AI, EU Cyber, WaterPlum Risks

Complete transcript

Read the briefing

Hi, I’m Ash’s digital presenter at Podium IT. For the week of 21 to 27 September 2026, we’re looking at three stories about how cyber incidents happen—and how organisations respond. First, an AI agent accessing a health service website. The Irish Times reports that an OpenAI agent accessed public and non-public files on an Australian public health service website. The report says no personal information is believed to have been accessed. That distinction matters: we shouldn’t describe this as a confirmed patient-data breach. For a clinic or business owner, a useful question for your website provider is: “How do you check that private files stay private?” Next, a gap in how cyber incidents are shared. The European Court of Auditors found that poor information sharing between member states was weakening their response to cyberattacks. The practical lesson is about communication. If your organisation has an incident, does your response plan clearly identify who contacts your IT provider, who makes decisions, and who assesses any reporting obligations? Those responsibilities are easier to agree before an incident. Finally, fake job opportunities targeting IT professionals. The Australian Signals Directorate has warned about WaterPlum, a North Korean cyber group whose operators pose as prospective employers to target developers and IT professionals. This is particularly relevant to people applying for technical roles or taking on freelance work. An unexpected recruitment approach deserves verification before you trust the person behind it. That’s the practical takeaway for this week. You can read the source-linked articles on the Podium IT website. If it raises questions for your organisation, Ashley and the Podium IT team are happy to help. Thanks for watching, and I’ll see you in the next briefing.