Incidents
Tue 13 Oct
Updated Mon 26 Oct
All Souls St Gabriels School has confirmed a cyber incident. A notice on its website says it is investigating a recent cyber incident involving unauthorised access to part of its systems. It took immediate steps to secure its systems and engaged specialist cyber security and forensic experts, and it has found no impact on day-to-day operations, with teaching and learning continuing as normal. It is aware of online claims naming the school, which its external specialists are assessing, and has put ongoing monitoring in place. It has notified the Australian Cyber Security Centre and will contact individuals directly if their personal information is found to be affected. It warns current and former community members to expect more phishing and scam contact and has set up dedicated support channels. A spokesperson told Cyber Daily (13 October) that parents and staff were told 'late last week'. According to Cyber Daily, the gang has not said how much data it holds or what it is demanding. According to Cyber Daily, the school, based in Charters Towers in North Queensland, has 460 students from pre-prep to Year 12, about 200 of them boarders. The school was listed on The Gentlemen ransomware gang's leak site in a 9 October post, according to Cyber Daily. Cyber Daily has also reported The Gentlemen listing Mandurah SES in WA (see mandurah-ses-thegentlemen-20261002). (sources: All Souls St Gabriels School; Cyber Daily) Correction (25 Oct 2026): removed leak-site tracker links and the gang's publication threat, which an earlier version wrongly attributed to the school's spokesperson; the listing is now credited to Cyber Daily. (source: Cyber Daily) Correction (26 Oct 2026): the card date has moved from 9 to 13 October 2026, the Perth date of Cyber Daily's report (12 October, 23:47 UTC; 13 October, 7:47 am Perth time (AWST)), the earliest dated source cited; the school's notice is undated, and 9 October is the date of the leak-site post Cyber Daily describes. (source: Cyber Daily)
All Souls St Gabriels School — Important information about a cyber incident
australia
Incidents
Mon 12 Oct
Updated Fri 30 Oct
The Older Persons Advocacy Network (OPAN) says an unauthorised email titled 'The National Advocate – Special Appeal' was sent to people on its mailing list through a third-party mailing system on 11 September 2026. The email asked for donations and did not come from OPAN. In an update posted 12 October, OPAN says it stopped the email, contacted everyone who received it along with network members, government and sector partners and the National Anti-Scam Centre, and engaged independent forensic, legal and cyber advisers. That investigation is now complete, OPAN has strengthened its security, and it is contacting a small number of individuals directly where required under privacy laws; people who are not contacted need do nothing further. CEO Craig Gear apologised for the worry caused to older people and families. (source: OPAN) Correction (30 Oct 2026): removed Webber Insurance's data-breaches list as a source and removed wording the notice does not state; the card now carries only what OPAN's notice states. (source: OPAN)
OPAN — Cyber incident update (12 Oct 2026)
australia
Incidents
Mon 12 Oct
Updated Sat 31 Oct
Have I Been Pwned (HIBP) added Sharecare on 12 October 2026. HIBP says the digital health company was the target of a ShinyHunters 'pay or leak' extortion campaign in August 2026, and that the group then published data it claimed was taken from Sharecare's systems, containing about 318,000 unique email addresses. HIBP says most of the data was business-to-business sales and marketing records with names, physical addresses, phone numbers, job titles and employers, and that it also included a small number of Brazilian health insurance plan members with dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer IDs). No public statement from Sharecare was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned). Correction (31 Oct 2026): removed a sentence and link from BreachNews that only repeated the extortion group's own claims about the data, so the card rests on Have I Been Pwned; the card date has also moved from 13 to 12 October 2026, the date HIBP shows, which carries no time zone. (source: Have I Been Pwned)
Have I Been Pwned — Sharecare breach (added 12 Oct 2026; breach August 2026)
breaches identity
Incidents
Mon 12 Oct
Updated Sun 25 Oct
iRhythm Holdings, the US maker of the Zio wearable cardiac monitor, said on 2 October 2026 that its forensic investigation into the June incident was complete and that it had begun notifying affected individuals. The company detected unauthorised access to certain third-party-hosted business applications on or around 8 June 2026, and found that data was accessed and downloaded between 3 and 8 June. In its 15 June Form 8-K, iRhythm said the access was obtained through social engineering. A threat actor contacted the company on 9 June, claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it. The exposed fields are patient name, address, email, phone, date of birth, iRhythm patient account number, device serial number, insurance number and date of service. iRhythm says it holds no financial account or payment card data, and that products, clinical and medical-device systems, manufacturing and patient safety were not affected. The Record (9 Oct) reports breach notices covering 298,647 people in Texas and another 69,526 in South Carolina, and that iRhythm also filed breach notices in California. No group has publicly claimed the attack. iRhythm has not said whether it paid. (sources: iRhythm update; SEC Form 8-K; The Record) Correction (23 Oct 2026): this card earlier credited the state-filing figures to two outlets (12 Oct) and added them together; they are now credited to The Record (9 Oct) and are not combined. UPDATE (23 Oct 2026): Oregon's Department of Justice breach database lists an iRhythm Technologies Inc. entry with 8,179,772 as the number affected, reported on 6 October 2026, giving 3 to 8 June 2026 as the dates of breach (the entry also shows a placeholder date of 1/1/0001), 8 June 2026 as the date of discovery and 2 October 2026 as the date notice was sent. The database says its entries show the information in an organisation's initial breach report and do not reflect later updates to affected numbers.
iRhythm — Provides update on cybersecurity incident previously disclosed in June 2026 (GlobeNewswire, 2 Oct 2026)
breaches identity cloud
Incidents
Mon 12 Oct
Updated Mon 2 Nov
France's CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October 2026 (latest version 16 October) saying it knows of numerous compromises of remote controllers for refrigeration installations: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb. CERT-FR says exposing a management interface on the internet is contrary to good practice, warns that attack campaigns against this equipment are probably still under way, and says internet-exposed equipment without security fixes (end of life) is very likely to be compromised; a factory reset alone removes an intruder's persistence but leaves the unit vulnerable, so it will almost certainly be compromised again. CERT-FR has not named a vulnerability. Earlier public research gives a possible path: Claroty Team82 found a hidden date-based 'code of the day' login in the Danfoss AK-SM 800A that bypasses the admin password (CVE-2025-41450, fixed in R4.2), plus post-login command injection fixed in 4.3.1; CERT-FR does not say this flaw was used. UPDATE 14 October: ASD's ACSC issued a High alert (act within 48 hours), Protecting operational technology and edge devices, saying it is aware of incidents affecting commercial refrigeration systems overseas and has not seen active targeting in Australia. It recommends that Australian organisations running internet-connected OT, including commercial refrigeration, keep OT interfaces and edge devices off the internet, patch known vulnerabilities promptly, apply strong authentication, access control and segmentation, and monitor for unusual automated activity. CORRECTION (21 Oct 2026): this card earlier carried store counts, temperatures, losses, fires, a claim that Copeland acknowledged a vulnerability, and statements attributed to Danfoss, Les Mousquetaires, Carrefour, Coopérative U and others, from media reports we had not linked. We removed them; they will return only with a linked source for each claim. Correction (31 Oct 2026): removed from the affected-versions line a statement attributed to Danfoss that no linked source contains; CERT-FR's end-of-life warning stays. (source: CERT-FR) UPDATE (2 Nov 2026, Perth; BleepingComputer; The Record): a second wave of refrigeration attacks hit European stores overnight into Monday 2 November, European time. According to BleepingComputer (2 Nov), attackers remotely changed temperature settings on freezers and cooling systems at more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; chains that acknowledged refrigeration issues include ICA and Coop in Sweden (Coop said 7 of more than 800 stores), Ahold Delhaize in Belgium and Luxembourg (several dozen stores), Carrefour in Belgium (15 of 700 stores, no hypermarkets), Spar Colruyt (about five independently run stores), Intermarché in Belgium, SuperValu in Ireland and Selver in Estonia. According to The Record (2 Nov), retailers said freezers had been remotely set to 50°C, the Centre for Cybersecurity Belgium said it was aware of the incident and that it is not known who is behind it, no group has claimed responsibility, an Estonian contractor said the attackers accessed an older Danfoss system, and the Paris prosecutor's office put the number of victims of October's French attack at around 700. No Australian victims reported. (sources: BleepingComputer; The Record)
CERT-FR — CERTFR-2026-ALE-012: Security incident targeting remote controllers of refrigeration installations (12 Oct 2026, latest version 16 Oct)
breaches ot ics
Incidents
Mon 12 Oct
Updated Mon 26 Oct
Ahold Delhaize said on 12 October 2026 (Zaandam, Netherlands, 08:29 Europe/Amsterdam) that it is experiencing a security issue within its network and is taking steps to assess and mitigate it, including taking some systems offline to help protect them. The company said its stores are open and serving customers, and that protecting infrastructure for customers, associates and partners is a top priority. The release is marked as inside information under the EU Market Abuse Regulation. BleepingComputer reported the same day that employees at Stop & Shop (US) had trouble accessing schedules and pay stubs, and that customers could not use websites, apps and customer-service platforms at Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium. An internal Food Lion memo described an IT outage that could leave stores unable to shop, stage or hand off online orders. BleepingComputer says Ahold Delhaize operates 9,551 stores across Europe, the United States and Indonesia. The company has not publicly confirmed ransomware, encryption, data theft or a named threat actor for this incident. BleepingComputer notes it is the second major cybersecurity incident to affect Ahold Delhaize in recent years, after INC Ransom stole the personal, financial and health information of over 2.2 million individuals in a November 2024 attack that affected the company's US systems. (sources: Ahold Delhaize newsroom; BleepingComputer) Updated 13 and 19 Oct 2026 (Ahold Delhaize newsroom; 13 October 8:00 pm and 19 October 11:04 pm Perth): on 13 October the company said it was starting a controlled re-launch of certain systems and had no evidence that customer, associate or partner data was taken. On 19 October it said the investigation confirmed the suspicious activity in its IT infrastructure resulted from the malicious actions of others. Taking systems offline, including brand websites and apps, affected most of its brands in Europe and the United States, while all stores stayed open. It notified the Dutch National Cyber Security Centre (NCSC) within 24 hours, has kept the NCSC, law enforcement and regulators updated, and filed a formal police report with the Dutch police on 19 October. Restoration: Albert Heijn's website and app are back, with home deliveries expected from Friday 23 October; Etos and Gall & Gall websites are available; Belgian e-commerce is fully operational; most websites and apps in Central and Southeastern Europe are available; e-commerce at the Ahold Delhaize USA brands (such as Food Lion and Stop & Shop) is expected back in the coming days. The company again says it has no evidence so far that sensitive customer, associate or partner data was taken, and it is not describing the attack type or saying whether a ransom is involved. Correction (26 Oct 2026): the store count is now BleepingComputer's figure of 9,551 (it was given as more than 9,400 with no source), the November 2024 INC Ransom background is credited to BleepingComputer, Ahold Delhaize's 13 October update is now linked, and an unlinked credit to The Record has been removed; the 19 October details rest on Ahold Delhaize's own update. (source: Ahold Delhaize; BleepingComputer)
Ahold Delhaize newsroom — Takes precautionary measures following cybersecurity incident (12 Oct 2026)
breaches
Incidents
Mon 12 Oct
Updated Fri 23 Oct
Icon Oncology Group said on 12 October 2026 that it is managing a data breach involving unauthorised access to some patient information held on a supplier's system, and that at this stage the incident appears to affect Australia only. Its notice (last updated 15 October 2026, 8:15am AEST) states the incident involved an externally hosted and managed platform that converts incoming faxes to email — not Icon's main system for sending or receiving patient information — that it was contained immediately, and that core clinical and patient management systems were not affected, with all systems online and patient treatment unaffected. The group says it activated its incident response plan, reset access to the affected system, engaged specialist cyber security and forensic advisers, and notified the Australian Federal Police and relevant regulators. It has obtained a copy of the impacted records and is confirming which patients and what information are involved, and says it will contact those patients directly; people who may be concerned can also register for an update via privacy@icongroup.global. Icon believes the records are discrete documents associated with business correspondence rather than complete patient files. Icon Cancer Centre is headquartered in South Brisbane and describes itself as Australia's largest dedicated cancer-care provider, with more than 40 centres. (source: Icon Group notice) Correction (23 Oct 2026): removed a forum seller's unverified claim about the number and content of documents; Icon's own notice is the only source for what was accessed. (source: Icon Group)
Icon Group — Important notification – data breach incident (12 Oct 2026; last updated 15 Oct 2026, 8:15am AEST)
breaches australia identity
Incidents
Fri 9 Oct
Updated Sun 1 Nov
Hardware wallet maker Ledger said on 9 October 2026 that it was investigating reports of stolen funds from users in Southeast Asia who bought its devices from a reseller named CryptoBilis, and asked the reseller to pause all sales and shipments. Ledger advised anyone who bought from CryptoBilis in the last 90 days not to set up the device, and anyone who already had to move their assets to a new Ledger signer with a new recovery phrase. Updated 11 Oct 2026 (Ledger Support on X, 10 October UTC; 1:09 am 11 October Perth): Ledger Support confirmed that one affected user's device contained an unauthorised hardware implant, said it was contacting affected users and working with authorities and the SEAL 911 crypto incident-response group, and said CryptoBilis had suspended sales of its whole hardware-wallet inventory. Ledger said it has no indication that its own security infrastructure, systems or services have been compromised. Lesson for anyone holding keys on hardware: buy direct from the manufacturer where possible, and treat a recovery phrase shown on any device as exposed if the device's supply chain is in doubt. (source: Ledger Support on X) Updated 15 Oct 2026 (BleepingComputer, 14 October US time; 1:46 am 15 October Perth): BleepingComputer reported that Ledger Donjon, largely confirming earlier reports by Mark Karpelès and Tibane Labs, confirmed the implant's microcontroller decodes the 24-word recovery phrase shown during setup and exfiltrates it over LTE via a provisioned eSIM, without modifying the Secure Element, Ledger OS, transactions or signatures — so Ledger integrity self-checks still pass. Ledger ordered a broader sales halt covering distributors across Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong, and MediaMarkt pulled stock after users also reported modified devices from other sellers (including a Singapore airport Metapod retailer and MediaMarkt/Aqipa in Europe). Ledger still says confirmed fund losses are tied to CryptoBilis stock and that its own infrastructure and direct sales channel remain safe; Trezor separately said it will shrink its reseller network. Correction (26 Oct 2026): Ledger Support's second post and BleepingComputer's report, both later than the 9 October card date, now carry Updated lines. (source: Ledger Support on X; BleepingComputer) Correction (27 Oct 2026): removed on-chain loss estimates credited to The Block, which is not linked and could not be read by Cyberstack, a description of teardown photos and a phrase about the reseller's status, which no linked source supports, and a line about Ledger's view of the losses that its linked posts do not contain; BleepingComputer's report that Ledger says all confirmed losses involve CryptoBilis devices remains. (source: Ledger Support on X; BleepingComputer)
Ledger Support on X — situation update: unauthorised hardware implant confirmed in an impacted user's device (10 Oct 2026)
breaches
Incidents
Fri 9 Oct
Updated Wed 21 Oct
FBI Director Kash Patel said on X on 9 October 2026 that agents had arrested another suspected co-conspirator of the ShinyHunters extortion group, which the bureau blames for the recent FBIJobs.gov incident on a platform run by a third-party vendor. Patel called it the latest of several arrests in a matter of days but did not name the suspect or say where the arrest happened. The New York Times reported that the suspect is a Canadian citizen arrested in Pennsylvania and regarded as a primary co-conspirator in the intrusion; no name or charges have been made public. ShinyHunters told BleepingComputer in September that it got in through an alleged Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud systems, claiming 2 to 3 TB of data on current and former staff and job applicants; the FBI has since said a contractor-managed platform had not installed a security update, and the Times reports an internal memo assumed every employee was affected. Earlier actions: Dutch police arrested Pepijn van der Stap ('Umbreon') on 15 September, and Jordan detained Saif al-Din Khader ('Rey'), who sources say is cooperating with the FBI. (sources: FBI Director Kash Patel on X; BleepingComputer) UPDATE (10 Oct): Politico and KrebsOnSecurity named the man arrested in Pennsylvania as Edward Dubrovsky, 54, a Canadian cybersecurity executive whom Politico and BleepingComputer described as a co-founder of CYPFER and associated with CyberSteward, firms that help breach and ransomware victims negotiate with extortion groups; he was reportedly attending the NetDiligence Cyber Risk Summit. Public court records show he appeared in the Eastern District of Pennsylvania and was transferred in custody to the Eastern District of Texas, where charges were filed. The complaint is sealed, but the docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort (18 U.S.C. 371 and 1030(a)(7)(B)) and Hobbs Act extortion and conspiracy (18 U.S.C. 1951). The FBI has not publicly confirmed that Dubrovsky is the suspect Patel described; KrebsOnSecurity cites multiple sources linking the arrest to the ShinyHunters investigation. The FBI says ShinyHunters and associates breached more than 140 organisations and collected more than US$70 million in extortion payments over the past year. (source: BleepingComputer) UPDATE (12 Oct): Reuters (republished by iTnews on 12 October) says the partially sealed court papers filed in the Eastern District of Pennsylvania spell the defendant's surname 'Dobrovsky' or 'Dobrosky' and give no age, profession or employer; a person briefed on the matter told Reuters it is Canadian security executive Edward Dubrovsky. Reuters says federal prison records show a 54-year-old Edward Dubrovsky currently held at a federal detention centre in Philadelphia. The FBI referred Reuters to Director Patel's statement and declined further comment, and CyberSteward did not respond. UPDATE (19 Oct, KrebsOnSecurity): citing two sources close to the investigation, Krebs reports that FBI investigators believe at least one executive at a large US consulting firm with more than 1,000 associates helped operate ShinyHunters' victim-extortion site shinywire[.]com. Krebs does not name the firm or the person because no charges have been filed. The site ran from about 3 May to 16 October 2026 and had pages for nearly 100 breached organisations, each with samples of stolen files and a demand to negotiate; victims who did not respond within seven days had their data published on the group's Tor leak blog. Sources say Signal messages read when Dutch police arrested Pepijn van der Stap on 15 September showed frequent contact with Dubrovsky and with the US executive, who often knew about new victims before the victims did, and that Dubrovsky knew ShinyHunters had stolen FBI data but did not tell the bureau before the group threatened to publish it. The FBI has not commented and these claims are not in public court records; Dubrovsky's complaint remains sealed. CYPFER, in a 14 October statement quoted by KrebsOnSecurity, says it learned of his arrest from the media, that to its knowledge it is not a target of any investigation, that its business does not include making or facilitating ransomware payments, and that CyberSteward and CYPFER are separate companies with no officers, directors or employees in common. KrebsOnSecurity also reports that Daniel Tobok of CYPFER, in a legal dispute with Dubrovsky, said Dubrovsky has misrepresented himself as a CYPFER founder and is not a shareholder. CORRECTION (21 Oct 2026): this card earlier stated as fact that Dubrovsky co-founded CYPFER and that the firms help victims pay extortion demands; that description comes from Politico and BleepingComputer, and CYPFER disputes it.
FBI Director Kash Patel on X — another suspected ShinyHunters co-conspirator arrested (9 Oct 2026)
breaches identity
Incidents
Fri 9 Oct
Updated Sat 31 Oct
Have I Been Pwned (HIBP) added Neogen on 9 October 2026. HIBP says the food and animal safety organisation was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group later published data it claimed had been obtained from Neogen. HIBP says the data consisted largely of corporate contact records and included about 436,000 unique email addresses from mailing lists, employee records and other contacts, with names, phone numbers, physical addresses, employers, job titles and salutations. No public statement from Neogen was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned). Correction (31 Oct 2026): removed a sentence and link from Cybernews that only repeated the extortion group's own statements; the card rests on Have I Been Pwned. (source: Have I Been Pwned)
Have I Been Pwned — Neogen breach (added 9 Oct 2026; breach August 2026)
breaches
MapRoulette, an open-source tool that helps OpenStreetMap (OSM) contributors fix map problems, published a security incident report on 9 October 2026. Maintainer Jake Low of OpenStreetMap US found the flaws on 7 October, took the service offline for about 15 hours, revoked every credential that could have been exposed and shipped fixes in v4.11.0 and v4.11.1. Four main problems were found: public API and GraphQL responses included each user's full record, including the stored OSM access token (which can edit the map as that user), MapRoulette API key and email address (since April 2020); API keys saved in OSM user preferences could be read by any app granted the common 'read your user preferences' permission (since October 2022); sending an empty API key matched the never-set default 'super key' and granted administrator rights (since March 2017); and several endpoints allowed SQL injection (oldest from November 2019). The server and application logs, covering 8 September to 7 October 2026, showed no malicious use, but older abuse cannot be ruled out because the bugs are years old. OSM passwords were never at risk. Users must log in again, old API keys no longer work, affected users are being emailed, and anyone running a self-hosted MapRoulette above v2.0.3 must update, reset stored OAuth tokens and check admin accounts. (source: OpenStreetMap community forum post by the maintainer)
OpenStreetMap Community — MapRoulette security incident, October 2026 (Jake Low, 9 Oct 2026)
breaches identity
Incidents
Thu 8 Oct
Updated Fri 30 Oct
Canonical posted on Ubuntu Discourse on 8 October 2026 that its websites were under a sustained distributed denial-of-service attack, that some services might be intermittently unavailable, and that its team was working on it. A follow-up on 9 October said the team was still restoring affected services and most were now available, and on 14 October Canonical said all websites were restored. According to OMG! Ubuntu (8 Oct), the outages hit the main Ubuntu and Canonical domains, including canonical.com, ubuntu.com, blog.ubuntu.com, developer.ubuntu.com and the Ubuntu Security API and notices pages, while Ubuntu PPAs, the CD image server, Launchpad, the Snap Store and Ubuntu SSO were operational as of writing. OMG! Ubuntu says this is the second major attack on the company this year: in May, what Canonical called a 'sustained cross-border attack' caused outages of the main websites and blogs, plus Launchpad PPAs, Ubuntu Single Sign-on, mailing lists, signing keys and the Snap Store, and OMG! Ubuntu says Canonical has not publicly said who was behind it. For defenders, the practical effect was that Ubuntu security notices and CVE status pages were briefly unreachable. (sources: Canonical on Ubuntu Discourse; OMG! Ubuntu) Correction (23 Oct 2026): an earlier version said the sites were offline for about four hours, a figure from an outlet not linked here; Canonical's own posts say restoration was still under way on 9 October and all websites were restored on 14 October. (source: Ubuntu Discourse (Canonical)) Correction (30 Oct 2026): removed details that only SecurityWeek, which this desk cannot read, gave (what Canonical had not disclosed, the earlier attack's date range and effect on updates, and a responsibility claim for it), and removed UTC and Perth times because Ubuntu Discourse shows its post times without a time zone; the affected and unaffected services and the May attack are now credited to OMG! Ubuntu. (source: OMG! Ubuntu)
Ubuntu Discourse (Canonical) — DDoS on Canonical and Ubuntu websites (8 Oct 2026, update 9 Oct)
tech network
