DIVD breached by what it judges to be an autonomous AI agent chaining two Zammad zero-days

DIVD internal systems; spread limited by network segmentation; full scope of accessed data still under investigation

The agent attribution is DIVD's own judgement from observed behaviour, not independently proven; no human operator or group has been identified. DIVD's own incident page carries the quote above in its first public statement, and a later statement says the agent worked automated and decided each next step itself at speed, with its own over-explaining comments in the attacker's scripts supporting the assessment. DIVD's separate case page for the two Zammad vulnerabilities documents the flaws and the 21 September breach date but does not itself make the agent claim. The session-hijack remote code execution and root privilege escalation are confirmed by DIVD's incident page (CVSS 9.4 per press). Realized impact: DIVD states volunteer data got out, such as email addresses and possibly contact details, and that signs of compromise are still being investigated; which data and whose is not yet fully known. Spread was limited by network segmentation. Help Net Security and Sysdig's write-up repeat DIVD's characterisation.