Socket (28 August 2026) reports that ten versions of npm package @7nohe/openapi-react-query-codegen were published that day after a comment-triggered GitHub Actions trusted-publishing workflow was abused. An untrusted GitHub account could comment a publish trigger on a pull request and ship fork code under the repository OIDC identity. Versions named by Socket and Step Security are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, plus two 0.0.0-sha prerelease tags. Stable releases ran obfuscated JavaScript 3FWCvzduYZg.js via binding.gyp and/or a preinstall hook. Socket describes Mini Shai-Hulud-consistent self-propagation. Install-time code targeted cloud credentials, package-registry credentials, GitHub Actions secrets and AI-agent configuration. All ten carried valid npm provenance. Pin known-good 0.5.3, 1.6.2, 2.2.0 or 3.0.2, isolate affected hosts, then rotate tokens. This Cyberstack does not attribute the package to TeamPCP; Socket and Step Security do not name that group.
Socket (28 Aug 2026)
tech cloud identity
Incidents
Fri 28 Aug
Updated Sun 1 Nov
Hasbro has disclosed that attackers accessed the personal and financial information of an undisclosed number of employees, BleepingComputer reported on 28 August 2026. According to BleepingComputer, Hasbro filed data breach notification letters with the Massachusetts Attorney General's Office but did not disclose the total number of people affected or when the incident was detected. BleepingComputer quotes the letters: "The information involved varied by individual but may have included your name and one or more additional personal information elements such as email, address, phone number, national ID number, or financial information," and "Hasbro implemented containment and remediation measures, including disabling the compromised employee account, terminating unauthorized access, and deploying additional safeguards designed to help prevent a similar incident from occurring in the future." Citing the Massachusetts Attorney General's Office 2026 Data Breach Notification Report, BleepingComputer says the Social Security numbers, financial account information, credit/debit card numbers and driver's licence information of 436 Hasbro employees in Massachusetts were affected. Hasbro did not link this breach to the cyberattack that hit its systems on 28 March, according to BleepingComputer. Correction (28 Oct 2026): the Massachusetts letter and breach-list pages return HTTP 403 to Cyberstack, so their links, the letter number and a line on customer impact were removed; the details above are credited to BleepingComputer, which quotes the letters. (source: BleepingComputer)
BleepingComputer — Toy-making giant Hasbro disclose data breach affecting employees (28 Aug 2026)
breaches identity
Incidents
Fri 28 Aug
Updated Fri 30 Oct
Sharp Motor Group, a Tweed Heads-based car dealership, has confirmed a third-party cyber incident, according to Cyber Daily (28 August 2026). Storm claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (30 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily)
Cyber Daily — Sharp Motor Group confirms third-party cyber incident in wake of ransomware claims (28 Aug 2026)
australia retail
Incidents
Fri 28 Aug
Updated Thu 29 Oct
McKesson's Form 8-K (dated 28 August 2026) says that on 25 August 2026 it discovered a cybersecurity incident affecting its information systems, that its investigation is in its early stages, and that information and updates are available at www.mckesson.com/cybersecurity. As of the filing date, McKesson had not determined that the incident is material or that it has had, or is reasonably likely to have, a material impact on the company, including its financial condition or results of operations. (source: McKesson Form 8-K) Correction (24 Oct 2026): removed a reference to an extortion group's unconfirmed claims about patient records and access methods; McKesson's notice and 8-K do not confirm them. (source: McKesson Form 8-K) Correction (29 Oct 2026): a bare link credit was replaced with a named credit. (source: McKesson Form 8-K) Correction (29 Oct 2026): McKesson's cybersecurity web page could not be read (the address redirects to an empty page), so the details that only that page gave have been removed: the 28 August customer notice, the involvement of third-party applications and data exfiltration, and the 29 August operations update. The card now rests on McKesson's Form 8-K, and the title has been changed to match. (source: McKesson Form 8-K)
McKesson Form 8-K (28 Aug 2026)
breaches healthcare
iTnews (28 August 2026), citing an NSW Police statement, reports that a 30-year-old telecommunications employee was arrested at a police station in Sydney's west and charged over allegedly accessing customer data through his employment and selling it to criminal groups. Police allege the information was then used to commit fraud against multiple victims. Charges listed in that report are 12 counts of deal with identity info to commit an indictable offence, 12 counts of unauthorised function with intent to commit a serious offence, and 10 counts of agent corruptly receive benefit (34 offences). The arrest followed a Queensland Police referral. iTnews does not name the employer. The National Tribune reprint of the police release dates the arrest about 9.30am on Thursday 27 August 2026, refused bail to Liverpool Local Court the same day. These are allegations before a court.
iTnews (28 Aug 2026; quotes NSW Police)
australia identity
Incidents
Thu 27 Aug
Updated Wed 28 Oct
The US Bureau of Alcohol, Tobacco, Firearms and Explosives said in a press release, as reported by BleepingComputer (27 August), that a standalone system was breached in what it described as a 'major incident', which it is investigating with the Justice Department. BleepingComputer quotes ATF as saying the impacted system operates separately from the ATF enterprise network, that there is no indication the incident has affected the enterprise network, the ATF eForms system or any other ATF system, that on discovery ATF immediately terminated connections to the affected environment and initiated incident-response and forensic activities, and that it is coordinating closely with the Justice Department to investigate; BleepingComputer adds that ATF said the incident did not affect the agency's operations. BleepingComputer reported that Qilin added ATF to its data leak portal on 26 August without saying whether it had stolen files or demanded a ransom, and that ATF published its press release the same day. Actor claims are not treated as verified facts on Cyberstack. UPDATE (25 Oct 2026): ATF said on X on 31 August that it is aware of claims about the possible publication of data allegedly obtained in the incident, which involved a standalone system used in connection with CALEA; that it is working with the Justice Department and other federal partners to assess the claims; that the affected system was separate from ATF's enterprise network; and that it has not confirmed the authenticity, nature or scope of the materials. (source: ATF on X) Correction (26 Oct 2026): ATF's press release cannot be read by Cyberstack, so its text is now credited to BleepingComputer, which quotes it; an earlier correction saying the release was readable and was the primary source was wrong. Details that BleepingComputer does not report (the release's printed date, the designation of the event by senior Department officials, completed notifications and a statement about ATF's missions) and an unlinked SecurityWeek credit have been removed. The card date has moved from 28 to 27 August 2026, the date of BleepingComputer's report. Earlier, on 25 Oct, we removed SecurityWeek's description of the Qilin post and credited the listing to BleepingComputer. (source: BleepingComputer) Correction (28 Oct 2026): BleepingComputer's report and ATF's X post show times with no time zone, so the card now gives their dates only (27 and 31 August) and drops the Perth and US-time conversions; the card date stays 27 August. (sources: BleepingComputer; ATF on X)
BleepingComputer — ATF confirms "major incident" after recent Qilin breach claims (27 Aug 2026; quotes ATF press release)
breaches
Incidents
Thu 27 Aug
Updated Thu 29 Oct
MAG’s 27 August 2026 statement said an unauthorised third party obtained customer data from car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports (emails, phones, vehicle registrations, postcodes; no bank details; operations unaffected). The BBC (2 September 2026) reports that criminal hackers posted the personal data of nearly nine million people online after breaching the three airports, and that they extorted MAG for an undisclosed amount but failed to get their ransom paid; it quotes MAG saying it has contacted all those affected, including everyone with upcoming bookings. (source: BBC News) A group calling itself FulcrumSec claimed responsibility, according to Computer Weekly. (source: Computer Weekly) Have I Been Pwned, which added the data on 2 September 2026, lists about 8.8 million affected email addresses and phone numbers, with names, browser user agent details, IP addresses, purchases and vehicle registration plates also present. (source: Have I Been Pwned) MAG’s original mediacentre statement remains the operator notice. Correction (22 Oct 2026): the headline previously stated the leak came 'after ransom refusal' as fact; MAG has not said so, and the BBC reports only that the hackers failed to get their ransom paid. (source: BBC News) Correction (29 Oct 2026): removed claims made by FulcrumSec that no confirmed source supports, and a SecurityWeek link.
MAG statement (27 Aug 2026)
breaches identity
Hachette Australia told ABC News that unauthorised activity on the computer systems of its distribution subsidiary Alliance Distribution Services (ADS) was believed to have occurred on 18 July 2026. As of the 27 August 2026 ABC report, Hachette said it was still restoring systems and services, could not yet confirm a timeline for a full return to normal operations, and that restoring full operations securely remained its top priority. The disruption has hit book supply to Australian bookshops and authors ahead of the busy trading period. Hachette has not publicly confirmed whether the incident involved ransomware, data theft, or another form of attack. Secondary commentary that labels the event ransomware remains unverified by the company.
ABC News (quotes Hachette)
australia supply chain
Incidents
Thu 27 Aug
Updated Tue 3 Nov
Joint AFP, Western Australia Police Force and FBI release: two West Australian men were charged on 26 August 2026 with a combined 14 offences after Perth search warrants. Police allege a syndicate inserted malicious code into software on an open-source repository that other developers then pulled in. The AFP estimates more than 1,000 organisations globally, more than 500,000 credentials, and at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. The FBI statement in that release names the group TeamPCP. The men are not named in the AFP release. The investigation continues; further arrests have not been ruled out. (source: AFP) Correction (28 Oct 2026): removed an internal label and a statement that TeamPCP used an autonomous multi-agent framework to harvest credentials in under six hours. (source: AFP) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: AFP)
AFP media release
australia supply chain
Incidents
Wed 26 Aug
Updated Fri 23 Oct
Boston Scientific's customer updates say it identified a cybersecurity incident on 25 August 2026 that resulted in a network outage and disruption to its operations; the incident affected access to certain operating systems and business applications, including the ability to manufacture products and to process and ship customer orders (updates of 26, 27 and 29 August). The company filed an 8-K on 26 August describing a global disruption to its operations. It worked with CrowdStrike and other third-party cybersecurity experts. Its 30 August update (8:25 p.m. ET) said it saw no indication of unauthorised activity in its environment related to the incident since 25 August, that there was no impact to its cloud-based systems and applications, and that the unauthorised activity was limited to certain on-premise systems. Its 27 August update said its investigation to date showed no impact to implantable cardiac rhythm management (CRM) device function or to remote monitoring of CRM devices monitored before the disruption, while new remote-monitoring activations were impacted. Actor identity is unknown on Cyberstack. UPDATE (23 Oct 2026): Boston Scientific's 22 September 2026 update shares CrowdStrike's final investigation summary: the threat actor gained access to an external-facing network device and then to a limited portion of the on-premises IT environment. CrowdStrike found no evidence of ongoing threat actor activity after the 25 August containment measures, no evidence of compromise within Microsoft Office 365 applications (including email), other cloud-based applications or the listed business systems (manufacturing maintenance, product and software development, medical device maintenance, human resources and employee benefits, and SCADA environments), and no evidence that the actor accessed, staged or exfiltrated data from those systems and applications, including customer or patient data. Boston Scientific says customers and partners may safely continue normal business activities and system connections. (source: Boston Scientific (news.bostonscientific.com))
Boston Scientific — Update on the August 25 cybersecurity incident (22 Sep 2026)
breaches
Incidents
Fri 21 Aug
Updated Fri 23 Oct
Origin Energy confirmed unauthorised access to personal information of approximately 900,000 current and former customers in July 2026. Categories include name, address, date of birth, contact phone, account details, and partial payment data (last four digits of a credit card or last three of a bank account). On 21 August 2026 Origin said a completed review found about 60 customers had full bank account numbers accessed, about 100 had an ID document number accessed (number only, no scans), and about 15,000 had government concession-scheme numbers accessed. Origin told ABC the alleged attacker had not publicly leaked customer data. The company is working with ASD's ACSC, the National Office of Cyber Security, AFP and OAIC; a criminal investigation continues. Earlier reporting linked the incident to a former Accenture Manila call-centre worker; Accenture declined to comment to ABC. UPDATE (23 Oct 2026): AAP reports that at Origin's annual meeting on 14 October 2026 chairman Scott Perkins said: 'We have seen no evidence of the information being published on the internet or the dark web to date; however we note this risk remains and affected customers will need to remain vigilant to any suspicious activity or scams.' (source: AAP)
ABC News (quotes Origin 21 Aug update)
breaches australia
Oz Hair and Beauty's official statement says its online purchase and order platform was briefly accessed by an unauthorised third party. Limited personal information of some customers who purchased before August 2026 was involved: full name, email and/or mobile, and purchase data (currency, total spend, purchase location, customer creation date). The company says credit cards, passwords, payment information and invoice details were not accessed. It reported the incident to ACSC, OAIC and New Zealand's Office of the Privacy Commissioner. Customers not emailed by 22 August 2026 were, on that statement, not identified as impacted on the investigation to date. The company has not published a count of affected records.
Oz Hair and Beauty statement
breaches australia
