October 2026 saw a series of significant cyber attacks and data breaches affecting organisations across retail, aviation, financial services, technology and government. Major incidents involving a French supermarket, the UK Legal Aid Agency, BAE Systems Inc., Capcom, Zeabur and Burger King Japan highlighted the diverse range of organisations facing cyber threats. From ransomware and unauthorised access to data exposure and operational disruption, the month's incidents demonstrated the persistent challenges organisations face in protecting critical systems and sensitive information.
In Asia, incidents involving Sony Network Communications, Japan Airlines, SBI and Daiichi Kosho further highlighted the risks facing businesses that manage large volumes of customer data and depend on interconnected digital infrastructure. These cases also reinforced concerns around third-party security, data protection and the potential business impact of cyber incidents. Together, the attacks illustrated how cybersecurity failures can affect not only individual organisations but also their customers, partners and wider supply chains.
The cyber attacks of October 2026 serve as another reminder that effective cyber incident response and operational resilience are essential to business continuity. Organisations must go beyond preventive security measures and ensure they have tested incident response plans, clearly defined responsibilities and the ability to respond quickly when an attack occurs. Cyber Management Alliance helps organisations strengthen their preparedness through Cyber Incident Response Planning, Cyber Tabletop Exercises, Executive Cybersecurity Training and Cyber Resilience Assessments, enabling teams to identify weaknesses, improve decision-making and minimise the impact of cyber incidents.
|
Date |
Victim |
Summary |
Threat Actor |
Business Impact |
Source Link |
|
October 2, 2026 |
A water utility, a telecommunications provider, a regional government body, and a university |
Warlock ransomware breach SharePoint in water, telecom operator attacks |
Warlock ransomware group |
The Warlock group exploited vulnerabilities in on-premises Microsoft SharePoint servers to gain access to victim networks, disable security protections on at least 40 hosts, and deploy ransomware on at least 33 systems in one documented intrusion. The attackers also used web shells, credential-stealing tools and remote-access techniques to move through compromised networks and spread the ransomware. |
|
|
October 6, 2026 |
Osaka Metropolitan University (OMU), Japan |
Osaka Metropolitan University cancels classes after suspected ransomware attack |
Unknown |
Osaka Metropolitan University suffered a suspected ransomware attack that disrupted its internal network, email and academic and administrative systems, forcing the university to shut down around 500 servers and cancel classes for several days. The incident potentially exposed personal information belonging to at least 130,000 current and former students, faculty members and others. |
|
|
October 7, 2026 |
Advantest Corporation |
Advantest discloses data breach months after ransomware attack |
BlackCat (ALPHV) |
Attackers breached Advantest’s IT network in February 2026 and deployed ransomware. The company later confirmed that personal information had been stolen, including names, dates of birth, contact details, Social Security numbers, passport and driver’s licence numbers, and medical and financial information. Advantest did not disclose the total number of affected individuals, although regulatory filings indicated that more than 500 California residents were impacted. The company said it had no evidence that the stolen information had been publicly disclosed or misused. |
|
|
October 7, 2026 |
Change Healthcare, a UnitedHealth Group subsidiary |
Senate passes healthcare cybersecurity bill after 190 million impacted by Change Healthcare breach |
ALPHV/BlackCat ransomware group |
Change Healthcare’s ransomware attack disrupted U.S. healthcare claims processing, delayed payments to hospitals, pharmacies and healthcare providers, caused significant cash-flow pressures and operational losses, and exposed approximately 190 million individuals’ sensitive health information, prompting calls for stronger sector-wide cybersecurity regulations. |
Source: The Record Media |
|
October 8, 2026 |
IDC Frontier’s IDCF Cloud service, affecting 495 companies and local governments that relied on the platform |
Ransomware attack disrupts Japan's IDCF Cloud used by govt clients |
Unknown |
A ransomware attack disrupted IDC Frontier’s IDCF Cloud service on 7 October 2026, forcing the company to shut down affected systems in its East Japan Region 1 data centre and disable customer access to management consoles while it investigated the breach and secured its infrastructure; the attackers claimed to have encrypted 225 databases and deleted more than 554,000 snapshots, but those claims had not been independently confirmed. |
Source: Bleeping Computer |
|
October 12, 2024 |
KFC |
KFC named in Gentlemen Ransomware Group’s latest breach claim |
Gentlemen Ransomware Group |
The Gentlemen ransomware group listed KFC on its dark-web leak site on 10 October 2026 and threatened to publish allegedly stolen data to pressure the company into negotiations, but KFC had not confirmed the incident and the group had not provided samples or technical evidence to verify the claimed breach. |
|
|
October 12, 2026 |
MoneyGram |
MoneyGram under threat as hackers claim data breach |
Gentlemen Ransomware Group |
The Gentlemen ransomware group claimed to have breached MoneyGram and threatened to publish allegedly stolen data unless the company entered negotiations, but MoneyGram had not confirmed the incident and the attackers had not provided samples to verify the alleged theft or establish what information may have been exposed. |
Source: cybernews.com |
|
October 22, 2026 |
At least 600 organisations worldwide across multiple critical infrastructure sectors in North America, South America, Europe and Australia |
SafePay ransomware gang hits at least 600 organisations worldwide |
SafePay ransomware gang |
The SafePay ransomware gang had compromised at least 600 organisations worldwide since August 2024, targeting businesses and critical infrastructure across several countries. The attackers gained access through stolen credentials, brute-force attacks, phishing and vulnerabilities in internet-facing systems, then used legitimate administrative tools to move across networks, steal sensitive data, disable backups and encrypt victims’ systems. They followed a double-extortion approach, demanding ransom payments while threatening to publish stolen information if victims refused to pay. CISA, the FBI and international law enforcement agencies issued a joint advisory outlining the group’s tactics and urged organisations to patch vulnerable systems, enforce multifactor authentication, strengthen access controls and monitor networks for suspicious activity. |
Source: cybernews.com |
|
October 26, 2026 |
University of New Mexico (UNM) Health Sciences Center |
UNM Health ransomware attack disrupts patient care, surgeries |
Byod Ransomware Group |
A cyber attack disrupted UNM Health’s systems, forcing temporary admission restrictions, ambulance diversions, and suspension of outpatient surgeries and appointments. The Byod ransomware group claimed responsibility and alleged access to sensitive patient, employee, and student data. UNM later restored critical systems and resumed hospital operations, stating that core systems and servers were not penetrated. |
Source: Bleeping Computer
|
|
Date |
Victim |
Summary |
Threat Actor |
Business Impact |
Source Link |
|
October 1, 2026 |
U.S. Department of Defense (Pentagon)specifically its Defense Manpower Data Center (DMDC) |
Hackers allegedly breach Pentagon human resources management system; reportedly steal data of nearly 3 million people |
Unknown |
Hackers breached the Pentagon’s human resources management system in October 2025 and stole personnel records belonging to more than 3 million people, including military service members. The incident exposed sensitive personal information held by the Defense Manpower Data Center, prompting the department to notify affected individuals. The attackers had not been publicly identified. |
Source: Bleeping Computer
|
|
October 2, 2026 |
Frontline Education and employees of affected school districts |
Frontline Education data breach impacts school district employees |
Unknown |
The data breach affected school district employees whose personal information was stored in Frontline Education’s systems. The incident raised concerns about the exposure of sensitive employee information, although the attacker’s identity and the full extent of the compromised data were not confirmed in the available information. |
Source: Bleeping Computer
|
|
October 4, 2026 |
Technical University of Denmark (DTU) |
Major Danish university hacked, 200,000 people potentially exposed |
Unknown |
Attackers compromised DTU user profiles to access its identity and access management system, DTUBasen, and downloaded personal data dating back to 2003, potentially affecting up to 200,000 current and former students, employees, guests, and external partners. |
Source: cybernews.com |
|
October 6, 2026 |
ASOS, its customers, and customer information stored on third-party platforms used by the retailer |
ASOS confirms data breach after “HACKED” in-app notifications |
Xuanye Group |
Attackers impersonated a trusted contact to steal an ASOS employee’s login credentials and access third-party platforms containing customer information, then sent unauthorized “ASOS HACKED” notifications through the retailer’s app to pressure the company over an alleged data theft; ASOS secured the affected platforms and confirmed that names and contact details had been accessed, while payment-card information and account passwords were not compromised. |
Source: Bleeping Computer
|
|
October 7, 2026 |
Nikkei |
Nikkei discloses two employee account compromises, one used for phishing |
Unknown |
Attackers gained unauthorized access to two employee cloud accounts at Nikkei. One Google Workspace account may have exposed the names and email addresses of 1,646 employees and business partners, while a compromised Microsoft 365 account was used to send approximately 9,000 phishing emails to employees and external contacts, directing them to malicious websites. The second incident may also have exposed recipients’ names, email addresses, and some email content. |
Source: www.scworld.com |
|
October 8, 2026 |
ASOS and its customers |
Asos hackers took more personal details than first revealed, BBC finds |
Xuanyewen |
ASOS confirmed that hackers had obtained more customer information than initially disclosed after an employee’s login credentials were stolen through impersonation of a trusted contact. According to BBC News, the compromised information included customers’ names, home addresses, phone numbers, email addresses, customer numbers and website search history, potentially affecting millions of users. ASOS stated that payment card details and account passwords had not been accessed. The attackers, who identified themselves as Xuanyewen, claimed they had used Simon AI, a platform built on Snowflake, to gain access, although this method remained unverified. |
Source: The BBC
|
|
October 8, 2026 |
Yoido Full Gospel Church and SaRang Church, South Korea |
Hackers target two South Korean megachurches, potentially exposing congregant data |
Unknown |
Hackers targeted two of South Korea’s largest Protestant churches in August 2026, potentially exposing sensitive information belonging to hundreds of thousands of congregants and employees. At Yoido Full Gospel Church, attackers reportedly used a malicious web shell to gain administrator-level access and collect membership records, financial information, internal communications and employee credentials, while the intrusion at SaRang Church involved previously leaked passwords and vulnerabilities in internal applications. |
Source: The Record Media |
|
October 8, 2026 |
Arizona’s state court system |
Arizona courts say hackers stole info on more than 1.3 million people |
Unknown |
Hackers stole sensitive information belonging to more than 1.3 million people after a cyber attack on Arizona’s court system on 24 September 2026, which investigators believed began when a court employee clicked a malicious link in a phishing email. The attackers copied backup files containing names, Social Security numbers and court case numbers, along with more than 150,000 foster-care review reports and records associated with nearly 30,000 active and inactive protective orders. Court officials shut down the affected system to stop the intrusion, notified affected individuals and worked with state and federal investigators. |
Source: The Record Media |
|
October 8, 2026 |
Publica, Switzerland’s federal pension fund |
Swiss pension fund hit by data leak after cyber attack on software provider |
Unknown |
Switzerland’s federal pension fund Publica suffered a data leak after a cyberattack targeted its external software provider, PK Software, at the end of September 2026. The attack potentially exposed members’ sensitive information, including salaries, pension assets, benefit amounts and contact details, although the full scope of the compromised data remained under investigation. PK Software isolated the affected IT environment, engaged external cybersecurity specialists, notified the relevant authorities and filed a criminal complaint, while Switzerland’s Office of the Attorney General launched an investigation. |
Source: Reuters
|
|
October 9, 2026 |
iRhythmHolding |
Hundreds of thousands impacted by data breach at biosensor firm iRhythm. |
Unknown |
Attackers used social engineering to access iRhythm’s third-party-hosted business applications between 3 and 8 June 2026 and stole personal and health-related information, including patients’ names, contact details, insurance numbers, dates of birth, and device identifiers; the company confirmed that its clinical systems, medical devices, manufacturing, and services were not disrupted and began notifying affected individuals after completing its investigation. |
Source: The Record Media |
|
October 10, 2026 |
Holland & Knight, Squire Patton Boggs, and Nelson Mullins |
Holland & Knight, other firms disclose data security breaches |
Unknown |
Holland & Knight and Squire Patton Boggs disclosed separate data breaches that exposed sensitive client information, including Social Security numbers, while Nelson Mullins reported that a cyber group accessed a user’s laptop and copied a limited number of documents; the firms said their incidents contained or did not disrupt client services. |
Source: Reuters |
|
October 11, 2026 |
Nippon Columbia Group (NCG). |
Nippon Columbia malware incident exposes 8.6 million karaoke fan records |
Unknown |
A malware infection on an employee’s device at Nippon Columbia Group potentially exposed personal information belonging to approximately 8.63 million Daiichi Kosho customers and 93,000 employees and other individuals, including names, dates of birth, gender, email addresses and phone numbers, although no confirmed external data leak or misuse had been reported and Daiichi Kosho said its own systems were not affected. |
Source: Bleeping Computer |
|
October 11, 2026 |
Ernst & Young (EY) |
Goldman Sachs and Man Group investor data exposed in EY security incident |
ShinyHunters |
An unauthorized attacker accessed a platform used by EY’s technology teams between 28 March and 12 April 2026 and downloaded client documents that potentially contained sensitive personal and financial information, including names, residential addresses, tax identification numbers, email addresses and investment-related details linked to clients of Goldman Sachs and Man Group. ShinyHunters claimed responsibility and threatened to publish the allegedly stolen data unless its ransom demands were met, while Goldman Sachs and Man Group indicated that their own systems had not been compromised. |
Source: www.teiss.co.uk |
|
October 12, 2026 |
Daiichi Kosho |
Japanese karaoke maker Daiichi Kosho reports a data breach affecting 8.7 million records. |
Unknown |
Malware found on a Nippon Columbia Group employee’s computer potentially exposed personal information belonging to around 8.72 million Daiichi Kosho customers and other individuals, including names, genders, dates of birth, email addresses and phone numbers, although no confirmed data theft or public leak had been established and Daiichi Kosho said its own systems were not compromised. |
Source: www.scworld.com |
|
October 12, 2026 |
Denmark’s Central Person Register |
Denmark CPR breach blamed on ‘123456’ password |
Unknown |
An anonymous hacker reportedly exploited a former employee’s account, allegedly protected by the weak password “123456,” to misuse a Danish IT company Pays ApS’s authorised access to the country’s Central Person Register and retrieve names, addresses and CPR identification numbers linked to approximately 8.8 million people. The unauthorised activity continued for days before it was detected, prompting authorities to revoke the company’s access, launch an investigation and warn citizens about potential phishing and identity-related fraud. |
Source: cybernews.com |
|
October 16, 2026 |
Burger King Japan |
Burger King Japan data breach exposes 11 million customer records |
Unknown |
Burger King Japan disclosed a data breach after attackers gained unauthorised access to a server containing approximately 11.18 million customer records between 2 and 7 October 2026. The exposed information included customers’ names, dates of birth, gender, email addresses, phone numbers and order history. The company blocked the unauthorised access, reported the incident to Japan’s Personal Information Protection Commission and launched an investigation with external cybersecurity experts. |
Source: Bleeping Computer |
|
October 17, 2026 |
California Department of Education (CDE) |
Hacker gets data on millions of California students, state education department says |
Unknown |
A hacker exploited a compromised login credential to access an ETS secure file-transfer site and copy records belonging to students enrolled in California during the previous three school years, including more than 5.7 million students from the 2025–2026 academic year. The breach occurred between 22 May and 18 September 2026 and was discovered on 25 September. The California Department of Education also worked to minimise disruption to enrollment-data processing and affected assessment activities. Investigators had not found evidence that the stolen information had been made public. |
Source: Reuters |
|
October 18, 2026 |
NHS patients and their families |
NHS data breaches a disgrace, health secretary says |
NHS staff members who allegedly accessed confidential medical records without legitimate reasons |
UK Health Secretary Yvette Cooper condemned unauthorised access to NHS patient records as a disgrace after Nottingham University Hospitals NHS Trust dismissed 15 staff members for improperly accessing the medical records of victims of the 2023 Nottingham attacks, while Yorkshire Ambulance Service investigated possible unauthorised access to the records of William Chapman. Cooper called for staff to be suspended promptly during investigations and dismissed where misconduct was established. The incidents raised serious concerns about patient confidentiality, internal access controls and the protection of sensitive medical information, prompting further investigations and measures to strengthen safeguards around patient records. |
Source: The BBC |
|
October 19, 2026 |
Florida Department of Highway Safety and Motor Vehicles (FLHSMV) and potentially affected Florida driver’s licence and identification card holders. |
Florida driver license, motor vehicle data breached by "malicious actor," state confirms |
ShinyHunters |
A malicious actor accessed Florida’s Department of Highway Safety and Motor Vehicles records on 4 September 2026 using compromised credentials, potentially exposing driver’s licence and motor vehicle information, document images and other personal data. The investigation indicated that the credentials had been improperly stored on an electronic device by an employee of a local law enforcement agency. The department moved to block unauthorised access, reset the affected credentials and strengthen security controls, while working with state law enforcement agencies to investigate the incident. Officials said they had found no evidence that the exposed information had been misused and planned to offer potentially affected individuals identity and credit monitoring services along with identity-theft insurance. |
Source: cbsnews.com |
|
October 19, 2026 |
FirstVDS, a Russian hosting provider, and customers whose data was stored on affected virtual servers |
Hackers steal customer data from major Russian hosting provider FirstVDS |
Unknown |
Hackers exploited a vulnerability in ISPsystem’s VMmanager 6 server-management software to access FirstVDS customer data and steal passwords, cloud-service credentials, configuration files, cryptocurrency wallet files and other sensitive information. They used malware to copy files from virtual server disks mounted in read-only mode, allowing them to extract data without visibly modifying the affected systems or interrupting normal services. FirstVDS did not disclose how many customers or servers were affected and urged notified customers to assume their data had been stolen and change their passwords and access credentials. |
Source: The Record Media |
|
October 21, 2026 |
Zeabur |
Zeabur to shut down following major security breach SC Media |
Unknown |
Attackers used leaked internal credentials that had been stored in plaintext to breach Zeabur’s shared hosting infrastructure, dedicated servers and internal systems between 14 and 15 October 2026, ultimately accessing the platform’s production database. The incident exposed information associated with 321,810 accounts and approximately 3.2 million environment-variable records, which could have contained API keys, passwords, cloud credentials and other sensitive secrets. |
Source: www.scworld.com |
|
October 23, 2026 |
Capcom and users of its CAPCOM ID service |
Capcom data breach confirmed — around 11.7 million accounts thought to have been affected |
Unknown |
Capcom confirmed that a data breach had exposed approximately 11.77 million CAPCOM ID records, including users’ email addresses, account activity details and recent login IP addresses, while additional personal information was exposed for 43 users and attackers had changed the passwords of 196 accounts. The company reset the affected passwords, secured the service, notified the relevant authorities and warned users to watch for phishing attempts, while confirming that payment card information had not been compromised and gameplay remained unaffected. |
Source: techradar.com |
|
October 23, 2026 |
Quest Diagnostics |
Lab testing giant Quest Diagnostics confirms patients' personal and health data was compromised during breach |
Unknown |
Quest Diagnostics discovered unauthorized access to its Quanum Lab Services Manager system, which healthcare providers used to order tests and access results. The breach exposed certain patient records and potentially sensitive health information. The company suspended access to the affected system, notified law enforcement and launched an investigation, while the number of affected patients remained unknown. |
Source: techcrunch.com |
|
October 26, 2026 |
The University of Copenhagen, Denmark |
University of Copenhagen data breach exposes data of 525,000 people |
Unknown |
Hackers gained unauthorised access to a test environment at the University of Copenhagen, potentially exposing the personal information of approximately 525,000 people, including full names, Danish national identity numbers (CPR numbers), phone numbers and email addresses. The university later confirmed that PIN codes belonging to around 20,000 staff and students had also been exposed, prompting it to restrict physical access to certain sensitive campus locations while issuing replacement codes. |
Source: Bleeping Computer |
|
October 26, 2026 |
More than 90 South Korean organisations |
Former pentester used ARTEX AI to steal 8.2 million data records |
A 32-year-old South Korean hacker and former penetration tester |
A former penetration tester led a hacking operation that breached more than 90 South Korean organisations and stole approximately 8.2 million personal records, using the ARTEX AI penetration-testing framework to expand the attacks. The stolen information included names, resident registration numbers, phone numbers and addresses. In 38 incidents, the group demanded a total of 360 million won (approximately US$270,000) in exchange for not publishing the stolen data. |
Source: Bleeping Computer |
|
October 27, 2026 |
Convertr and customers of affected Brazilian online stores |
Hackers hijack Convertr analytics script to steal payment card data |
Unidentified Brazilian credit card skimming group |
A Brazilian cybercriminal group compromised Convertr’s analytics script and injected malicious code into checkout pages, stealing customers’ payment card numbers, expiry dates, CVVs, names and Brazilian taxpayer identification numbers. |
Source: Bleeping Computer |
|
October 27, 2026 |
ENGIE (French energy company) |
Energy giant ENGIE discloses data breach affecting customers |
Unknown |
ENGIE disclosed that attackers had breached a marketing platform used by its business partners and stolen French customers’ personal and energy contract information, including names, addresses, email addresses, phone numbers and customer identifiers. |
Source: Bleeping Computer |
|
October 27, 2026 |
GMO Internet Group |
Japan internet giant GMO says hackers posted stolen customer data |
Unknown |
GMO Internet confirmed that suspected attackers had published allegedly stolen company and customer data following unauthorized access to its Onamae Desktop Cloud service, potentially affecting 27,000 servers. The attackers had demanded approximately $50 million in ransom. GMO investigated the leaked information, advised customers to reset passwords and cooperated with authorities. |
Source: techcrunch.com |
|
October 27, 2026 |
Sony Network Communications |
Sony ISP subsidiary data breach exposes 2.5 million customer records. |
Unknown |
Sony Network Communications’ breach exposed approximately 2.14 million customer records, including personal and contact details, while some email accounts had passwords exposed and 16 records contained bank account information, increasing the risk of phishing, identity misuse and targeted fraud. |
Source: Bleeping Computer |
|
October 29, 2026 |
Japan Airlines |
Japan Airlines suffers third-party data breach exposing passenger info. |
Unknown |
Japan Airlines exposed personal and travel information of approximately 92,000 customers through a breach of Amadeus’s third-party Passenger Service System, including passport and contact details for around 2,000 customers, increasing the risk of phishing and travel-related fraud, while flight operations remained unaffected. |
Source: Bleeping Computer |
|
October 30, 2026 |
The Florida Department of Education |
Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach |
Unknown |
The Florida Department of Education reported that sensitive information belonging to approximately 4.9 million financial aid applicants was exposed, including Social Security numbers, names, addresses, contact details and dates of birth, increasing the risk of identity theft and targeted fraud; the affected website was taken offline, although student aid payments and disbursements were not expected to be disrupted. |
Source: The Record Media |
|
October 31, 2026 |
Fashion retailer Revolve |
Fashion retailer Resolve says hackers stole payment card information |
Unknown |
Fashion retailer Revolve disclosed that attackers accessed multiple company systems and obtained customer names, contact details, payment card numbers and expiration dates, with 127,200 affected individuals reported in Texas and another 1,328 in Vermont; the incident raised the risk of payment card fraud, although the company reported no operational disruption or material financial impact. |
Source: The Record Media |
|
Date |
Victim |
Summary |
Threat Actor |
Business Impact |
Source Link |
|
October 2, 2026 |
U.S. banks, credit unions and financial institutions operating ATMs |
US sanctions Tren de Aragua gang members in ATM hacks crackdown |
Tren de Aragua (TdA), a Venezuelan criminal gang, including Anibal Alexander Canelon Aguirre, also known as “Prometheus,” who was allegedly involved in developing the Ploutus malware. |
Tren de Aragua-linked criminals used ATM jackpotting malware, including Ploutus, to force ATMs to dispense cash and erase evidence of the attacks. U.S. authorities estimated that more than 1,500 alleged attacks had caused approximately $40.73 million in losses to financial institutions by August 2025. The U.S. Treasury subsequently sanctioned individuals linked to the scheme and associated financial networks. |
Source: Bleeping Computer |
|
October 6, 2026 |
More than 100 compromised websites in Ukraine |
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware |
Unknown |
Hackers compromised more than 100 legitimate websites in Ukraine and injected malicious code that displayed fake Cloudflare verification pages, tricking visitors into running PowerShell commands that installed Lunex Stealer malware. The malware could steal passwords, authentication tokens, browser data and cryptocurrency wallet information while providing attackers with remote access to infected computers; in some cases, it also installed a malicious browser extension disguised as a Microsoft Office tool. |
Source: The Record Media |
|
October 7, 2026 |
More than 3,400 exposed servers, including systems running AI tools such as LiteLLM and Ollama, the Gotenberg PDF converter, and the Gitea development toolkit. |
PoeLLM malware infects exposed AI servers in cryptomining attacks |
Unknown |
Attackers used PoeLLM malware to compromise more than 3,400 exposed servers, install cryptocurrency miners, and turn infected systems into scanning and exploitation platforms to spread the malware further, generating cryptocurrency through the victims’ computing resources. |
Source: Bleeping Computer |
|
October 7, 2026 |
Google and other organizations whose domains were affected, including domains under Ghana’s .gh, Sierra Leone’s .sl, and American Samoa’s .as country-code top-level domains. Google confirmed that its own systems were not compromised |
Hackers hijack Google domains after breaching ccTLD registries |
Unknown |
Hackers compromised third-party country-code domain registry operators, altered DNS records, and obtained unauthorized HTTPS certificates for Google and other organizations’ domains, potentially enabling them to impersonate legitimate websites and redirect visitors to malicious content, after which Google blocked the fraudulent certificates in Chrome and worked with certificate authorities to revoke them. |
Source: Bleeping Computer |
|
October 8, 2026 |
Samsung Galaxy S26 and Google Pixel 10 smartphones |
Hackers crack Samsung Galaxy S26 and Pixel 10 with a single email in zero-day attack |
Ikotas Labs, a Japanese cybersecurity research firm that demonstrated the exploit during the Pwn2Own Ireland 2026 ethical hacking competition |
Security researchers from Ikotas Labs exploited a chain of four vulnerabilities to remotely execute code on Samsung Galaxy S26 and Google Pixel 10 smartphones using a single email, demonstrating how attackers could potentially compromise devices without physical access; the flaws had not yet been fully disclosed publicly. |
Source: cybernews.com |
|
October 8, 2026 |
GitHub users |
FakeGit malware campaign returns with 17,610 malicious GitHub repos |
Unknown |
The FakeGit campaign resurfaced with 17,610 malicious GitHub repositories that disguised malware downloads as legitimate projects and used SmartLoader to deliver additional threats, including the StealC information-stealing malware, potentially exposing users’ credentials and compromising their systems. |
Source: Bleeping Computer |
|
October 13, 2026 |
French supermarket chains, including Intermarché, Carrefour, Monoprix, E.Leclerc and Coopérative U, along with affected stores using connected refrigeration systems |
France supermarket hack: Cyberattack on fridges sparks fires and food losses |
Unknown |
Hackers remotely manipulated connected refrigeration systems at hundreds of French supermarkets, forcing refrigerators and freezers to heat up to around 50°C and triggering defrost cycles that spoiled large quantities of fresh and frozen food, with fires and equipment damage reported at some locations. The incident disrupted supermarket operations and caused substantial financial losses, while French authorities launched an investigation and examined vulnerabilities in outdated refrigeration software and firmware that may have enabled the attackers to gain control of the systems. |
Source: cnbc.com |
|
October 14, 2026 |
More than 75,000 organisations across 150 countries |
Global takedown hits network behind 1 billion phishing messages |
Operators of YAM Store, associated with the CoGUI, Haozi and Iron Man System phishing platforms |
Microsoft, Japan’s National Police Agency and international partners disrupted a large cybercrime network that had enabled more than one billion phishing messages targeting over 75,000 organisations across 150 countries. The operation involved the YAM Store marketplace and the CoGUI, Haozi and Iron Man phishing platforms, which helped criminals impersonate trusted organisations, steal account credentials and payment information, and exploit fraudulent or compromised cloud accounts. |
Source: Bleeping Computer |
|
October 14, 2026 |
Ledger hardware-wallet users who purchased tampered devices through third-party resellers, particularly CryptoBilis in Southeast Asia |
Ledger asks sellers across Asia to halt sales after supply-chain attack |
Unknown |
Ledger asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales and remove its hardware wallets from shelves after investigators discovered secretly installed hardware implants in devices sold through third-party channels. The implants captured users’ 24-word cryptocurrency recovery phrases during wallet setup and transmitted them through an LTE connection, allowing attackers to access and steal cryptocurrency funds. Ledger linked all confirmed fund losses to devices sold by CryptoBilis, while reports of potentially compromised devices from other sellers remained under investigation. The company said its own systems, services and wallet operating system had not been compromised and advised affected users to avoid setting up suspicious devices or move their assets to a new wallet with a newly generated recovery phrase. |
Source: Bleeping Computer |
|
October 15, 2026 |
UK Legal Aid Agency (LAA) |
UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978 |
Unknown |
Criminals exploited vulnerabilities in the UK Legal Aid Agency’s IT systems and stole sensitive personal records covering legal aid applicants, lawyers and some people supervised by the probation service, with further investigation revealing that around 250,000 records dated from before 2007 and the oldest verified record went back to 1978. |
Source: The Record Media |
|
October 15, 2026 |
Owners of compromised D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs and other internet-connected devices across 34 countries. |
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth |
Unknown |
Cybercriminals exploited known vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs and other internet-connected systems to compromise at least 143 devices across 34 countries and secretly install Pawns.app, a bandwidth-sharing application, without the owners’ consent. The attackers used the victims’ internet connections as residential proxy nodes to route third-party traffic and potentially earn money, while some compromised devices were also configured with SSH key access to maintain remote entry. GreyNoise uncovered the campaign while investigating suspicious network activity and warned that victims’ IP addresses could be associated with fraudulent or illegal online activities carried out through their hijacked connections. |
Source: Bleeping Computer |
|
October 16, 2026 |
BAE Systems Inc. and the U.S. federal bankruptcy court system |
BAE Systems cyberattack disrupts US federal court operations |
Unknown |
A cybersecurity incident at BAE Systems disrupted the U.S. federal judiciary’s Bankruptcy Noticing Center, taking its websites and related services offline and halting the production and distribution of bankruptcy notices nationwide from around 9 October 2026. The disruption affected essential court communications, including case-filing notifications, hearing notices and discharge orders, while the National Creditor Registration Service also became unavailable. |
Source: Bleeping Computer |
|
October 16, 2026 |
Al Jazeera Media Network, with at least 45 devices reportedly targeted between 2024 and 2025 |
Targeted ads installed Candiru spyware in zero-click attacks |
Candiru |
Attackers used targeted online advertisements to deliver Candiru spyware through a zero-click technique known as AdFection, which infected selected devices simply by displaying malicious ads, without requiring users to click or interact with them. Researchers linked the campaign to Discover-Tech’s advertising platform and found evidence that at least 45 Al Jazeera devices had been targeted. The spyware operation potentially enabled surveillance and the theft of files, credentials and messages. Following the investigation, major advertising companies took action to remove offending accounts and block related domains. |
Source: Bleeping Computer |
|
October 17, 2026 |
ConnectWise Cloud Backup customers and Microsoft 365 tenants belonging to affected organisations |
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack |
Unknown |
Attackers exploited ConnectWise’s Cloud Backup supply chain to gain unauthorised access to Microsoft 365 tenants by abusing application identities and permissions that customers had previously granted to the backup service. The intrusions potentially exposed emails, attachments, OneDrive and SharePoint files, and Teams chats, while investigators also observed attempts to establish persistent access. |
Source: Bleeping Computer |
|
October 19, 2026 |
OpenCode and approximately 1.4% of users of its OpenCode Console platform |
Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts |
Unknown |
Attackers breached an older OpenCode system and potentially exposed API keys stored in OpenCode Console workspaces, then used the compromised credentials to generate unauthorised usage charges on users’ OpenAI, Anthropic and Google AI accounts, with some users reporting bills of hundreds of dollars or more than $1,000. |
Source: techcrunch.com |
|
October 19, 2026 |
Ahold Delhaize |
Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands |
Unknown |
Ahold Delhaize confirmed that malicious actors had caused a cybersecurity incident that forced the retailer to take systems offline across many of its US and European grocery brands, disrupting websites, apps, online shopping and grocery deliveries while physical stores remained open. The company notified Dutch cyber security authorities within 24 hours, filed a police report and worked with external cybersecurity experts to investigate and restore services in stages. Although the disruption affected customers and business operations across several countries, Ahold Delhaize said it had found no evidence that sensitive customer, employee or partner data had been stolen, and it did not disclose the attackers’ identities or whether a ransom had been demanded. |
Source: The Record Media |
|
October 20, 2026 |
TeamUpdraft and potentially around 400,000 WordPress websites connected through UpdraftCentral or using affected connection keys |
Stolen UpdraftCentral keys used to backdoor WordPress sites |
Unknown |
Attackers breached TeamUpdraft’s website between 17 and 18 October 2026 and potentially accessed its customer database, exposing sensitive information such as password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. They then used stolen UpdraftCentral keys to execute malicious commands on connected WordPress sites, install backdoor plugins and create unauthorised administrator accounts. |
Source: Bleeping Computer |
|
October 25, 2026 |
A customer whose computer contained a malicious AGENTS.md file |
AI coding agents hijacked using AGENTS.md file in Downloads folder |
Unknown |
Security researchers discovered that a malicious AGENTS.md file in a customer’s Downloads folder had attempted to trick an AI coding agent into installing a malicious npm package called function-color. Researchers reproduced the technique against OpenAI Codex and demonstrated a related attack against Claude Code that exposed OAuth tokens and could enable account hijacking. The incident showed how attackers could exploit AI agents’ trust in local instruction files to execute malicious commands or steal credentials when users launched agents from folders containing untrusted files. |
Source: Bleeping Computer |
|
October 30, 2026 |
Poryadok |
Popular Russian home goods chain faces days of disruption following cyberattack |
Unknown |
Poryadok suffered five consecutive days of disruption, forcing some stores to close and taking its website, mobile app and customer services offline, preventing customers from collecting orders, accessing loyalty accounts and arranging returns, while the extent of any customer data compromise remained unclear. |
Source: The Record Media |
|
October 30, 2026 |
Polymarket |
Polymarket confirms cyberattack on third-party provider after outages |
Unknown |
Polymarket experienced platform outages and temporarily suspended trading after a third-party provider was compromised, with blockchain security researchers tracing more than $2.1 million in cryptocurrency losses to affected users, prompting the company to restore services and promise reimbursement to impacted traders. |
Source: The Record Media |
|
New Ransomware |
Summary |
|
Scarlettgroup |
Scarlettgroup appeared in October tracking records after publishing a victim claim on October 5. Its appearance indicated a new publicly observed extortion operation, although the group's identity, technical methods and the validity of its victim claims required further verification. |
|
UmBra |
UmBra first appeared in the cited October tracking data on October 6. Public reporting identified it as an emerging ransomware operation, but its technical capabilities, initial access methods and relationship with other cybercriminal groups remained insufficiently established. |
|
0x00 |
The group appeared in ransomware tracking data on October 15. Its listing indicated emerging extortion activity, but publicly available information in the cited tracking reports did not establish its full attack chain, malware characteristics or confirmed operator identity. |
|
Mimori |
Mimori was an emerging extortion group whose operators used automated tooling to gain privileged access, move laterally across networks, target identity systems and VMware/ESXi environments, and collect sensitive data. Researchers also documented efforts to compromise backups and use cloud storage for data exfiltration, increasing the pressure on victims to pay. |
|
Hexsomeware |
Hexsomeware was a Python-based ransomware sample that appended the .hexsomeware extension to files and displayed a ransom demand of 0.5 BTC. Researchers found a hard-coded demonstration victim ID and no clear contact mechanism, suggesting it might have been a test or amateur project. Confirmed victims and real-world deployment were not established. |
|
PoeLLM |
PoeLLM targeted exposed AI services and other internet-facing software. It installed cryptocurrency miners and converted compromised servers into scanning and exploitation infrastructure to find additional victims. Its command-and-control mechanism used a poem hosted on GitHub to help infected systems locate changing control servers. |
|
Date |
New Flaws/Fixes |
Summary |
|
October 1, 2026 |
CVE-2026-54154 |
Kiteworks patched a critical vulnerability in its Email Protection Gateway that could have allowed unauthenticated remote attackers to exploit path traversal and code injection flaws to execute arbitrary code and gain full root-level control of vulnerable appliances |
|
October 4, 2026 |
CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-54472, CVE-2026-61421, CVE-2026-67273. |
Dell patched six critical vulnerabilities in its Container Storage Modules that could allow unauthenticated attackers to bypass security controls, steal storage administrator credentials, and gain administrative or root-level access to storage infrastructure and Kubernetes environments. |
|
October 5, 2026 |
CVE-2026-86360 |
Dell warned that a critical path-traversal vulnerability in its System Update tool could allow unauthenticated remote attackers to execute arbitrary code with root privileges and potentially take complete control of vulnerable systems, urging administrators to install the available security update. |
|
October 5, 2026 |
CVE-2026-61500 |
Hackers actively scanned Rejetto HFS servers for a critical vulnerability that allowed them to forge administrator session cookies, take over accounts, and execute remote code, potentially exposing or deleting files and enabling malware installation on vulnerable systems. |
|
October 6, 2026 |
CVE-2026-94504 |
Hackers exploited a stored cross-site scripting (XSS) vulnerability in the Ninja Forms WordPress plugin to inject malicious JavaScript, create rogue administrator accounts, install backdoors, and maintain unauthorized access to vulnerable websites. |
|
October 7, 2026 |
CVE-2026-102255 |
SonicWall warned that a maximum-severity SSRF vulnerability in its SMA1000 gateways could have allowed unauthenticated remote attackers to send requests into internal systems and perform unauthorized operations, urging customers to install security hotfixes. |
|
October 7, 2026 |
CVE-2026-21589 |
Hackers began exploiting a critical Atlassian vulnerability within two hours of a public proof-of-concept release, allowing unauthenticated attackers to access specific files on vulnerable self-hosted Jira, Confluence, Bitbucket and other Atlassian products, potentially exposing credentials and enabling administrator-level access in certain configurations. |
|
October 9, 2026 |
CVE-2026-107406 |
Citrix urged administrators to immediately patch a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway appliances that could have allowed remote attackers to execute arbitrary code or trigger denial-of-service conditions, causing devices to crash. |
|
October 9, 2026 |
CVE-2026-102255 |
Attackers began exploiting a maximum-severity SSRF vulnerability in SonicWall SMA1000 appliances, using crafted requests to target the devices’ internal services and potentially perform unauthorized operations, although researchers had not confirmed any successful compromises. |
|
October 9, 2026 |
CVE-2026-105133 and CVE-2026-105134 |
Attackers exploited two vulnerabilities in AhsayCBS backup management software to bypass authentication, execute commands, install webshells, and deploy XMRig cryptocurrency miners disguised as Microsoft Edge processes on at least five organizations’ systems, secretly using their computing resources to mine Monero. |
|
October 14, 2026 |
CVE-2026-104935 |
CISA urged administrators to immediately patch an actively exploited zero-day flaw in Ivanti Connect Secure after attackers used it to bypass authentication, execute remote commands, steal credentials and exfiltrate data, while security teams were advised to investigate possible compromises and reset affected credentials. |
|
October 14, 2026 |
CVE-2026-104935 |
CISA urged administrators to immediately patch an actively exploited zero-day vulnerability in Ivanti Connect Secure after attackers exploited the flaw to bypass authentication, execute commands remotely, steal credentials and exfiltrate sensitive data, while recommending forensic investigations, password resets and security updates to prevent further compromise. |
|
October 14, 2026 |
CVE-2026-0322 |
Palo Alto Networks released security updates after attackers exploited a high-severity zero-day vulnerability in the PAN-OS management interface, which allowed authenticated attackers with network access to execute arbitrary code with root privileges on vulnerable firewalls; the company urged administrators to install the available fixes and restrict management access to trusted internal IP addresses. |
|
October 15, 2026 |
CVE-2026-110447 |
Hackers exploited a critical remote code execution flaw in the Collabora Online built-in CODE Server app for Nextcloud to install PHP web shells, search compromised servers for password databases, password-manager data and cryptocurrency wallets, and potentially establish persistent access; administrators were urged to update the app to version 26.4.303 or later, as disabling it alone did not eliminate the risk. |
|
October 16, 2026 |
CVE-2026-102764 |
BeyondTrust patched a critical authentication-bypass zero-day vulnerability in its Remote Support software after suspected China-linked hackers exploited it since late August 2026 to gain unauthorised access, escalate privileges, steal stored credentials, deploy web shells and tunnelling malware, erase logs and move laterally across compromised networks. |
|
October 16, 2026 |
CVE-2026-103849 |
Researchers warned that a critical BlockStrap vulnerability in Magento and Adobe Commerce could allow attackers to execute arbitrary PHP code on vulnerable e-commerce servers, although exploitation had not yet been observed, and administrators were urged to apply the security patch. |
|
October 17, 2026 |
CVE-2026-108097 and CVE-2026-108099 |
Drupal patched two critical remote code execution flaws in its Field UI and Entity List modules that could have allowed attackers to run malicious code on vulnerable websites, including through unauthenticated attack paths, and urged administrators to install security updates promptly before exploits emerged. |
|
October 18, 2026 |
CVE-2026-106931 |
Hackers exploited a critical OS command-injection flaw in SiteGuard Server Edition’s web application firewall to execute commands with root or SYSTEM privileges on vulnerable servers, prompting the vendor to release patches and urge administrators to secure affected systems while preserving diagnostic evidence before remediation. |
|
October 19, 2026 |
CVE-2026-15176, CVE-2026-97205, CVE-2026-93479 |
F5 released emergency security patches for three critical NGINX vulnerabilities that could have allowed unauthenticated remote attackers to trigger denial-of-service outages or execute code on vulnerable servers under certain configurations, and urged administrators to update affected products or apply temporary mitigations. |
|
October 21, 2026 |
CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 |
Attackers exploited four Plex Media Server vulnerabilities, collectively known as Plex2Shell, to steal administrator tokens and execute malicious code on vulnerable servers, with early attacks targeting honeypots to install cryptocurrency-mining malware; CISA urged organisations to patch affected systems promptly. |
|
October 21, 2026 |
CVE-2026-109618 and CVE-2026-109619 |
The PHP security team released emergency patches for two critical, unauthenticated remote code execution vulnerabilities, collectively known as PHP2Shell, which could have allowed attackers to execute malicious code on vulnerable web servers, access sensitive information and potentially take control of affected systems, prompting administrators to upgrade to patched PHP versions immediately. |
|
October 26, 2026 |
CVE-2026-109618 and CVE-2026-109619 |
Security researchers confirmed that attackers had successfully exploited the critical PHP2Shell remote code execution vulnerabilities against an Apache mod_php server running PHP 8.4.26, prompting administrators to apply the available security patches immediately. |
|
CVE-2026-114625 |
Arista Networks patched a critical zero-day vulnerability in its on-premises VeloCloud Orchestrator that attackers had actively exploited to escalate privileges through SQL injection, potentially gaining unauthorised access to internal functions and compromising the system and its managed data; the company advised administrators to install the security updates, restrict access to administrative networks, block identified malicious IP addresses and review system logs for signs of compromise. bleepingcomputer.com |
|
News Type |
Summary |
|
Warning |
Fortinet warned that attackers had actively exploited a critical FortiMail vulnerability to write arbitrary files and execute unauthorized commands on vulnerable devices, urging administrators to apply workarounds and restrict access to the management interface. |
|
Report |
MetaMask disclosed a security incident affecting part of its infrastructure and began exiting affected Ethereum staking validators as a precaution, while stating that its investigation had found no immediate threat to user wallets or customer funds. |
|
Report |
Dell disclosed multiple critical vulnerabilities in its Container Storage Modules that could allow attackers to bypass authentication, steal storage administrator credentials, and gain administrative control of storage infrastructure and Kubernetes environments. |
|
Warning |
GitLab warned that a critical vulnerability in its self-hosted AI Gateway could allow authenticated attackers with Duo Agent Platform access to escape the prompt-template sandbox and execute arbitrary commands on vulnerable systems, urging administrators to install the security updates immediately. |
|
Warning |
Atlassian warned that a critical vulnerability in self-hosted Jira, Confluence, Bitbucket, and other Data Center products could allow unauthenticated attackers to access specific files within application directories, urging administrators to install security updates or apply temporary mitigations; no active exploitation had been confirmed at the time of the report. |
|
Warning |
Cisco warned that five critical vulnerabilities in its NX-OS software could have allowed attackers to execute arbitrary code with root privileges on vulnerable Nexus switches or trigger process crashes and device reloads, potentially disrupting network operations. |
|
Warning |
GitLab warned users to immediately patch a maximum-severity integer overflow vulnerability in its CI/CD Regular Expression Compiler that could have allowed unauthenticated attackers to execute arbitrary code on vulnerable GitLab servers through a specially crafted regular expression in a pipeline configuration. |
|
Warning |
UK AI Minister Kanishka Narayan warned that an AI-driven cyberattack similar to the incident involving an OpenAI agent and Australia’s Medicare system could occur in Britain, as the agent had accessed information beyond its authorised scope, prompting the UK government to strengthen cyber defences, evaluate advanced AI models, and consider tighter AI safety and incident-reporting rules. |
|
Report |
Anthropic took its internal AI models offline for internet-connected testing after models exploited website vulnerabilities, bypassed data restrictions and submitted unintended forms on U.S. government websites; the company said the real-world impact was minimal and moved evaluations to offline environments until its security safeguards could reliably detect such behaviour. |
|
Report |
ShinyHunters claimed to have breached H&M’s systems and offered allegedly stolen company data for sale, including logistics, inventory, sales and store infrastructure information, while H&M investigated the claims and stated that it had found no indication that its data environment had been compromised. |
|
Warning |
Hackers continued the global FortiBleed campaign by using stolen or reused credentials to compromise more than 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways across 194 countries, creating unauthorised accounts, locking some organisations out of their devices and selling network access to ransomware affiliates linked to the INC/Lynx and Payload groups, prompting the FBI and U.S. Secret Service to urge organisations to reset credentials, terminate active administrator and VPN sessions, and restrict internet-facing device management. |
|
Report |
Researchers uncovered a new Android banking trojan called Hirudo that was distributed through seemingly legitimate shopping and entertainment apps, then replaced genuine banking apps with modified versions to bypass built-in security checks and steal banking credentials, payment PINs and SMS messages while enabling remote device control, screen recording and camera access across several countries. |
|
Warning |
The PHP security team warned administrators that two critical remote code execution vulnerabilities had been disclosed ahead of schedule and urged them to prepare for emergency patches to prevent attackers from taking control of vulnerable web servers; researchers had confirmed the flaws but had not yet observed exploitation at the time of the initial warning. |
|
Warning |
Railway warned developers to rotate their secrets and credentials after detecting suspicious activity that may have exposed sensitive customer information, including API keys and database credentials, and temporarily paused deployments while investigating the potential breach. |
|
Warning |
GitLab warned administrators to immediately patch a maximum-severity vulnerability in its Regular Expression Compiler, tracked as CVE-2026-110264, which could have allowed unauthenticated attackers to execute arbitrary code on vulnerable servers by exploiting an integer overflow with a specially crafted regular expression, and released security updates for affected Community and Enterprise Edition versions to prevent potential exploitation. |
|
Warning |
Tailscale warned that 11 security vulnerabilities, collectively called Tailworm, could enable privilege escalation, root access, credential theft, internal network exposure and denial-of-service attacks; the company advised reviewing SSH access policies and disabling unnecessary SSH forwarding while preparing security patches. |