Hello. The Justice Department charged a Ukrainian woman with hacking water plants and food production facilities, and accused the Russian government of directly supporting cyberattacks on U.S. and global critical infrastructure.

The attacks didn’t reflect the degree of technical skill typically associated with nation-state cyber operations. Instead, they sought—and found—gaps in basic security, such as unpatched devices and open connections to the public internet. Read our full story. 

More news below.

• Coupang executives are due to testify about the cyberattack to South Korea's parliament Dec. 17. (Korea JoongAng Daily)

High risk: New OpenAI models carry a cyber risk level of "high," according to the company's internal rating system. New models that can work autonomously for longer periods of time than prior models can be more easily used in brute-force attacks, OpenAI said in a blog post.

• "High" is a notch below "critical," a level that would prohibit a model from being made public. (Axios)

Customers with debt-consolidation, dental and other types of loans via Prosper Marketplace are being notified that their personal information was stolen in a cyberattack. The company discovered suspicious activity Sept. 1 and an investigation revealed that unauthorized queries to its databases went on between June and August. 

• Compromised data includes name, Social Security number, date of birth, bank account number, Prosper account number, other financial and credit-application information, driver’s license number, marriage or birth certificate, passport number, tax information and payment card number, the San Francisco company said. 
• Prosper hasn't said how many customers in total have been affected but in Texas, the number is 1,161,581, according to a notice sent to that state's attorney general. The company hasn't offered credit monitoring or identity-theft protection. 

Indicted: A federal grand jury in Washington, D.C., indicted a former Accenture employee for allegedly misleading the U.S. Army and others about the cybersecurity protections of cloud services provided by the company's Accenture Federal Services unit. (NextGov)

• Danielle Hillmer, a former senior manager, concealed non-compliance with federal cyber requirements and obstructed audits in 2020 and 2021, according to the indictment. 

Trucking company Volume Transportation, based in Conyers, Ga., is notifying nearly 3,000 current and former employees that their personal information was exposed in an August cyberattack. 

• Related reading from WSJ Pro: Crime Rings Enlist Hackers to Hijack Trucks

• The exchange also reached a settlement agreement with the Financial Crimes Enforcement Network, the Treasury Department’s law enforcement arm, which said Paxful facilitated more than $500 million worth of suspicious transactions, including some linked to Iran, North Korea and Venezuela.
• Read the full story, subscription required, or sign up for a free trial to Dow Jones Risk Journal. 

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.