The most time-sensitive item this morning is a remote-access flaw in Ivanti Connect Secure that CISA says attackers are already exploiting, so any office or family office using it should confirm its patch status today. Two other U.S. stories concern exposure closer to the principal: a federal suit against a firm that sold sextortion "relief" to families, and a recording device found in an executive conference room at OpenAI. Abroad, the UK has widened its no-travel zones in Venezuela, and drone strikes on two ships off Bulgaria matter to anyone with maritime exposure in the Black Sea.
United States
Cyber & FraudUnited StatesHigh
A remote-access gateway flaw is being exploited, and office networks are the target
CISA says attackers are actively exploiting a newly disclosed vulnerability in Ivanti Connect Secure, tracked as CVE-2026-104935. Affected versions are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. CISA urges organizations to patch.
Why it matters. The family office, the principal's company and any advisor who connects to files and wire approvals through an Ivanti VPN are exposed, because a compromised gateway can open the accounts behind the money movement. Ask whoever runs your IT whether this product is in use and which version it is.
What to do
- Ask your IT provider whether Ivanti Connect Secure is in use and confirm it is patched
- Review recent remote logins to finance and document systems for anything unfamiliar
Sources: CISA | See the Exposure Assessment →
Cyber & FraudUnited StatesModerate
A firm selling sextortion 'rescue' to families is halted by court order after FTC suit
The FTC has sued Digital Forensics Corporation LLC and its CEO, and a federal court has temporarily halted their activities. The FTC alleges the company charged consumers thousands of dollars while claiming it would identify criminals and end sextortion attacks, did not deliver those services, and used deceptive reviews.
Why it matters. Children and teens in the family, and the parents or staff who may be pressed to pay quickly, are the people exposed. Families facing a sextortion threat are being targeted twice, first by the extortionist and then by paid services that may not deliver.
What to do
- Tell children to come to a parent first if anyone threatens to share images, and agree that no payment is made before an adviser is consulted
- Route any paid 'recovery' service through your attorney or security adviser before engaging it
Sources: FTC | Set up a Verification Protocol →
Privacy & ExposureOpenAI office (city not stated)Moderate
A listening device was found in an executive conference room at OpenAI
Prosecutors say a Saudi employee planted a recording device in an OpenAI office. They say it was wrapped in toilet paper and inserted in a USB port on the back of a TV in an executive conference room. The employee has been charged.
Why it matters. Executives and family office principals who hold sensitive meetings in boardrooms, offices or at home are exposed, since the device sat in an ordinary conference-room TV. The case shows that those with legitimate building access are a route to private conversations.
What to do
- Have the TVs, USB ports and ceiling fixtures in meeting rooms inspected, and limit who has unescorted access
- Move the most sensitive discussions to rooms you control
Sources: BBC News | See the Exposure Assessment →
Targeted ViolenceCalvert County (Huntingtown), MarylandLow
A shooting at a Huntingtown, Maryland home ends with a man charged in his sister's death
A Huntingtown man is being charged with murder in the death of his sister. Officers arriving at the scene found a man in the driveway, who told them he had shot someone.
Why it matters. Principals with homes or relatives in Calvert County and Southern Maryland should note that this case involves a family member rather than a stranger. Concern about a relative's or household member's behavior is best raised early with a trusted adviser, before it reaches the home.
What to do
- Write down who has access to the home and agree on how a worrying change in a relative or staff member is reported
Sources: WTOP News | About the Protective Intelligence Cell →
Global
Travel & RegionVenezuelaModerate
UK widens no-travel zones in Venezuela to Amazonas state and the Colombian border
The UK Foreign Office now advises against all travel to Amazonas state and to within 40km of the Colombia border. It continues to advise against all travel to the Orinoco Mining Arc and within 40km of the Brazil and Guyana borders. It advises against all but essential travel to the rest of the country, including Zulia state and Maracaibo.
Why it matters. Traveling executives, and families with business, mining or property interests in or near Venezuela, now have a larger area where their travel plans fall outside UK advice. Insurers and employers often rely on such advisories when they review cover.
What to do
- Check travel insurance and employer duty-of-care terms against the new advisory before any trip near the region
Sources: UK Foreign Office | Take the 10-question Self-Check →
Cyber & FraudUnited KingdomModerate
A cyber-attack at the owner of Phase Eight and Hobbs may expose customer details
TFG London, which owns Phase Eight and Hobbs, says it identified a cybersecurity incident on Sunday and has apologised to customers for the disruption. Separately, H&M is looking into a claim that it was hacked.
Why it matters. Spouses, adult children and household staff who shop with these retailers may receive convincing messages about orders or accounts. Retail incidents often lead to phishing aimed at the customer, so treat unexpected messages carefully until the company says what was affected.
What to do
- Tell family and staff to treat any unexpected order or account message from these retailers as suspect and to use the official site directly
Sources: BBC News | Set up a Verification Protocol →
Maritime & AviationBlack Sea, off BulgariaModerate
Drone strikes on two ships off Bulgaria put Black Sea yacht and cargo exposure in focus
Bulgaria's prime minister says drones struck two ships off the country's Black Sea coast. Bulgaria has summoned the Russian ambassador over the strikes.
Why it matters. Yacht owners, charter clients and family businesses with cargo or vessels in the Black Sea are exposed, since civilian ships off a NATO member's coast are now being hit. Captains and managers should review routing and insurer notices for the area.
What to do
- Ask your yacht captain or shipping manager to confirm current routing and insurer guidance for the Black Sea
Sources: The New York Times | Take the 10-question Self-Check →
One thing to do todayCheck the VPN, the boardroom and the kids' rules
Ask your IT provider to confirm whether Ivanti Connect Secure is in use and patched, and to review recent remote logins. Have meeting rooms where sensitive business is discussed checked for unfamiliar devices. Agree with your children that any threat involving images goes to a parent first, with no payment made to anyone.
Train for it: Defensive Communications, digital defense for phones, accounts and messaging.
See the Exposure Assessment
