A Stolen Registry, a Nuclear Umbrella, and a Royal Reckoning

This Week in Brief

Weeks 22 and 23, the window from 20 May through 1 June, picking up where issue 017 left off. The news pipeline is back. The local model that drives summarisation had been returning empty output across the previous issue’s window, the fix landed this week, so this issue blends the recovered feed with direct SearXNG verification against open-source reporting. Every story below is cross-checked against at least one named outlet, single-source items are marked as such in the text.

The defining stories are the theft of Lithuania’s land registry, more than 600,000 records covering close to a fifth of the country’s population with home addresses of intelligence officers reportedly among them, the Narvik Agreement bringing Norway under France’s nuclear deterrent, and Crown Prince Haakon answering the Epstein questions around the Crown Princess in public for the first time. On the criminal side the ShinyHunters federation kept its run going, Carnival and Charter both confirmed breaches, a Gogs zero-day arrived with a public exploit module and no vendor fix, and the FBI warned on two fronts at once. Russia put an Oreshnik hypersonic missile on Kyiv and, days later, a drone into an apartment block inside NATO member Romania. EU AI Act high-risk enforcement is sixty-two days out at the close of this issue.

Security

Lithuania’s Land Registry Stolen, a Fifth of the Population Exposed

Around 27 May, Lithuania’s State Enterprise Centre of Registers was breached and more than 600,000 real-estate registry records were downloaded, exposing close to 540,000 people, nearly a fifth of the national population. The stolen set includes names, personal codes, and property and home addresses. Lithuanian politicians have said publicly they fear the data is destined for Russian intelligence, and reporting notes the exposure of the home addresses of intelligence officers and other officials. Lithuania has opened a criminal cyberattack investigation (Meduza, Anadolu Agency, Cybernews, TechTimes, 27 May).

This is the Nordic-Baltic story of the window and the one closest to home for Norwegian readers. A national registry is a single point of failure for an entire population’s physical-location privacy, and when the suspected end customer is a hostile state intelligence service the threat model shifts from fraud to personal safety for named officials. The operational lesson for any institution holding a population-scale dataset is that the blast radius of one registry breach is measured in fractions of a country, the defensive posture has to match that scale, segmentation, strict egress monitoring, and the assumption that a state actor is patient and well-resourced.

Carnival Confirms Breach Touching Nearly Six Million People

On 27 May, Carnival Corporation began notifying customers of an April 2026 cybersecurity incident traced to a compromised employee account, a social-engineering route against a third-party account. The exposed data includes names, addresses, government-issued ID numbers, and passport and driver’s-license data. BleepingComputer puts the figure at close to six million people, with roughly 800,000 Texans named in a Texas Attorney General filing. Reporting links the intrusion to ShinyHunters (Reuters, BleepingComputer, Cyber Daily, 27 to 31 May).

Passport and government-ID exposure is the worst tier of breach data, durable, hard to rotate, and useful for identity fraud for years. The social-engineering entry path is the recurring theme of the ShinyHunters run, the human account is the soft edge, not the firewall.

Charter Confirms Breach After ShinyHunters Extortion

Charter Communications, the operator of Spectrum, confirmed a data breach in late May following a ShinyHunters extortion threat. The threat actor claimed 40 to 42 million customer records, Charter’s own disclosure reportedly indicates around 4.9 million accounts exposed (BleepingComputer, TechRadar, HotHardware, 26 to 29 May). The claimed figure and the disclosed figure are an order of magnitude apart, the prudent read is to treat 4.9 million as the confirmed floor and the 40-million-plus claim as an unverified extortion lever until Charter says otherwise.

This is the second major ShinyHunters-attributed telecom and travel breach of the window alongside Carnival, both via account compromise and voice-phishing rather than a software exploit. The federation, blending ShinyHunters, Scattered Spider, and Lapsus$ affiliates, is running an identity-first playbook that no perimeter patch addresses.

Gogs Zero-Day RCE, Public Exploit and No Patch (CVE-2025-8110)

On 29 May, Rapid7 flagged a critical-severity zero-day remote-code-execution flaw in the self-hosted Git service Gogs, tracked as CVE-2025-8110. A public Metasploit exploit module is available and there was no vendor fix at the time of reporting (The Register, BleepingComputer, SecurityWeek, Cyber Daily, 29 May). CISA had already added an earlier Gogs flaw to its Known Exploited Vulnerabilities catalog in January 2026, so this is a repeat-offender codebase with a fresh, weaponised, unpatched bug.

Operational read, any internet-reachable Gogs instance should be treated as compromised-pending-proof and pulled behind authentication or taken offline until a patched release ships. Self-hosted Git is a high-value target because it sits on source code and CI secrets, the exact pivot a supply-chain attacker wants. Confirm the exact CVSS against the advisory when the vendor publishes, the sources reviewed describe it as critical without a settled score.

FBI Warns Twice, Kali365 and Silent Ransom Group

The FBI issued two notable alerts in the window. The first concerns Kali365, a phishing-as-a-service platform that hijacks Microsoft 365 accounts, Outlook, Teams, and OneDrive, and bypasses multi-factor authentication through OAuth token theft, no password required (BleepingComputer, HotHardware, TechRepublic, around 28 May). The second warns that the Silent Ransom Group is targeting US law firms with phishing, fake IT-support phone calls, and in-person physical visits where operatives plug in USB drives to steal client data (TechRepublic, Dark Reading, WebProNews, 28 May).

The pairing is instructive. Kali365 shows that MFA is necessary and no longer sufficient, OAuth token theft sidesteps the second factor entirely, the mitigation is conditional-access policy, token-binding, and session-revocation discipline, not just the presence of MFA. Silent Ransom Group shows that the physical layer is back in scope, an attacker willing to walk into a reception desk with a USB drive defeats every network control you own. Visitor policy and endpoint USB control are security questions, not facilities questions.

Signal Recovery-Key Phishing Targets Journalists and Activists

A phishing campaign in the window targeted Signal users, specifically journalists, anti-Chinese-Communist-Party activists, and human-rights workers, with fraudulent text messages designed to steal the 64-character recovery key that decrypts the entire message archive (TechTimes, 31 May). A successful theft exposes the full encrypted history, not a single conversation. This is a targeted operation against a high-risk population, the defensive answer is to treat the recovery key like a private key, never enter it in response to an inbound prompt, and to understand that the encryption holds, the human handling the key is the target.

LA Metro Breach Attributed to Iran, 23andMe Sued Over 2023 Breach

Two attribution and accountability items rounded out the window. Israeli firm Gambit Security attributed the March 2026 disruptive breach of Los Angeles Metro, which forced parts of the rail network offline and reached a rail-yard control display, to hackers linked to Iran’s intelligence ministry rather than a hacktivist front (Reuters, Times of Israel, SecurityWeek, 26 May). Separately, California Attorney General Rob Bonta sued 23andMe on 28 May over the 2023 breach that exposed genetic and personal data of an estimated 6.9 million customers, the suit alleging the company misled consumers and that specific ethnic groups were targeted (Reuters, Engadget, ABC7). Both are older incidents reaching their attribution and legal-consequence phase, the throughline is that breaches now carry a multi-year accountability tail.

As a trend anchor, Sophos research published around 29 May found that 71 percent of organisations suffered at least one identity-based breach in the past year, the same identity-first pattern the ShinyHunters run keeps proving in the wild.

Norway and the Nordics

The Narvik Agreement, Norway Under France’s Nuclear Umbrella

On 27 May, Prime Minister Jonas Gahr Støre announced that Norway will come under France’s nuclear deterrent, formalised as the Narvik Agreement on joint Norwegian-French defence, with Sweden and Denmark also involved. The structure places Norway under French extended deterrence with no nuclear weapons stationed on Norwegian soil and no Norwegian financing of them. By 31 May the agreement had won cross-spectrum support in the Norwegian press despite anti-nuclear opposition and some internal Labour Party criticism (Reuters, News in English, US News, 27 to 31 May).

This is a structural shift in Nordic security posture, a European deterrence arrangement standing up in parallel to the American umbrella at the precise moment Washington is publicly pressing Europe to carry more of its own defence. Moscow answered around 29 to 30 May with a public warning that Oslo’s participation threatens Russian security interests, the wording is widely echoed but thinly sourced, treat it as a signal rather than a settled quote until a primary source confirms it.

Russian Intelligence Targeting Nordic Defence Technology

On 30 May, an Associated Press investigation datelined Stockholm, citing three senior European intelligence officials, reported that Russian intelligence is intensifying the theft of Western technology and defence secrets as sanctions bite, using fake companies, cyber operatives, and recruited middlemen. Sweden’s defence industry was named specifically, with targets spanning advanced machine tools, dual-use camera and laser systems, and space, quantum, Arctic, and marine technology (US News via AP, The Independent, Christian Science Monitor). Sweden also arrested two people over a suspected Russia sanctions breach in the same period.

For Norwegian and Nordic industrial readers this is the espionage face of the same pressure that produced the Lithuania registry theft, a sanctioned state reaching for technology and data through every available channel. Defence-adjacent manufacturers, Arctic and marine technology firms, and dual-use suppliers should assume they are inside the target set.

Arctic Opening and the Northern Sea Route

On 28 May, Russia sent its first liquefied-natural-gas tanker of the year eastward along the Arctic Northern Sea Route, with navigation opening roughly two months earlier than usual per LSEG data (Reuters). In the same period Norway is lobbying against EU opposition to new Arctic oil and gas drilling, with plans for dozens of new offshore blocks including 38 in the Barents Sea, a posture the Barents Observer treated critically in commentary amid record Arctic warming. The earlier navigation window and the drilling push point the same direction, the Arctic is becoming a busier and more contested operating environment, and the security, environmental, and sovereignty questions travel together.

Regulatory and Policy

EU AI Act, Sixty-Two Days to High-Risk Enforcement

The 2 August 2026 enforcement date for the EU AI Act’s high-risk obligations is sixty-two days out at the close of this issue. Any team building AI systems for European clients in credit scoring, recruitment filtering, healthcare triage, or education assessment has this window to land its conformity assessment, fundamental-rights impact assessment, and Article 26 deployer documentation. For FTRCRP-adjacent work the Article 50(4) transparency obligation on AI-generated text published to inform the public remains the live one, the editorial-responsibility carve-out applies where a person holds editorial responsibility, the safer move for any publisher of AI-assisted content is explicit disclosure regardless. This digest carries its own disclosure in the front matter, mode fully-automated, human-reviewed before publication.

The Lithuania breach is also a GDPR event in waiting. A population-scale registry compromise inside the EU sets up Article 33 and 34 notification obligations and, if the controller’s safeguards are found wanting, the kind of enforcement action that ran to nine figures in the Dutch Yango decision flagged in issue 017.

Scams and Consumer Protection

The ITavisen Pattern Holds, CryptoEasily Still Live

The FTRCRP scam monitor flagged the same persistent cluster of ITavisen pages every day across the window, an eToro affiliate set, a “best VPN for crypto trading” piece steering toward NordVPN, a crypto-price hub, and a warning page about a fake Ledger Live app. These are recurring sticky alerts rather than new daily detections, no high-priority scam finding was adjudicated as new in the window and the monitor’s overall threat assessment closed at LOW on 1 June. The honest read is that the affiliate-content pattern around ITavisen persists, the volume did not spike this period.

No new CryptoEasily-branded ITavisen article surfaced in the local monitor during the window. Externally, CryptoEasily remains a live and widely flagged scam platform, with warnings on r/CryptoScams, TracingFrauds, TradersUnion, and Trustpilot, and public suspicion of ITavisen promotion continues on Norwegian forums. The Reddit threads carry no reliable publish date, treat the external signal as ongoing background to the investigation rather than a fresh in-window event. The investigation stands where it stood, the pattern is consistent, the disclosure practice around sponsored crypto content on Norwegian tech media remains the open question.

Epstein

Crown Prince Haakon Answers, SVT Releases Swedish Files

Between 26 and 28 May, Crown Prince Haakon publicly answered questions about the Crown Princess and Epstein for the first time. Mette-Marit’s reported account is that she was, in her framing, manipulated and tricked (NRK), and King Harald publicly defended the Crown Princess, noting she broke off contact, in his words unlike some others in Norway (Aftenposten). The Royal House issued an official statement. This coverage ran alongside the Crown Princess’s serious illness and Queen Sonja’s hospitalisation, with the Crown Prince cutting short a Japan trip, the royal-health and Epstein threads are entangled in the Norwegian feed and are kept separate here.

In Sweden, SVT published new Swedish traces from the Epstein files between 25 and 26 May, including an email concerning the financier Barbro Ehnbom’s network, with Princess Sofia of Sweden named in the new material and Terje Rød-Larsen referenced. SVT noted the release could continue for weeks. Ehnbom responded that she feels disgust, in Swedish känner avsky. The presumption of innocence applies throughout, the public-interest question is the network and the institutions, not individual guilt absent documented evidence.

Stortinget’s Commission, US Oversight Continues

On the Norwegian institutional side, Stortinget’s Epstein hearing was postponed to the autumn, with September reported as the window, and the Storting has formally established a commission of enquiry, a granskingskommisjon, confirmed through Stortinget’s own published recommendation on the commission’s mandate and composition. A Swedish-led investigation is separately probing the Epstein connection to Thorbjørn Jagland. The postponement and the Jagland probe broke around 21 to 22 May, just before this window opened, and carry forward as standing context.

In the United States, former Attorney General Pam Bondi gave closed-door testimony to the House Oversight Committee on 28 to 29 May, conceding redaction errors in the DOJ Epstein file release and saying she had delegated release oversight to the acting Attorney General. Former Barclays chief Jes Staley agreed to a 23 July interview, the Committee is summoning further witnesses including Bill Gates, and the broader documentary record continues to expand against the 3.5 million pages already released.

Conflicts

Oreshnik on Kyiv, a Drone Inside Romania

On the night of 23 to 24 May, Russia struck Kyiv with a mass drone and missile barrage that included an Oreshnik intermediate-range hypersonic ballistic missile, the third combat use of the system, killing at least four and causing damage across every district of the capital (The Guardian, Kyiv Independent, Times of Israel). Moscow then warned foreign diplomats and citizens to leave Kyiv and threatened systematic strikes on decision-making centres. On 29 May a Russian drone from an overnight attack on Ukraine crashed into an apartment building in eastern Romania, injuring two, the most serious spillover yet onto the territory of a NATO member, condemned as a reckless airspace violation (AP, Ukrinform, New York Post).

The Romania strike is the line to watch. A munition landing inside a NATO member’s housing stock, whatever the intent, is the kind of event that pulls Article 5 conversations from the abstract to the concrete. The escalation ladder in this war now has rungs on alliance territory.

Ukraine’s Deep-Strike Campaign, US-Iran, Israel-Lebanon

Ukraine’s long-range drone campaign against Russian energy infrastructure intensified through late May, with strikes on oil pipeline pumping stations, a refinery, and a fuel depot across several Russian regions on 30 and 31 May, and reporting framing Ukraine as gaining a drone overmatch even as the front stalled (Reuters, US News, CNN). Casualty tallies in the coverage, including figures near half a million Russian dead, are contested estimates and single-source in places, attribute them carefully.

In the Gulf, the United States conducted repeated self-defence strikes on Iranian missile sites and drone operations near the Strait of Hormuz across the window, Iran fired a ballistic missile at Kuwait on 28 May after US forces downed Iranian drones, and Kuwait’s air defences intercepted further attacks on 1 June. A sixty-day ceasefire extension with nuclear talks was reported at outline level but remained unsigned at the close of the window, oil rose more than two percent (AP, US News, New York Post). In Lebanon, Israel captured the Crusader-era Beaufort Castle and its ridge on 31 May, its deepest incursion in roughly two decades despite a ceasefire announced six weeks earlier, and on 1 June ordered strikes on Beirut’s southern suburbs, prompting an emergency UN Security Council session (AP, Reuters, New York Times).

By the Numbers

What to Do This Week

1. Treat any internet-reachable Gogs instance as compromised. CVE-2025-8110 has a public exploit and no patch. Pull self-hosted Git behind authentication or offline until a fixed release ships, then rotate any CI secrets that instance could reach.
2. Harden Microsoft 365 against token theft, not just password theft. Kali365 bypasses MFA via OAuth token theft. Tighten conditional-access policy, enable token-binding where available, shorten session lifetimes, and drill session-revocation.
3. Put the physical layer back in the threat model. The Silent Ransom Group is sending operatives to reception desks with USB drives. Enforce endpoint USB control, visitor escort policy, and a no-unknown-device rule, treat it as security, not facilities.
4. Re-examine population-scale data holdings. The Lithuania registry breach is the worst-case for any institution holding a whole population’s records. Segment, monitor egress hard, and assume a patient state-level adversary.
5. Audit for ShinyHunters-style account compromise. Carnival and Charter both fell to social engineering and voice-phishing against accounts, not software exploits. Review help-desk identity-verification procedure and high-privilege account recovery flows.
6. Brief high-risk individuals on Signal recovery keys. Anyone in journalism, activism, or sensitive work should know the 64-character recovery key is never entered in response to an inbound prompt.
7. EU AI Act, final sixty-two days. High-risk deployers should close out Article 26 documentation, the fundamental-rights impact assessment, and Article 50(4) disclosure framing before 2 August enforcement.

FTRCRP Security Digest. The summarisation pipeline was repaired this week after returning empty output across the issue-017 window, this issue blends the recovered feed with direct SearXNG verification against open-source reporting. Sources, open-source reporting including Meduza, Anadolu Agency, Cybernews, Reuters, BleepingComputer, The Register, SecurityWeek, TechRepublic, Dark Reading, HotHardware, TechRadar, Cyber Daily, TechTimes, Engadget, Times of Israel, The Guardian, Kyiv Independent, AP, Ukrinform, New York Post, New York Times, CNN, US News, The Independent, Christian Science Monitor, the Barents Observer, NRK, Aftenposten, SVT, Nettavisen, Stortinget, Sophos, Rapid7, CISA KEV, and the FBI. Single-source and contested claims are marked in the text. Presumption of innocence applies throughout the Epstein coverage. Issue 018, weeks 22 and 23, 2026-06-01