Incidents
Wed 7 Oct
Updated Sat 31 Oct
Have I Been Pwned (HIBP) added CyrusOne on 7 October 2026. HIBP says the data centre operator was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group then published data allegedly obtained from the company, including about 373,500 unique email addresses across records relating to users, sales leads and CyrusOne employees. HIBP says the data was largely corporate contact information (names, physical addresses, phone numbers, employers and job titles) and also included support tickets and other information about the company's operations. No public statement from CyrusOne was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned). Correction (31 Oct 2026): removed a sentence and link from Cybernews that only repeated the extortion group's own claims and demand; the card rests on Have I Been Pwned. (source: Have I Been Pwned)
Have I Been Pwned — CyrusOne breach (added 7 Oct 2026; breach August 2026)
breaches cloud
Incidents
Wed 7 Oct
Updated Tue 27 Oct
The US Justice Department said on 7 October 2026 that Zohar Pinhasi, 50, owner of Florida ransomware remediation company MonsterCloud LLC, was arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy (docket 26-CR-271; indictment filed 23 September). Prosecutors allege that from June 2018 to June 2023 MonsterCloud told ransomware victims not to pay and claimed to have proprietary tools and advanced decryption techniques, but in practice contacted the attackers, paid them for decryption keys and charged clients far more than the ransom. In one example cited by the Justice Department, about US$8,200 went to a ransomware operator and the client was billed about US$150,000. Over the scheme he allegedly charged clients more than US$19 million and paid more than US$8 million in ransoms, with BleepingComputer reporting hundreds of affected companies in the US and Canada. Pinhasi pleaded not guilty and was released on a US$2 million bond, according to the US Attorney's Office. Each count carries a maximum of 20 years. For Australian organisations the case is a reminder that a paid recovery or negotiation firm may still be paying the attacker on your behalf, which can bring the ransomware payment reporting obligation under the Cyber Security Act 2024 into play. (sources: US Department of Justice; BleepingComputer) Related page (not a source): CyberStack knowledge page ransomware-payment-reporting.
US Department of Justice — Known cybersecurity expert and owner of Florida ransomware remediation company charged with defrauding clients (7 Oct 2026)
breaches
Oasis Security has analysed files recovered from an attacker-controlled, US-based server used against two of South Korea's largest churches, which it does not name. Researchers collected the files between 28 August and 1 September 2026; Cyber Security News reported the findings on 7 October. At the first church, a web shell on the enterprise resource planning (ERP) system let the attackers decrypt database settings, gain administrator access to Microsoft SQL Server and use xp_cmdshell to run commands and move to linked systems, opening member, accounting, access-control, library, chat and mail databases; they also got past a database-monitoring control, recovered a MariaDB root password and used hardcoded NAS credentials to reach backup storage. That haul held about 960,000 congregant records updated in the past two years, including names and resident registration numbers, about 330,000 donation records, 68,000 document records, more than 14,000 chats and 6,874 login accounts; 47.3 GB in 13,939 files was found staged in a compromised MinIO bucket. The second church was entered earlier with leaked credentials and insecure direct object reference (IDOR) flaws in its groupware and membership (SIMS) systems: from a normal member session the attackers could see other users' plaintext PINs and reset a manager-level account, then reached SAP and took about 89,000 congregant records, 383 employee records and approval documents. Oasis says third-party transfers mean the recovered volume is a lower bound and unique-person totals are unverified. (sources: Oasis Security; Cyber Security News)
Oasis Security — Analysis of cyber intrusions targeting major religious organisations in South Korea
breaches identity cloud
Incidents
Wed 7 Oct
Updated Sat 31 Oct
Advantest Corporation, a Japanese maker of automated test equipment for the semiconductor industry, has begun notifying people that their personal information was taken in the ransomware attack it disclosed in February 2026. An attacker broke into its network on 15 February and deployed ransomware; at the time the company could not say whether customer or employee data was affected. In a notification letter dated 6 October 2026, Advantest says an unauthorised third party accessed its systems and extracted data from its servers, including the recipient's personally identifiable information. The letter does not say how many people are affected or whether they are customers, employees or partners, and BleepingComputer had no answer to those questions at publication. Advantest says it has no information that the data has been leaked or misused, and is offering 18 months of identity, credit and web monitoring through Kroll, with enrolment open until 4 January 2027. BleepingComputer found no public claim by a ransomware group. Source: BleepingComputer (7 Oct), which quotes the notification; Advantest's own notice is not yet linked publicly. Correction (31 Oct 2026): the card date has moved from 6 to 7 October 2026, the date of BleepingComputer's report; the 6 October date came from a letter the card does not link. (source: BleepingComputer)
BleepingComputer — Advantest confirms personal information stolen in ransomware attack (7 Oct 2026)
breaches
The Office of the Victorian Information Commissioner (OVIC) has published its investigation into the student data breach the Department of Education reported on 7 January 2026, and found the department contravened Information Privacy Principles 4.1 (security) and 4.2 (destroying data no longer needed). The Australian Signals Directorate issued a critical alert at 10am on 27 October 2025; the department passed it to school technicians the same afternoon, but not every school patched, and the department had no way of checking that they did. Attackers got in through one school's internet-facing server on or before 6 November 2025. A vendor detected the activity on 2 December, forensic work confirmed data had left on 23 December, and media reporting began on 14 January. The stolen database held every government school student's first name and surname, school, year level, school email address and encrypted password, and the same details for hundreds of thousands of former students, which the department kept so email addresses would not be reissued. OVIC called that retention disproportionate. It also found the department's vulnerability scanning did not cover every school and that critical findings were not always fixed. OVIC saw no evidence of misuse soon after the attack but notes the copy could be used later, a particular worry for families escaping violence or under protection orders. OVIC made seven recommendations due by 31 December 2026, including a plan to align with the Essential Eight. The department has accepted them, promised an archive policy for old student records by December and an internal audit in 2027, and plans centrally provided vulnerability management for schools by the end of 2028. OVIC's report does not name the vulnerability. (sources: OVIC investigation report; iTnews)
OVIC — Investigation into the data breach of student information held by the Department of Education (report, October 2026, PDF)
australia identity
Solar 4RAYS, the threat research team of Russian security company Solar, published an investigation (reported by Cyber Security News on 7 October 2026) into a long intrusion at a medical organisation that it links to the group it calls Partisan Zmiy, based on overlapping infrastructure and techniques. The earliest evidence dates to early 2024 and the investigation began in December 2025, so the attackers had access for about two years; how they first got in is not known. They ran commands remotely, then moved through the network over legitimate remote desktop and Windows file sharing. VMware Tools had been installed long before but was not in use, so its folder became a trusted, unwatched place to drop malicious files named like real virtualisation components, with timestamps changed to match. Shortly before discovery the attackers swapped a genuine VMware library for an unsigned malicious one, keeping the original under another name. Windows services with plausible names started a previously undocumented loader, which ran an updated Vasilek backdoor and GOST tunnels on a schedule, including one tunnel open only from 10pm to 11pm each Saturday, likely as a backup way in. The organisation had two-way trust relationships with many subsidiary medical institutions, and the researchers read the case as espionage rather than disruption. Solar did not name the victim. (sources: Solar 4RAYS blog; Cyber Security News)
Solar 4RAYS — Partisan Zmiy: атаковала медицинскую организацию (blog, Russian)
breaches ai
Incidents
Wed 7 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added the Angel One breach on 7 October 2026, so people can now check whether their email address is in it. HIBP says that in July 2024 the Indian stock brokerage confirmed that data leaked online related to a breach in April 2023, and that the leaked data included 7.9 million user records with 6.8 million unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs, India's tax ID) and portfolio holdings; HIBP also lists dates of birth. In its July 2024 statement, reported by The Hindu BusinessLine, Angel One said no new data breach had occurred, that the issue related to an April 2023 incident that was promptly reported to the relevant authorities, and that "this incident has no impact on client securities, funds, or credentials". It also said the authenticity of the leaked data had not been validated. UPDATE 22 Oct 2026: added Angel One's own statement and attributed the breach details to Have I Been Pwned (source: The Hindu BusinessLine, 10 Jul 2024).
Have I Been Pwned — Angel One breach (added 7 Oct 2026; breach April 2023)
breaches
SOCRadar's Threat Research Unit published research on 6 October 2026 into CyberXero, a Russian-speaking, financially motivated initial access broker that pairs common attack tools with an AI orchestration layer on its own servers. Everything surfaced through one mistake: an open directory served the actor's live working folder, more than 90,000 files including AI session logs, scripts with plaintext tokens and stolen data, and the actor stayed active while researchers watched. On one workstation it configured up to 51 Claude Code agents for discovery, password testing, exploitation and data theft; a second setup connected PentAGI, an open-source AI penetration-testing framework, to a Cobalt Strike team server through an AI provider's API, with model choice and token budgets set per task. Session logs show the operator telling the model the targets were its own systems under authorised testing and, when refused, opening a fresh session with the same cover story; some refusals held, including requests to install a backdoor, disable a firewall, move across a network and plant a webshell. The broad campaign used an internal wp2shell package that abuses the WordPress REST API batch endpoint to inject SQL, create a rogue administrator and drop a WSO-family webshell, and it also hit Magento and used Support Board CVE-2026-4815 within 30 days of disclosure; one automated run scanned 4,708 targets, found 429 reachable WordPress admin panels and placed 32 shells in 61 seconds. A separate hand-picked pipeline mapped seven Ukrainian energy and utility organisations, including the national transmission operator; four Ukrainian organisations had confirmed data theft, a Kharkiv district-heating provider lost 564,073 subscriber records, and data on more than 628,000 Ukrainians was found. More than 40 organisations were affected worldwide, with activity also seen in Poland, China and Pakistan; SOCRadar found no direct proof of an access sale. Infrastructure was first seen in July 2026 across eight nodes in European hosting and Tencent Cloud. (sources: SOCRadar; Cyber Security News)
SOCRadar — CyberXero: an AI-augmented initial access broker targeting Ukrainian critical infrastructure (6 Oct 2026)
ai
Incidents
Tue 6 Oct
Updated Fri 30 Oct
US energy group Southern Company disclosed that an unauthorised third party accessed limited information about the accounts of approximately 400,000 customers through its online customer portal, according to WVTM 13 (6 Oct 2026 Perth time); a Southern Company spokesperson told WVTM 13 that about 100,000 Alabama Power customers were affected. Southern Company's customer notice says the information related to customer accounts across Georgia Power, Alabama Power and Mississippi Power and included name, address, phone, email, or the last four digits of the Social Security number, plus other basic account details, and did not include bank account numbers, payment card numbers or driver's licence numbers. The company says it found the activity through its own ongoing monitoring, took immediate steps to address and resolve the issue, engaged law enforcement and, based on its review to date, has not identified any evidence of ongoing unauthorised access. Customers whose information was involved will be contacted by email and/or letter and offered one year of free credit monitoring through Equifax. (sources: Southern Company; WVTM 13) Correction (30 Oct 2026): removed a per-utility customer figure and statements about the intrusion that only SecurityWeek, which this desk cannot read, gave; the 400,000 total and the Alabama Power figure are now credited to Southern Company via WVTM 13, and the card is dated by WVTM 13's report. (source: WVTM 13)
Southern Company — Information regarding a recent incident involving customer information (customer notice; date not shown on page)
breaches identity ot ics
MVSEP, an online service that separates music and voice tracks, published a security incident notice (last updated 6 October 2026) saying an attacker was in its servers between 4 and 6 October and could read its database and stored files. Automated probing began on 4 October; at about 01:30 UTC on 5 October the attacker abused a flaw in how the website read one of its browser cookies to run commands on the web server, found login details for MVSEP's other servers and signed in to them as an administrator. The 5 October database outage was the attacker restarting the database. MVSEP fixed the flaw on all servers at 03:25 UTC on 6 October, removed the access, moved servers to key-only logins and replaced its encryption key, database and payment-provider keys, and Google, GitHub, Google Drive and Yandex Disk credentials. It is treating everything as exposed: names, email addresses, sign-in method, plan and credit balance; passwords as salted bcrypt hashes; API keys, which were stored as-is and work until replaced; processing history including file names, transcriptions, job IP addresses and webhook URLs; audio uploads still on the servers; payment records (card details are entered on Paddle and YooKassa pages and never reached MVSEP); support tickets; and cloud-storage tokens, now revoked. All saved logins were signed out. MVSEP has not said how many users are affected. (source: MVSEP incident notice)
MVSEP — Security incident: 4–6 October 2026 (last updated 6 Oct 2026)
breaches identity
Incidents
Tue 6 Oct
Updated Tue 3 Nov
Google said on 6 October 2026 that the previous week it became aware of hijacks of three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). The attackers compromised the third-party registries rather than Google or the domain owners, changed the authoritative DNS records for selected domains under those suffixes, and used that control to pass certificate authority domain validation and obtain HTTPS certificates covering several Google domains and domains of other organisations. Google says it has no reason to believe the issuing certificate authorities did anything wrong. Chrome blocked the certificates through CRLSets and Google worked with the issuing CAs to revoke them; Certificate Transparency data pointed to more affected organisations, including leading global brands and widely used services, which Google also blocked and contacted where it could. Google has not named the attackers, said how the registries were breached, whether any certificate was used to impersonate a site, or whether the registries are now secure, and warns its analysis may have missed affected domains and that Chrome's blocking does not protect other browsers. (sources: Google; Ars Technica) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Google; Ars Technica)
Google — Chrome's response to recent ccTLD registry hijacks (6 Oct 2026)
breaches network identity
Browser security company Island published research on 6 October 2026 on a phishing platform dressed up as a range of AI advertising products, from campaign optimisation and spend audits to business-account connections, using the names ChatGPT, Gemini, Claude, Perplexity and Manus. Eight days after Meta launched its Muse AI agent on 8 September, museads.ai appeared (by 16 September) offering a fake "Muse Ads" manager. Every page leads to a Connect button that draws a fake browser window inside the page, with an address bar showing accounts.google.com or an Okta tenant, styled to match Windows, macOS, iOS or Android. Behind it a human operator watches in real time: the platform keeps every password attempt, fingerprints the device, can ask for the password up to three times, then chooses whether to show an SMS or authenticator code request, an Okta push, a Google approval prompt or a QR code, and can reject codes or hold the victim on a waiting screen. It supports Google, Meta, TikTok and Okta sign-in flows. Targets are agency staff, media buyers and administrators whose accounts reach many client ad accounts, which can be drained on fraudulent campaigns or resold. Older source code left in misconfigured public GitHub repositories traced the operation back to March and showed the same kit reused for refund and recruitment lures; Island saw hundreds of victim submissions to its Telegram control channel, and activity was ongoing at publication. (sources: Island; BleepingComputer)
Island — Behind the Connect Button: The Fake AI Ads Campaign (6 Oct 2026)
breaches identity ai
