The exposure has now put a massive threat on the iPhone’s global supply chain and manufacturing ecosystem, as rivals, counterfeiters, and the tech giant’s own vendors may end up accessing the dark web data and getting a glimpse of who makes what.

The setback will likely be even bigger for Tata, which both supplies parts and assembles iPhones in India as a contract manufacturer. The company has emerged as one of Apple’s most important manufacturing partners outside China, an expansion that has been often cited by the Narendra Modi-led administration in its push to ⁠make the South Asian giant an electronics manufacturing powerhouse.

Apple is reportedly on track to release its iPhone 18 Pro and Pro Max in September 2026. The data leak will put further pressure on the tech giant, which has already raised iPad and MacBook prices due to soaring memory and storage chip costs, a development that would directly weigh on its balance sheet and sales figures in the coming quarters.

As per Reuters, the Tata Electronics leak consisted of more than 200,000 files on the dark web by World Leaks, including the ones with “component design papers” of older iPhones and some parts of Tesla, both of which are Tata clients. They also broke into the documents of Taiwan Semiconductor Manufacturing Co (TSMC) and Qualcomm, both of which make iPhone parts. The stolen files include at least six files that map many components in the iPhone 18 Pro models to the specific companies that supply them. These include details of chips on its main circuit board and parts of the battery and cameras.

The stolen records also show where Apple draws a part from several suppliers and where it relies on just a few, laying bare both the tech giant’s bargaining leverage and its vulnerabilities within its global supply chain.

Apple is reportedly investigating the matter and working with Tata on long-term countermeasures. Tata, for its part, has hired a global consultant to conduct a forensic audit of both its IT systems and the leaked data. It has also tightened internal security protocols at all its facilities and offices to restrict remote access to sensitive internal tools only to “select employees.”

Tata Electronics, headed by former Intel and Applied Materials executive Randhir Thakur, is part of the legendary salt-to-aviation Tata conglomerate. Set up in 2020, Tata Electronics’ businesses cover semiconductors as well. However, this is not the first time a Tata conglomerate vertical has fallen prey to cyberattack. In 2025, Tata Motors was hit by a similar incident at its British Jaguar Land Rover unit, resulting in a six-week production halt.

Several of the leaked files also carried Apple “confidential” watermarks and internal Apple codenames consistent with ⁠the iPhone 18 Pro generation. The files also have images of iPhones undergoing drop tests at one of Tata’s plants, dated early 2026.

Talking about Apple-Tata Electronics, the Indian company became the flagbearer of the iPhone maker’s “China Plus One” approach. As of 2026, India is on track to make 26% of the world’s iPhones, up from the 2023 tally of 6%, according to the research firm Counterpoint.

The post Ahead of iPhone 18 Pro launch, sensitive Apple data leaks onto dark web appeared first on International Finance.

In 2021, cybersecurity researchers at Socket identified nine packages on NuGet that contained sabotage payloads intended to activate in 2027 and 2028 if certain conditions were met.

NuGet is the package manager for .NET, which includes open-source .NET libraries that can be easily added to a project by software developers. Siemens S7 industrial control devices are commonly found in manufacturing plants, energy and utilities, oil, gas, and chemical industries, building automation, and transportation.

The payload is active only between August 8, 2027, and November 29, 2028, and has two destructive actions: it randomly kills the host process 20% of the time (immediate stops), and in the Sharp7Extend package, breaks initialisation and/or, after a 90-minute delay, corrupts PLC write commands with an 80% chance.

The identity of the threat actors who uploaded these packages and their motives remains unknown. Users are urged to audit their assets for the packages and remove them immediately.

Here is the full list of malicious packages discovered so far: SqlUnicorn.Core, qlDbRepository, SqlLiteRepository, SqlUnicornCoreTest, SqlUnicornCore, SqlRepository, MyDbRepository, MCDbRepository, Sharp7Extend.

Meanwhile, Dark Web Intelligence reported that threat actors claimed to have stolen data from HSBC USA and that they had access to a large database containing highly sensitive personally identifiable information (PII) and financial records of HSBC USA customers, including Social Security numbers (SSNs), bank account numbers, and account balances, among other data.

The threat actor announcement appeared on dark web forums, where those who identify themselves as responsible for the breach have disclosed information about the customer database that was breached, including a substantial number of HSBC USA customers, and claim to have access to full financial profiles.

The post Industrial computing systems at risk from ‘time bombs’ in malicious NuGet packages appeared first on International Finance.

Not to be confused with the deep web (the part of the Internet not indexed by search engines), the dark web is a part of the deep web and is used for many reasons: maintaining privacy, circumventing censorship, or providing an enabling space for criminal activity (cybercrime tools, trading data or illicit materials).

Dark web: A threat to financial sector

Businesses

Increased ‘cyberization’ has been integral to the financial sector over recent decades and cyberthreats have increased in step, directly impacting the operational risks faced by the financial industry. The dark web provides an enabling facilitator for these cyberthreats.

For example, hacker forums on the dark web can share expertise or coordinate attacks in relative anonymity, syphoning funds or stealing data. Ransomware attacks can be executed on the dark web preventing lawful access until a ransom is paid. In fact, ‘Ransomware-as-a-Service’ is readily available on the dark web.

The dark web can also facilitate DDoS (Distributed Denial of Service) attacks; denial of access to financial services in such a time-sensitive sector has a significant negative impact, operationally and financially.

Consumers

Consumers hold and transact multiple financial assets online and use their identities to access these assets. The identity of a consumer online is often simply a collection of data points others don’t know. Such data points include password credentials, card details, dates, addresses, relationships, history etc. With enough of these data points, a person’s identity can be reconstructed online to gain access to the assets illegally. Obtaining these pieces of data is made much easier when there is a market where missing bits can be bought and sold in anonymity. This is, once again, where the dark web comes in.

The financial sector holds a wealth of such data for its consumers, since it collects the data to enable its service offerings while also maintaining regulatory obligations. Financial institutions are therefore valuable targets of cybercriminals who use the dark web to plan and execute data theft. At the same time, the dark web enables them to monetise the stolen data.

Malware that directly infects users’ computers and steals banking credentials is also sold on the dark web. It captures keystrokes or creates backdoors for later exploitation, leading to the loss of assets and consumer trust.

Consumer trust is crucial in the financial sector. Illegal activities on the dark web can erode trust and damage reputation, significantly impacting the financial industry.

Capital markets

Exploiting inside information, commonly referred to as UPSI (Unpublished Price Sensitive Information), undermines trust and investment in capital markets. The dark web enables buying and selling inside information in secrecy which also hurts the regulatory ability to curtail insider information. In response to such challenges, regulators have required the maintenance of Structured Digital Databases to track the flow of all UPSI from the source.

Impact on risk capital

The higher the risk, the more capital the financial sector must set aside to manage it. The impact of operational risks in the financial industry cannot be considered complete without considering the contribution of the dark web in increasing the cyberthreat quotient. Cybercriminals who are yet to achieve the required levels of sophistication can also avail of ‘cybercrime-as-a-service’ on the dark web, increasing the number of ‘threat actors’ and the resultant risks. With the increase in risks comes an increase in the need to hold regulatory capital in reserve, reducing the capital otherwise available for use and ultimately hurting the financial sector.

Threat quotient in financial sector

The threat from the dark web to the financial sector as the primary but anonymous facilitator of tools, resources, expertise, and services continues to increase. In addition, attacks on other sectors can also impact the financial industry. For example, sensitive information belonging to 815 million Indians recently emerged on the dark web, brought by a hacker described as ‘pwn0001’, advertising the stolen information on the dark web. While the financial sector is not believed to be the source, misuse of such data can nonetheless compromise its consumers.

In the future, the influence of the dark web is expected to grow. A marketplace called STYX was introduced on the dark web in early 2023, offering services primarily related to financial fraud. These services include the sale of identities, money laundering, DDoS attacks, bypass mechanisms for 2FA, and distribution of malware, among others. The increasing threat quotient of the dark web to the financial sector rightly deserves greater attention. Simply put, there is little alternative.

The post Erosion of trust: Dark web’s financial fallout appeared first on International Finance.

Durov has multiple citizenships spanning France, Russia, the Caribbean island nation of St. Kitts and Nevis, and the United Arab Emirates (UAE). He was born in Russia but lived much of his youth in Italy. After arriving from Azerbaijan, he was detained at Paris-Le Bourget Airport in France and freed following four days of interrogation. According to the Paris prosecutor’s office, he was told to go to a police station twice a week and was compelled to pay 5 million euros in bail.

Telegram maintained that it complies with European Union (EU) regulations and that its content filtering is “within industry standards and constantly improving” in a statement that was uploaded to its platform. The business continued by saying Durov “has nothing to hide and travels across Europe frequently.”

Here are some specifics about the Telegram app, which is the reason behind Durov’s detention.

What is Telegram?

With the help of the Telegram software, users can have one-on-one chats, group chats, and broadcast messages to a large number of subscribers through “channels.” In contrast to competitors like Meta’s WhatsApp, Telegram supports up to 200,000 users in group chats, while WhatsApp only supports 1,024 users. Experts are worried that in group discussions, big, false information might spread quickly.

In contrast to widespread belief, Telegram does not automatically enable end-to-end encryption for user communications. Users must activate the option. Group conversations are not compatible with it either. This is in contrast to Facebook Messenger and rival Signal, where conversations are always end-to-end encrypted.

“Group conversations and channels—two popular Telegram features—are not end-to-end encrypted,” said John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto, explaining that their contents can be accessed through Telegram.

Similarly, user-to-user conversations are not end-to-end encrypted by default, which leaves Telegram with access to them as well. The only end-to-end encrypted function on Telegram is the opt-in “secret chat” option, which keeps Telegram from viewing the chat data.

According to Telegram, there are over 950 million active users. It is a popular messaging app in France, and some officials from the presidential palace and the ministry overseeing Durov’s probe use it as well. However, French police have also discovered that drug dealers and Islamic extremists have utilised the programme.

In 2013, Durov and his brother Nikolai founded Telegram. Pavel Durov backs the app “financially and philosophically, whereas Nikolai’s input is technological,” according to Telegram.

Durov established the biggest social network in Russia, VKontakte, before Telegram. The business faced pressure as a result of the Russian government’s crackdown following the large-scale pro-democracy demonstrations that shook Moscow at the end of 2011 and 2012.

According to Durov, representatives of the administration ordered VKontakte to remove the internet networks run by Russian opposition activists. Later, it demanded that the site provide the personal information of users who participated in the 2013 Ukrainian rebellion that resulted in the removal of a pro-Kremlin president.

However, in 2014, under pressure from Russian authorities, Durov sold his interest in VKontakte. He departed the nation as well. Currently headquartered in Dubai, Durov described the city as “the finest position for a neutral platform like ours to be in if we want to make sure we can preserve our users’ privacy and freedom of speech” during an April 2024 interview with Tucker Carlson, host of a conservative talk programme.

Why Did Durov Get Arrested?

French officials detained Durov and charged him with a misdemeanour for permitting suspected illegal activities on Telegram. They also prohibited him from leaving the country while they conducted additional inquiries. Durov is accused of allowing drug trafficking and child abuse materials to be distributed on his platform, and of Telegram refusing to provide information or documents to law enforcement when asked to do so.

According to the prosecutor’s office, the first preliminary complaint against him was for “complicity in maintaining an online platform to allow unlawful transactions by an organized gang,” a crime that carries a maximum sentence of 10 years in prison and a fine of 500,000 euros.

French law defines preliminary charges as a magistrate’s strong suspicion of a crime, with the option to continue the inquiry at a later date.

South Korea Gets Tough

South Korean police have now launched an investigation into Telegram over deepfake online sex crimes, reported the Yonhap news agency.

South Korean authorities have called on Telegram and other social media platforms for cooperation in fighting sexually explicit deepfake content. A broadcaster reported in August 2024 about university students running an illegal Telegram chatroom, sharing deepfake pornographic material of female classmates, one of a slew of high-profile cases that have stoked public anger.

“In light of these (deepfake) crimes, the Seoul National Police Agency launched their probe last week… for abetting the crimes,” said Woo Jong-soo, head of the investigation bureau at the National Police Agency, according to a transcript of a press briefing.

Police received 88 reports of deepfake porn last week alone, Woo said, adding they have identified 24 suspects. As per the AFP, the authorities have pledged to “find ways to cooperate with various investigative bodies, including the French, to enhance” their investigation into the platform.

As per the activists, South Korea is reportedly suffering from “an epidemic of digital sex crimes,” including those involving spycams and revenge porn, with inadequate legislation to punish offenders.

Perpetrators of deepfake crimes have reportedly used social media platforms such as Instagram to save/screen-capture photos of victims, which were then used to create fake pornographic material.

Dark Web Allegations Against Telegram

Telegram’s lack of content filtering has drawn criticism from Western governments on several occasions. Experts claim this exposes the messaging app to possible uses in drug trafficking, money laundering, and the transmission of content related to the exploitation of kids.

In contrast to other messaging apps, David Thiel, a researcher at Stanford University’s Internet Observatory who has studied the use of online platforms for child exploitation, claimed that Telegram is “less secure (and) more lax in terms of policy and detection of unlawful information.”

Additionally, Thiel stated that WhatsApp, a messaging software, “submitted over 1.3 million CyberTipline reports in 2023 (while) Telegram submits none,” and that Telegram “appears basically unresponsive to law enforcement.”

Due to the Telegram operators’ noncompliance with German legislation, Germany fined them 5.125 million euros (USD 5 million at the time). According to the Federal Office of Justice, Telegram has not designated a German company to receive official correspondence or established a legal mechanism for reporting illegal content.

Under German rules governing big internet platforms, both are necessary.

Due to Telegram’s refusal to provide information on neo-Nazi behaviour linked to a police investigation into school shootings in November 2023, Brazil temporarily blocked the messaging app.

As per Joe Tidy, Cyber correspondent, BBC World Service, criminals generally like the dark web because of the anonymity it provides: internet traffic is bounced around the world, obscuring people’s locations. Citing Researchers at cyber-security company Intel471, he said, “pre-Telegram this activity (cybercrime) was predominantly done in online markets hosted using hidden dark web services but for lower-level, lesser-skilled cyber-criminals, Telegram has become one of the most popular online destinations”.

The hacker group Qilin, which held United Kingdom’s NHS hospitals to ransom recently, notably chose to publish stolen blood test data on its Telegram channel before its dark web website. The deepfake service used to create fake vulgar images of teenagers in Spain and South Korea also runs its full service, including payment, on Telegram.

In January 2024, state police in Latvia set up a separate unit specialising in monitoring chat apps for drug trafficking and communication, and officials have named Telegram as a particular concern.

On “Chila Abuse Materials,” Telegram says that its content moderation is “within industry standards”, but BBC has found evidence to the contrary related to “an area of criminality far less visible.”

The BBC learnt that while Telegram does respond to some takedown requests from police and charities, it does not participate in programmes aimed at proactively preventing the spread of images and videos of child abuse. Not doing enough to police CSAM has been one of the allegations French prosecutors have brought against the platform.

“At the heart of this case is the lack of moderation and co-operation of the platform, in particular in the fight against crimes against children,” said Jean-Michel Bernigaud, the secretary general of French child protection agency Ofmin, on LinkedIn.

Moderation is not the only part of the problem for Telegram. The platform’s approach to police requests to remove illegal content and pass on evidence is another criticism.

Brian Fishman, a co-founder of Cinder, a software platform for trust and safety, posted, “Telegram is another level: it has been the key hub for Isis for a decade. It tolerates CSAM. It’s ignored reasonable law enforcement engagement for years. It’s not ‘light’ content moderation; it’s a different approach entirely.”

“Some might argue that Telegram’s privacy features mean that the company does not have much data about this activity to report to police. This is the case with ultra-private apps like Signal and WhatsApp. Telegram offers users similar levels of privacy if they opt to create a ‘Secret Chat’ which uses the same end-to-end encryption that those apps do. It means the activity inside a conversation is completely private and not even Telegram itself can view the contents. However, this function is not set as default on Telegram, and it seems that most of the activity on the app – including on those illicit channels I was added to – are not set as secret,” Joe Tidy noted.

Telegram could read all content and pass it on to the police if it wanted to, but it states in its terms and conditions that it does not. In June 2024, Pavel Durov told journalist Tucker Carlson that he only employs “about 30 engineers” to run his platform. Telegram’s cold approach to law enforcement is something that Tidy cited by frustrated police officers on the fringes of press events.

French authorities also noted in their statements about Mr Durov’s charges that police there and in Belgium had historically an “almost total lack of response from Telegram to legal requests”.

The post IF Insights: Is Telegram in trouble post Pavel Durov’s arrest? appeared first on International Finance.