The Luanti project says an attacker gained unauthorised access to ContentDB's servers and data, including emails, hashed passwords and uploads, in a notice titled 'URGENT: ContentDB security incident: 22–26 October 2026' on the Luanti blog (web address dated 27 October 2026). Luanti says the attacker broke in by exploiting two vulnerabilities, one in a third-party component that it has reported to the maintainer. In UTC: from 22 October 13:00 the attacker had access to ContentDB's internal configuration and used it to sign into a staff account (the configuration also allowed modifying uploads and sending emails, but Luanti has no evidence this took place); a patch for one of the vulnerabilities was coincidentally deployed on 22 October at 17:35; from 24 October 23:00 the attacker probed for remote code execution; from 26 October 00:15 the attacker had full access to run commands on the server inside a docker container; and on 26 October at 09:00 Luanti discovered the break-in, took ContentDB offline and revoked all secrets, including sessions, API tokens and GitHub OAuth tokens. Luanti says the attacker had full access to the secrets, database, redis and uploads: usernames, emails and passwords stored as salted bcrypt hashes; IP addresses, not linked to any account, of people who downloaded or viewed packages in-game in the two weeks before 26 October; and uploaded packages and release files. With the secret key the attacker could act on behalf of any account. Luanti says it checked every upload against backups and found no changes, but has not ruled out that ContentDB served malicious uploads during the vulnerable period. ContentDB will stay offline for security updates, likely for a week or more.
Luanti Blog — URGENT: ContentDB security incident: 22–26 October 2026
breaches
Incidents
Tue 27 Oct
Updated Sat 31 Oct
Sony Network Communications said in a notice dated 27 October 2026 (in Japanese) that the member database of its So-net internet service was accessed without authorisation from outside on 19 October; it confirmed the access on 23 October, stopped the affected server and cut off communications from the source, and on 24 October established that personal information had leaked. The company lists 2,141,986 So-net member records (1,869,771 current members and 272,215 former members who left in March 2026 or later) and 443,495 plala (S Course) member records (422,365 current and 21,130 former), covering name, phone number, email address, user ID, date of birth, gender and internet connection ID, and says no passwords were leaked from these records. Separately, it confirmed the leak of email addresses together with their mailbox passwords across four mail services, 54,401 in total by this desk's addition of its per-service figures (Mail Service (G) 24,655, A-Box 17,672, So-net VAIO Mail 7,005 and PostPet mail account service 5,069), which it reset on 27 October, as well as 16 bank account records (it says it holds no account PINs) and 7 password-reset notice records. The company says none of the leaked data includes credit card information, that it has not confirmed any leak from NURO or its other services, and that people who left by the end of February 2026 are not affected. It gives the cause as unauthorised access by a third party (under investigation), says it has reported the incident to Japan's Personal Information Protection Commission, and says that, as far as it knew on 27 October, no secondary damage had been confirmed. (source: So-net notice) Correction (30 Oct 2026): removed the Help Net Security link and the line citing it, because this desk could not read that page; every fact on this card comes from So-net's own notice. (source: So-net)
So-net (Sony Network Communications) — So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ (27 Oct 2026, Japanese)
breaches
Incidents
Tue 27 Oct
Updated Mon 2 Nov
TrendAI (Trend Micro) published research on 27 October 2026 describing three attack infrastructures, rebuilt from exposed open directories, that targeted Japan with different levels of AI use. In Case A, TrendAI says a CyberStrikeAI setup with a Simplified Chinese console split work across 44 agents (reconnaissance, vulnerability search, exploitation and exfiltration), and at least 19 identifiable organisations, including at least 16 in Japan, were subjected to validation activity in October 2026; TrendAI says deep compromise was limited. In Case B, a human-led operator used LLM help, targeted AI and GPU services and, through a GIS server with default credentials, reached several hundred thousand cadastral and commercial records over about 24 days in August and September. Case C made limited use of AI and ran at least six campaigns from January to October against Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210 devices and WebLogic servers. TrendAI says it does not know whether the cases share an operator, withheld indicators of compromise and plans to provide its results to law enforcement. (source: TrendAI) Correction (29 Oct 2026): removed an "(English edition)" note. (source: TrendAI) Correction (02 Nov 2026): removed The Hacker News as a source. (source: TrendAI)
TrendAI — Not Only ARTEX: The Different Levels AI Is Used in Attacks Targeting Japan (27 Oct 2026)
ai network
The US Justice Department announced on 27 October 2026 that Artem Stryzhak, 36, a Ukrainian national formerly of Barcelona, Spain, was sentenced to 70 months in prison for conspiracy to commit computer fraud over ransomware attacks on hospitals, government entities, law firms and other businesses. According to the DOJ, he joined the Nefilim conspiracy as an affiliate from about June 2021, agreeing to pay Nefilim administrators including Volodymyr Tymoshchuk 20% of ransom proceeds; his Nefilim attacks included a June 2021 data theft from an oil and gas transportation company, and he worked with Nefilim until at least October 2021. The DOJ says he was also one of Hive's earliest affiliates and deployed Hive against seven victims, including law firms, a dentist office and a healthcare provider; the FBI gave a decryption key to one of them. He was arrested in Spain in June 2024, extradited in April 2025 and pleaded guilty in December 2025 to two counts of conspiracy. The FBI's Brett Leatherman said the groups caused more than $100 million in losses. The US State Department offers up to $11 million for information on Tymoshchuk. The Record (27 Oct) reports that throughout 2021 Stryzhak used Nefilim against organisations in the U.S., Canada and Australia.
US Department of Justice — Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses (27 Oct 2026)
breaches australia
US prosecutors announced on 27 October 2026, in a release published by the US Secret Service, that the Justice Department's Scam Center Strike Force had charged six Africa-based scammers with connections to Southeast Asia and China. According to affidavits unsealed that day, a group linked to Malaysia and China opened scam compounds in Madagascar in early 2025, likely after law enforcement action in Cambodia. Scammers posed as women on US dating sites, persuaded victims to connect their crypto wallets to fake NFT investment sites, and then pulled money from the wallets without their knowledge. The FBI identified about 74 crypto wallets associated with about 800 victims, and funds moved to accounts associated with Chinese-based actors; websites used in the scheme were seized. Chui Kok Wa was charged with conspiracy to commit wire fraud as the leader. In August 2026 the FBI helped Madagascar police take down 13 compounds and seize more than 3,200 devices, but the release says Madagascar repatriated numerous suspects to China before the investigation was complete. The Strike Force says it has restrained $1,006,460,156.82 in crypto overall. The Record (27 Oct) reports losses of more than $516,695.
US Secret Service — Scam Center Strike Force Expands Reach to Target Global Crime Syndicates; Charges Scammers Based in Africa and Tied to China (27 Oct 2026)
breaches
Italy's Chamber of Deputies confirmed on 27 October 2026 that its IT systems were hit by a cyberattack involving some parliamentary email accounts, including one assigned to Prime Minister Giorgia Meloni as a deputy, Euronews reported. The Chamber's press office said the matter was not an emergency and that all protective measures had been taken in cooperation with Italy's national cybersecurity agency ACN, which may include temporarily disabling some system functions, and that similar attack attempts against other national, European and international institutions had intensified in recent days. Citing Corriere della Sera, Euronews said three addresses were involved: Meloni's deputy mailbox, which she does not use, and those of Andrea Delmastro (Fratelli d'Italia) and Paolo Formentini (Lega). ANSA reported the same day that Rome prosecutors were awaiting a first report from the Polizia Postale and would open an investigation into unauthorised access to a computer system.
Euronews (Italian) — Attacco hacker alla Camera dei Deputati, verifiche su alcune email tra cui quella di Meloni (27 Oct 2026, 12:07 CET)
breaches
Incidents
Tue 27 Oct
Updated Wed 28 Oct
BleepingComputer reported on 27 October 2026 (US time) that Warp, the developer tool that started as a terminal and became an agentic development environment, has disclosed a breach in which agent decision logs and telemetry data belonging to Warp users were exposed in an attack on a third-party vendor in its infrastructure. According to BleepingComputer, Warp founder and CEO Zach Lloyd said: "On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure", and "We detected the operation within hours and were able to remediate and mitigate the impact." Lloyd estimates that "roughly 1% of Warp users may have been impacted", BleepingComputer reports. BleepingComputer says agent traces and telemetry were identified as potentially affected data, and that the company did not clarify whether the exposed information included source code, prompts, credentials or other sensitive details. According to BleepingComputer, Lloyd said analysis suggests the attack was powered by "an agent swarm" relying on "a very sophisticated penetration and escalation technique", and that Warp has contacted the vendor about the vulnerability but no details have been shared. BleepingComputer also reports that Warp has notified users identified as affected, engaged CrowdStrike to assist with the investigation and informed law enforcement. BleepingComputer does not name the vendor. (source: BleepingComputer) Correction (28 Oct 2026): the card was dated 28 October; its only source, BleepingComputer, is dated 27 October 2026 and shows no time zone, so the card now carries that date. (source: BleepingComputer)
BleepingComputer — Warp discloses breach exposing AI agent logs, user telemetry data (27 Oct 2026)
breaches ai
French energy company ENGIE has confirmed that attackers accessed customer data after breaching a tool used by its partners to market energy offers, BleepingComputer reported on 27 October 2026. An ENGIE spokesperson told BleepingComputer: "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers." According to BleepingComputer, ENGIE cut off the attackers' access to the platform, says the incident is limited to customers in France, has notified the relevant authorities and has contacted affected customers, but did not say how many customers were affected. ENGIE told BleepingComputer that "the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected." BleepingComputer says ENGIE's breach notification letters to customers list first and last names, mailing address, email address, phone number, the electricity delivery point (PDL) or gas metering point (PCE) number, customer ID and contract number. ENGIE did not attribute the attack to a specific group, and BleepingComputer says no ransomware or extortion gang had claimed it before publication. (source: BleepingComputer)
BleepingComputer — Energy giant ENGIE discloses data breach affecting customers (27 Oct 2026; includes ENGIE spokesperson statement)
breaches
Incidents
Mon 26 Oct
Updated Sun 1 Nov
The Bathurst RSL Club has confirmed it recently responded to a cyber security incident, Cyber Daily reported on 26 October 2026. “Bathurst RSL Club is aware of claims made online by an unauthorised third party,” the club's CEO, Peter Sargent, told Cyber Daily. (source: Cyber Daily) Correction (31 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily) Correction (01 Nov 2026): removed an unconfirmed attacker claim from the title and summary. (source: Cyber Daily)
Cyber Daily (26 Oct 2026)
australia
Incidents
Mon 26 Oct
Updated Wed 28 Oct
Sansec reported on 26 October 2026 that a Brazilian Magecart group it says has been active since 2024 planted a payment skimmer in the self-hosted Plausible Community Edition analytics tracker run by Brazilian checkout platform Convertr (analytics.convertr.app.br). According to Sansec, from 24 October checkout.convertr pages that loaded the tracker sent the card number, expiry date, CVV, cardholder name and CPF (Brazilian taxpayer number) to 1x0.is, and the skimmer was updated on 26 October to target the exact field names of Convertr's payment API. According to Sansec, Convertr says its merchants have sold more than R$2 billion (about €320 million) through the platform and that browsers may cache the script for up to 24 hours. Sansec suspects the entry point was CVE-2026-8467, an unauthenticated command-execution flaw via /storybook in Plausible CE 3.0.0 to 3.2.0 that Plausible fixed in May 2026 (Sansec advises upgrading to 3.2.1 or later), but says it cannot confirm this. In a 27 October update Sansec said Convertr had removed the skimmer, upgraded Plausible and was notifying merchants, payment providers and authorities, and that Sansec had confirmed the tracker was clean. Sansec said it had notified Convertr but received no response before its 26 October publication, and BleepingComputer (27 Oct) said it contacted Convertr for a statement and had not received a response. Correction (28 Oct 2026): removed a 15 May 2026 fix date that no linked source gives (Sansec says Plausible fixed the flaw in May 2026), corrected 'tracked since July 2024' to Sansec's 'active since 2024', credited the R$2 billion sales figure to Convertr as reported by Sansec, and changed the title to say Sansec reported the removal on 27 October rather than giving that as the removal date. (source: Sansec)
Sansec — Convertr / Plausible supply-chain attack (26 Oct 2026, updated 27 Oct)
breaches
Incidents
Mon 26 Oct
Updated Thu 29 Oct
The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, says it experienced a cybersecurity event on Monday 26 October 2026. In updates on its newsroom, UNM HSC said its IT security teams began containment around 11 a.m. that day after identifying a threat, notified state and federal law enforcement, engaged external partners and that UNM Hospital leadership activated an Emergency Operations Center. UNM HSC said its assessment found the event affected some end-user devices but did not penetrate core systems or servers. From 12:30 to 2:30 p.m. on Monday, UNM Health diverted ambulance traffic to other area health systems, and system outages required it to suspend outpatient surgeries and appointments for the rest of the day; The Record reports ambulances went to health systems in Albuquerque and Santa Fe for about two hours. In its update as of 2:02 p.m. on 27 October, UNM HSC said critical electronic systems were back online, all UNM Health hospitals were fully open, ambulance traffic had returned to normal and clinics had resumed regularly scheduled appointments and procedures, while classes at the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health remained cancelled on Tuesday 27 October. "Because this remains an active law enforcement investigation, we are limited in what we can share at this time," UNM HSC said. According to The Record, a spokesperson did not respond to questions about whether ransomware was involved, and a ransomware gang called BYOD, which The Record says emerged last month, claimed the attack; UNM has not confirmed that claim or any data theft. (source: The Record) Correction (28 Oct 2026): removed the BYOD gang's own claims that it compromised 36,000 machines and stole student, patient and employee data, and a description of its leak-site listing credited to Help Net Security (not linked), under Cyberstack's policy that gang claims are not reported as fact; the card now adds UNM HSC's 27 October update that the event affected some end-user devices but not core systems or servers. (source: UNM HSC newsroom; The Record) UPDATE (28 Oct 2026; UNM HSC): In an update dated 28 October, UNM HSC said classes and research activities at the Health Sciences Center resumed on Wednesday and clinical operations across all UNM Health facilities are fully functional, and that UNM did not make concessions with any group behind the threat. It warned that those responsible may attempt to exploit individuals through additional scams, including false offers of payments or compensation, and said patients, students, employees and community members should not respond to or engage with anyone claiming responsibility for the incident. (source: UNM HSC newsroom; The Record)
UNM HSC Newsroom — UNM Warns Public Not to Engage with Any Groups Claiming Responsibility for Cybersecurity Threat (updates of 26–28 Oct 2026)
breaches healthcare
The University of Copenhagen in Denmark has confirmed a cyber attack in which hackers gained access to one of its test environments, which held personal data belonging to 525,000 people, according to BleepingComputer, which reported on 26 October 2026 that the university detected the breach the previous Tuesday and disclosed it on Friday. According to BleepingComputer, the university is still investigating the extent of the incident and warns that full names, national identity numbers (CPR), phone numbers and email addresses may have been exposed. In an update reported by BleepingComputer, the university added another 20,000 staff and students whose PIN codes were exposed; it has restricted physical access to certain critical locations on campus as a precaution and is reopening them as it hands out new access codes. BleepingComputer reports the university says it contained the attack and blocked the attacker's access, that there is no indication the attackers reached systems supporting daily operations or disrupted university activities, and that it has reported the incident to the Danish Data Protection Agency. The university's own notice (news.ku.dk) could not be read by Cyberstack (connection failed); the details above are as reported by BleepingComputer.
BleepingComputer — University of Copenhagen data breach exposes data of 525,000 people (26 Oct 2026)
breaches
