AI is learning to anticipate our choices, from battlefield decisions to mortgages, spending and relationships. Alex Karp’s warning raises a question of power: when machines understand our habits and vulnerabilities, will they serve our interests or subtly steer us towards someone else’s objectives?
The AI-assisted raid on South Korea's banks never went near the vault. It slipped in through loan portals, sales platforms and a staff mobile app. Now Seoul is ordering every bank to count its exposed doors, and regulators in Washington, London, Frankfurt and Sydney are asking the same question.
A bipartisan AI committee wants independent evaluators inside OpenAI and Anthropic and early access for security agencies. Read slowly, its letter to Albanese is a ransom note written in reverse. Australia is not being held hostage. It is offering itself, with its creative archive as collateral.
Booking.com confirms hackers accessed customer names, emails, addresses, and booking details via third-party compromise. Stolen data is already fuelling targeted WhatsApp phishing attacks, exposing deep supply chain vulnerabilities in global travel platforms.
Booking.com’s confirmation on 13 April 2026 that unauthorised parties accessed customer booking data marks another serious lapse in safeguarding traveller privacy. The exposed information – names, email addresses, phone numbers, physical addresses, reservation specifics and platform–hotel message histories – while excluding financial details per the company’s statement, has already fuelled a wave of highly targeted secondary attacks.
Affected Australians report receiving WhatsApp messages bearing accurate booking particulars days before official notification, with one Bali traveller losing $100 to a fraudster impersonating Booking.com support.
This is not an isolated failing but a symptom of a systemic vulnerability: security firms Bridewell and Sekoia have long documented how attackers compromise hotel partner credentials via infostealer malware, then mine reservation databases to craft convincing phishing lures. The Dutch Data Protection Authority’s €475,000 fine against Booking.com in 2021 for an almost identical supply-chain breach underscores the pattern.
The scale of exposure is significant: Operating across 28 million global listings and processing hundreds of millions of bookings yearly, the scale of potential harm is immense. Yet critical questions remain unanswered: how many customers were affected, for how long was data accessible, and through what precise vector? This opacity complicates individual risk assessment and raises concerns about compliance with GDPR and Australia’s Privacy Act, which mandate timely, transparent disclosure of breaches involving personal information.
Treat every unexpected Booking.com message as suspect until proven otherwise. Go directly to the official app or website and avoid clicking on links in emails, texts or WhatsApp messages, no matter how authentic they look.
Check your current reservations line by line. Look for any change to guest names, email addresses or phone numbers, which can signal that someone is already inside your account. Turn on two-factor authentication immediately to make it materially harder for attackers to reuse stolen credentials.
Ensure reputable antivirus software is installed and up to date on any device you use for travel bookings, given infostealer malware is a key tool in this campaign. Be wary of unsolicited calls or messages from anyone claiming to represent Booking.com and refuse to share card details, one-time passwords or security codes. Keep a close eye on bank and card statements for unfamiliar transactions, even though there is no firm evidence yet that card numbers were the primary target.
Where possible, route bookings through a dedicated email alias so that a compromise does not expose your main inbox. Do not rely solely on Booking.com’s automatic PIN reset. Log in and update reservation PINs and account security settings yourself to close off easy opportunities for follow-on fraud.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
OpenAI flew its chief strategy officer to Sydney to apologise for a rogue AI agent's Medicare breach. The hack was clumsy. The silence that followed was worse, and Parliament now has to decide whether sorry is the only accountability on offer.
OpenAI’s Medicare breach has shifted Australia’s AI debate from investment to accountability. As Canberra examines legal options and calls grow for stronger sovereign capability, the question is global: who controls autonomous systems, and who answers when they cross national boundaries?
OpenAI's Astra can develop zero-day exploits, while a US$1 billion defence push seeks to give critical infrastructure teams the same machine-speed advantage.
US authorities have dismantled QTFY’s QScan and QTRouter platforms, exposing a China-linked service model that blended exploit trading, automated scanning and hijacked IoT devices to reach critical infrastructure while concealing where attacks began.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
