Michigan State University told The Record that it became aware of suspicious cyber activity in early October 2026 and immediately began investigating. To protect accounts and systems, the university's IT team required everyone with an MSU NetID to reset their password to a new one of at least 15 characters, in an email sent to campus on 1 October, The Record reports. A spokesperson said that, based on the investigation to date, the activity appeared to be a potential credential compromise, that current evidence does not indicate a successful compromise of the university's central Active Directory environment, and that there is no evidence other MSU data was accessed, changed or stolen. According to The Record, the BYOD ransomware gang claimed responsibility. University officials said the claims were tied to the October incident, and the university did not respond to follow-up questions about them, The Record reports. MSU has not confirmed any data theft. (source: The Record)
The Record (2 Nov 2026)
breaches education
Incidents
Mon 2 Nov New
Updated Tue 3 Nov
Russia's federal statistics agency, Rosstat, confirmed that it had been targeted by a cyberattack, according to The Record. In a statement to Russian state news agency TASS, Rosstat said its security systems had detected suspicious activity in time for specialists to respond, that it had found no evidence that protected information had been leaked or its databases compromised, and that it was working with cybersecurity experts and law enforcement to identify the source of the attacks, according to The Record. The Record reports that groups claimed responsibility and that their claims could not be independently verified. (source: The Record) Correction (03 Nov 2026): the card date has moved from 3 to 2 November 2026, the date The Record shows on its report. (source: The Record)
The Record (2 Nov 2026)
breaches
Abrigo, which provides cloud software to US community banks and credit unions, said on its status page on 30 October 2026 that it identified irregular activity in its environment and, out of an abundance of caution, disabled the Sageworks application at about 11:25 am US Eastern time (11:25 pm Perth). The incident covers Sageworks Analysis, the Sageworks API and Online Portal Now. Abrigo's updates over 30 October to 1 November said its team continued to investigate and that notices were going to Product and IT & Security contacts at customer institutions; on 2 November at 07:11 US Eastern time (8:11 pm Perth) it said the Sageworks platform was available again with the exception of borrower-facing capabilities, and that it was monitoring. Abrigo's status updates do not say what the irregular activity was or whether any data was accessed. (source: Abrigo status page) BleepingComputer reported on 2 November that Abrigo serves more than 2,400 institutions, that Sageworks handles sensitive information including banking customer details, and that Abrigo had not responded to its request for details, so it is unclear whether the outage was caused by a breach or a technical issue. (source: BleepingComputer)
Abrigo status — Sageworks Analysis, Sageworks API and Online Portal Now Unplanned Maintenance (updates 30 Oct to 2 Nov 2026)
breaches
Blockchain analytics firm Chainalysis says in a security incident post dated 30 October 2026 that it was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks. In the text of the email it sent to impacted customers, which it publishes in the post, Chainalysis says that this month it detected an external actor using offensive agentic techniques to gain unauthorised access to Chainalysis systems and internal tools, and that its teams have been working to investigate the activity, patch vulnerabilities and harden its systems. It says some non-sensitive customer data, such as user IDs, full names, email addresses and organisation role labels for users provisioned on its platform, was accessed, and that it is working out which records were accessed for each organisation. It says it has found no indication that investigation content (such as graphs, notes or cases), transaction or query results, passwords in clear text, MFA secrets or user session tokens were accessed. Chainalysis says it has engaged third-party cybersecurity experts, has proactively notified all of its customers (some had been notified earlier), and that the incident is not related to the recent crypto theft at Binance. It has not said when the access began, how the attacker got in, or how many users are affected. (source: Chainalysis)
Chainalysis — Chainalysis Security Incident Information (30 Oct 2026)
breaches crypto ai
Revolve Group, the US online fashion retailer, said in a Form 8-K dated 29 October 2026 and filed with the US Securities and Exchange Commission on 30 October that it recently became aware of unauthorised access to certain of its systems, started its cyber incident response protocols and confirmed the unauthorised activity was remediated. Revolve says that, based on its investigation, an unauthorised actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information with their online shopping account on its e-commerce platform. It says it notified federal law enforcement, engaged external cybersecurity experts, that the incident has not caused operational disruption or interrupted service to customers, and that it does not believe the incident will have a material impact on its business. Revolve did not say when the access happened or how many customers are affected. According to The Record, Revolve did not answer its questions about when the attack occurred, and told regulators in Texas that 127,200 people in the state had information stolen, with another 1,328 in Vermont and notifications also filed in Massachusetts (state filing figures as reported by The Record, not independently verified). (sources: Revolve Form 8-K; The Record)
Revolve Group, Inc. — Form 8-K, Item 8.01 Other Events (dated 29 Oct 2026, filed 30 Oct 2026)
breaches
Florida's Department of Education (FLDOE) said it became aware on 19 October 2026 of a data breach involving the Florida Student Financial Aid website, according to The Record, which reported the department's statement on 30 October. According to The Record, the exposed information includes names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth, and the breach affects nearly 5 million people who have applied for financial aid in Florida. The Record quotes the department's statement: 'An unauthorized party gained access to a system or database containing company or customer information,' and says FLDOE is working with the Florida Digital Service and the Florida Department of Law Enforcement. According to The Record, FLDOE has taken the financial aid site down, warned that other department websites and services may see temporary disruptions, says the incident has been contained and was reported to the Office of the Attorney General, and says financial aid, scholarships, grants and student loans are not affected and disbursements will not be delayed. The department declined to comment to The Record on the nature of the incident or the attackers. Cyberstack could not read the department's own notice. (source: The Record)
The Record — Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach (30 Oct 2026)
breaches
Incidents
Fri 30 Oct
Updated Mon 2 Nov
Hardware wallet maker Trezor said in a blog post on 30 October 2026 that its security team received a responsible-disclosure report on 28 October of a hardware implant in a Trezor Safe 5 bought in August 2026 from CryptoBilis, until October an official Trezor reseller in Southeast Asia, through the marketplace Tokopedia. Trezor says it has not yet received the device to confirm the report, but based on the customer's description, photos and a video interview it is treating the report as credible and warning customers now as a precaution; its lab will examine the device when it arrives. According to the report, which Trezor says it has not verified itself, an extra circuit board with a cellular module and antenna sits between the main board and the screen, reads what the screen shows, including the wallet backup (recovery phrase), and sends it out over a mobile network whenever the device is plugged in. Trezor says the implant appears to operate similarly to those seen in Ledger devices but will not draw comparisons while investigations continue, and does not know who is behind it. Trezor says no CryptoBilis buyer has reported a loss of funds, that the reporting customer had moved his funds before finding the board, and that it has no reports involving any other reseller. Trezor removed CryptoBilis as a reseller on 9 October 2026, after Ledger began investigating fund losses among its own CryptoBilis buyers. Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, including through any store selling CryptoBilis-supplied devices; it will ship a new device or give a voucher to those buyers, and warns that scammers are likely to use the incident for phishing by email, letter and phone. (source: Trezor) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Trezor)
Trezor Blog — Implant reported in a Trezor sold by CryptoBilis (30 Oct 2026)
breaches crypto
Incidents
Fri 30 Oct
Updated Sun 1 Nov
Cloud deployment platform Northflank opened a security incident on its status page on 30 October 2026, marked as a major outage affecting the Northflank Platform. At 13:40 UTC (9:40 pm Perth) Northflank told users to rotate environment variables immediately; at 13:58 UTC (9:58 pm Perth) it said to assume all environment variables had been decrypted and to disable or rotate all keys. In an update at 15:12 UTC (11:12 pm Perth) Northflank said all users should assume their environment variables are decrypted and begin rotation immediately, listing secrets on workloads, secret groups and global secrets, and said multiple users are confirming that their AI keys have been used. The incident timeline on the page starts with a Wiz threat alert at 11:43 UTC (7:43 pm Perth), reviewed by Northflank engineers a minute later, followed by an initial network policy patch at 12:02 UTC (8:02 pm Perth), further patches at 12:50 and 13:05 UTC, and a request for support from the Wiz CIRT at 13:00 UTC. Northflank has not said on the page how the variables were exposed or how many customers are affected. (source: Northflank status page) UPDATE (1 Nov 2026): Later updates on Northflank's status page (still marked Identified, major outage) say secret rotation for Postgres and MongoDB was enabled for all users at 15:12 UTC on 30 October (11:12 pm Perth), with a recommendation to disable public expose on add-ons. At 19:28 UTC (3:28 am Perth, 31 Oct) Northflank said its investigation was ongoing with no further confirmed findings and its guidance was unchanged: assume all environment variables have been compromised and rotate all secrets and credentials. At 23:38 UTC on 30 October (7:38 am Perth, 31 Oct) it said users have reported unauthorised use of AI API keys supplied to the platform, told users to revoke existing credentials with their issuing providers, generate replacements and review AI provider usage and billing logs, and said these reports may be consistent with the broader pattern of attacks targeting AI credentials described in Wiz's 'Black October' report. At 01:04 UTC on 31 October (9:04 am Perth) it enabled audit logs for all customers, including free users, and at 13:34 UTC (9:34 pm Perth) it said secret rotation for MySQL and Redis is available to all customers. BleepingComputer reported on 31 October (2:01 am Perth, 1 Nov) that Northflank had not answered its questions about the breach and its impact. (sources: Northflank status page; BleepingComputer) UPDATE (1 Nov 2026): Northflank's status page said at 22:32 UTC on 31 October (6:32 am Perth, 1 Nov) that secret rotation for Minio add-ons is available to all customers, and at 23:31 UTC (7:31 am Perth) that secret rotation is available for RabbitMQ add-ons; it again asked users to rotate all secrets if they have not already. The incident is still listed as Identified, with a major outage. (source: Northflank status page)
Northflank status — Security incident (30 Oct 2026, times in UTC)
breaches cloud
Russian home goods retailer Poryadok, which operates 48 stores across 32 Russian cities, confirmed that a cyberattack caused disruption that forced it to close some of its stores and suspend online services for five consecutive days, The Record reported on 30 October 2026. "We have been hit by a cyberattack, but we are already actively working to restore our services and gradually return operations to normal," the company said in a statement, according to The Record. The Record says Poryadok first reported technical problems on Sunday, saying its website, mobile app and physical stores were temporarily unavailable, and that customers have been unable to collect orders, access loyalty accounts or contact customer support. According to The Record, the company did not disclose how hackers breached its systems or when normal operations would resume, said it expected to reopen its stores and restore access to order information and loyalty bonuses without giving a timeline, and its website indicated that only some stores were still affected. The Record says it was not immediately clear who carried out the attack or whether any customer information had been compromised. (source: The Record)
The Record — Russian popular home goods chain faces days of disruption following cyberattack (30 Oct 2026)
breaches
Incidents
Thu 29 Oct
Updated Sat 31 Oct
The UK Investigatory Powers Commissioner's Office (IPCO) says in its 2025 annual report, ordered by the House of Commons to be printed on 29 October 2026, that GCHQ has scoped the maximum number of items of removable media (USB sticks, external hard drives, compact discs, memory cards and other portable storage) that it cannot immediately locate and are therefore unaccounted for, some of which may contain data handled under the Investigatory Powers Act. IPCO calls this a very significant number, which GCHQ currently estimates to be in the thousands, and says GCHQ has a programme of work to locate as many as possible, after which it will be able to report how many devices are confirmed lost. The Commissioner writes that he remains concerned GCHQ has not yet established a sufficiently clear understanding of the scale, location and recoverability of the lost media, although the issues were first raised with him several years ago; IPCO says it is disappointed with the time GCHQ has taken to investigate, that a new GCHQ tool to monitor the issue, storage and location of removable media will come into use in 2026, and that it will require regular written progress reports throughout 2026. (source: IPCO) The Record reported on 30 October that a GCHQ spokesperson said its management system for removable media was previously not sufficiently robust to track the items registered for use, that it has taken action against all of IPCO's recommendations and the findings have been addressed comprehensively; the spokesperson declined to say whether unauthorised people had accessed any of the missing media. The Record notes the report does not allege any devices have fallen into the hands of adversaries. (source: The Record) Correction (31 Oct 2026): removed the reference to the Australian Information Security Manual (cyber.gov.au ISM, Guidelines for media) and its control numbers as a source, because this desk could not read that page in full; the card's facts come from IPCO's annual report and The Record. (source: IPCO)
IPCO — Annual Report 2025 (HC 253, ordered to be printed 29 Oct 2026; paragraphs 4.66–4.68)
breaches government
The US Justice Department said on 29 October 2026 that a federal district court in the Eastern District of Virginia sentenced Ahmad Umar Agha, also known as Th3Pr0, to 42 months in prison for his central role in a hacking conspiracy organised and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, from as early as 24 August 2011 to 31 January 2024. According to the department, Agha hacked about 47 Western media entities, businesses, NGOs and US and allied government entities to spread the former Syrian government's propaganda; the conspiracy also collected intelligence for that government and tried to cause US service members to refuse duty. The department says Agha's hack of a news agency's Twitter account let him post on 23 April 2013 a false claim that President Obama was injured in two explosions at the White House, causing a temporary $136 billion flash crash in the value of Dow stocks, and that he redirected visitors to the US Marine Corps recruitment website, through the company hosting it, to an image urging Marines to refuse orders; about 3,500 visitors saw it. Court filings cited by the department say one victim company lost about $35,000 a day for roughly six months and one NGO lost $480,000 in total. Agha and co-conspirator Firas Dardar were charged by complaint in June 2014 and indicted in May 2018; the department says Dardar remains a fugitive. The FBI Washington Field Office investigated. (source: US Department of Justice) The Record reports that Agha was taken into US custody last year and that the department has not given details of his arrest. (source: The Record)
US Department of Justice — Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on Behalf of the Bashar Al Assad Regime (29 Oct 2026)
breaches
Incidents
Thu 29 Oct
Updated Sat 31 Oct
Cursor said in a security notice dated 29 October 2026 that a maliciously modified version of Anthropic's Claude Code extension, Anthropic.claude-code version 2.1.313, was available in the Cursor VS Code extension Marketplace between about 2:27am PT and 1:35pm PT that day (about 17:27 on 29 October to 04:35 on 30 October Perth time), and that the version was not developed by Anthropic. Cursor says at most 5,000 users were affected and that it will contact them directly. According to Cursor, the extension collects host and user information (including hostname, username, OS, environment variable names, configured Git email and public IP), adds an attacker-controlled SSH key labelled svc-telemetry to authorized_keys, tries to enable the local SSH service and open a persistent reverse SSH tunnel via a LaunchAgent on macOS or a scheduled task on Windows, and reports host details to the attacker's server. Cursor says enabling the SSH service needs admin rights the extension does not have on most macOS and Windows hosts, so on those hosts that step fails and the attacker could not have logged in through the tunnel, but the key, persistence and host-detail report still happen. Cursor says it removed the version, shut down the marketplace as a precaution, audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt and restored the marketplace, and worked with the hosting provider to take the attacker's server offline. It says it has no evidence that other versions of the extension or the official distribution are affected, and it published indicators of compromise and remediation scripts for macOS and Windows. (source: Cursor) UPDATE (31 Oct 2026): Felix Rieseberg, a member of Anthropic's technical staff, said in a post on X on 30 October (10:08 pm Perth): 'We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish.' (source: Felix Rieseberg on X) According to The Register, his post goes on to say the versions on Anthropic's official channels are not affected and that this only impacts Cursor users, and neither Cursor nor Anthropic has said how the malicious package reached the marketplace. (source: The Register)
Cursor — Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace (29 Oct 2026)
breaches ai
