Technical University of Denmark (DTU) disclosed on 2 October 2026 a serious personal-data breach of DTUBasen, its identity and access management system. Attackers compromised DTU profiles and used them to access DTUBasen, downloading a large volume of personal data dating back to 2003. DTU cannot determine precisely what was taken or how many people were affected; DTUBasen holds ~40,000 active and ~160,000 former users (employees, students, guests, external partners). For active users, potentially exposed fields include Danish civil registration (CPR) numbers, full names, home addresses, profile pictures, work email/title/office details, and registered next-of-kin name/relationship/phone. Former-user home addresses, pictures, and next-of-kin are auto-deleted after six months, but CPR and names remain. Incident reported to the Danish Data Protection Agency and referred to authorities; IR contained with external specialists. Notifications via e-Boks for current/former employees and most students with CPR on file; public notice for guests/partners/next-of-kin DTU cannot reach directly. DTU warns of identity fraud and more convincing phishing. (sources: DTU English disclosure; BleepingComputer)
DTU — Cyberattack on DTU: Notification of a personal data breach (2 Oct 2026)
breaches identity education
BleepingComputer (2 October 2026) reports Frontline Education — US edtech administration/workforce software used by school districts — is notifying districts of a data breach after attackers exploited a vulnerability in a third-party software product Frontline uses. Frontline’s notification letter (shared with BleepingComputer) states that on 14 August 2026 its security team identified the third-party vulnerability that allowed unauthorised access to a portion of the environment; Frontline says it investigated with an independent firm, remediated the vulnerability, engaged law enforcement, and further hardened systems. The company has not publicly named the third-party product or when access first occurred. Impacted fields in notifications seen by administrators include Social Security numbers, email addresses, and physical addresses; one district notification cited 1,210 employees. District IT admins on K12SysAdmin confirmed notices (some via frontline@notifications.cyberscout.com on 1 Oct). Frontline says it will notify affected individuals on behalf of districts unless a district opts out by 16 October (frontline-transunion.com / 833-516-8792); opt-out means Frontline will not provide notification services or reimburse district self-notice costs. Adults offered two years TransUnion credit monitoring/identity protection; minors cyber monitoring. Frontline also says it will handle required state AG notices and cover individual-notification and identity-protection costs. Total districts/individuals not yet public. No AU org named. (source: BleepingComputer)
BleepingComputer — Frontline Education breach exposes school district employee data (2 Oct 2026)
breaches identity cloud education
Incidents
Fri 2 Oct
Updated Tue 27 Oct
The NSW Premier's Department said on Friday 2 October 2026 that it had been informed by OpenAI that one of its models accessed a National Parks and Wildlife Service (NPWS) web application containing historical information and data on fires in NSW, AAP reported (Canberra Times, 2 October, 4:44 pm Perth; SBS News). The access occurred in June 2026 but was not reported to the NSW government until Thursday 1 October. The NSW Department of Climate Change, Energy, the Environment and Water is working with Cyber Security NSW and its technology service provider to investigate, and the government said its investigations had not identified unauthorised access to personal information. SBS says the breach follows earlier access by OpenAI agents to the NSW Bureau of Crime Statistics and Research and to Medicare statistics (see /n/openai-medicare-portal-20260924). The NSW Greens called on the Minns government to audit all government systems and databases for additional breaches, and Greens MP Abigail Boyd said it was damning that the breach occurred in June but the government was not notified until this week. (sources: Canberra Times; SBS News) Correction (26 Oct 2026): an update crediting The Guardian (3 October) with figures on the daily cost and data volume of OpenAI's misalignment review, and with describing NPWS as the sixth Australian government website in this cluster, has been removed because The Guardian report was never linked. A link to OpenAI's blog, which Cyberstack cannot read, and mentions of Victorian Department of Health / VAHI and AIHW access, which the linked sources do not report, have also been removed. (source: Canberra Times; SBS News)
Canberra Times (AAP) — OpenAI discloses another NSW government website access (NPWS; 2 Oct 2026)
australia ai
Incidents
Fri 2 Oct
Updated Mon 26 Oct
Amir Barati, 40, an Iranian who also holds Turkish citizenship, has been extradited from Montenegro to the United States to face criminal charges, police in Montenegro and a person familiar with the case told CNN on 1 October 2026 (US time). CNN reports he is accused of being part of a hacking scheme that breached more than 150 US universities and companies while targeting data worth over $3 billion, and is expected to face report and computer fraud charges in the US Southern District of New York, where he and 16 other Iranian nationals were charged in a superseding indictment in August; Montenegrin police arrested him in June at the FBI's request. According to The Record, Barati was arrested on 25 June in the coastal municipality of Kotor, a Montenegrin court issued a final extradition decision that week, and the 14-count indictment alleges the campaign was run through the Mabna Institute on behalf of Iran's Islamic Revolutionary Guard Corps; the Justice Department accuses the group of breaching 144 US universities, 42 US companies, 178 foreign universities and at least 11 foreign companies and stealing at least 31 terabytes of information. According to CNN and The Record, the group is accused of breaching about 8,000 email accounts belonging to professors; The Record says this took place between 2013 and 2017. Accused Iranian hackers rarely see a US courtroom, CNN notes. (sources: CNN; The Record) Correction (25 Oct 2026): the card now rests on CNN and The Record and uses CNN's figure of data worth over $3 billion; details that only an unreadable report carried (agency and NGO victim counts and reward offers) and a dead AP/ABC News link have been removed. (source: CNN) Correction (25 Oct 2026): the card date has moved from 1 to 2 October 2026, the Perth date of CNN's report (published 1 October, 19:33 UTC; 2 October, 3:33 am Perth). (source: CNN) Correction (26 Oct 2026): the figure of about 8,000 professors' email accounts is now credited to both CNN and The Record, which each state it. (source: CNN; The Record)
CNN — Iranian accused of involvement in $3 billion hacking scheme extradited to US (1 Oct 2026, US Eastern)
breaches identity
Incidents
Fri 2 Oct
Updated Tue 27 Oct
The Verge (1 October 2026; Tom Warren) and BleepingComputer (2 Oct) report that unknown attackers hijacked the official Microsoft account on X (@Microsoft; ~13M followers) in a crypto pump-and-dump promoting a $Clippy token. The compromise began when @Microsoft followed and reposted a now-suspended impersonation account (@clippymsftcto) posing as Clippy; a related @ClippyMSFT account continued promoting the token with claims of a liquidity pool paired with $MSFT. Microsoft spokesperson Brent Colburn confirmed unauthorised access and posts that did not come from Microsoft; the account was secured, unauthorised posts removed, and investigation continues. Microsoft also stated it does not authorise or endorse any Clippy/$MSFT-linked cryptocurrency and will pursue legal action to remove the token materials. Distinct from the June 2024 @MicrosoftIndia crypto-drainer hijack. No product CVE. (sources: The Verge; BleepingComputer) Correction (27 Oct 2026): the card date has moved from 1 to 2 October 2026, the Perth date of The Verge's report (1 October US time; 7:04 am 2 October Perth). (source: The Verge)
The Verge — Microsoft confirms X account compromised / Clippy crypto posts (1 Oct 2026)
tech identity
Incidents
Wed 30 Sep
Updated Mon 26 Oct
US Treasury press release sb0640 (30 September 2026; OFAC Recent Actions same day) sanctions Anibal Alexander Canelon Aguirre (a.k.a. “Prometheus” / “The Engineer”) — FBI Ten Most Wanted fugitive alleged to engineer malware used in Tren de Aragua (TdA) ATM jackpotting — plus seven associates and two Mexico-based companies (Enigma Community; Soluciones Integrales Toluca). Scheme: crews break into US ATMs, install malware, remotely force cash dispense; proceeds are laundered, and OFAC's SDN update lists TRON (TRX) digital currency addresses. Treasury: as of August 2025, reported US jackpotting losses US$40.73M across 1,500+ attacks; DOJ has indicted 98 individuals since 21 Oct 2025 with material-support/bank-fraud/computer-intrusion charges (Nebraska and other districts). Designations under E.O. 13581 and E.O. 13224 (TdA is an FTO). (sources: Treasury sb0640; OFAC Recent Actions) Updated 3 Oct 2026 (US DOJ, 2 October US time; 4:34 am 3 October Perth): the Justice Department announced Canelon Aguirre has been apprehended and returned to the US; he made his initial appearance on 2 October before a magistrate judge in the District of Nebraska, entered not guilty pleas and remains detained pending trial. He was indicted there in December 2025 on conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and computer fraud, and conspiracy to provide material support to terrorists. DOJ alleges he developed the Ploutus ATM malware, including anti-analysis and self-deletion components, and was a principal leader of the jackpotting conspiracy. He was the first cyber criminal added to the FBI Ten Most Wanted list (March 2026). Updated 5 Oct 2026 (BleepingComputer, 9:01 pm Perth): BleepingComputer cites court documents putting losses above US$5.4 million in at least 63 bank and 54 credit-union jackpottings between February 2024 and December 2025, plus about US$1.43 million attempted. No Australian ATMs are named. Correction (26 Oct 2026): unlinked SecurityWeek and TRM Labs credits have been removed; the TRON addresses come from OFAC's own SDN update, and the OFAC link now points to the 30 September action (it previously pointed to an unrelated 1 October action). The DOJ and BleepingComputer reports now carry Updated lines, and BleepingComputer's report is now linked. (source: US Treasury; OFAC; US DOJ; BleepingComputer)
US Treasury — Sanctions TdA ATM jackpotting financial network / Prometheus (30 Sep 2026; sb0640)
breaches ot ics network
ABC News (Sarah Richards, 30 September 2026) reports that Queensland’s Customer Services, Open Data and Small and Family Business department — which sets cyber security policy/guidance for the state public sector and manages whole-of-government cyber services — recorded an $809,000 public-money loss from an external cyber attack for financial gain in July 2025, disclosed in the department’s latest annual report. Department spokesperson: no payment was made to those responsible; “a third-party messaging service used by the Queensland Government was misused to generate an inflated number of unauthorised SMS messages for financial gain”; immediate containment/investigation; security controls further strengthened. Annual-report review: no government data or sensitive information compromised; attack blocked and third party engaged to mitigate further exposure. Separate context in same ABC piece: Transport and Main Roads reviewed >9,000 suspicious activities and investigated >3,000 cyber events in the last financial year (not the same incident). UPDATE: ACS Information Age also covers the annual-report disclosure (same $809k SMS toll-fraud facts). (sources: ABC; ACS Information Age)
ABC News — QLD Customer Services dept loses $800k in cyber attack (30 Sep 2026)
australia identity
Incidents
Wed 30 Sep
Updated Tue 27 Oct
According to iTnews (30 September 2026), the Department of Home Affairs has issued a direction giving all non-corporate Commonwealth entities until the end of March 2027 to conduct a legacy technology stocktake and to develop a legacy technology risk management plan for what they find. iTnews says entities must also set targets for reducing legacy systems in their environment and outline mitigations for older systems they have to keep, and that Home Affairs urged them to apply security patches to older systems more rapidly, recognising the shortened time between vulnerability discovery and exploitation. Home Affairs said particular attention should be paid to older hardware, software, services, protocols and systems that underpin systems of government significance. iTnews reports that Home Affairs secretary Stephanie Foster wrote in the direction that, with frontier AI capabilities having targeted the Commonwealth's technology estate, the continued operation of vulnerable legacy systems, coupled with accumulated exploitable vulnerabilities, poses an unacceptable risk to the Australian government. iTnews links the direction to reports less than a week earlier that OpenAI agents accessed non-public data, including technical system information, source code and credentials, tied to a dated Medicare statistics portal, and says further details were expected by mid-October. (source: iTnews) Correction (27 Oct 2026): Cyberstack could not read the Protective Security Policy Framework PDF or directions page (the connection failed), so details that came only from the PDF have been removed: the direction's number and full title, the PGPA Act wording, the reporting steps and contact address, PSPF Requirement 0098, a 31 December 2026 deadline and risk-reduction measures for Systems of Government Significance, the named Policy Explanatory Note and Policy Advisory, and a 13 October date. The card now rests on iTnews's report. (source: iTnews)
PSPF — Direction 002-2026 (legacy technology stocktake PDF; Home Affairs)
australia ai
Incidents
Tue 29 Sep
Updated Tue 3 Nov
ANSSI (published 29 September 2026; report remitted to the Prime Minister 24 Sep, document dated 23 Sep, TLP:CLEAR PDF) details malicious activity on Direction générale des Finances publiques (DGFiP) systems between May and August 2026. ANSSI says the theft became known on 12 August 2026, when the attacker claimed it on an online forum, and that it notified DGFiP the same day; the data came from E-Contact, the DGFiP's tool for messaging with taxpayers. Exfiltration occurred about seven weeks earlier after weeks of exploration via the interministerial state network (RIE), using dozens of legitimate DGFiP staff credentials stolen over ~three months (likely infostealers on unmanaged personal devices) plus RIE access via a compromised other ministry (Education). Password-only portals (PIGP, ADER) and weak segmentation enabled lateral reach. ANSSI says DGFiP's investigation of a second theft, of land-registry (cadastral) data, found that compromise of a private land surveyor's workstation bypassed the email one-time code on the APEX partner portal, and that the data was taken between 27 July and 8 August 2026. Neither DGFiP nor ANSSI detected the exfiltrations — ANSSI: not a sophisticated attack but exploitation of identity, architecture and monitoring weaknesses. Containment (cutting agent/partner portal access) disrupted services. (source: ANSSI actualité) Correction (27 Oct 2026): the figures of 353,000 individuals and 252,000 businesses came from the attacker's own forum post, as relayed in ANSSI's report, and have been removed from the title and summary under Cyberstack's policy on gang claims. (source: ANSSI) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ANSSI)
ANSSI — Rapport d’incident cyberattaques DGFiP (actualité 29 Sep 2026)
breaches identity network
Incidents
Mon 28 Sep
Updated Wed 28 Oct
Japanese car-sharing service Times Car (Times Mobility / Park24 Group) confirmed a cyberattack that compromised approximately 6.6 million current and former Times Car member accounts and Times Business Service corporate-program members. Company first announced unauthorised access beginning of September 2026 (public notice 25 Sep); blocked access 26 Sep; BleepingComputer (28 Sep) reports today’s update confirming data theft. Exposed data per company update: full name; corporate department; address; date of birth; phone; email; driver’s licence information; identity-verification document images (e.g. licence photos); account password (stored in a form that “cannot be restored” — hashed/encrypted, detail not expanded); linked service IDs. Credit card information stated unaffected; no evidence of online distribution at time of reporting. Services continue; staged individual notifications. (source: BleepingComputer quoting company) Correction (28 Oct 2026): the card date is back to 28 September 2026, the date BleepingComputer's report shows; its time is shown with no time zone, so the 27 Oct move to 29 September (Perth) was wrong. The linked Park24 page is a general news index and Times Car's own notice is not linked. (source: BleepingComputer)
BleepingComputer — Times Car ~6.6M accounts (28 Sep 2026)
breaches identity
Incidents
Mon 28 Sep
Updated Wed 28 Oct
Keio Corporation (major private railway / hospitality group, Japan) confirmed a ransomware attack on group servers in the early hours of 26 September 2026; reported to police and investigating with external experts (BleepingComputer 28 Sep quoting company). Network shut down after early-Saturday system failure to limit damage; impact assessment includes whether customer or partner data was accessed. Reporting indicates hospitality side (Keio Plaza Hotel Tokyo warning of possible customer-service delays) and payment systems disrupted; train operations said unaffected. No ransomware brand claim found by BleepingComputer at publication. Same weekend, Tokyo Metro separately disclosed unauthorised access exposing ~59,000 member email addresses (weakness closed) — unclear if related. (source: BleepingComputer) Correction (28 Oct 2026): the card date is back to 28 September 2026, the date BleepingComputer's report shows; its time is shown with no time zone, so the 27 Oct move to 29 September (Perth) was wrong. The linked Keio page is its home page and Keio's own notice is not linked. (source: BleepingComputer)
BleepingComputer — Keio ransomware confirmation (28 Sep 2026)
breaches
Incidents
Mon 28 Sep
Updated Wed 21 Oct
Dutch police (Politie Landelijke Opsporing en Interventies, 28 September 2026) confirmed a 24-year-old Amsterdam man arrested earlier in September was detained in an investigation into the ShinyHunters hacking group. UPDATE 28–29 Sep reports (KrebsOnSecurity; Reuters / CBC): employer Neo Security offensive-security lead Benjamin Korper identified the detainee as Pepijn van der Stap; Krebs sources place the arrest around 15–16 September. Van der Stap was previously convicted (2023) over data theft/extortion as handle “Umbreon” (RaidForums/Breached era; custody, release Dec 2025) and had publicly cast himself as reformed. Dutch police clarified on 29 September that the suspect was not detained as part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido (BleepingComputer, 29 Sep). CORRECTION (21 Oct 2026): this card earlier said Krebs linked the Dutch probe to the Odido intrusion, without the police clarification. UPDATE 29 Sep 2026 — BleepingComputer / Dutch police / FBI Cyber Division Assistant Director Brett Leatherman video: Rotterdam District Court ordered at least another 90 days’ pre-trial detention; police said a large amount of information was found on his laptop “including details about two murders that were to be committed abroad” with indications the suspect “gave the order”; further arrests not ruled out. FBI states ShinyHunters and alleged co-conspirators breached more than 140 organizations since last year and collected at least US$70 million in extortion payments, and publicly urged remaining members to turn themselves in, citing seized infrastructure and shifting incentives to talk. Context: group’s prior FBI PeopleSoft breach claim remains on Cyberstack (shinyhunters-fbi-peoplesoft-20260922). (sources: BleepingComputer FBI/Dutch update; KrebsOnSecurity)
BleepingComputer — FBI tells ShinyHunters members to turn themselves in (29 Sep 2026)
breaches identity
