Observed incident
DIVD traces ticketing-system breach and volunteer data theft to ARTEX
Reported
Published here
What happened
DIVD says the attacker chained two Zammad flaws, reached root in 12 minutes and accessed other services. Volunteer email addresses were exfiltrated and some CSIRT mailbox and ticket data leaked.
Parties and reporting
AI tools and systems: ARTEX, Zammad ticketing system, Admin API token
Outcome
DIVD isolated its infrastructure and declared containment on October 2. Its October 31 update identified ARTEX from logs. The exact records affected and the final investigation report remained pending.
Operating lesson
Patch both ticketing vulnerabilities, revoke long-lived admin tokens and set an escalation deadline for alerts that span service accounts or mailboxes.
Evidence and limits
The breach began September 21 and was disclosed September 24. The institute reported CVE-2026-102489 and CVE-2026-102490 in its ticketing system. ARTEX was named later. DIVD withheld actor identity and cautioned against linking other ARTEX activity.
Sources
- DIVD public disclosures and subsequent ARTEX findings
Primary source ·
- DIVD CSIRT case file and data-scope investigation
Primary source ·