five independent third-party extensions and disabled those extensions as a precaution. Their presence does not establish that all those environments were compromised.
Huntress says it observed malicious Run Command activity from about 17:48 UTC on 11 November. Attackers installed a second remote-access client and a toolkit that can target a technician connecting to an infected customer device. ConnectWise says initial access and full scope remain unresolved, and some reported behaviours are still being validated. This is not confirmation of a newly discovered ScreenConnect software vulnerability.
For Australian businesses using managed IT support, the service owner should ask the provider to check the listed extensions, preserve command and authentication records, and investigate suspected endpoints with separate trusted security tools. ConnectWise advises against interactive ScreenConnect connections to suspected compromised devices. Disabling an extension or resetting a password does not prove an attacker-installed client or persistence has been removed. This campaign is distinct from the earlier ConnectWise Cloud Backup incident.
How Xpansion can support your next step
Xpansion Technologies can help you review your business technology requirements and coordinate practical next steps with your IT providers. For these developments, start with a clear owner for recovery evidence, supplier access and AI data handling. Talk to Xpansion Technologies about your requirements. Specialist incident response, legal advice and forensic conclusions should come from appropriately qualified advisers.
Sources
- McGrathNicol / YouGov – primary
- McGrathNicol / YouGov – corroboration
- A.P. Moller – Maersk – primary
- A.P. Moller – Maersk – corroboration
- CloudSEK research into Silent Lynx – primary
- CloudSEK research into Silent Lynx – corroboration
- Notion / Fireworks AI – primary
- Notion / Fireworks AI – additional primary
- Notion / Fireworks AI – corroboration
- ConnectWise / Huntress – primary
- ConnectWise / Huntress – additional primary
- ConnectWise / Huntress – corroboration
- McGrathNicol 2026 ransomware report and survey methodology
Source qualifications: company findings and researcher assessments remain attributed above. Date-only publications are not asserted to meet an exact rolling 24-hour test. Survey findings are indicative of the stated sample, not a census. This is general technology information, not legal advice.
