Incidents
Mon 28 Sep
Updated Sun 25 Oct
District of Columbia Department of Health Care Finance (DHCF) public notice (page dhcf-data-incident) states that on 21 July 2026 DHCF learned two reports on its website contained hidden personal information reachable by unauthorised users. Reports were meant to show only aggregate enrollment/statistics; underlying PII supporting those reports may have been reachable between 2023 and July 2026. Exposed fields may have included Medicaid ID numbers, date of birth, provider name, race, gender, ward, or ethnicity; DHCF says beneficiary names, Social Security numbers, and financial account information were not included. Not a hacking incident — misconfigured public reports. DHCF removed the reports immediately, began an internal review, and is mailing individual notices; enrollees in Medicaid or DC Healthcare Alliance between 2023 and July 2026 may call 1-833-687-5424. DHCF says it has no reason to believe the data was misused. (source: DHCF notice) Updated 30 Sep 2026: The HIPAA Journal reports that the investigation determined the personal and protected health information of 399,086 Medicaid and DC Healthcare Alliance beneficiaries may have been accessed by unauthorised individuals. (source: The HIPAA Journal)
DHCF — Data Incident public notice (Medicaid / DC Healthcare Alliance)
breaches identity
Incidents
Sat 26 Sep
Updated Sun 25 Oct
CNN (25 September 2026, 4:18 pm US Eastern; 26 September, 4:18 am Perth) reports that a data breach at the Pentagon's HR system exposed Social Security numbers and other personal information of current and former military personnel. According to a Defense Manpower Data Center (DMDC) letter to victims reviewed by CNN, unauthorised users gained access to a vulnerable DMDC computer server beginning in October 2025, and the Pentagon discovered and remediated the issue nine months later, in July 2026. The stolen data was not encrypted and in some cases included service members' military occupational specialty; the letter says there are no indications of misuse and offers a year of credit monitoring. It is unclear who was behind the breach. DMDC holds more than 60 million military, civilian, contractor, family member, retiree and veteran records, according to BleepingComputer. (sources: CNN; BleepingComputer) Updated 29 Sep 2026: a Defense Department official told CNN the breach affects 2.76 million living individuals and 294,000 deceased individuals. (source: CNN) Updated 1 Oct 2026: BleepingComputer (5:44 pm Perth) reports that DMDC's notification letters, shared online by affected people, say a small number of unauthorised users had access to their data between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems; the data varies by person and includes Social Security numbers, names, dates of birth, contact information, sex, race and military personnel information. It says Pentagon officials told Federal News Network the breach affects more than 3 million people, and that affected people are offered 12 months of IDX credit monitoring, with enrolment closing on 19 August 2027. (source: BleepingComputer) Correction (25 Oct 2026): the card date has moved from 29 to 26 September 2026 (Perth time), the date of CNN's first report, and the card now rests on CNN and BleepingComputer; details only a press report we cannot verify gave (a letter date of 18 September and a discovery date of 16 July) have been removed. (source: CNN)
CNN — Pentagon data breach of military personnel raises national security concerns (25 Sep 2026 US Eastern, updated 28 Sep)
breaches identity
The NSW Department of Education has confirmed that James Fallon High School in North Albury was hit by a cyber data breach in April 2026, The Border Mail reported on 25 September 2026. Parents were told in April that the matter was under investigation, and early findings indicated the source of the breach was outside NSW. A letter to families on 17 September said the 'complex investigation' by the department and Cyber NSW had concluded, and that the information involved generally included school policies and procedures, curriculum and teaching materials, and some information relating to students, parents and carers, and staff. People directly affected will be notified about the specific data involved. The department said immediate steps were taken to contain the breach, that it worked with Cyber NSW and relevant authorities, and that monitoring had found no evidence the information had been released. It has not said how the attackers got in or how many people are affected. Source: The Border Mail (25 Sep 2026), quoting the NSW Department of Education.
The Border Mail — Department investigation concludes after cyber breach at Border high school (25 Sep 2026)
breaches australia
Incidents
Fri 25 Sep
Updated Mon 26 Oct
The Arizona Supreme Court says criminal hackers accessed and copied backup court files in an attack that began around 11:30 a.m. on Thursday 24 September 2026 (Arizona time). Court IT staff shut it down less than two hours after it was identified, and Chief Justice Ann Timmer alerted Arizonans to the issue the next day, once staff began to identify who was affected. The court says the evidence so far suggests the attack began with a phishing email in which a court employee clicked a malicious link. According to the court's FAQ, the copied data covers approximately 1.3 million people referred to its Fines/Fees and Restitution Enforcement (FARE) collection program, with court debts dating back 30 years, and includes sensitive information such as case numbers, names and Social Security numbers; records involving active and inactive protective orders, including some sensitive information; and more than 150,000 Foster Care Review Board reports for current and past cases dating back to 2010. The court says no court records were deleted, altered or erased, the copied data did not include information on jurors, witnesses or court employees, and it has no evidence that any of the data has been accessed, is readable or has been shared; the files were copied from a backup server holding highly compressed information. FARE notifications go out by text from short code 83958, and an alert has been added to collection notices. Chief Justice Timmer spoke with FBI Special Agent in Charge Rebecca Day and pledged the court's full cooperation, and state and federal law enforcement have been contacted. (source: Arizona Courts cybersecurity alert) Correction (26 Oct 2026): this card earlier credited an Associated Press report (6 Oct), FOX 10 Phoenix and SecurityWeek. The AP page cannot be read by Cyberstack and the other two were never linked, so those credits and the AP link have been removed, along with a figure of nearly 30,000 protective-order records and a mention of confidential addresses, which the court's page does not give. The 1.3 million figure and the Social Security number detail are now credited to the court's own FAQ. (source: Arizona Courts)
Arizona Courts — Cybersecurity Alert and FAQs (attack 24 Sep 2026)
breaches
Incidents
Fri 25 Sep
Updated Sun 25 Oct
Eye Security research (Dion Fieret & Lucas Hop; published 25 September 2026) documents lookalike storefronts that appeared within days of TypeSafe AI’s Jev model launch (15 Sep; hosted API public ~21 Sep). Fake sites (e.g. jev-ai.pro, jevtypesafeai.com, jev-agent.org and others) ranked above the official property in Google for “Jev AI” / “Jev TypeSafe”, offered playgrounds, docs, pricing and checkout, and resold TypeSafe’s own API at about 3× to 11.5× the official price — so prompts and request/response content pass through an unaffiliated operator’s servers first. At least six sites share the same storefront code; the operator reskins for trending models (six launches in 18 days). Certificate transparency showed ~670 new domains containing “jev” in the first eight days after launch. Affiliation disclaimers buried in footers/terms. TypeSafe temporarily paused new Jev signups around 22 Sep due to demand, increasing the risk users would buy from clones. Buy only via typesafe.ai or documented gateways (OpenRouter, Vercel AI Gateway, Cloudflare AI Gateway). (source: Eye Research)
Eye Research — Rise of the Jev-Clones (25 Sep 2026)
ai identity
Incidents
Fri 25 Sep
Updated Mon 2 Nov
Microsoft Security Research (Yossi Weizman, Tushar Mudi; published 25 September 2026) documents Azure-focused destructive activity by JADEPUFFER, tracked as Storm-3168 — an evolution of the actor Sysdig described in July 2026 as the first documented agentic ransomware operation (Langflow CVE-2025-3248 initial path; ENCFORGE later). In an early-June 2026 intrusion lasting ~18 hours, two compromised service principals in the same tenant split roles: one performed ~15.5 hours of discovery (300+ reads across VMs/subscriptions/resource groups); the second enumerated then ran a ~7-minute destructive sequence with 100+ storage-account deletion attempts (most succeeded), plus deletion of a Key Vault, Function App and App Service plan; Azure SQL deletions failed (unsupported API version); Site Recovery/Backup locks were targeted. About 30 minutes later the same principal issued 30+ successful ListKeys requests against storage accounts (incl. Site Recovery-related). User agent python-requests/2.34.2; five unique tokens observed. Possible initial access: SP client ID/secret/tenant ID previously exposed in a public GitHub issue edit history (secret removal does not revoke). Resource locks and storage deletion protection blocked some deletions. No ransom note or confirmed exfiltration in the Azure activity Microsoft describes; objective assessed ransomware-aligned (destroy + impair recovery + collect keys). IoCs include 45.131.66.106, 34.153.223.102, 64.20.53.230. (source: Microsoft Security Blog) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Microsoft Security Blog)
Microsoft Security Blog — Storm-3168 agentic cloud attacks via compromised service principals (25 Sep 2026)
breaches cloud identity ai
Incidents
Fri 25 Sep
Updated Tue 27 Oct
The U.S. Department of Justice said in a press release dated Friday, 25 September 2026 that former U.S. Army soldier Cameron John Wagenius (21; online kiberphant0m / cyb3rph4nt0m) was sentenced to 70 months in prison and ordered to pay $294,978 restitution for hacking and extorting at least ten U.S. technology and telecommunications companies between April 2023 and December 2024 while on active duty. Court narrative (via BleepingComputer/DoJ): Wagenius and conspirators used an SSH brute-force tool he helped develop, moved stolen credentials on Telegram, and threatened to publish data on BreachForums / XSS.is or sold it; attempted extortion totaled at least $1 million; stolen data also used for SIM-swapping and other fraud. Prior guilty pleas: February 2025 (AT&T / Verizon confidential phone-records transfers) and July 2025 (aggravated identity theft, conspiracy to commit wire fraud, extortion related to computer fraud). Accomplices Connor Riley Moucka (“Waifu”/“Judische”) and John Erin Binns (“irdev”) were separately accused in the Snowflake-linked campaign affecting customers of AT&T, Ticketmaster, Santander and others; Moucka pleaded guilty August 2026. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 28 to 25 September 2026, the date the Justice Department's press release visibly shows (Friday, 25 September 2026); BleepingComputer reported it on 28 September. (source: U.S. Department of Justice)
U.S. Department of Justice — former US soldier sentenced for hacking and extortion scheme
breaches identity cloud
Incidents
Fri 25 Sep
Updated Sun 25 Oct
The Intercept (25 September 2026, 7:21 am Perth; updated 11:58 am Perth) reports researcher Joshua Michael obtained an access token from Flock Safety without logging in and used it to query ArcGIS (Flock’s geospatial layer) for device locations — a December 2025 snapshot he archived powers a public Flock Surveillance Map covering ~300,000+ devices (ALPR cameras plus acoustic and networking gear). Michael says he disclosed to Flock on 13 November 2025 (non-intrusive unauthenticated endpoints only); Flock acknowledged triage then went quiet. A Doppel complaint on Flock’s behalf alleges trademark infringement and seeks site takedown. No CVE. (sources: The Intercept; Tom's Hardware) Updated 27 Sep 2026: Tom's Hardware (8:00 pm Perth) reports on the dispute and cites about 335,701 camera locations on the map. (source: Tom's Hardware) Correction (25 Oct 2026): the card date has moved from 24 to 25 September 2026, the Perth date of The Intercept's report (published 24 September, 23:21 UTC; 25 September, 7:21 am Perth). (source: The Intercept)
The Intercept — Flock wants detailed camera map taken down (24 Sep 2026 US time; 25 Sep Perth)
breaches identity network
LuaRocks.org official incident notice (Security Incident, September 2026) states CISA coordinated a report on 25 September 2026 of remote code execution in the rockspec upload path: rockspecs are Lua files loaded in a restricted environment, but the loader accepted precompiled LuaJIT bytecode that could escape the sandbox. Fixed 26 September 2026 (text-only rockspec load). Forensic review found exploitation on 9 July, 7 August (three malicious packages published: bcrcewon, 7e0b94029db0, 7e0b9402f9c8 — removed), and hundreds of automated upload-API attempts 16–20 August. Site rebuilt on a new server; every credential the old host held revoked. Exposed (assumed): usernames, emails, bcrypt password hashes, API keys, 2FA secrets, GitHub link tokens, session/IP data, third-party server credentials. No evidence existing packages were modified (git mirror from 8 July compared). Users: create new API key, re-login, change password (+ elsewhere reused), re-enrol 2FA, upgrade LuaRocks client to 3.12+ (≤3.11.1 on LuaJIT/Lua 5.1 can run precompiled bytecode from a malicious server). Treat machines that installed the three attacker packages as compromised. (source: luarocks.org incident notice)
LuaRocks.org — Security Incident, September 2026
breaches cloud identity
Incidents
Fri 25 Sep
Updated Sun 1 Nov
The US Justice Department said on 24 September 2026 (US time) that Kosovar national Ardit Kutleshi, 28, pleaded guilty in the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy over his creation and operation of Rydox, an illicit website and marketplace where cybercriminals bought, sold and traded stolen personal information, access devices and other cybercrime tools. According to court documents cited by the department, since at least 2016 Rydox conducted over 7,600 transactions involving stolen personally identifiable information, stolen access devices, means of identification and cybercrime tools and services, receiving at least US$232,000 in revenue, with the PII stolen from victims in the United States. Kutleshi was arrested by Kosovo law enforcement in December 2024, when the US also seized the Rydox.cc domain, and was extradited to the United States in 2025. He is due to be sentenced on 9 February 2027 and faces a mandatory minimum of two years in prison for aggravated identity theft and up to 20 years for money laundering conspiracy. US Attorney Troy Rivetti said Kutleshi's brother Jetmir pleaded guilty and was sentenced in December 2025, before his deportation to Kosovo. The FBI's Pittsburgh Field Office investigated with authorities in Kosovo, Albania and Malaysia, and FBI Cyber Division Assistant Director Brett Leatherman is quoted on the takedown. BleepingComputer (25 September) adds that Rydox offered over 321,000 other cybercrime products to more than 18,000 users, that a third administrator, Shpend Sokoli, was also arrested in December 2024, and that the marketplace's servers in Kuala Lumpur were seized with the help of the Royal Malaysian Police. (sources: US Justice Department; BleepingComputer) Correction (25 Oct 2026): the Justice Department's release is now readable and the card rests on it and on BleepingComputer; a judge's name and a sentencing detail, which neither source gives, have been removed. (source: US Justice Department)
US Justice Department — Kosovar national pleads guilty to operating Rydox cybercrime marketplace (24 Sep 2026, US time)
breaches identity
iTnews (25 September 2026 05:05 AEST) reports that a US court sentenced Karen Vardanyan (aliases Manekeen / Karl Lagerfeld), an Armenian national extradited from Kyiv in 2025, to two years’ federal prison and about US$1.219 million in restitution after a July 2026 guilty plea to conspiracy and computer fraud tied to Ryuk ransomware operations from 2019. iTnews cites US prosecutors that Ryuk took at least US$15 million in extortion; other alleged Ryuk members named in reporting include Levon Avetisyan, Oleg Lyulyava and Andrii Prikhodchenko. Australia angle: ACSC previously attributed a 2019 Victorian healthcare-sector attack (Gippsland Health Alliance and South West Alliance of Rural Health) to Ryuk operators — iTnews notes it is not clear whether Vardanyan was involved in those AU incidents. (source: iTnews) Distinct from Conti/Ryuk historical KEV material.
USAO District of Oregon — Armenian national sentenced for ransomware extortion (DOJ PR URL)
australia
Incidents
Thu 24 Sep
Updated Mon 26 Oct
Dutch Institute for Vulnerability Disclosure (DIVD) CSIRT (24 September 2026, “It was a matter of when, not if…”): after nearly seven years the volunteer vuln-disclosure nonprofit confirmed it was breached. Modus operandi “indicates that this is an agentic AI powered attack”; infrastructure access blocked; third-party IR engaged; Autoriteit Persoonsgegevens, NCSC-NL and police notified; treat as worst-case assume-breach until proven otherwise. Updated 29 Sep 2026: BleepingComputer (29 Sep, 11:39 pm Perth), citing DIVD's Monday update, reports DIVD described the attack as “loud and very, very messy”; after initial exploit of an undisclosed technical vulnerability (explicitly not Citrix NetScaler), an automated AI agent performed post-exploitation, choosing next steps autonomously, leaving verbose decision comments, and interfering with its own adversary-in-the-middle / password-spraying path — researchers characterise the agent as poorly trained/configured, aiding reconstruction. Purpose and full impact still unclear; DIVD intends a more detailed public update on 1 October and victim notification for the same vulnerability when ready. KrebsOnSecurity (28 Sep): a DIVD spokesperson said the incident does not appear related to ShinyHunters, nor are there any signs it involves the work of a previous volunteer. Updated 1 Oct 2026: BleepingComputer (30 Sep, 15:49 US Eastern; 1 Oct, 3:49 am Perth) reports initial access was a chain of two Zammad helpdesk zero-days CVE-2026-102489 and CVE-2026-102490 (discovered with Merlon Security) enabling session hijacking, RCE, and escalation to root in seconds under AI automation, then lateral access/exfiltration; segmentation limited deeper movement. DIVD recommending Zammad users upgrade to version 7 or take instances offline; alerting other vulnerable operators; further public detail still expected. Product patch path filed separately as zammad-102489-102490-20260930. (sources: DIVD CSIRT; BleepingComputer) Correction (26 Oct 2026): the KrebsOnSecurity report credited on this card is now linked. (source: KrebsOnSecurity)
DIVD CSIRT — It was a matter of when, not if… (24 Sep 2026)
breaches ai identity network
