Weekly Security News: Google security team layoffs, Audi A6 money laundering network dismantled, Coupang hit with $400 million sky-high fine

Incident Overview

This week, multiple incidents in the global cybersecurity landscape warrant the attention of enterprise security leaders. Google Cloud conducted layoffs within its security division, affecting the Mandiant team and Google Threat Intelligence Group (GTIG); an international law enforcement operation successfully dismantled the cryptocurrency money laundering network known as AudiA6, which had laundered over $388 million for ransomware groups; South Korea's Personal Information Protection Commission (PIPC) imposed a $400 million fine on e-commerce giant Coupang for security vulnerabilities that led to a data breach affecting over 30 million users. Additionally, Oxford University's CareerConnect platform was hacked, IBM and AT&T were accused by former employees of covering up a foreign government hacking incident, CISA added a LiteLLM vulnerability to its Known Exploited Vulnerabilities catalog, Microsoft released an AI incident response handbook, ENISA launched the 2026 Collective Resilience Exercise, and a Bitsight report indicated that ICS device exposure remained flat but the attack surface has expanded.

Technology and Risk Analysis

Attack Methods and Exploitation Chains

• AudiA6 Money Laundering Service: This network used thousands of fake exchange accounts opened with stolen identities to provide fund-cleaning services for ransomware groups, involving $388 million between 2022 and 2025. Attackers evaded tracking through cryptocurrency mixers, transaction layering obfuscation, and automated trading bots. Law enforcement successfully identified its infrastructure via blockchain analysis, financial intelligence sharing, and anomaly detection in accounts.
• Coupang Data Breach: Investigation revealed severe deficiencies in access controls and authentication key management, enabling hackers to steal personal information of over 30 million customers. The attack chain likely started with exploiting weak keys or unpatched vulnerabilities, moved laterally to the database, and then bulk-exported data.
• LiteLLM Command Injection Vulnerability (CVE-2026-42271): This AI gateway vulnerability allows remote attackers to execute arbitrary commands and has been added by CISA to the Known Exploited Vulnerabilities catalog, indicating that hackers have begun targeting AI infrastructure.

Affected Assets

• AudiA6: Primarily affects financial institutions, cryptocurrency exchanges, and ransomware victim enterprises—the laundering activity indirectly fueled the economic motivation for ransomware attacks.
• Coupang: Affects e-commerce platform databases, user account systems, and identity authentication systems.
• Google Security Layoffs: Affects enterprise security operations capabilities, threat intelligence output, and Mandiant’s incident response services.
• Oxford CareerConnect: Exposed names, emails, and encrypted passwords of alumni, researchers, and employers.

Enterprise Impact Analysis### Operational Risks - Google's security layoffs may lead to a short-term decline in its threat intelligence and incident response capabilities. Enterprises relying on Google Cloud should monitor SLA and security support quality. - The Coupang incident demonstrates that even large tech companies can suffer catastrophic data breaches due to improper access control and key management. Enterprises should regularly audit IAM policies.

Financial Risks - Coupang faces a $400 million fine; if the appeal fails, it will directly impact its profits. According to the PIPC decision, the fine is calculated based on the scale of the violation and the number of users, serving as a warning to other enterprises. - After the takedown of AudiA6, ransomware groups will seek alternative money laundering channels, potentially leading to a temporary increase in attack frequency against enterprises.

Compliance Risks - The heavy fine imposed by South Korea's PIPC highlights the strengthening enforcement of data protection regulations in the Asia-Pacific region. Enterprises with user data in South Korea need to review their compliance frameworks. - IBM and AT&T are accused of concealing hacker incidents. If confirmed, they could face loss of federal contracts and legal action, underscoring the importance of transparency in government contracts.

Brand Risks - The data breach incident has damaged Coupang's brand trust, and user churn and stock price decline may persist. - As a leader in the security industry, Google's layoffs have raised market doubts about its commitment to security.

Industry Trend Observations

This week's news is not isolated but reflects the following long-term trends:

1. Cyclical Fluctuations in Security Budgets: Google's layoffs are not an isolated case. Under economic pressure, tech giants are reassessing security investments, but the threat landscape has not weakened. Enterprises should build resilient security architectures to reduce dependence on a single vendor. 2. Enforcement Actions Targeting Financial Foundations: From AudiA6 to the shutdown of the Dark2Web forum, global law enforcement agencies are systematically targeting the economic infrastructure supporting ransomware. Enterprises should strengthen cooperation in blockchain financial crime monitoring. 3. AI Security Becomes a New Focus: The LiteLLM vulnerability and Microsoft's release of an AI incident response manual indicate that the AI attack surface is rapidly expanding. Security teams need new tools and processes to defend AI models and their supply chains. 4. Soaring Data Compliance Costs: The Coupang fine is a milestone in the field of data protection in South Korea and globally, signaling that hefty fines will become the norm. Enterprises need to incorporate data governance into board agendas.

Defense and Response Recommendations

Enterprise Level - Identity Security: Mandate multi-factor authentication (MFA) and rotate API keys regularly, as shown by the Coupang incident. - Zero Trust Architecture: Default distrust of any internal or external network, with fine-grained access control. - Vulnerability Management: Prioritize patching known exploited vulnerabilities in the CISA KEV catalog, such as LiteLLM.

Technical Level - SIEM and XDR: Integrate AI workload logs and follow Microsoft's AI incident response manual for monitoring and detection.### Technical Level - SIEM and XDR: Integrate AI workload logs and refer to Microsoft's AI incident response playbook for monitoring and detection. - Threat Intelligence: Pay attention to IoCs related to AudiA6 (may have recently migrated to new services), subscribe to intelligence sharing platforms such as FS-ISAC. - Blockchain Analysis: Deploy tools to track anomalous cryptocurrency transactions and prevent ransomware payments.

Management Level - Incident Response Plan: Conduct regular drills, including AI-related scenarios. - Third-Party Risk Management: Audit cloud service providers' security capabilities, especially when suppliers undergo layoffs or restructuring. - Compliance Audit: Ensure data protection measures are in place against regulations such as K-PIPA and GDPR.

SecurityPost Insight

This week's security news may seem scattered, but they point to the same core: the resilience of enterprise security no longer depends solely on the technology stack, but also on strategic stability, compliance transparency, and cross-ecosystem collaboration capabilities. Google's layoffs remind us that security investments may fluctuate with business cycles, but threats never take a vacation—enterprises must build internal resilience rather than rely entirely on external sources. The takedown of AudiA6 proves that global law enforcement capabilities are improving, but enterprises still need to proactively strengthen financial crime detection. Coupang's $400 million fine is a landmark event in the era of data protection, sending a clear signal to all businesses: the cost of neglecting data security governance will far exceed compliance costs. In the future, we expect AI security, supply chain resilience, and cross-regional compliance to become the three core issues for enterprise security leaders. It is recommended that CISOs use the current window to reassess the reliance on outsourced security operations and invest in automated monitoring and AI-ready incident response capabilities.