Incidents
Mon 14 Sep
Updated Sun 25 Oct
Clover Health Investments Corp., a PPO and HMO organisation with a Medicare contract, says in a notification letter filed with South Carolina's Department of Consumer Affairs that on 4 July 2026 it determined it had experienced a cybersecurity incident involving unauthorised access to certain company applications and data. Its investigation found that between 3 and 4 July 2026 an unauthorised party gained access to credentials belonging to three non-managerial employees and used them to access company applications and data; Clover says it detected the incident on 4 July, ended the access within hours, engaged third-party cybersecurity experts and notified law enforcement. Certain data was accessed and acquired, and a review completed on 28 August 2026 identified personal information about the people being notified; the published letter template does not list the types of data. Clover says it is unaware of any attempted or actual misuse. The US Department of Health and Human Services breach portal lists Clover Health (Minnesota, health plan) with 138,677 individuals affected, submitted on 14 September 2026, as a hacking/IT incident involving a network server and other locations. (sources: Clover Health notification letter; HHS OCR breach portal) Correction (25 Oct 2026): the card now rests on Clover's notification letter and the HHS portal; a social-engineering description, a list of data types and a note about attribution from a press report we cannot verify have been removed. (source: HHS) Correction (25 Oct 2026): the card date has moved from 5 October to 14 September 2026, the breach report submission date the HHS portal lists; HHS gives a US date with no time. (source: HHS)
Clover Health — Notice of Data Security Event (consumer letter, South Carolina Department of Consumer Affairs, PDF)
breaches identity
Incidents
Mon 14 Sep
Updated Mon 2 Nov
St James’ Anglican School (Alkimos, Western Australia) published an incident update dated Monday 14 September 2026 (9:00am): it identified a cyber security incident involving unauthorised access to its computer systems, contained and secured systems, and is auditing. Personal information relating to members of the school community was involved; families were notified with protective steps. The school says it reported to ASD’s ACSC and the OAIC; investigation ongoing; no technical commentary. The West Australian (15 September) reported that student medical records, photos and bank details were stolen; Insurance Business (17 September), citing The West Australian, says the data belongs to current and former students dating back to 2015 and includes names, addresses, email addresses, phone numbers, bank account details, student medical records and photographs. The school’s public statement does not itemise the data. The school’s statement does not name a threat actor. UPDATE 1 Oct 2026: according to Cyber Daily (David Hollingworth), the ThreeAM ransomware group claimed responsibility for the attack in a 28 September post to its darknet leak site; a school spokesperson told Cyber Daily experts have not identified evidence that any school information has been published or released online, investigation and dark-web monitoring continue, learning undisrupted, ACSC and OAIC informed at first discovery. (sources: St James’ Anglican School; Cyber Daily; The West Australian; Insurance Business) Correction (25 Oct 2026): removed an attacker quote and a leak-site tracker reference; the remaining claim is credited to Cyber Daily. (source: Cyber Daily) Correction (26 Oct 2026): removed credits to NewsWire and DataBreaches.net and a breach-list reference that no linked source supported; the data categories are now credited to The West Australian and Insurance Business, which are linked. (source: Insurance Business)
St James’ Anglican School — Incident Update (14 Sep 2026)
australia
Incidents
Mon 14 Sep
Updated Tue 27 Oct
Spain’s Agencia Española de Protección de Datos (AEPD) blog (14 September 2026; Francisco Pérez Bes) reports the agency’s first notification of a personal-data breach in which the incident was allegedly executed by an AI agent using a known large language model. Per the notifier: the agent searched generic files for vulnerabilities, successfully logged in, then autonomously hunted application flaws, modified personal data, and accessed invoices. AEPD stresses the claim is from the organisation’s notification, has not yet been independently verified by the agency and still requires analysis; use of a given model does not imply the provider’s model or infrastructure was compromised or purpose-built for crime. Framing: shift from AI-assisted attacker tools (phishing copy, vuln search) toward agentic chaining of attack phases at machine speed — with implications for identity/credential controls, detection, and response timing. According to BleepingComputer, AEPD said AI can increase the speed, scale and adaptability of attacks and reduce defenders’ response-time margins, a paradigm shift recently highlighted by Spain’s National Cryptologic Center. (source: AEPD blog) Updated 16 Sep 2026: BleepingComputer reported the AEPD post on 16 September. Correction (27 Oct 2026): a second card on the same AEPD notice has been merged into this one and removed; an earlier Perth conversion of BleepingComputer's time has been dropped because the page states no time zone. (source: BleepingComputer)
AEPD — primera notificación brecha por agente de IA (14 Sep 2026)
ai identity
Incidents
Mon 14 Sep
Updated Sat 24 Oct
Brevo's status write-up says that on 14 September 2026 an attacker used a compromised long-lived Cloudflare API key (stored in Brevo application source code; Brevo says it was first misused in late August) to deploy a Cloudflare Worker that rewrote responses at the CDN edge. Brevo gives the impact window as 15:01 to 20:30 UTC (5h29): the Worker was routed to all of brevo.com at 15:01, and at 16:07 it was updated to also append a loader to the three embedded JavaScript files and routed to sibforms.com; Brevo says the ClickFix was active on the listed URLs from 16:07 until 20:30 UTC. Affected: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com, plus Brevo forms script, Conversations widget, and SDK loader that customers embed. The Worker stripped CSP and served a fake Cloudflare “verify you are human” ClickFix lure (Win+R / Ctrl+V / Enter) downloading malware on Windows; Brevo says that on WordPress sites embedding a Brevo widget, if the visitor was logged in as an administrator, the script also attempted to silently install and activate a plugin. Not affected per Brevo: app.brevo.com, API, email delivery, and customer account data held in Brevo. Remediation: Worker/routes/hostnames removed, key revoked, hardcoded credential removed, Vault + Cloudflare audit alerting planned. Distinct from Brevo’s earlier 9–10 September SSO boundary incident (Trezor phishing wave). (source: Brevo status write-up) Updated 17 Sep 2026: BleepingComputer reported that Sansec, which first reported the attack, said it may have affected up to 100,000 websites, gave the malicious window as 16:05 to 20:13 UTC, and that BleepingComputer found the plugin, named 'Web Media Optimizer', on VirusTotal. (source: BleepingComputer) Correction (24 Oct 2026): an earlier version paired 'about five and a half hours' with 16:07–20:30 UTC; Brevo's 5h29 is its 15:01–20:30 UTC window. (source: Brevo status write-up)
Brevo status — Cloudflare Worker ClickFix write-up (14 Sep 2026 incident)
breaches cloud
Incidents
Mon 14 Sep
Updated Thu 29 Oct
In a Form 8-K filed with the US Securities and Exchange Commission on 14 September 2026, Houston-based utility CenterPoint Energy said that an unauthorized third party obtained personal information relating to a portion of its customers through one of its external-facing systems; BleepingComputer reported the filing on 15 September. CenterPoint says electric and gas services were not impacted and does not expect a material business effect; it activated IR, engaged third-party experts, hardened systems, and notified law enforcement/regulators. Class-action complaints filed in US federal courts allege the incident window was about 17 August–1 September 2026. UPDATE (14 Oct 2026, US time): KPRC 2 Houston reports that a CenterPoint breach report published on the Texas Attorney General's website on Monday (12 October, US time) lists 1,062,060 Texans as affected, gives names, addresses, Social Security information and driver's licence numbers as the information involved, and indicates affected people had not yet been notified when it was submitted. A CenterPoint spokesperson told KPRC the company is still working with third-party experts to assess the scope of affected customer data and identify which customers will be notified. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General) Correction (26 Oct 2026): removed the threat actor's own claims about how many records it took and how, and its later data release; CenterPoint has not confirmed them and no outlet has independently verified them. (source: BleepingComputer) Correction (26 Oct 2026): removed every SecurityWeek credit, link and detail; the affected-Texans count, data types and notification status from the Texas Attorney General's breach database are now credited to KPRC 2 Houston (14 Oct), citing the Texas Attorney General. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General) Correction (27 Oct 2026): CenterPoint's SEC Form 8-K is now linked and the company's statements are credited to it directly rather than to BleepingComputer's account of it. (source: CenterPoint Energy Form 8-K, SEC) Correction (29 Oct 2026): the card date is now 14 September 2026, the date shown on CenterPoint's linked Form 8-K, the earliest source for this story; the filing-acceptance time used for the earlier 15 September date came from an SEC page that is not linked, and it has been removed. Internal source labels were also removed. (source: CenterPoint Energy Form 8-K, SEC)
SEC — CenterPoint Energy Form 8-K, Item 8.01 (14 Sep 2026)
breaches ot ics
Incidents
Mon 14 Sep
Updated Fri 30 Oct
Victorian car dealership Penfold Motors says it is contacting its customers after their contact and vehicle details were compromised by hackers, according to Cyber Daily (14 September 2026). Storm claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily)
Cyber Daily — Penfold Motors latest car dealer to fall victim to the Storm ransomware group (14 Sep 2026)
breaches australia
BleepingComputer (14 September 2026) reports that the verified Reddit account u/hbomax was hijacked and used to run about 108 malicious advertisements over roughly 48 hours. Ads used ClickFix social engineering (victims paste commands into Windows Run/PowerShell or macOS Terminal) and redirected to lookalike sites (including hbomaxx[.]us). Hudson Rock and ADAMnetworks link the activity to a broader campaign they call PasteSwitch delivering information stealers, loaders, crypto clippers, and fake wallets on Windows and macOS; one macOS chain referenced “AMOS helper” persistence under a .com.apple.accountsd-style directory. Some ads impersonated HBO Max; others pushed fake AI/developer/macOS utilities. BleepingComputer said HBO / Warner Bros. Discovery had not responded at publication. (source: BleepingComputer)
BleepingComputer — HBO Max Reddit ClickFix (14 Sep 2026)
breaches identity
Incidents
Mon 14 Sep
Updated Mon 2 Nov
Hunt.io (14 September 2026) describes an intrusion against 3BB, a major Thai broadband provider. Researchers captured an attacker-operated server still live on 3 June 2026 that held tooling run from inside 3BB’s network, a MeshCentral deployment reporting to www.ayuthayatech[.]com under device group TH-3BB (agents with root), cleanup scripts that preserved MeshCentral, SSH password spraying against 55+ internal hosts, probes of agent.3bb.co[.]th, and scripts aimed at copying RADIUS subscriber credential databases (targeted; Hunt.io does not state confirmed exfiltration). The same cache held a complete exploit for FortiGate SSL-VPN CVE-2024-21762 aimed at mail.3bb.co[.]th and a valid 3BB VPN certificate plus Jasmine-network sessions (shared infrastructure; Jasmine breach not confirmed). (source: Hunt.io) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Hunt.io)
Hunt.io — 3BB FortiGate / MeshCentral intrusion (14 Sep 2026)
breaches network identity
Incidents
Sat 12 Sep
Updated Thu 29 Oct
A Revolut spokesperson told The Guardian (17 September 2026) that Revolut had identified a sophisticated external impersonation scam in which an unauthorised third party used a legitimate government agency domain email to submit fraudulent requests for information; that on detection it immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators; that Revolut systems and customer funds are unaffected; and that it has contacted the limited number of impacted individuals directly. (source: The Guardian) TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity). (source: TechCrunch with Revolut confirmation) The Guardian reports the breach affected about 680 of Revolut's customers; OCCRP attributes that figure to a source familiar with the incident cited by Reuters. Revolut has not published a number. (sources: The Guardian; OCCRP) OCCRP (17 September 2026) reports that a group calling itself 'iamnotavillain' demanded 6,000 Monero, worth about US$3 million, threatening to sell the data. (source: OCCRP) A Revolut spokesperson told Reuters the company had received no direct contact or ransom demand. (source: OCCRP, citing Reuters) Correction (22 Oct 2026): an earlier version presented the 680-account figure and a US$3 million ransom demand as established facts; they come from news reports, and Revolut has said it received no demand. (source: OCCRP, citing Reuters) Correction (29 Oct 2026): removed a SecurityWeek link, details that came only from the hacker's own account as relayed by Hudson Rock, and an unattributed line from The Guardian.
TechCrunch — Revolut fake government-request disclosure (12 Sep 2026)
breaches identity
Incidents
Fri 11 Sep
Updated Mon 26 Oct
Japan's Digital Agency (news 11 September 2026) says unauthorised access to Government Solution Service (GSS) may have exposed about 246,000 personal-information records. Detection on 25 June 2026 (large-scale file access via a maintenance/operations account); on 9 July investigators found a third party had used a vulnerability in a network-connected VPN device to enter the system. That day the agency suspended the account and cut external communication from the compromised equipment. Possible leaked fields include names, email addresses, phone numbers, and addresses of GSS-using agency staff, associated public officials, and contractors/individuals who worked with those agencies. Agency says My Number, bank accounts, and pension numbers were not in the exposed set; no secondary misuse confirmed at publication. Q&A: vulnerability was previously published (not a zero-day) with a medium CVSS rating; product/CVE withheld for security. (source: Digital Agency notice) Updated 15 Sep 2026: BleepingComputer reported the notice on 14 September US time (15 September 4:36 am Perth). (source: BleepingComputer)
Digital Agency (Japan) — GSS unauthorised access / possible personal information leak (11 Sep 2026)
breaches identity network
Incidents
Fri 11 Sep
Updated Sun 25 Oct
Daily Hive (11 September 2026) reports that Telus confirmed unauthorised access to some customers' personal information. A Telus spokesperson told Daily Hive: "We recently identified and blocked unauthorized access to limited information contained in a small number of telecom consumer accounts," without saying how many accounts were affected. According to an email Telus sent customers, unauthorised individuals used compromised credentials to access customer accounts sometime between February 2025 and June 2026, and may have used the account information to contact customers to persuade them to move their services to competitors and/or made unauthorised changes to their Telus services. The compromised information included full name, account number, billing address, preferred language and phone numbers, and in most cases email address, the last four digits of the payment card on file, the types of service, amounts charged and payment history. Telus says it notified affected customers, provided complimentary identity protection (two years of Telus Guardian through Norton; enrol by 30 November 2026) and contacted law enforcement and the Privacy Commissioner of Canada. Telus has not said where the credentials came from. Distinct from the data theft Telus confirmed in March 2026. (source: Daily Hive) Correction (25 Oct 2026): the card date has moved from 14 to 11 September 2026, the date of Daily Hive's report (11:16 pm Perth time), and the card now rests on that report; a reference to Vancouver Police, which Daily Hive does not mention, has been removed. (source: Daily Hive)
Daily Hive — Telus confirms 'unauthorized access' to some customers' personal information (11 Sep 2026)
breaches identity
Incidents
Fri 11 Sep
Updated Tue 27 Oct
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a DAVID driver-database breach; according to BleepingComputer, the confirmation came after the ShinyHunters extortion group claimed it had breached the database. In a statement posted to X, FLHSMV said it learned of the breach on 4 September 2026, that it was quickly mitigated, and that no further breach is ongoing. Investigation found attackers used compromised credentials of a single Plant City Police Department user that had been improperly stored on the employee’s personal electronic device. FLHSMV notified the Florida Office of the Attorney General and is working with the Florida Digital Service and Florida Department of Law Enforcement; further detail withheld pending the criminal investigation. FLHSMV has not disclosed how many records were accessed. According to BleepingComputer, FLHSMV's finding that a single user's stolen credentials were used differs from how ShinyHunters claimed to have got in. No Australian nexus identified. (sources: FLHSMV X statement; BleepingComputer) Updated 16 Oct 2026: FLHSMV issued a public notice saying its investigation with the Florida Digital Service and the Florida Department of Law Enforcement found the potentially affected information includes driver licence and motor vehicle data, including document images, and other personal information. It is mailing letters this week to current driver licence and ID card holders who may be affected, offering one year of identity and credit monitoring plus $1 million identity-theft insurance through Sontiq, a TransUnion company. Because it may not have current addresses for former licence, ID or title holders, it also issued a substitute notice under Florida's breach law (s. 501.171) and asks them to contact the department if no letter arrives. FLHSMV still has not said how many people are affected and says it has no evidence the data has been misused. Correction (25 Oct 2026): removed the extortion group's own claims about how many records it took, how it got in and the screenshot it offered as proof; FLHSMV has not confirmed any of them. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 8 to 11 September 2026, the earliest date its linked sources visibly show (BleepingComputer's report and FLHSMV's statement on X, both 11 September). (source: BleepingComputer)
FLHSMV — Public Notice Regarding September Security Incident (16 Oct 2026)
breaches identity
