Anon Ghost, apparently firmly in ISIS's camp, hacks Malaysian police Facebook and Twitter accounts.

As the US Federal CIO warns that the Government's security "sprint" may well uncover more problems, the scope of the OPM breach continues to sink in. (It will sink in farther as general realization of how many people who never applied for clearances nevertheless had their personally identifiable information compromised on someone else's SF-86.) Consensus among observers is that the breach was the culmination of a long-standing Chinese espionage campaign whose long march into OPM began in several little-attended third-party sites.

Congress will soon hold more hearings on the breach, which has lent impetus to pending cyber security legislation (much of which paradoxically focuses on information sharing). Text of three pending bills is linked below. Director Archuleta's exit in the wake of OPM's breach prompts widespread industry reflection on executives' vulnerability to cyber fails.

The Hacking Team breach has turned up more Flash and Java exploits, some of the former now being exploited, FireEye reports, by Chinese criminal gangs. Adobe is working to patch Flash, but Mozilla (which has now blocked Flash by default in its Firefox browser) and Facebook seem to think Flash ultimately unfixable.

Telegram, a "security-enhanced chat app," is in the midst of a days-long denial-of-service attack on its Asia-Pacific service. No attribution yet, but Quartz thinks it significant that the DDoS campaign coincides with a Chinese crackdown on human rights attorneys.

A minor mystery: Rhino Security has withdrawn ProxyHam, for unclear reasons.