UK education software provider Bromcom has notified customers of a personal data breach involving legacy single sign-on (SSO) registration functionality in its Communication Server environment, The Register reported on 6 October 2026. In a 24 September post on the EduGeek forum, a Bromcom account said an unauthorised third party had accessed and retrieved email addresses and limited information tied to affected SSO registrations. Bromcom identified the incident on 6 September after reports of SSO access problems. The service held email addresses linked to SSO registrations, the sign-in provider used (such as Microsoft or Google), registration and last sign-in dates where recorded, and internal user and registration reference numbers; Bromcom says it held no passwords or authentication tokens and did not allow access to Microsoft or Google accounts. The superseded component had stayed in production because an internal system still called it, and has now been withdrawn. Bromcom says it found no evidence its school Management Information System (MIS), which holds student, attendance and behaviour data, was compromised, and it is working with forensic specialists and liaising with schools, trusts and the authorities. Bromcom software is used by more than 5,000 schools and 390 multi-academy trusts. (source: The Register)
The Register — Legacy sign-on service comes back to bite school software provider Bromcom (6 Oct 2026)
breaches identity
Incidents
Tue 6 Oct
Updated Thu 29 Oct
On 6 October 2026, from about 5am US Eastern time, users of the ASOS shopping app, mainly in the UK, received a push notification addressed to the British online fashion retailer's data protection officer and IT team: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it", with a link to a Telegram channel run by a group calling itself Xuanye, which has no known track record. Later the same day ASOS confirmed a data breach: it says third-party platforms it uses to communicate with customers were accessed without authorisation and that basic personal information, including names and contact details, may have been exposed. ASOS says it does not believe payment card details or account passwords were affected, and it is showing an in-app notice telling customers to ignore the alert and not to open its link. ASOS has not confirmed the claim that its Snowflake environment was compromised and has not said how many customers are affected. Researchers quoted by the BBC said sending the notification needed access to ASOS's own messaging systems. Sources: BleepingComputer (ASOS confirmation), BBC News. UPDATE (8 Oct 2026): ASOS now says the breach began with social engineering. In a security notification shared with BleepingComputer it says an unauthorised party got into an ASOS employee account by impersonating a trusted contact to obtain login credentials, then used those credentials to reach information on certain third-party platforms ASOS uses. ASOS locked down the affected platforms, is investigating with external experts, law enforcement and regulators, and repeats that payment card details and account passwords were not accessed and customers need take no action beyond watching for unexpected messages or calls claiming to be from ASOS. It still has not addressed the Snowflake claim or given a customer count. Source: ASOS customer update (linked) and BleepingComputer (8 Oct). UPDATE (8 Oct, BBC News): BBC News reported that ASOS later told customers hackers hold detailed customer profiles of potentially millions of users, beyond the "basic contact details" that, according to BBC News, ASOS had previously said might have been accessed. Fields now confirmed or shown in samples include names, addresses, phone numbers, emails, customer numbers, dates of birth and on-site search terms. ASOS said no bank details or passwords were accessed, urged caution about unexpected messages or calls claiming to be from ASOS, and said it will contact customers directly where more support is needed. BBC News notes Snowflake has previously said its own platform was not breached. According to BBC News, ASOS's customer email confirms the wider set of profile details. CORRECTION (21 Oct 2026): removed an unsourced line about the ASOS share price, removed The Register from the sources (not linked), and corrected the date of the BBC report from 13 to 8 October. Correction (23 Oct 2026): removed the extortion group's own statements about what it holds and how it got in; Australian impact is now attributed to Cyber Daily's 8 October report. (source: BBC News) Correction (29 Oct 2026): removed a reference to an LSE notice that is not linked (the LSE page is not readable without a login), internal source labels and a bare link credit. (source: BBC News) Correction (29 Oct 2026): the line on ASOS's earlier "basic contact details" wording is now credited to BBC News, because ASOS's London Stock Exchange notice could not be read. (source: BBC News)
BleepingComputer — ASOS confirms data breach after "HACKED" in-app notifications (6 Oct 2026)
breaches cloud
Incidents
Mon 5 Oct
Updated Sun 25 Oct
TrendAI Research published a report on 5 October 2026 linking more than four years of espionage campaigns to Earth Sirrush, a Russia-aligned intrusion set previously tracked as SHADOW-EARTH-065 that overlaps with CERT-UA's UAC-0099. Since at least 2022 it has sent tailored spear-phishing to Ukrainian government agencies, defence organisations, border guard units and logistics operators, using malicious archives and documents that impersonate police, border, tax and justice authorities and, more recently, a drone-parts supplier with a convincing download site and a fake antivirus check. Earlier waves exploited the WinRAR flaw CVE-2023-38831. The group has built more than 10 malware families, moving from PowerShell and Go to C# loaders and .NET implants. In 2026 it leaned on steganography, hiding payloads in PNG images either appended after the image data or pulled out of the pixels with PowerShell, including the border-guard-themed CINDERBLOT (also called BadPaw) campaign. In July 2026 CERT-UA documented a chain that starts with LUNCHPOKE, a malicious Notepad++ plugin (NppExport.dll) that runs through DLL proxying when the editor opens and drops the BURNYBEAR and MATCHBOIL.V2 loaders, kept running by renamed copies of schtasks.exe. The newest tool, ASHVEIN ("TelemetryBrowser" to its developers), is a .NET stealer and remote access trojan that takes Chrome and Firefox credentials, screenshots and files, runs PowerShell, fingerprints the machine, checks for analysis tools, hides tasking in invisible web page elements and can fall back to GitHub to find its server. TrendAI tied the campaigns together through shared encryption code, identical system queries, reused artefacts and infrastructure, with many command servers registered through the same registrar behind Cloudflare. In one case an implant kept its foothold through a month with no server contact. (source: TrendAI Research)
TrendAI Research — Earth Sirrush: a Russia-aligned intrusion set with 4 years of evolving espionage tooling (5 Oct 2026)
breaches
Incidents
Mon 5 Oct
Updated Fri 23 Oct
Tellter SAS, which runs the Discord server protection bot Double Counter, published an incident report (version 2.0, last updated 21 October 2026) on a multi-stage attack on 4 October 2026. The way in was an old server from its previous OVH hosting that was no longer used but still ran a publicly reachable self-hosted Metabase analytics instance; a Metabase vulnerability let the attacker forge an administrator session and reach the host. The company does not name a CVE. That server held a cloud service-account key with administrator rights and an administrator's saved command-line session. With them the attacker added an SSH key, exported a database to a bucket, read the bot's Discord token from a running container, gave itself admin on the support server and posted links to its own Discord server in about 50 large servers using the bot. It read a replacement token within two minutes, deleted backups, changed the database admin password and copied about 12 GB before being cut off around 17:55; the service was restored at 19:19 with new credentials. Exposed data includes IP-address records for alt detection (about 5.4 million copied in full) and a verified-users table (about 21.7 million rows, treated as wholly exposed though about 20% left). The attacker also used a stolen Stripe key for Tellter's separate Atis product to charge 'the cards saved by 11 existing customers of that product, one of them a company card of ours': 23 charges went through, for $7,331, of which '$7,322 was refunded the same day', and the remaining $9 has since been refunded. According to the report, the copied data also includes de-duplicated email addresses for about 1.0 million accounts (Doogle accounts, about 840k, and Double Counter dashboard, server-manager, customer and advertiser contacts, about 240k), and payment-provider customer records for about 5,000 Doogle and Atis customers (name, email address, Discord ID and username, billing address, plan and payment history, card brand, expiry date and last four digits), marked 'Copied, partly published'. Tellter says full card numbers and security codes were never accessible. It notified France's data protection authority, the CNIL, on 5 October, filed a criminal complaint with the Paris public prosecutor on 21 October, and since 21 October has been emailing everyone whose email address was in the affected data (about 1 million people). Have I Been Pwned loaded the published data on 7 October: 274,922 unique email addresses with Discord usernames, plus names, countries and postcodes for a small number of paying subscribers. Discord passwords and stored card numbers were not exposed. Correction (23 Oct 2026): this card previously said three cards were charged; Double Counter's report version 2.0 (21 October) says the saved cards of 11 customers were charged, for $7,331, almost all refunded the same day, and adds the copied email addresses and the Doogle customers' billing records. (source: Double Counter incident report)
Double Counter — Targeted attack on Double Counter’s infrastructure (Security incident report INC-2026-10-04, version 2.0, updated 21 Oct 2026)
breaches cloud identity
CloudSEK published research on 5 October 2026 on a Russian-speaking affiliate of the Gentlemen ransomware group who calls himself Azazel. An exposed open directory and a misconfigured storage server revealed more than two dozen victim directories and about 6TB of stolen data from organisations in logistics, insurance, pharmaceuticals, AI, medical devices and government-adjacent services across six countries (CloudSEK does not name them), with one exfiltration still running during the investigation. Most victims were reached the same way: tokens, database credentials, API keys and SSH keys harvested from GitLab CI/CD variables and git history. One CI/CD token at a SaaS provider reached more than 150 databases, payment gateways and hundreds of repositories across more than a dozen client companies; at a platform hosting a government-linked financial registry, more than 120,000 records were taken before the attacker killed the live PostgreSQL process and deleted the production data. A separate intrusion at an AI company began with an AI medical imaging API that fetched user-supplied URLs without validation (server-side request forgery). CloudSEK found a reverse-shell handler registered as a tool in an AI coding assistant through the Model Context Protocol (MCP), and a script that used that MCP channel to confirm ransom notes had landed on six internal hosts, which it calls the first public report of MCP used this way as a criminal control channel. Azazel published victims on his own leak site, LEAKNED, and did not share proceeds with the Gentlemen operator. CloudSEK says it notified identified victims before publication. (sources: CloudSEK; Cyber Security News)
CloudSEK — Caught in 4K: The Gentlemen Files (5 Oct 2026)
breaches cloud ai
The US Attorney's Office for the District of New Jersey announced on 5 October 2026 that Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced on 28 September to 32 months in prison. He had pleaded guilty on 1 April 2026 to extortion involving a threat to damage a protected computer and to intentionally damaging a protected computer. Rhyne was a core infrastructure engineer at a US industrial company headquartered in New Jersey. In November 2023 he used unauthorised remote desktop sessions and scheduled tasks on the domain controller to delete network administrator accounts, change passwords on other accounts and shut down servers, then on 25 November 2023 emailed staff threatening to keep shutting down servers unless he was paid about 20 bitcoin (then about US$750,000). BleepingComputer, citing the criminal complaint, reports the tasks deleted 13 domain admin accounts, reset 301 domain user passwords, and locked staff out of 254 servers and 3,284 workstations, and that the ransom email claimed backups had been deleted. Investigators traced searches for the commands he used to a hidden virtual machine and his work laptop. (source: BleepingComputer)
BleepingComputer — Engineer sentenced for locking over 3,000 devices on employer network (6 Oct 2026)
breaches identity
Incidents
Mon 5 Oct
Updated Fri 23 Oct
A group calling itself BYOD posted data to its dark web leak site that it says came from Trump Mobile, the US mobile service owned by T1 Mobile under a brand licensed from the Trump Organization. Straight Arrow News reported that the leak exposed personal data for 3,615 customers. Straight Arrow News reported on 5 October 2026 that its analysis of the data found first and last names, email addresses, phone numbers, home addresses and order details. Straight Arrow says one customer it called confirmed he had paid Trump Mobile a $100 deposit, several other people it contacted confirmed their exposed personal data was accurate but denied being customers, and a Trump Organization employee listed in the data confirmed he had previously used Trump Mobile. Straight Arrow says its review found no member of the Trump family among the customers, but the data includes Trump Organization CIO Eric Brunnett. Trump Mobile did not immediately respond to Straight Arrow's request for comment. UPDATE 22 Oct 2026: cut the group's unverified claims about how it got in and about continuing access; this card now keeps only what Straight Arrow News says it verified (source: Straight Arrow News, 5 Oct 2026). Correction (23 Oct 2026): the 3,615-customer figure was attributed to the BYOD group; it is Straight Arrow News's own reporting. (source: Straight Arrow News)
Straight Arrow News — Trump Mobile's latest problem: hackers just released customer information (5 Oct 2026)
breaches identity
Incidents
Mon 5 Oct
Updated Mon 26 Oct
Denmark's Central Person Register (CPR) administration announced on 5 October 2026 that it had found a serious security incident: by misusing a Danish company's lawful access to search the CPR system, unauthorised parties obtained names, addresses, CPR (personal identity) numbers and other details for about 8.8 million people registered in CPR. The CPR administration says its review shows the unauthorised access does not include the names and addresses of people registered with name and address protection. It has stopped the company's access and is working with specialists and authorities to map what happened; it has reported the incident to the Danish Data Protection Agency (Datatilsynet), and police are investigating with the relevant authorities. The company, the attackers and how many records were actually extracted have not been named. Separate from the DTU incident on Cyberstack. CORRECTION (21 Oct 2026): a 12 October update naming the company whose access was abused, its owner and passwords used on its accounts has been removed until we can link a readable primary source for it. Correction (26 Oct 2026): a line quoting minister Christina Egelund to Ritzau on how long the access ran and an unlinked Cybersecurity News report credit have been removed, because no linked source carries them. (source: CPR administration) Correction (26 Oct 2026): the Ministry of Higher Education, Research and Digitalisation's press release link now redirects to the ministry's home page and can no longer be read, so it has been removed and the card now rests on the CPR administration's own notice (5 Oct 2026). Details that only the ministry's release gave have been removed: that the ministry co-announced the incident, that CPR staff noticed irregular activity on Friday 2 October covering a period in September, the briefing of the parliamentary digitalisation committee, the ordered security review of CPR, the explanation of why the figure exceeds Denmark's population, and the authorities' warning about passwords and codes. (source: CPR administration)
CPR administration — Omfattende uautoriseret adgang til borgeres CPR-oplysninger (5 Oct 2026, Danish)
breaches identity
Incidents
Sun 4 Oct
Updated Sun 25 Oct
Nikkei Inc., the Japanese media group that owns the Financial Times, said on 4 October 2026 (English notice 5 October) that a Microsoft 365 account used by one of its employees was accessed by a third party and used on 30 September to send about 9,000 spoofed emails with links to malicious websites, to staff and to news sources and others who had been in contact with several Nikkei employees. Nikkei believes recipients' names and email addresses and the content of some emails were exposed. It changed the account password, has seen no unauthorised logins since, asked recipients to delete the emails, reported the incident to Japan's Personal Information Protection Commission and is still working out the scope and the number of records involved. Group company Nikkei BP said separately on 4 October that one of its employees handed over login details to a phishing email that came from a Nikkei staff address, exposing 26 names and email addresses. Updated 6 Oct 2026: BleepingComputer (5:25 pm Perth) reports Nikkei also disclosed that an employee's Google Workspace account was accessed in late July, exposing names and email addresses of 1,646 employees and business partners but not reader or interviewee data, which Nikkei found in early August after a Google notification. (source: BleepingComputer) No attacker has been named and Nikkei has not said whether the incidents are connected. (source: Nikkei Inc. notice)
Nikkei Inc. — Regarding information leaks and the sending of suspicious emails due to a cyberattack (5 Oct 2026; Japanese notice 4 Oct)
breaches identity cloud
Incidents
Sat 3 Oct
Updated Sat 31 Oct
BleepingComputer reported on 3 October 2026 (US Eastern time) that, according to Reuters, Jordanian authorities detained a suspected ShinyHunters member known online as “Rey”, identified as Saif al-Din Khader, this week, with two sources saying he was taken into custody on Tuesday. Two sources told Reuters that Khader is helping the FBI and international law enforcement agencies locate other group members, and one source said he is walking law enforcement through his electronic devices and digital communications, according to BleepingComputer. BleepingComputer says the Dutch police arrested a 24-year-old Amsterdam man on 15 September as part of an investigation into ShinyHunters (see /n/shinyhunters-dutch-arrest-20260928), and that after Tuesday the group's main representative stopped responding to questions from the media, including BleepingComputer and Reuters; it is unclear whether that is connected to Khader's reported detention. BleepingComputer also says security journalist Brian Krebs reported in November 2025 that Rey was Saif Al-Din Khader, and that Krebs could not verify Khader's claims at the time that he had been cooperating with law enforcement; treat that as background, not confirmation of this week's custody terms. (source: BleepingComputer, citing Reuters) Correction (31 Oct 2026): removed details that only Reuters' report gave, because the linked copy cannot be read by this desk, and removed context that rested on the group's own claims; the card now rests on BleepingComputer's report citing Reuters. (source: BleepingComputer, citing Reuters)
BleepingComputer — ShinyHunters hacker reportedly detained in Jordan, aiding FBI (3 Oct 2026)
breaches identity
Incidents
Fri 2 Oct
Updated Fri 23 Oct
OFX Group Limited, the Sydney-based ASX-listed money transfer and financial operations company, first advised the market on 2 October 2026 that it was investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients, and that it had notified the Australian Cyber Security Centre, the OAIC and other global regulators. Its 15 October 2026 update says the investigation has confirmed that the databases supporting its client platforms were not accessed; based on the investigation to date, OFX has not identified any unauthorised access to client accounts or funds, or any financial loss to clients arising from the incident; and services and systems have continued to operate normally. Analysis of the data found some personal information in the affected files; the files did not contain copies of identity documents, and none of the accessed data can be used to make a payment on the OFX platform. OFX says it has implemented containment actions and additional monitoring of client accounts, is communicating with affected clients and individuals (including recommended protective steps), and is arranging specialist identity and cyber support services where available. The investigation remains ongoing; OFX does not anticipate further market updates unless material developments require continuous disclosure. UPDATE 15–16 October: OFX's incident page (last updated 15 October) says it is moving into a 'next phase' of communications in which affected clients and individuals are told exactly what information about them was accessed, and it has set up incident phone lines in each region (Australia 1800 524 924) plus questions@ofx.com for account enquiries. BeyondMachines (16 October), reporting on those notifications, says the unauthorised access happened on 28 September and that the files exposed names and usernames, contact information, dates of birth, occupation details, answers to secret questions, details of selected transfers and payment recipients, some customer communications, IP addresses and device information, and social media URLs. OFX has not said how many people are affected; BeyondMachines says the New Zealand Privacy Commissioner was also notified. OFX warns the data could be used for scams and impersonation, and says its staff will never ask for passwords, one-time codes or security details. (sources: OFX ASX announcement; OFX incident page) Correction (23 Oct 2026): the headline stated the exposed-data list as OFX's own; it comes from BeyondMachines' reporting on OFX's notifications. Removed 'identified and contained the next day', which only an unreadable source carried. (source: BeyondMachines)
OFX Group — Update on cybersecurity incident (ASX, 15 Oct 2026)
breaches australia identity
Incidents
Fri 2 Oct
Updated Mon 26 Oct
Seoul Economic Daily reported on 2 October 2026 (2:21 pm Perth) that KB Kookmin Bank said the personal and credit information of 119 customers had leaked from a mobile work-support system used by employees, and that it blocked the server and access route immediately after recognising on the night of 30 September that information might have leaked through abnormal external access; KB said the breach was unrelated to customer financial transactions such as internet and mobile banking and that it would fully compensate any losses. Hana Bank said an external hacking agent gained abnormal access to its operations support system and that it believes resident registration numbers, names, addresses, email addresses, phone numbers, mobile numbers and employer names were leaked (the paper puts the Hana figure at 89 customers); Hana blocked the affected servers and access routes and said it would fully compensate customers if actual damage occurs. The paper said signs were confirmed that personal information of 11 outsourced development staff at BNK Busan Bank was exposed, that traces of an AI-based automation tool were found in the earlier Shinhan Bank breach, and that the National Police Agency's cyber terror response investigation unit launched a pre-charge investigation into the Shinhan, KB Kookmin, Hana and Busan leaks the same day. It quoted Genians Security Center head Moon Jong-hyun as saying on LinkedIn that a string naming ARTEX was found in some HTML titles of the web server presumed to have been used in the attack and that many threat analysts reasonably suspect an AI-based attack automation tool was used; the paper describes ARTEX AI as a Chinese-language system that automates vulnerability scanning. Neither the banks nor regulators have confirmed which tool was used. Updated 4 Oct 2026 (Korea Times, 1:21 pm Perth): President Lee Jae Myung ordered a thorough investigation and countermeasures, presidential spokesperson Kang Yu-jung said. The Korea Times reported that Shinhan Bank reported a breach on Thursday 1 October affecting about 25,000 customers, followed by KB Kookmin Bank, Hana Bank and BNK Busan Bank on Friday 2 October, and that the leaked information included customers' names, phone numbers, annual income and loan limits, with some resident registration numbers also exposed. Yegaram Savings Bank reported a leak involving about 40,000 customers, and Hyundai Capital said some personal data of 146 housing-loan agents had been exposed. These are separate affected groups, not one pool. Financial Services Commission Chairman Lee Eog-weon and Financial Supervisory Service Governor Lee Chan-jin chaired an emergency meeting with representatives from banks, securities firms, insurers, credit card companies, savings banks and fintech companies, and police have launched an investigation. (source: Korea Times) Updated 7 Oct 2026 (CrowdStrike): CrowdStrike Intelligence published analysis on 7 Oct of attacker infrastructure linked to the campaign, which it says ran from late September to early October and resulted in exfiltrated data. Open directories on attacker-controlled servers held Claude Code session histories, Claude memory files and configuration for ARTEX, a recently released Chinese-developed open-source agentic pentesting tool; one server (38.244.50[.]120) hosted the ARTEX instance and a Hong Kong-based server acted as primary infrastructure. The ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 and Grok 4.6 also used in sessions. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated but does not attribute it to a named group; the sessions also asked Claude where Korean breach data is sold, and a résumé prompt contained personal details placing a likely suspect in Maoming, Guangdong, which CrowdStrike says it cannot definitively tie to the actor. (source: CrowdStrike) Correction (26 Oct 2026): the card date has moved from 4 to 2 October 2026, the Perth date of the earliest source it cites (Seoul Economic Daily); the Korea Times and CrowdStrike reports now carry Updated lines. Statements that no linked source supports have been removed: a 10 October update about a statement by the ARTEX developer and BleepingComputer's reporting on it, a BleepingComputer figure of 119,000 KB Kookmin clients, on-site inspections and information-sharing with KISA, an SBS report of common IP addresses, and unlinked Cybersecurity News and Reuters/iTnews report credits. The ARTEX string and the Genians quote are now credited to Seoul Economic Daily, and the Australia field now reads unknown. (source: Seoul Economic Daily; Korea Times; CrowdStrike)
Korea Times — Lee orders thorough probe into AI-powered cyberattacks in banks (4 Oct 2026)
breaches identity ai
