Cybersecurity News: Eurail traveler data for sale, EU Parliament blocks AI features, Washington Hotel discloses ransomware hit

By
Sarah Lane
-

In today’s cybersecurity news…

Eurail stolen traveler data now up for sale

Eurail says data stolen in a recent breach is now being offered for sale on the dark web, with a sample also posted on Telegram. The Netherlands-based rail pass operator previously confirmed attackers accessed its customer database, exposing information including names, passport and ID numbers, IBANs, health data, and contact details. The company is still determining how many customers were affected and says it will notify individuals once the investigation is complete, while urging users to reset passwords and monitor bank activity. (BleepingComputer)

EU Parliament blocks AI features

The European Parliament has disabled built-in AI features on work tablets and phones used by lawmakers and staff, after its IT department said it couldn’t guarantee the tools’ data security. An internal email said some features send data to cloud services even for tasks that could run locally, and the extent of shared data is still being assessed. Core apps like email and documents are unaffected, but officials were advised to avoid exposing work information to AI tools and to be cautious with third-party AI apps on personal devices. (Politico)

Japan’s Washington Hotel discloses ransomware hit

Washington Hotel, a 30-property business hotel chain in Japan run by Fujita Kanko, says it was hit by a ransomware attack on February 13th after hackers breached its servers. The company disconnected affected systems and is working with police and external security experts, confirming that business data was accessed. It says customer data is likely safe because it’s stored on separate systems, though some operations, including credit card terminals, were temporarily affected. (BleepingComputer)

Google patches Chrome zero-day, exploits surface

Google issued an emergency patch for Chrome’s first zero-day of 2026, a high-severity use-after-free flaw in the browser’s CSS handling. The bug could let attackers run code inside the browser sandbox via a malicious webpage, and Google says it was already being exploited in the wild before the fix. Security researcher Shaheen Fazim reported the issue on February 11th, and patched versions are now rolling out for Windows, macOS, and Linux. (The Register)

Huge thanks to our sponsor, Conveyor

Here’s a fun question. Would you rather support more enterprise deals… or answer fewer security questionnaires? Moving upmarket usually means more scrutiny and more security questions. Instead of hiring more people or slowing sales, Alteryx used Conveyor’s AI to automate customer security reviews like questionnaires, SOC 2 requests, and all the back-and-forth. They supported 200% growth and over half a billion dollars in pipeline with a 4 person team. If you’re tired of choosing between growth and sanity, check out Conveyor at conveyor.com.

Starlink restrictions hit Russian forces

Ukraine’s new national verification system for Starlink terminals is disrupting Russian forces, after it confirmed Russia was using Starlink-equipped drones for real-time control. Only registered devices now work in Ukrainian-controlled territory, and officials say the change has already reduced kamikaze drone attacks and disrupted coordination. Ukrainian authorities warn Russia is trying to recruit civilians to register terminals on its behalf, while a hacker group claims it tricked Russian soldiers into revealing locations and paying to restore blocked devices. (The Record)

Operation DoppelBrand: weaponizing Fortune 500

SOCRadar researchers say a financially motivated group dubbed GS7 is running a phishing campaign called Operation DoppelBrand that impersonates Fortune 500 brands to steal credentials. The operation, active since at least late 2025, targets major financial institutions and other high-value companies using more than 150 spoofed domains and highly accurate login pages. Stolen credentials and device data are sent to Telegram bots, and victims may have remote management tools installed, suggesting GS7 may sell access to ransomware groups as an initial access broker. (Dark Reading)

Compromised password managers? Maybe not. 

Researchers from ETH Zurich and Università della Svizzera italiana found multiple weaknesses in Bitwarden, LastPass, and Dashlane that could expose passwords if the services’ servers were compromised, despite their “zero-knowledge” claims. Using a malicious-server model, the team demonstrated 12 attacks against Bitwarden, seven against LastPass, and six against Dashlane, with some leading to password disclosure or vault changes. The researchers said legacy cryptography and unclear threat models contributed to the issues. (The Register)

Infostealer malware found stealing OpenClaw secrets

Hudson Rock researchers say an infostealer, likely a Vidar variant, exfiltrated configuration files from an OpenClaw AI agent, including gateway tokens, cryptographic keys, and the agent’s core behavioral rules. The data could let attackers remotely access the agent or impersonate it in authenticated requests. SecurityScorecard also found hundreds of thousands of exposed OpenClaw instances vulnerable to remote code execution, while other researchers uncovered malicious “skills” and undeletable AI-agent accounts on the Moltbook platform. Researchers warn infostealers will likely add dedicated modules to target AI agents as they become more widely used. (The Hacker News)