Incidents
Tue 20 Oct
Updated Thu 29 Oct
BILD reported, in an article dated 20 October 2026 (09:20 German time), that a website had published that day what it says are 421,179 emails (281 GB) from Germany's Alternative für Deutschland (AfD) party, along with AI-generated summaries of selected messages attributed to party figures including co-leader Alice Weidel, honorary chairman Alexander Gauland and Leif-Erik Holm. In a limited look at the material, BILD saw a photo of the identity card of Markus Frohnmaier, deputy leader of the AfD group in the Bundestag, other identity documents, invoices, bank statements, certificates, and membership applications and member lists from AfD district branches in North Rhine-Westphalia. An AfD spokesperson confirmed to BILD that in September 2026 a hosting provider used by the party was hacked and parts of a few mailboxes, most of them unused for years, appear to have been unlawfully copied. The party says the attack was stopped quickly, all affected users were informed, current mailboxes of the federal party were not affected, and it is examining the published material. According to B.Z., an internal AfD email to its state branches gives the same account. It is not yet confirmed whether the published files are genuine or whether they all come from the September intrusion. AfD has not named the hosting provider, and nobody has publicly claimed the attack or been identified. (sources: AfD; BILD; B.Z.) Correction (24 Oct 2026): an earlier version said the emails were published on 19 October and that BILD reported it that evening; BILD's article is dated 20 October 2026, 09:20, and says the material was published that day. (source: BILD) UPDATE (27 Oct 2026; AfD, Have I Been Pwned): In its own statement dated 20 October 2026, the AfD says a hosting provider used by the party was hacked at the end of September 2026 and that the data taken then has now been made accessible through an activist website. The federal party says that although only a few mailboxes were unlawfully copied, large amounts of data flowed out; that it informed the mailbox owners and the data protection officer at the time; and that it is in close contact with the security authorities and has reported both the attack and the publication of the data. Have I Been Pwned added the breach on 27 October 2026, saying it exposed 345k unique email addresses (data classes: email addresses and email messages); HIBP has flagged it as a sensitive breach, so an address can only be checked by its verified owner through HIBP's notification service, or by searching a domain the person controls. (source: AfD; Have I Been Pwned) Correction (27 Oct 2026): this card was previously dated 19 October; it now carries 20 October, the date of its earliest sources (the AfD statement and BILD's article). (source: AfD)
AfD — AfD zum Daten-Hack: Angriff auf Parteiensystem und Demokratie (20 Oct 2026)
breaches
Incidents
Mon 19 Oct
Updated Sat 24 Oct
PingCAP published a security incident report on 19 October 2026 saying that between 9 September and 7 October 2026 an unauthorised party used stolen service-account credentials to access certain PingCAP internal systems, copy data and obtain source code. PingCAP says it became aware on 7 October and began disabling the affected credentials that day, deleted further compromised credentials and removed excessive cross-project permissions by 10 October, and that as of 14 October all identified compromised credentials were invalidated and identified unauthorised access paths blocked. PingCAP says exported records included TiDB Cloud user names and email addresses, organisation and project associations, SQL editor text and errors, and some organisation, project and cluster identifiers, plus business and billing information (customer contacts, contract terms, orders, pricing, payment terms and billing configuration); it says this does not mean every customer had every category exposed and it is still establishing per-customer impact. It says an exported table contained encrypted TiDB Cloud API-key values and that one investigator-owned value tested by its external incident response firm could not be used directly as an API key, while whether other usable credentials were exposed is still being determined. PingCAP says the external firm found no evidence the attacker ran commands or kept persistent access in the production systems reviewed, and that with outside counsel and forensic specialists there is no evidence data stored in TiDB was impacted. It says the firm reported four vulnerabilities on 12 to 13 October, which PingCAP fixed by 14 October, and that it is checking production logs for earlier exploitation. PingCAP says it will notify affected customers directly. Source: PingCAP security incident report (19 Oct 2026). UPDATE (24 Oct 2026): PingCAP co-founder and CEO Max Liu published a note on 23 October apologising to customers, saying 'This happened on my watch' and that he takes responsibility for it, and pointing to a completed independent investigation by NebuSec. NebuSec's report (findings as of 21 October) says the attacker got in through a compromised GitHub account exposing private repositories, then used keys and tokens harvested from those repositories and Terraform state to reach Google Cloud, Jira and the internal chat system used for TiDB alerts. Through Jira support tickets it harvested credentials customers had shared during support work, including AWS keys that reached several S3 buckets holding customers' TiDB diagnostic data. NebuSec says eight compromised Google Cloud service accounts were used, 6,458 BigQuery tables were exported on 23 and 24 September and Cloud Storage data was downloaded with rclone; the data taken includes TiDB Cloud control-plane metadata, customer SQL editor history, AI interactions and gateway connection logs, CRM and billing records, support tickets and attachments with embedded credentials, source code, Jira issues and internal chat history. NebuSec found no evidence that data in customer TiDB databases was accessed or of attacker command execution or persistence in production, and says the encrypted TiDB Cloud API-key values could not be decrypted because the encryption key was not exposed, which does not apply to credentials shared in support materials. It says the four vulnerabilities it found were patched and retested with no evidence of earlier exploitation, and it publishes six attacker IP addresses. (source: PingCAP CEO note; NebuSec)
PingCAP — Security Incident Report: Unauthorized Access to PingCAP Cloud Resources (19 Oct 2026)
breaches cloud identity
Incidents
Mon 19 Oct
Updated Tue 27 Oct
Developer hosting and deployment platform Zeabur published a preliminary report on 19 October 2026 on a second breach in two months. It says that on 14–15 October an attacker used leaked Zeabur internal credentials (AWS keys and shared-cluster admin tokens stored in plaintext in a private configuration repository, with no expiry and never rotated since January 2024) to break into its shared clusters in nine regions, some customer Dedicated Servers and internal systems, and eventually read the platform database. Zeabur says the root cause was its own: long-lived admin credentials stored in plaintext and usable from the public internet, which its rotation after the late-August breach did not cover. Confirmed exposure includes 3,218,965 service environment-variable records (names and values), account, project and service data for 321,810 accounts, and 566 plaintext zSend API keys (revoked). The attacker ran commands inside 865 customer database services, including n8n instances whose encryption keys sat in environment variables (602 of 607 checked), so their stored third-party credentials were effectively exposed, and planted a program that called back to an external host in at least two PostgreSQL databases in Tokyo. The attacker signed in as root to 101 customer servers on Google Cloud using root passwords stored in plaintext in server initialisation settings, added their own SSH keys on 50 of them, and attached 16 copies of customer disks to five virtual machines they created. They also read about 53 production secrets, including the Zeabur GitHub App private key (rotated; no use found), and tokens for managing customer servers at Hetzner and DigitalOcean leaked with the database (revoked 16 Oct). Database backups in the Taipei and Hong Kong regions may have been downloaded. More than 16 hours of activity on 14 October raised no alerts; Zeabur learned of it from a user report. Zeabur has signed out all users, revoked all platform access tokens and leaked keys, and blocked public SSH to admin interfaces. On 17 October founder Yuanlin Lin announced the platform will wind down: new purchases have stopped, shared-cluster services pause and server renewals stop from 1 December, and everything shuts down by 31 December 2026. No country breakdown of affected users has been published. (sources: Zeabur preliminary report; BleepingComputer) Updated 20 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 20 October 2026; details credited to BleepingComputer on this card come from that report.
Zeabur — October 2026 security incident (preliminary report, 19 Oct 2026)
breaches cloud identity
Chukwuemeka Victor Amachukwu, 40, was sentenced in the US District Court for the Southern District of New York to eight years in prison, US Attorney Jamie McDonald announced on 19 October 2026, according to BleepingComputer's report of the press release. He had pleaded guilty to conspiracy to commit computer intrusions and wire fraud after extradition from France in August 2025. With co-defendant Kingsley Uchelue Utulu and other co-conspirators, he sent spearphishing emails to tax-preparation businesses in New York, Texas and other states between 2019 and 2021, got into their computers and took tax and personal data on at least 800 of their clients. The group used it to file for about US$8.4 million in refunds with the IRS and state tax agencies, receiving about US$2.5 million, and obtained about US$819,000 through fraudulent Economic Injury Disaster Loan applications. He was also involved in a fake investment scheme that took more than US$7 million. The court ordered US$3.6 million in restitution and forfeiture of nearly US$11 million. (sources: BleepingComputer; US Attorney's Office SDNY)
US Attorney's Office SDNY — Nigerian man sentenced to eight years for hacking, fraud and identity theft schemes (19 Oct 2026)
breaches
Incidents
Mon 19 Oct
Updated Mon 2 Nov
OVHcloud founder Octave Klaba disclosed on 19 October 2026 that an attacker used a compromised contributor's GitHub account to tamper with the releases of the company's open-source command-line tool (ovhcloud-cli), which admins and developers use to manage OVHcloud services. The attacker replaced the macOS (x86_64 and arm64), Linux (x86_64 and arm64) and Windows x86_64 archives, plus checksums.txt so the hashes matched, on existing releases v0.11.0 through v0.15.0; v0.10.0 and the new v0.16.0 are clean. The swapped files were live from 12:47 to 14:21 UTC (14:47 to 16:21 Paris; 20:47 to 22:21 Perth) until a customer whose CI pins the archive hash noticed the mismatch and filed a public GitHub issue. Exposure is limited to people who, in that window, ran the official install script (which checks no hash), downloaded a release archive, ran an unpinned CI download, or ran the CLI's own upgrade command; Homebrew (pinned hashes), go install, source builds and the Docker image were not affected, and copies installed before the window are original. Klaba says the build was poor quality but built to pull secrets off the disk, the source code, tags and CI/CD pipelines were not touched, and the root cause was that GitHub release immutability was not enabled, so a privileged account could re-upload release files; OVHcloud has now enabled it and promised a postmortem. OpenSourceMalware links the contributor account, compromised since at least March, to the GlassWorm campaign through a Solana-memo loader, which it calls an inference; no copy of the swapped binary has been analysed publicly. The OVHcloud CLI stores API credentials in ~/.ovh.conf. (sources: Octave Klaba on X; BleepingComputer) Updated 20 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 20 October 2026; details credited to BleepingComputer on this card come from that report. Correction (02 Nov 2026): removed The Hacker News as a source. (source: Octave Klaba on X; OVHcloud CLI on GitHub; BleepingComputer)
Octave Klaba (OVHcloud founder) on X — OVHcloud CLI repository compromised; v0.11.0 to v0.15.0 affected (19 Oct 2026); follow-up: x.com/olesovhcom/status/2112280116017471626
breaches cloud
Incidents
Mon 19 Oct
Updated Sat 24 Oct
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin (more than 4 million active installations on WordPress.org) and the UpdraftCentral, UpdraftVault and UpdraftClone services, said on 19 October 2026 that it found unauthorised access to the teamupdraft.com website over the weekend of 17–18 October. The company believes its customer database was accessed. That database holds names, email addresses, billing addresses and order history; account passwords stored as hashes; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details are not stored (payments go through Stripe and PayPal). TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected, backups sent to customers' own remote storage (such as Google Drive, Dropbox or Amazon S3) were not affected, and self-hosted UpdraftCentral is not affected. The main risk is the cloud UpdraftCentral connection keys, which can send commands to connected WordPress sites. In response the company closed the access route and fixed the underlying weakness, signed out every teamupdraft.com account, disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated keys with payment providers and other connected services, added monitoring, and reported the incident to the UK Information Commissioner's Office and other authorities. It released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) to automatically disconnect old UpdraftCentral connections so the old keys stop working (this card earlier gave the cutoff as 22:00 BST on 18 October, from an earlier version of TeamUpdraft's page; the page now says 1.26.13 and 2.26.13 disconnect every UpdraftCentral connection made before 13:07 BST on 18 October, 8:07 pm Perth); 1.26.12 was published on WordPress.org on 19 October at 16:46 UTC (12:46 am Perth, 20 October) with the changelog entry 'Revokes UpdraftCentral Cloud keys created before the incident'. TeamUpdraft said on 21 October: 'We know the attacker used a compromised key to access our site', and that 'The attacker exploited the connection to users’ sites to create admin accounts, install malicious plugins etc – the extent of that is unknown'. It has not said how many accounts are affected. No Australian impact has been reported, but Australian agencies, hosts and businesses that manage WordPress sites through cloud UpdraftCentral are in scope. UPDATE (21 Oct; Patchstack, Nethemba, TeamUpdraft): the stolen keys were used. Patchstack (Critical, CVSS 9.8; no CVE, as this is a key compromise rather than a code flaw) says an attacker holding valid UpdraftCentral dashboard keys sent correctly signed plugin.upload_plugin commands to connected sites between 18 October 15:32 UTC and 19 October 09:23 UTC (11:32 pm 18 Oct to 5:23 pm 19 Oct Perth), installing at least 99 differently named backdoor plugins (the name 'Site Health Cache' recurs; every sample carries the description 'Small maintenance toolkit: keeps option storage tidy.'). The backdoor creates an Editor-looking account that also holds manage_options and install_plugins and logs the attacker in by cookie, bypassing the login form and 2FA; the account survives removal of the plugin. Early samples crashed sites with HTTP 500 errors; Nethemba documents a working newer variant and says two of its three targeted sites, running WordPress 7.1.3 and UpdraftPlus 2.26.11, were backdoored. Patchstack notes sites can hold a key without anyone choosing UpdraftCentral, because connecting a TeamUpdraft.com account ticks 'Add this website to UpdraftCentral' by default, and keys do not expire. Published indicators include source addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, accounts such as data-ops43 and media-staff96 with @example.org emails and display name 'Site Tools', and an option ending in _sync_token. Nethemba found that 1.26.12 / 2.26.12 did not actually remove the old keys because of a bug; UpdraftPlus 1.26.13 (WordPress.org changelog: 'Properly apply the revocation in 1.26.12') and 2.26.13 shipped on 19 October just after 22:00 BST (5:00 am 20 Oct Perth). TeamUpdraft's 20 October 16:25 BST update says the unauthorised access was resolved and 1.26.13 / 2.26.13 block that route, but still asks users to check their sites. With around 10% of UpdraftPlus sites estimated to hold an UpdraftCentral or Migrator key, roughly 400,000 sites may have been exposed (BleepingComputer). UPDATE (23 Oct 2026; TeamUpdraft incident page, last updated 23 Oct 05:26 BST): in its 21 October 10:23 BST update (5:23 pm Perth) TeamUpdraft said it had found that the attacker used a compromised key to access its site, that 'The speed of the exploits following the breach combined with the initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack', that it had brought in an external cyber security firm, and that it had 'contacted the relevant authorities (including the police)'. At 15:35 BST on 21 October (10:35 pm Perth) it asked UpdraftPlus Premium users to check their websites for signs of unusual activity 'even if you’ve never used UpdraftCentral', and took its support form offline because of the PHP vulnerabilities. At 14:42 BST on 22 October (9:42 pm Perth) it said the support form was back, that 'If a site is listed that you didn’t knowingly connect since the 19th Oct, please check it for signs of compromise', and that it is 'seeing a pattern of unexpected ‘editor’ roles'; it asks users to log in to UpdraftCentral through My Account and check the sites listed there for unexpected users, unrecognised plugins and unknown IP addresses in logs. Correction (24 Oct 2026): an earlier version quoted TeamUpdraft as saying 'Any site listed before this incident has potentially been exposed to the attacker'; that sentence is no longer on its incident page (last updated 23 Oct 05:26 BST), whose 22 Oct 14:42 BST update now asks users to check any listed site they did not knowingly connect since 19 October. (source: TeamUpdraft)
TeamUpdraft — TeamUpdraft security incident: What customers need to know (19 Oct 2026, last updated 23 Oct 05:26 BST)
breaches identity
Incidents
Mon 19 Oct
Updated Mon 2 Nov
NorForge researcher Snorre Fagerland published 'Inside Cairn' on 19 October 2026, after scanning Shodan and Censys for AI hacking harnesses whose web panels were left open (searches began after Gambit Security's September report of Strix, Cairn and Hermes being used against online retailers). Cairn is an open-source, state-based 'problem-solving engine': each project has a start point and an end goal, and AI agent workers post facts and intents to a shared blackboard until the goal is met. NorForge found more than 20 exposed Cairn panels it assesses as likely malicious and financially motivated, in three clusters. AIA0001, a Chinese-language actor (high confidence malicious), ran more than 1,100 attack projects across 14 panels, mostly hosted on AS56594 (Cgi Global Limited). Its automated pipeline feeds in real US, Canadian, Japanese and Australian online shops with 200,000 to 1.5 million visits, already checked with Playwright that orders can be placed, and tells the agents to find unauthenticated remote code execution (login SQL injection, unauthenticated endpoints, file uploads, deserialisation, authentication bypass, account takeover) and plant an 'uploader' webshell, aiming at persistent access to e-commerce and payment systems. NorForge's first case study is an Australian e-commerce site where the panel recorded the goal as met; NorForge confirmed a shell giving command execution on its web server, reached through a chain starting with unauthenticated account modification. AIA0002, an English-language crew on about 10 panels mostly on AS20473 (The Constant Company/Vultr), openly tasks agents to steal card data and cryptocurrency and used DeepSeek models through OpenRouter; AIA0003 is a smaller, lower-confidence English-language panel. Successful AIA0001 projects took a little under 23 hours on average, and NorForge estimates a success rate of about 10% across these harnesses. Running Trufflehog over the panel data found hundreds of exposed secrets, 11% verified as valid, and the panels appeared to expose full admin controls; NorForge also found legitimate red-team engagements exposed the same way. NorForge has redacted panel addresses and is working with Reuters to notify victims and with hosts to take panels down. Reuters (19 Oct), which reviewed the attacker's own records, reported (as relayed by The Verge) that the hacker broke into websites of more than 100 companies, including Deere, SharkNinja and Cummins: Deere said it took remediation actions and has no indication sensitive information was accessed; SharkNinja said a standalone product-support site was hit and contained; Cummins told The Verge it is investigating a potential attack on a website run by a third-party vendor. Cairn's creator says the platform was never a hacking tool and misuse is a human decision. No Australian victim has been named publicly. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: NorForge; The Verge)
NorForge — Inside Cairn: Open windows into massive AI-driven cyber operations (19 Oct 2026)
ai australia
Incidents
Sat 17 Oct
Updated Sat 24 Oct
Bullhorn, a US company whose cloud applicant-tracking and CRM software is used by staffing and recruitment firms (more than 10,000 customers worldwide, according to the company), disabled access to its platform after detecting what it calls a cyber incident on the Bullhorn Platform. Its status page shows login errors across all ATS/CRM clusters, including the Australian clusters CLS61 and CLS62, from 05:24 EDT on 17 October (5:24 pm Perth), a system-wide outage by 08:04 EDT, and at 15:28 EDT (3:28 am Perth, 18 October) the statement that a cyber incident had been detected, access had been temporarily disabled to contain the activity, and CrowdStrike specialists were assisting. Bullhorn brought its Australian, EMEA/UK and US regions back online on 19 October; at 16:54 EDT (4:54 am Perth, 20 October) it said all regions were online and that it had fixed sign-in problems for SSO customers. In its customer FAQ (last updated 19 October, 5:15 pm ET) Bullhorn says it has isolated the issue and removed the immediate threat, that the incident affected Bullhorn ATS/CRM, and that there is no indication other Bullhorn products, including its Salesforce-based products, Bullhorn Automation, SourceBreaker and VMS Sync, were affected. Its forensic investigation is ongoing and it has not yet determined whether customer data was exfiltrated; it says it will contact affected customers and meet notification obligations if data was affected. Non-SSO users must reset their password at their next login (with two-factor verification), API user passwords have been expired and must be changed, and client secrets will have to be rotated later. Bullhorn Back Office passwords were not reset and were not affected. To reduce risk Bullhorn removed the underlying technology behind a significant number of features, so some functions remain offline or changed while they are rebuilt, including the legacy ATS/CRM SOAP APIs, several integrations and job publishing. Bullhorn warns that criminals may pose as Bullhorn staff by email, text or phone using the incident as a pretext, and says it will never ask for passwords, MFA codes or verification tokens. It has not said what kind of attack it was or who was behind it. UPDATE (23 Oct 2026; Bullhorn status page): In an update posted at 6:28 pm US Eastern on 22 October (6:28 am Perth, 23 October), headed 'Update on PHP Vulnerabilities and Service Restoration', Bullhorn said Talent Platform access had been fully restored and listed Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal and Akyla as 'Upgraded to address the vulnerabilities and fully available', with the Back Office (BBO) 'Upgrade in progress'. It said: 'We recommend that customers plan for BBO to remain unavailable through the end of this week.' In a separate 'Status Update: Bullhorn Back Office' posted at 6:30 pm US Eastern on 22 October, Bullhorn said: 'Whilst we are in this extended outage, we will not be able to provide user access to enter time sheets and we recommend using alternative approaches', adding that Bullhorn Support can run payroll reports for customers. On 23 October (Perth) the status page listed every ATS/CRM cluster, including the Australian clusters CLS61 and CLS62, as 'Degraded Performance' and Bullhorn Back Office, including BBO SYD, as 'Major Outage'. Bullhorn's 22 October update links the Back Office work to the PHP vulnerabilities; it does not say whether it is connected to the 17 October incident. (sources: Bullhorn status page; BleepingComputer) UPDATE (24 Oct 2026; Bullhorn status page): in an update headed '[6:30 PM EST 10/23/2026]' (incident first posted at 3:01 pm US Eastern on 23 October, 3:01 am Perth 24 October) Bullhorn said 'Access to BBO has been restored', that time entry with existing credentials is available and password changes are not required. In a separate update with the same heading it said 'All products are available, but some features are still impacted', that Canvas in the ATS is not yet available and that some users are still having login issues. On 24 October (Perth) the status page listed BBO SYD as 'Degraded Performance' and the Australian ATS/CRM clusters CLS61 and CLS62 as 'Under Maintenance'.
Bullhorn Status — Update on PHP Vulnerabilities and Service Restoration; Status Update: Bullhorn Back Office (22 Oct 2026)
breaches australia cloud identity
Incidents
Sat 17 Oct
Updated Thu 22 Oct
OpenCode, the open-source AI coding agent, said on its official X account on 17 October 2026 (UTC) that it had a security breach the previous night, related to what it called a large-scale distillation attack, that affected 1.4% of OpenCode Console users. The company said it notified all affected users by email that morning, that users who did not get an email were not affected, and that the affected group was a subset of users who had external providers set up. An earlier version of the post said the incident was ongoing, so OpenCode could not share more details yet. OpenCode has not said how the attackers got in or how many people 1.4% represents. No Australian impact has been reported. UPDATE 19 October 2026 (BleepingComputer, 19 Oct): OpenCode's email to affected users says the external-provider API keys they had linked to OpenCode Console were exposed, with the earliest possible exposure at 00:30 UTC on 17 October (8:30 am Perth), and that no other data appears to have been exposed. Co-founder Dax Raad said attackers using AI agents had targeted OpenCode's systems for at least 48 hours. Affected users reported unauthorised API charges ranging from several hundred US dollars to about US$1,700 overnight, and some said Google suspended their Google Cloud projects for 'abusive activity consistent with hijacked resources'. OpenCode says it is working with Google, OpenAI and Anthropic, and its email raises the possibility of reimbursement. Correction (22 Oct 2026): removed an unconfirmed claim about OpenAI key revocation and refunds that rested only on a third-party forum post.
OpenCode (official X account) — security breach affecting 1.4% of OpenCode Console users (17 Oct 2026)
breaches ai
Australian cosmetics brand Napoleon Perdis has emailed customers to say a third party it used to store customer records, Retail Express, was hit by a cyber attack. According to the email, reported by the ABC on 17 October 2026, Napoleon Perdis was told in June, and in August 2026 Retail Express confirmed that an unauthorised party had access between November 2025 and June 2026, affecting approximately 339,055 customer records. The affected records belong to customers from before June 2025. Information accessed includes names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The company says the system did not hold bank account or card details or napoleonperdis.com account passwords, that the incident has been contained and the system permanently shut down, and that its current online store was not affected. The Office of the Australian Information Commissioner has been notified. Napoleon Perdis warns customers to watch for scam calls or emails impersonating the brand and to monitor bank transactions. Context: on 9 June 2026 Cyber Daily reported that the forum actor known as 2019 had listed Napoleon Perdis and claimed 339,100 customer records (including loyalty points, transaction history and spending totals), released free on a hacking forum; the company had not confirmed that claim at the time. (source: ABC News, reporting Napoleon Perdis's customer email)
ABC News — Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients (17 Oct 2026, quoting the customer email)
australia cloud
Incidents
Fri 16 Oct
Updated Fri 30 Oct
Lightning AI's security incident notice says that on 15 October at 11:00 PM UTC it identified a security incident on the Lightning Platform involving unauthorized access to credentials, and that it revoked all user access to the platform on 16 October at 1:00 AM UTC. Lightning says the incident involves Lightning Studio Platform services such as Studio, Deployments, Pipelines and Drive, and not the GPU cluster rental infrastructure or managed services like Kubernetes and SLURM. Lightning says it believes certain customer credentials were compromised to gain access to environments and connected third-party services, that it has revoked all identified credentials used in the incident, and that it is working with an independent external cybersecurity firm. Lightning says customers identified as potentially affected to date have been notified, and that users who have not received a notification have not been identified as affected based on its investigation to date. The notice itself carries no date; Lightning's status page first reported emergency maintenance at 03:08 UTC on 16 October, linked the notice at 20:34 UTC that day, last updated the incident at 12:49 UTC on 19 October, and still listed it as unresolved ('Service is down to address a security incident') when checked on 26 October (Perth). UPDATE (29 Oct 2026, Perth; Lightning AI): Lightning's notice now says it restored read-only access to Drive as of 2 PM ET on Wednesday 28 October (29 October 02:00 Perth), available through the CLI with the Lightning SDK required and no web UI access at this time, and that access to Studio, Jobs and Deployments will follow, with updates on their timing to come. Lightning's status page posted the Drive update at 15:55 UTC on 29 October (23:55 Perth) and still shows the incident as 'Service is down to address a security incident'. (source: Lightning AI; Lightning AI Status)
Lightning AI — October 2026 Security Incident (undated notice; linked from Lightning's status page 16 Oct 2026, 20:34 UTC)
breaches cloud identity ai
Incidents
Fri 16 Oct
Updated Tue 27 Oct
The California Department of Education (CDE) said on 16 October 2026 that ETS, the nonprofit assessment organisation that runs California's statewide student assessments (CAASPP and ELPAC), has begun notifying students and families of a data breach. According to the ETS notice published by CDE, ETS found unauthorised activity on 25 September on a secure file transfer protocol (SFTP) site used to exchange statewide assessment information with CDE; an unauthorised party had used a compromised login credential at various times between 22 May and 18 September 2026 to copy files of California student information. Data on all students enrolled in the three previous school years was accessed and copied, as well as some former students, and may include names, dates of birth, home addresses, schools, districts and grade levels, statewide and local student identifiers, gender, race or ethnicity, primary language, country of origin and English learner status, disability and Section 504 status, assessment accommodations and primary disability type, eligibility for Title I, McKinney-Vento (homeless) and military-connected programs, and English proficiency and assessment results. More than 5.7 million students were enrolled in California in the 2025 school year. Social Security numbers, licence and passport numbers, financial and card details, passwords and parent or guardian information were not involved. ETS disabled the account, took the SFTP site offline and built a new one, paused normal enrolment data processing and some assessment activities, and says it has taken steps with law enforcement and cybersecurity experts to reduce the risk of the data being published and has found no sign so far that it has been. No group has claimed the attack. Notices began on 16 October and will continue into early November, in 27 languages, with two years of free Experian IdentityWorks identity protection. CDE says it is reviewing ETS's compliance with its data-security and contract requirements. (sources: CDE news release; The Record) Updated 20 Oct 2026 (The Record): The Record's report is dated 20 October 2026; details credited to The Record on this card come from that report.
California Department of Education — ETS begins notifying California students and families following data security incident (16 Oct 2026)
breaches identity
