Morning Brief — June 6, 2026. Physical USB attacks on law firms, a whistleblower suit alleging IBM concealed 56,000 federal breaches, and a CFPB rule rewriting lending underwriting hit compliance teams simultaneously. The day's through-line: threat actors and regulators are both outpacing institutional defenses.
FBI and Mandiant warned that Silent Ransom Group imposters walked USB drives into dozens of law firm offices this year, bypassing digital defenses with a coordinated physical intrusion campaign.
A qui tam lawsuit alleges IBM concealed 56,000 APT 10 breaches from federal clients and failed to retain the logs needed to determine what data was exfiltrated.
The CFPB converts immigration status into a Reg Z income-continuity factor, forcing lenders to audit underwriting policies built under the agency's reversed 2023 guidance.
A June 2 executive order hands US federal agencies up to 30 days of pre-release access to frontier AI models; OpenAI committed first, and the voluntary label will not last.
The FCA froze Euro Exchange Securities — operating across the UK, US, and Spain — over money-laundering control failures, appointing court managers ahead of a June 11 hearing.
Google rents 110,000 Nvidia GPUs from SpaceX at $920M a month, bridging a Gemini Enterprise demand surge that a $190B capex plan can't keep pace with.
The Fed can't see where $300B in bank money flows into private credit, and it's now demanding answers before the next cockroach surfaces.
Retatrutide's 30.3% weight loss at 104 weeks rivals bariatric surgery, but seven arrhythmias in Transcend-T2D-1 complicate Lilly's NDA path.
Pfizer's berobenatide posted 15.9% weight loss at 32 weeks with no plateau, its first ADA showing since the $10B Metsera deal closed.
Silent Ransom Group sent imposters into dozens of law firm offices this year with USB drives. FBI and Mandiant filed concurrent warnings.
The FCA froze a payments firm operating in the UK, US, and Spain over money-laundering gaps and appointed court managers; hearing is June 11.
Polyfill.io reactivated in late May, hitting Toshiba, Muji, and five others with rogue login prompts two years after a Chinese entity hijacked the CDN.
CFPB converts immigration status into a Reg Z income-continuity factor, forcing lenders to audit policies built under its reversed 2023 guidance.
Darren Hughes offered free meth samples on Nemesis Market, then sold fentanyl to undercover agents five times in 2023. He got 26 years.
Barlow's qui tam suit alleges IBM concealed 56,000 APT 10 breaches from federal clients and didn't keep the logs to know what was taken.
Trump's June 2 EO hands feds up to 30 days pre-release access to frontier AI models. OpenAI said yes first, and the voluntary label won't last.
A 269-page bipartisan draft would freeze state AI laws for 3 years, but the $500M audit threshold and sunset clause are where operators look.
The Supreme Court's 8-1 ruling upholds $104M in FCC fines against AT&T and Verizon for selling real-time location data to bounty hunters.
Nubank hired a former Visa North America CFO, Revolut downgraded its CTO title, and Adyen's CFO quit for a job outside fintech, all in one week.
After DentaQuest didn't pay ShinyHunters, 234 GB went public: 2.6M accounts with Medicaid IDs, government IDs, and dates of birth.
Columbia's 2025 breach exposed 1.8M SSNs, and an undisclosed number of victims had no connection to the university or any warning it held their data.
XBOW found an API key in Moderna's source code, authenticated itself, and crashed the entire dev stack in hours. Mythos just made this repeatable.
New York's Champerty Fix Act cleared the Senate and faces an Assembly deadline this week, with hundreds of billions in sovereign debt at stake.
ETSI TS 104 033 sets GPU isolation and Model BoM rules for AI data centers. EU regulators routinely turn ETSI specs into enforceable law.
UK regulators gave Google nine months to give publishers AI opt-out controls, and banned Google from downranking any publisher who opts out.
