Weekly Roundup · Week of 24 to 30 August 2026
The week in business IT & comms
Two of this week's stories are about data nobody thought of as data. Manchester Airports Group had customer records taken that came from car park bookings, lounge passes and free airport Wi-Fi sign-ups, none of which feels like a database worth guarding until it sits on somebody else's server. Separately, a campaign hid working code inside an image file attached to a fake voicemail, and Microsoft's own spam scoring rated three-quarters of those messages as clean. Both come back to the same two questions: do you know what you are collecting, and do you know what you are letting through?
- 01Cyber Security
Manchester Airports Group confirms customer data taken from three UK airports
Records tied to car park, lounge and Fast Track bookings, plus in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands, were obtained by an unauthorised third party. Email addresses, phone numbers, vehicle registration numbers and postcodes were exposed. MAG said no bank or payment details were held on the affected system and that airport operations were not disrupted.
Read the full story - 02Cyber Security
Cyber insurance claims are getting rarer and a lot more expensive
Chubb's 2026 Cyber Claims Report, published on 25 August, found claim severity in the UK and Europe rose 34% for middle-market companies and 98% for large firms in 2025 against 2024. Smaller firms moved the opposite way to the US pattern: average SME claim costs in the UK and Europe rose from $51,095 to $82,621, while US SME costs fell. Chubb points at data breach and privacy litigation and at business interruption as the drivers.
- 03Microsoft & Cloud
Fake voicemail attachments slipped past Microsoft's spam scoring in three-quarters of cases
INKY, part of Kaseya, logged 26,589 messages across 5,527 organisations between 1 June and 4 August. The attachments were SVG image files declared as plain text with obfuscated JavaScript inside. 95% claimed to come from the recipient's own domain, and 75% were scored 0 or 1 by Microsoft, which treats that as not spam.
Read the full story - 04AI for Business
More than 100 tech and security firms warn the window on AI-enabled attacks is closing
An open letter published on 27 August, signed by companies including OpenAI, Anthropic, Google and Microsoft, says AI-enabled attacks will become far more widespread and sophisticated in the coming months and that current approaches to security are not equipped for it. What it asks of ordinary organisations is unglamorous: make cyber defence a leadership priority, deal with the highest-risk vulnerabilities, and upgrade or replace legacy systems.
- 05Connectivity & Broadband
New building rules for fibre installs start on 1 September, and some jobs have already moved
Circular 02/2026 gives installers a dispensation for drilling holes of 25mm or less to run fibre in existing buildings, and for rooftop masts on higher-risk buildings. ISPreview reported on 30 August that extra consent and assurance steps in the new process had already pushed some Openreach installs back by weeks. Openreach says it expects short-term adaptation rather than major disruption.
Read the full story - 06Connectivity & Broadband
Voneus buys Airband's assets and customers out of administration
The Macquarie-backed rural network confirmed on 28 August that it had completed the acquisition of the assets and customers of Airband Community Internet Limited from administration, taking Voneus to 170,000 ready-for-service gigabit premises and around 60,000 customers. Airband had put itself up for sale after its backer handed control to lenders.
- 07Connectivity & Broadband
Ofcom proposes to revoke Code Powers from a list of telecoms operators
On 26 August the regulator proposed revoking Code Powers from a set of network, civil engineering and broadband companies, either because they have closed or dissolved or because they told Ofcom they no longer need them. Code Powers speed up deployment and street works and support running fibre through Openreach ducts and poles, so the list doubles as a map of who has been consolidated or has stopped building.
What we’re watching
The building control dispensations for fibre work take effect on 1 September, and the signal worth watching over the next fortnight is whether install dates settle back down or keep slipping while the industry adapts to the new consent steps. On ownership, the Takeover Panel has given Epiris until 2 September and Waterland until 18 September to make a firm offer for Gamma or step away, so a sizeable slice of the UK business comms supply chain gets clearer inside three weeks. In the background the analogue phone network still switches off on 31 January 2027, with no extension and no fallback service for business lines.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.