Japanese karaoke operator Daiichi Kosho said on 8 October 2026 that Nippon Columbia Group (NCG), which handles customer personal data on its behalf, found malware on one employee's PC between 1 and 2 October and cut that PC off the network on 2 October; NCG told Daiichi Kosho on 5 October. Personal data from work Daiichi Kosho had outsourced was temporarily stored on that PC, so leakage cannot be ruled out. About 8,724,000 records may be exposed: roughly 8,631,000 customers who registered or booked at its venues (about 5,558,000 Big Echo, 3,462,000 DK Dining, 74,000 Karaoke CLUB DAM, 43,000 Mega Big, 5,000 Banana Club and 4,000 B-GARAGE, less about 515,000 duplicates) and about 93,000 employees. The data is registered name, gender, date of birth, email address and phone number; passwords are not included and the company says points cannot be used with this data alone. Daiichi Kosho says it has not confirmed any actual leak or misuse, its own systems were not affected, NCG has reset passwords and other credentials, and NCG and outside specialists are still investigating. It opened a free-call enquiry line on 9 October. BleepingComputer (11 October) could not find a public statement from NCG. Lesson: a contractor laptop holding a working copy of a customer database is the breach; keep outsourced data on controlled systems, not endpoints. (source: Daiichi Kosho notice)
Daiichi Kosho — possible personal-data leak at a contractor (8 Oct 2026, Japanese)
breaches
The US Justice Department said on 8 October 2026 that Oleg Korniev, 42, a dual Ukrainian and Russian citizen, pleaded guilty to running the Your Mule Cashout (YMCO) money-laundering organisation, which recruited more than 15,000 US-based money mules to launder at least US$10 million stolen by hackers from over 750 US bank accounts. Mules were recruited through spam from fake companies and an apparently normal hiring process, told they were processing payments for real businesses, and then wired stolen funds through Western Union and MoneyGram to cash-out contractors abroad (BleepingComputer lists Moldova, Ukraine, Russia and Latvia). Korniev admitted YMCO caused more than US$14.7 million in actual and intended losses and that he laundered at least US$7 million; he was arrested in the Republic of Georgia, pleaded guilty to money laundering, computer-fraud and access-device conspiracies and aggravated identity theft, and faces two to 50 years at a later sentencing. Four other YMCO members were earlier extradited and sentenced to about 37 to 63 months. BleepingComputer, citing the case, reports that YMCO ran similar mule schemes in Germany, Italy, the UK and Australia since it began in 2007. For employers and job seekers, 'payment processing' job offers that move money through personal accounts remain a classic mule recruitment pattern. (source: BleepingComputer)
US Department of Justice — Ukrainian-Russian dual citizen pleads guilty to running international money laundering organisation (8 Oct 2026)
breaches australia
IDC Frontier (IDCF), a SoftBank Group subsidiary that runs the IDCF Cloud IaaS platform, said a third-party ransomware attack caused a disruption in East Japan Region 1 from about 3:40am JST on 7 October 2026. Its third notice (8 Oct) says 495 corporate and municipal customers were affected. Impacted zones named: tesla, henry, pascal and joule. Effects included virtual servers stopping and not restarting. IDCF isolated East Japan Region 1, stopped the management console across regions while it checked safety, and is working with an external security firm to find and block the intrusion path. For the four named zones it says customer data is difficult to retrieve or restore and that recovery currently depends on customers' own backups; it is guiding those customers to rebuild in a separate environment. Other East Japan 1 zones and other regions had no confirmed unauthorised access at the time of the notice, but customers were told to take their own backups. IDCF has reported to regulators and the Tokyo Metropolitan Police. Press coverage (BleepingComputer, NHK, Mainichi) notes knock-on outages including Nissui logistics shipping and Ibaraki prefectural and police websites; IDCF has not itself confirmed every downstream victim in the notice. Threat-actor social posts claiming encrypted databases and hypervisors are unverified by IDCF. (sources: IDC Frontier notice 20261008001; BleepingComputer)
IDC Frontier — Notice 3: unauthorised access / disruption on part of IDCF Cloud (8 Oct 2026, Japanese)
breaches cloud
BleepingComputer reported on 8 October 2026 that Jonathan Spalletta, 36, of Maryland (online 'Jspalletta' and 'Cthulhon'), has been found guilty of computer fraud and money laundering over the April 2021 hacks of Uranium Finance, an automated market maker on BNB Chain. In the first attack on 8 April 2021 he drained about US$1.4 million by abusing a smart-contract flaw with zero-token withdrawals, then pressured Uranium into a sham 'bug bounty' of nearly US$386,000. About three weeks later he exploited a second coding error, where transaction checks used 1,000 instead of 10,000, to withdraw nearly 90% of the liquidity pools, about US$53.3 million in total, and Uranium closed. Prosecutors say he laundered the funds through Tornado Cash and decentralised exchanges and bought rare collectibles, including Magic: The Gathering packs and a Black Lotus card, a first-edition Pokémon base set and a Roman coin. Agents seized the collectibles in February 2025 and recovered about US$31 million in crypto. He surrendered on 30 March and faces up to 10 years for computer fraud and 20 years for money laundering. Source: BleepingComputer, quoting the US Attorney's office.
BleepingComputer — Uranium crypto exchange hacker convicted for stealing $53 million (8 Oct 2026)
breaches
Incidents
Thu 8 Oct
Updated Fri 23 Oct
A territory-wide technical network outage knocked out telecommunications and digital systems across key Northern Territory government departments and agencies on 8 October 2026, including Police, Health and Education. It began at about 3am NT time (4.30am Sydney) and was resolved about 12 hours later through what the government called undisclosed workarounds by the Department of Corporate and Digital Development (DCDD). NT Police, Fire and Emergency Services issued a public advisory that non-emergency communications, including police assistance lines and phone lines to local police stations, were affected, while triple zero (000) stayed up and all Territory hospitals kept providing patient care. Other agencies reported problems with phone lines, email and network-connected servers. DCDD says it is still investigating the root cause and how to prevent a repeat; the government has not said what caused the outage, and nothing published so far points to a cyber attack. (sources: NT Police, Fire and Emergency Services; iTnews) UPDATE (23 Oct 2026): iTnews (8 Oct), citing ABC News (8 Oct), reported that the problem was linked to a gateway in the core network, and that three calls were missed during the outage, although checks found they were routine police follow-ups rather than emergencies, which qualifies the government's line that triple zero kept working throughout. DCDD's root-cause review is still open.
NT Police, Fire and Emergency Services — Public advisory: technical network outage affecting non-emergency communications (8 Oct 2026)
australia network
Incidents
Thu 8 Oct
Updated Tue 27 Oct
Oregon's Department of Justice breach database lists two Cerner Corporation entries for the breach of Oracle Health's legacy Cerner systems, for 1,970,332 Oregonians (reported 25 July 2025) and 8,329 (reported 6 July 2026), both giving 22 January to 1 April 2025 as the breach dates and 20 February 2025 as the discovery date. HIPAA Journal reported on 8 October 2026 that the Texas attorney general was given an updated total on 2 October and that state filings confirm 2,992,244 affected people in Texas, 283,903 in South Carolina and 69,238 in Washington. HIPAA Journal says Oracle Health has not publicly disclosed the total number of people affected or how many Cerner clients were affected. A sample patient letter dated 25 July 2025, filed by Cerner Corporation with the California attorney general, says an unauthorised third party gained access to personal health information on legacy Cerner systems at least as early as 22 January 2025, that the provider sending it learned of the breach on 7 March 2025, and that federal law enforcement asked for patient notification to be delayed. The letter says the information may have included names, Social Security numbers and medical record information such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment, and offers 24 months of Experian IdentityWorks. HIPAA Journal says the incident involved two legacy Cerner servers that had not yet been migrated to Oracle Cloud, and that Oracle Health said its own systems were not affected. HIPAA Journal and Fierce Healthcare, each citing another outlet's report of information released by the Texas attorney general, put the total at almost 20 million; HIPAA Journal says this has not been independently verified. Updated 9 Oct 2026 (Fierce Healthcare): Fierce Healthcare says Cerner's entry on the Texas attorney general's breach portal, dated 2 October 2026, lists addresses, Social Security numbers and medical information, and that affected Texans were notified by US mail. (source: Fierce Healthcare) Correction (23 Oct 2026): removed an extortionist's ransom demand. Correction (23 Oct 2026): re-sourced to HIPAA Journal, Fierce Healthcare, the Oregon Department of Justice breach database and the California attorney general's sample letter; removed details we could not verify from a source we can recheck; removed the third-hand nationwide total from the headline and kept it only as one attributed line; Oregon figures are now given as filed. (source: HIPAA Journal) Correction (26 Oct 2026): the Australia field said no Australian impact had been reported; no cited source mentions Australia either way, so it now reads unknown. (source: HIPAA Journal) Correction (26 Oct 2026): the card date has moved from 5 to 8 October 2026, the Perth date of HIPAA Journal's report, the earliest linked source for this story; Fierce Healthcare's later report now carries an Updated line. The 2025 breach notices are background and do not set the date. (source: HIPAA Journal; Fierce Healthcare) Correction (27 Oct 2026): removed a line about which outlet first reported the breach, which no source Cyberstack can read states first-hand; the nearly 20 million figure is now credited to HIPAA Journal and Fierce Healthcare, both of which attribute it to another outlet's report; Fierce Healthcare's update is now dated 9 Oct 2026, the date its page shows (no time zone is shown, so no time is given), instead of a converted Perth time, and HIPAA Journal's report carries only the date its page shows (Oct 8, 2026). (source: Fierce Healthcare; HIPAA Journal)
HIPAA Journal — Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner (8 Oct 2026)
breaches cloud identity
BleepingComputer reported on 8 October 2026 that Raheim Hamilton, 30, who co-created and ran the Empire Market dark web marketplace from August 2017 until it went offline in 2020 amid extortion DDoS attacks and exit-scam claims, has been sentenced to 40 years in federal prison, citing the US Attorney's Office for the Northern District of Illinois. Empire facilitated more than 4 million transactions worth about US$430 million; drugs made up nearly US$375 million, but the site also sold counterfeit currency, stolen account credentials, hacking tools and personal information. At its peak in August 2020 it had about 1.68 million registered users, over 5,000 vendors and nearly 360,000 buyers. Hamilton pleaded guilty in January and agreed to forfeit three Virginia properties, about 1,230 bitcoin and 24.4 ether; co-defendant Thomas Pavey ('Dopenugget') pleaded guilty last year and is due to be sentenced later this month. Authorities seized about US$75 million in cryptocurrency when the pair were charged in July 2024. (sources: US Department of Justice; BleepingComputer)
US Attorney's Office, Northern District of Illinois — Co-creator of dark web marketplace sentenced to 40 years in federal prison
breaches identity
Incidents
Thu 8 Oct
Updated Mon 2 Nov
Socket and StepSecurity reported on 8 October 2026 that version 0.5.144 of tensorlake, the TypeScript SDK for Tensorlake's sandboxes for running LLM-generated code, was malicious. StepSecurity says someone pushed eight commits straight to the main branch of tensorlakeai/tensorlake under a maintainer's name from 01:20 UTC on 7 October, and the project's own release workflow published 0.5.144 to npm at 01:12 UTC on 8 October, so the package carries a genuine npm provenance attestation. Socket flagged it about 11 minutes after release and it has since been pulled from npm. A preinstall hook runs lib/setup.mjs, which skips CI, downloads the Bun runtime and runs an obfuscated payload (lib/Math_Symbol.js) that collects GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and config files for AI coding tools. Data goes to a public GitHub repository created in the victim's account (description 'Shai-Hulud: Here We Go Again') or to a server found through an Ethereum contract. With a stolen npm token the worm republishes the victim's packages with itself added; with a GitHub token it commits .claude/settings.json and .vscode/tasks.json files so it runs again when a project is opened in Claude Code or VS Code. It also installs a gh-token-monitor service that checks the stolen token every 60 seconds for up to 24 hours and deletes the user's home directory (or Windows profile) if the token stops working. The loader and payload names match the August ChainDrop compromises of keyv and cacheable. (sources: Socket; StepSecurity) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Socket; StepSecurity)
Socket — Tensorlake npm SDK compromised in ChainDrop Shai-Hulud credential-stealing attack (8 Oct 2026)
tech ai identity cloud
St Andrew's Hospital, a private hospital in Adelaide, said on Thursday 8 October 2026 that it had been investigating a breach of personal information affecting "a group of individuals". Chief executive Angela McCabe said the investigation had progressed far enough for the hospital to contact affected people directly, in line with its regulatory obligations, and that they had been given information on how to protect their personal information. The hospital says it has notified the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre, and is working with government agencies to apply extra measures to detect and prevent suspicious and fraudulent activity. The number of people affected, what kind of information was involved and how the breach happened have not been disclosed. South Australian Premier Peter Malinauskas said the state government expected to be briefed later on 8 October, including on whether anything criminal had occurred. (source: ABC News)
ABC News — 'Group of individuals' impacted by data breach at SA hospital (8 Oct 2026)
australia identity
The US State Department's Rewards for Justice (RFJ) programme is offering up to US$10 million for information on Zhang Yu, a Chinese national it describes as a director at Shanghai Firetech Information Science and Technology Company working at the direction of China's Ministry of State Security Shanghai State Security Bureau. RFJ says that from early 2020 Zhang and his partner Xu Zewei, then general manager at Shanghai Powerock Network, gained unauthorised access to COVID-19 research at US universities and stole information from immunologists and virologists, and that in 2021 the pair exploited Microsoft Exchange Server flaws as part of the HAFNIUM mass-intrusion campaign, with victims including a US university and a law firm. Xu was arrested in Italy and extradited to the US in April 2026; Zhang remains at large. Cybersecurity News reported the offer on 8 October, citing the FBI Cyber Division; the RFJ page itself carries no date. The charges are allegations, not proof of guilt. (source: Rewards for Justice)
Rewards for Justice — Zhang Yu (SSSB) (undated reward page, reported 8 Oct 2026)
breaches identity
Incidents
Thu 8 Oct
Updated Mon 26 Oct
Japan's National Police Agency (NPA) said in a press release dated 8 October 2026 that Germany had announced the arrest of a Russian national believed to have led the Qilin ransomware group, which has hit companies around the world, and that Germany's announcement mentioned the Japanese police's contribution. According to the NPA, after the suspect, for whom Germany had obtained an arrest warrant over a ransomware attack in Germany, arrived in Japan, the Kanto Regional Police Bureau's cyber special investigation unit and the prefectural police concerned worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office and Germany to detain him on a provisional detention warrant under Japan's extradition law and then hand him over to Germany. The NPA says the same police units had also investigated ransomware cases in Japan in cooperation with Germany. The suspect has not been named. Updated 9 Oct 2026 (BleepingComputer, 11:38 pm Perth): BleepingComputer reported that Germany has arrested the suspect, a Russian national believed to be a leading member of Qilin, after his extradition from Japan earlier in October; that the NPA said he was detained after arriving in Japan as a tourist; and that Japanese media had reported the arrest earlier that week, citing internal sources. BleepingComputer says Qilin is a ransomware-as-a-service operation that emerged in August 2022 under the name Agenda and has targeted more than 2,350 known organisations in 62 countries, including Nissan, Asahi, Lee Enterprises and Australia's Court Services Victoria; that it more recently hit the US ATF and has been linked to the exploitation of Check Point VPN zero-days and Palo Alto VPN n-day flaws. Correction (26 Oct 2026): this card was first based on a SecurityWeek report (7 October) that this Cyberstack does not link. Details that only that report gave have been removed: the suspect's age, his detention in Osaka in May 2026, the 2 October handover date, the September 2024 attack on a logistics company, the ransom of more than US$160,000, the Synnovis attack, a 2025 leak-site count and CVE-2026-50751. The card now rests on the NPA press release and BleepingComputer, and its date has moved from 7 to 8 October 2026, the date of the NPA release. (source: National Police Agency of Japan; BleepingComputer) Correction (26 Oct 2026): removed a count of victims listed on Qilin's leak site since June; this Cyberstack does not publish leak-site claims. (source: BleepingComputer)
National Police Agency of Japan — press release on Germany's arrest of a Russian ransomware suspect (8 Oct 2026, Japanese)
breaches
Incidents
Wed 7 Oct
Updated Wed 28 Oct
Blockchain analytics firm Crystal Intelligence said on 6 October 2026 that it had analysed a leaked export of 5,692 chat messages from August 2025 to September 2026, mostly in Russian, which it says points to Silent Ransom Group (SRG), also tracked as Luna Moth, Chatty Spider, UNC3753 and Storm-0252, a group that emerged in 2022 after Conti shut down. Crystal says the group's internal deal board claims about US$207M paid by 27 firms between 3 April and 24 September 2026, and that 'On-chain evidence supports the scale but not the exact figures.' Crystal traced a collection wallet that received 344 BTC (about US$27M) in six weeks during April and May 2026 and about 2,675 BTC (around US$200M) over its lifetime, but says no single wallet can be tied to a specific victim payment. GuidePoint's research team (GRIT) said on 15 October that the internal ledger claims US$206.95 million from 27 organisations, with a median entry of US$6.0 million and a largest single entry of US$30 million, and that 'These are the actors' own internal records' and no victim has confirmed a payment. GRIT assesses with moderate-to-high confidence that the people in the chats operate under or alongside the SRG name, and says the targets are large law firms. The Record (8 October) reports that Chainalysis tied addresses in the leak to known SRG extortions but could not 'speak to the totality of claims', and The Register (9 October, Perth) says Crystal could not verify the US$207 million total. The group does not encrypt files: per Crystal, it sends fake invoices or calls staff posing as 'IT support', talks them into granting remote access, steals data and threatens to publish it. Correction (28 Oct 2026): the figures are now credited to Crystal Intelligence's and GuidePoint's own write-ups instead of Cyber Security News; removed the US$100,000 low figure, the nine-firm disclosure count and SRG's 8 October response, which only DataBreaches.net (HTTP 403 to Cyberstack) or Cyber Security News gave. (sources: Crystal Intelligence; GuidePoint GRIT; The Record; The Register)
Crystal Intelligence — Inside the Silent Ransom Group leak: how ransoms were laundered (6 Oct 2026)
breaches identity
