The bank investigator trying to reconstruct June access through Palo Alto GlobalProtect needs records that may already be gone, as Kai Tanner’s filing today explains (installing a fix cannot recover VPN session records that were never retained).

Ransomware groups have exploited CVE-2026-0257 since June, according to reporting published on October 21. The flaw lets attackers open VPN sessions and enter corporate networks. Palo Alto Networks’ Unit 42 names Qilin and Inc among the ransomware operators exploiting it.

So the investigator’s starting point is the surviving record: accounts used, connection times and source addresses. A connection log can establish access. It cannot, by itself, establish everything that followed.

For a Hong Kong bank, that puts the issue within the institution-wide technology risk framework covered by HKMA’s SPM TM-G-1. The Banking Supervision Department, including its operational and technology risk division, supervises that territory. The supplied scope establishes no particular VPN retention period; it covers governance, continuous technology risk management and sound IT controls.

The October 21 warning gives an investigation a date to work back from. June is where the reported exploitation begins. Where the intervening records were never retained, the bank cannot recover that access history by repairing the entry point.