Safetech Innovations accelerates in H1 2026: consolidated net profit increases by 53% to RON 8.5 million. Safetech Innovations (BVB: SAFE), a Romanian cybersecurity company listed on the Bucharest Stock Exchange, with offices in Bucharest, London, Abu Dhabi and Riyadh, reports, at consolidated level, a turnover of RON 25.7 million in the first half of 2026, up 34% compared to the same period last year, an operating profit of RON 10.4 million, up 52%, and a net profit of RON 8.5 million, representing a 53% increase compared to H1 2025. "The results recorded in the first half of the year confirm Safetech Innovations' return to a solid growth trajectory, in a context in which cybersecurity is becoming increasingly important for both public and private-sector organizations. Over the past years, we have built a company capable of combining technical expertise, recurring services and proprietary solutions with access to highly complex projects. This positioning gives us confidence in Safetech's ability to capitalize on the opportunities available both in Romania and on international markets and to continue creating long-term value for our clients and shareholders," stated Victor Gânsac, Chairman of the Board of Directors of Safetech Innovations. At individual level, Safetech Innovations' turnover amounted to RON 25.2 million in the first six months of 2026, up 36% compared to the same period of the previous year. Recurring cybersecurity services and security solution implementation projects contributed approximately equally to turnover, accounting for around 50% each. Individual operating profit reached RON 10.4 million, up 44%, while individual net profit amounted to RON 8.6 million, 42% above the level recorded in H1 2025. "The performance recorded in the first half of the year demonstrates that we can sustain an accelerated pace of growth while maintaining an efficient operating structure. The fact that we achieved this level of performance with a team that increased by only two employees compared to H1 2025 reflects the progress made in terms of productivity and resource utilization. The integration of artificial intelligence-based tools into our day-to-day operations is also contributing to greater workflow efficiency. In the period ahead, we will focus on implementing the projects we have secured and delivering them to the quality standards that have supported Safetech's development and our long-term relationships with clients," stated Ionuț Georgescu, CEO of Safetech Innovations. In terms of Safetech UK, the entity generated revenues of approximately RON 974 thousand, up 30% compared to the same period last year, and attracted four new clients, primarily for cybersecurity services. At the same time, the subsidiary's operating costs decreased by 12%, while its loss for the first half of the year narrowed to approximately RON 13 thousand. A project initially scheduled for this period was postponed to the third quarter, and the company expects Safetech UK to become profitable in Q3 2026. The European business continued to develop, supported by projects carried out under the European Commission's FREIA (Fortified Security, Resilience, Expertise, Intelligence and Adaptability) framework agreement and by strategic partnerships with major international integrators. These collaborations facilitate Safetech Innovations' participation in more complex projects and contribute to the gradual increase in the share of international contracts in the company's revenues. The positive commercial momentum continued both during the reporting period and after its end. In May and July, Safetech Innovations signed two significant contracts, each with a duration of 36 months, worth RON 4.34 million and EUR 2.7 million, respectively, excluding VAT, for the provision of cybersecurity services and solutions. The company also entered into a 48-month framework agreement with the Authority for the Digitalization of Romania for the provision of cybersecurity assessment services required for the migration of certain applications to the Government Private Cloud. For the second half of 2026, Safetech Innovations' management expects the favorable trend observed in the first six months of the year to continue, supported by the current project portfolio, ongoing recurring contracts and opportunities generated by the company's international operations. Safetech Innovations has been listed on the Main Market of the Bucharest Stock Exchange since February 6, 2023, and is traded under the symbol SAFE. About Safetech Innovations Since 2011, Safetech Innovations S.A. has been providing customized cybersecurity services and solutions tailored to the needs of each organization. The company's portfolio of services and solutions includes consulting for governance, risk management, and compliance (GRC) in security, security testing and vulnerability management, security solutions, professional services, outsourced security services, and proprietary software applications for cybersecurity. Safetech Innovations has established partnerships with several leading cybersecurity companies, such as CheckPoint, DarkTrace, Microsoft, Splunk, Fidelis, HID, Cynet, and Phriendly Phishing. Currently employing over 60 staff members, the company has dedicated teams to research and develop cybersecurity software products, implement and support security solutions, and Computer Emergency Response Team (CERT) services. The company serves clients from various sectors, including utilities, healthcare, insurance, industrial manufacturing, retail, and the public sector. Additionally, seven of the top ten banks in Romania have chosen Safetech as their cybersecurity service provider. Safetech Innovations has been involved in over a hundred projects to secure critical infrastructures in the United States, Canada, Brazil, Morocco, the European Union, Singapore, the Philippines, India, China, and New Zealand. Safetech Innovations (SAFE) is listed on the Main Market of the Bucharest Stock Exchange as of February 6, 2023. More information about Safetech Innovations is available at www.safetech.ro

ReliaQuest: how ReliaQuest stopped a ShinyHunters breach attempt. ReliaQuest Thwarts ShinyHunters Social Engineering Attack Targeting Okta SSO On 23 August 2026, cybersecurity firm ReliaQuest confirmed a social engineering attack linked to the ShinyHunters threat group, which attempted to breach its systems using a fake Okta Single Sign-On (SSO) page. The attackers, posing as IT support, tricked an employee into approving a multi-factor authentication (MFA) push during an impersonation call, granting them access to a view-only identity dashboard session. The breach was contained quickly due to ReliaQuest's layered security controls, including device-trust policies that restricted the attacker to a single session. No business applications, customer data, or company data were accessed, and no persistence was established. The compromised credentials were immediately expired and reset upon detection. The attack followed a well-documented playbook: threat actors registered a lookalike domain, hosted a fake SSO page behind a content delivery network (CDN), and used phone-based impersonation to deceive the employee. The incident mirrored a recently disclosed WordPress plugin flaw that allowed authentication bypass, reinforcing the need for defense-in-depth strategies rather than reliance on single security measures. ReliaQuest's GreyMatter platform, which integrates with Splunk, CrowdStrike, Fortinet, and Google Cloud Chronicle, played a key role in normalizing telemetry data and enabling rapid response. The company emphasized that phishing remains effective, particularly when attackers leverage employee names and urgency to manipulate victims. A week prior, ReliaQuest's threat research team had shared intelligence on ShinyHunters, highlighting the group's use of fake domains and MFA bypass techniques. The screenshots of the compromised Okta dashboard, initially posted on X (formerly Twitter), were later deleted. The incident underscores the growing sophistication of social engineering attacks, even against cybersecurity providers. "id": "REL1787660926", "linkid": "reliaquest", "type": "Cyber Attack", "date": "8/2026", "severity": "25", "impact": "1", "explanation": "Attack without any consequences" {'affected_entities': [{'customers_affected': 'None', 'industry': 'Cybersecurity', 'name': 'ReliaQuest', 'type': 'Cybersecurity Firm'}], 'attack_vector': 'Fake Okta SSO page, MFA push manipulation, phone-based ' 'impersonation', 'data_breach': {'data_exfiltration': 'No', 'personally_identifiable_information': 'No', 'type_of_data_compromised': 'None'}, 'date_detected': '2026-08-23', 'date_publicly_disclosed': '2026-08-23', 'date_resolved': '2026-08-23', 'description': 'On 23 August 2026, cybersecurity firm ReliaQuest confirmed a ' 'social engineering attack linked to the ShinyHunters threat ' 'group, which attempted to breach its systems using a fake ' 'Okta Single Sign-On (SSO) page. The attackers, posing as IT ' 'support, tricked an employee into approving a multi-factor ' 'authentication (MFA) push during an impersonation call, ' 'granting them access to a view-only identity dashboard ' 'session. The breach was contained quickly due to ReliaQuest's ' 'layered security controls, including device-trust policies ' 'that restricted the attacker to a single session. No business ' 'applications, customer data, or company data were accessed, ' 'and no persistence was established. The compromised ' 'credentials were immediately expired and reset upon ' 'detection.', 'impact': {'data_compromised': 'None', 'operational_impact': 'Minimal (contained quickly)', 'systems_affected': 'Okta identity dashboard (view-only session)'}, 'initial_access_broker': {'backdoors_established': 'No', 'entry_point': 'Fake Okta SSO page, lookalike ' 'domain'}, 'investigation_status': 'Contained and resolved', 'lessons_learned': 'The incident underscores the growing sophistication of ' 'social engineering attacks, even against cybersecurity ' 'providers. Defense-in-depth strategies are critical, and ' 'phishing remains effective when attackers leverage ' 'employee names and urgency.', 'post_incident_analysis': {'corrective_actions': 'Credential reset, ' 'device-trust policies ' 'enforcement, enhanced ' 'monitoring', 'root_causes': 'Social engineering (MFA push ' 'manipulation), fake Okta SSO page, ' 'phone-based impersonation'}, 'recommendations': 'Implement layered security controls, enforce device-trust ' 'policies, and educate employees on social engineering ' 'tactics.', 'references': [{'source': 'ReliaQuest Threat Research Team'}, {'source': 'X (formerly Twitter)'}], 'response': {'containment_measures': 'Device-trust policies, credential ' 'expiration and reset', 'enhanced_monitoring': 'GreyMatter platform integration with ' 'Splunk, CrowdStrike, Fortinet, and ' 'Google Cloud Chronicle', 'incident_response_plan_activated': 'Yes', 'remediation_measures': 'Compromised credentials expired and ' 'reset'}, 'threat_actor': 'ShinyHunters', 'title': 'ReliaQuest Thwarts ShinyHunters Social Engineering Attack Targeting ' 'Okta SSO', 'type': 'Social Engineering', 'vulnerability_exploited': 'Human vulnerability (social engineering), ' 'potential WordPress plugin flaw (authentication ' 'bypass)'} Published by Cybersecurity Gaps Expose Australia's Transport and Logistics Sector Australia's transport and logistics industry a critical backbone for supply... Aug 25, 2026 Sotheby's International Investigates Cybersecurity Incident Involving Client Data Luxury real estate firm Sotheby's International is probing a cybersecurity... Aug 25, 2026 Historic McQuay Farmhouse Preserved Amid Charlotte's Growth; Preferred Parking Reports Data Breach Charlotte's Historic McQuay Farmhouse Stands as... Aug 24, 2026