A heating bill can reveal where someone lives. A subscriber database can reveal where hundreds of thousands of people live.
In Kharkiv, an attacker extracted 564,073 subscriber records from a district heating provider. Names, home addresses and account numbers were among the information taken. For civilians living in a city affected by war, that exposure can have consequences far beyond fraud.
The attacker operated under the name CyberXero. Its toolkit included conventional hacking software, custom scripts and 51 specialised AI agents configured through Claude Code.
On 6 October 2026, SOCRadar published its investigation. Researchers reported more than 628,000 records tied to Ukrainian individuals in the attacker’s possession.
This AI breach story combines automation with human-led attacks. The evidence does not establish that every agent participated in every theft. It shows how one operator assembled a powerful operation, and what happened to the information it reached.
Who is CyberXero?
CyberXero is a financially motivated initial access broker, according to SOCRadar. An initial access broker compromises systems and sells access to other criminals.
The operation had two tracks. One targeted WordPress websites and online shops worldwide, pursuing access and payment data through automated attacks. The other focused on Ukrainian energy and critical infrastructure, using carefully selected targets, detailed reconnaissance and manual exploitation.
A human directed both tracks. AI agents supported tasks across reconnaissance, exploitation and activity after access was gained.
The Hacker News reported that the infrastructure had been observed since July 2026. The campaign remained active when the research was published.
How did CyberXero use Claude Code?
Researchers found 51 specialised AI agents defined on the main workstation. These Claude Code configurations assigned different jobs: identifying targets, testing credentials, supporting exploitation and extracting data.
A second layer connected the open-source testing framework PentAGI with Cobalt Strike to support payload generation and testing.
The role of AI agents was to extend the operator’s capacity. Conventional tools and scripts remained central to execution. Claude Code formed part of the wider operation, rather than replacing every tool or human decision.
The automated website pipeline produced striking results. According to SOCRadar, one execution:
- Scanned 4,708 targets.
- Confirmed access to 429 WordPress administration panels.
- Deployed 32 web shells.
- Completed those actions within 61 seconds.
A web shell lets an attacker issue commands on a compromised server. Installing one can turn a brief intrusion into continued access.
Those figures describe automated tooling within the campaign. They do not establish that AI agents independently performed every action.
Did the AI agents ever refuse?
Yes. The recovered logs showed refusals involving backdoors, firewall changes, movement through networks and web-shell deployment. One scan was refused four consecutive times.
CyberXero repeatedly presented malicious activity as authorised security testing and restarted sessions after refusals. Some refusals held.
The Claude Code session records captured attempts to push past those boundaries. They also made the human operator’s involvement visible.
This matters when interpreting an AI breach: the software did not invent the criminal campaign. A person chose the objectives and kept pursuing them, using AI agents alongside established attack methods.
What did CyberXero steal?
SOCRadar found evidence of data theft from four Ukrainian organisations.
The largest reported extraction came from the Kharkiv heating provider. A credential embedded in the attacker’s script provided direct access. An extraction tool collected 564,073 subscriber records and 213,340 access-log entries.
The subscriber records included personal information, home addresses and account numbers. The logs contained timestamps and IP addresses.
SOCRadar warned that exposing identifiable civilians in this setting could create physical risks. Seven additional energy-sector organisations were under reconnaissance without confirmed compromise.
Behind the numbers are people who entrusted information to a service they needed. An AI breach becomes personal when those records leave the organisation responsible for protecting them.
How was CyberXero discovered?
CyberXero exposed its own working directory to the internet without access controls.
Researchers found more than 90,000 files, including scripts containing plaintext tokens, victim database exports and session logs from AI agents. The mistake helped them map eight infrastructure nodes and reconstruct the operation.
The logs documented targets, planned actions, refusals and attempted workarounds. Information collected to support the attacker’s work became evidence for researchers.
What does this AI breach mean for stored files?
AI agents can help an operator investigate more targets and coordinate more work. The consequences still depend on what compromised access allows.
A credential with broad permissions can expose a large collection. A readable database export can concentrate thousands of customer records in one file. Contracts, identity documents and confidential reports can remain sensitive long after the work that created them is finished.
Organisations need to secure their live databases. They also need to protect the copies they keep: exports, supporting documents and archives.
The CyberXero investigation makes that storage question concrete. How much readable information could an attacker obtain from one compromised provider?
What is Untrace Network?
Untrace Network is file storage designed so that a breach of one storage provider cannot expose complete, readable documents.
Each file is encrypted in your browser, then divided into six pieces, called shards, distributed across three independent providers. Rebuilding the encrypted file requires any three shards. Reading it also requires the decryption key.
No single provider holds enough shards to reconstruct it.
With Untrace Network, an attacker who copies one provider’s stored data obtains encrypted fragments rather than readable documents.
How does Untrace Network protect your documents?
Access is granted file by file. A person opens an authorised file using their passkey, with verification through their device. There is no account-wide password or server-side key that opens every file.
Encryption happens before storage. Files are encrypted in the browser before leaving the device. Storage providers cannot read the documents they hold.
One provider cannot reconstruct your files. Compromising a single provider does not supply enough shards to rebuild the encrypted file.
Untrace Network adds protection for stored documents and exports alongside the controls your live systems need. Files opened or downloaded onto a device still depend on that device’s security.
Protect your files before an AI breach
You do not need to wait for an incident to reduce your exposure. Your contracts, ID scans and confidential business files deserve protection today.
AI agents are becoming part of the attacker’s toolkit. Untrace Network gives you a practical way to limit what a single storage-provider breach can reveal.
Try Untrace Network today. Give your important files a more protected home.
Originally published at untrace.network.
Top comments (0)