NATSEC//BRIEF

SYNC OCT 19 06:46 ET

SYS // DAILY BRIEF

Sunday, September 27, 2026

FILED 13:14 ET 9 STORIES 5 MIN READ

Bottom line: A hacking group’s breach of FBI personnel data is exposing which bureau employees work counterintelligence cases against China and Russia, compounding a separate Pentagon breach that leaked Social Security numbers for up to four million current and former service members. Iran claimed its second seizure of a US Navy underwater drone this month in the Strait of Hormuz, and China ran large naval, air and coast guard drills near a contested South China Sea shoal.

Espionage and counterintelligence

Hacked FBI data exposes employees working counterintelligence cases. A hacking group is circulating a roughly 5,000-line spreadsheet with names, Social Security numbers, addresses and job assignments for thousands of FBI employees, including staff working cases against Chinese and Russian intelligence services and drug cartels, according to U.S. News. The exposure follows earlier revelations that a foreign hacker breached an FBI New York field office server in 2023 and compromised Epstein investigation files after an agent left the server vulnerable. Why it matters: The leak could let hostile intelligence services identify and target the specific officers assigned to counter them. (U.S. News)

Montenegro detains Russian pair with cash and surveillance gear. Police in Montenegro arrested a Russian couple at Tivat airport on September 23 as they prepared to fly to Tel Aviv with 19 pieces of luggage containing undeclared electronics, a GPS tracker fitted with a microphone and a radio-signal detector, according to Liga.net. Searches of apartments they had rented turned up roughly €1 million in eight currencies and counterfeit euros; both are held on suspicion of smuggling and money laundering. Why it matters: The kit is consistent with surveillance and counter-surveillance tradecraft, and Montenegro has repeatedly surfaced as a transit point for Russian intelligence activity in the Balkans. (Liga.net, EUalive)

China-linked hackers ran a sustained spying campaign on European shipping. The European Union Agency for Cybersecurity reported that a China-linked group tracked as Mustang Panda conducted continuous espionage campaigns against maritime and shipping organizations in at least seven EU member states through 2025, using spear-phishing, rigged USB drives and customized PlugX malware. The agency said the intrusions targeted intelligence collection rather than disruption and did not name the affected companies. Why it matters: Persistent access to shipping networks gives Beijing visibility into European supply chains and naval-adjacent logistics. (Politico Europe, Splash247)

US military and intelligence community

Pentagon breach exposed Social Security numbers of up to 4 million personnel. Unauthorized users accessed a vulnerable Defense Manpower Data Center server starting last October, and the Pentagon did not discover and fix the intrusion until July, CNN reported. The compromised records include Social Security numbers plus at least one other identifier, such as name, date of birth or military specialty; the Pentagon says it has no evidence yet the data has been misused, and no attacker has been publicly identified. Why it matters: Detailed personnel records tied to occupational specialty are useful to a foreign intelligence service building targeting profiles for recruitment or blackmail. (CNN)

Iran claims second seizure of a US Navy underwater drone this month. Iran’s Revolutionary Guard said it captured a Remus 600 unmanned underwater vehicle it accused of conducting espionage in the Strait of Hormuz and released video of the equipment, saying it is extracting data from it. Earlier in September, Iran made a similar claim about an Anduril-made Dive-LD drone that the US said was defective and malfunctioning rather than a live intelligence asset. Why it matters: Repeated seizures give Iran chances to reverse-engineer US undersea sensor and navigation technology, even as Washington disputes the drones carried anything classified. (Shabtabnews, Bloomberg)

British police arrest five near US air base over alleged bomb plot. British police detained five men near a base used by the US Air Force, citing suspected explosives and terrorism offenses, and evacuated nearby homes as a precaution, the AP and Defense News reported. President Trump said the suspects wanted to do “big damage” to the base. Why it matters: A plot against a base hosting US forces on British soil would hit US military posture in Europe directly, not just be a domestic UK case. (Defense News, AP)

China, Russia, Iran and North Korea

China runs large naval, air and coast guard drills near a contested shoal. The Southern Theater Command of China’s People’s Liberation Army exercised warships, a replenishment ship and a WZ-7 reconnaissance drone around Huangyan Dao (Scarborough Shoal) on September 27, focused on reconnaissance, rapid maneuver and joint search and rescue, while the China Coast Guard separately drilled on boarding, interdiction and towing in the same waters, per CGTN and Global Times. Chinese state media said the drills were a response to unspecified “provocations” and described forces as shifting “from training to combat.” Why it matters: The shoal, contested with the Philippines, is a flashpoint where a US treaty ally could pull Washington into a confrontation. (CGTN, Global Times)

Iran and the US remain at odds after Tehran rejected a proposed Hormuz deal. Trump administration official Mike Waltz said Iran had wanted sanctions relief up front in a deal that was ultimately rejected, while Iran’s foreign minister said Tehran is waiting for an official rejection and that only negotiation, not pressure, can end the conflict, according to the BBC. Why it matters: The impasse leaves in place the Hormuz tensions in which Iran has now seized two US undersea drones this month. (BBC)

Swiss voters reject stricter neutrality rules that would have blocked Russia sanctions. Roughly 70% of Swiss voters rejected a referendum that would have hardened Switzerland’s neutrality rules in a way critics said would undercut its ability to keep sanctions on Russia in place, according to Euromaidan Press and Politico Europe. Why it matters: The vote keeps Switzerland, a hub for Russian-linked finance, aligned with EU and US sanctions rather than opening a loophole. (Euromaidan Press)

Worth reading

What to watch

  • Japan holds its first expert panel talks on anti-espionage legislation on Monday, September 28.
  • Whether Iran and the US resume talks after Tehran’s rejection of the sanctions-relief terms described by US official Mike Waltz.
  • Whether investigators publicly attribute the breach of FBI employee data or the Pentagon’s personnel-records breach to a specific actor.

Coverage: Sat Sep 26 13:14 ET to Sun Sep 27 13:14 ET. 231 stories scanned from 27 sources.