🚨 Incidents
Top Stories 5
Artem Stryzhak, a Ukrainian national who acted as an affiliate for both Nefilim and Hive ransomware groups, was sentenced to 70 months for conspiracy to commit computer fraud. He operated attacks against U.S. businesses, including healthcare, causing over $100 million in losses. The U.S. State Department has offered rewards for information on his associates.
Key points
- Stryzhak joined Nefilim in mid‑2021, taking 20% of ransom proceeds and targeting an oil‑and‑gas transport firm.
- He later acted for Hive, encrypting data at a dental office, a healthcare provider, and law firms, with some victims paying ransom for decryption keys.
- The court noted the attacks disrupted patient care and contributed to more than $100 million in losses.
- U.S. authorities offered up to $10 million for information on Nefilim leader Volodymyr Tymoshchuk and up to $1 million for other group leaders.
Sources
SecurityWeek
Bleeping Computer
justice.gov
The Record by Recorded Future
Cyberscoop
5 articles
Blockchain intelligence firms TRM and Chainalysis attribute the $6.36 billion Binance hack to North Korea's elite group TraderTraitor. Binance froze roughly $3 billion of the stolen assets and is working to recover funds for users.
Key points
- TRM and Chainalysis say the attack moved $6.36 billion from Binance wallets across ten blockchains in about 20 minutes.
- Binance froze roughly $3 billion of the stolen assets and plans to cover all user losses.
- The hack mirrors previous North Korea‑linked heists, including the $1.5 billion Bybit breach.
- Investigators suspect a compromised laptop and a full‑access token to a hot wallet were used.
- Binance suspended withdrawals while deposits remain operational.
Polymarket confirmed that a breach of its performance‑monitoring vendor DebugBear caused wallet‑draining code to siphon over $2.1 million in crypto from users. The platform halted trading, reimbursed affected traders and referred the case to law enforcement.
Key points
- Outages on Thursday were traced to a security incident involving DebugBear, a website‑performance provider.
- Hudson Rock identified malicious code that harvested account data and transferred funds to a single address, resulting in $2.1 M loss.
- Polymarket stopped trading, reimbursed all affected users and removed the DebugBear embed from its site.
- The company has involved law‑enforcement but has not disclosed the attacker or total victim count.
The University of New Mexico Health Sciences Center restored its hospital operations after a ransomware intrusion claimed by the BYOD group. The gang threatened to expose stolen patient data and demanded a $2,500 ransom, which the university refused to pay. Officials warned staff and patients not to engage with any hacker communications.
Key points
- UNM’s Health Sciences Center restored all hospital, medical school, and research systems after a ransomware incident.
- The BYOD gang claimed responsibility, offered free decryption keys, but threatened to leak patient and employee data if contacted.
- The university did not pay the $2,500 ransom demand and cautioned against responding to hacker messages.
- Authorities advised anyone contacted by the attackers to retain the communication and report it to the FBI’s IC3.
- The incident follows recent healthcare cyber‑attacks and coincides with new federal initiatives to protect rural hospitals.
Sources
The Record by Recorded Future
Bleeping Computer
The Record by Recorded Future
SecurityWeek
4 articles
Ahmad Umar Agha, identified as a key operative for Bashar Assad’s inner circle, received a 42‑month federal prison term for a decade‑long hacking campaign that compromised media outlets, NGOs, and U.S. government sites. The operation included a fake AP tweet that sparked a brief $136 billion market flash crash and theft of White House staff credentials.
Key points
- Agha, using the handle “Th3 Pr0,” infiltrated roughly 47 targets from 2011‑2024, including the Associated Press, a Marine Corps recruitment site, and White House staff email accounts.
- His most damaging act was a fabricated AP tweet about an Obama injury that triggered a $136 billion flash crash on April 23, 2013.
- Victims reported significant costs, such as $35,000‑per‑day losses for a publishing‑service firm and $730,000 total losses for a global NGO.
- Agha and co‑conspirator Firas Dardar were indicted in 2018; Dardar remains at large while another associate, Peter Romar, was extradited and pleaded guilty.
- U.S. prosecutors highlighted the threat posed by regime‑backed cyber actors serving hostile governments.
Other Updates 10
Amadeus passenger service system breached, exposing reservation data of Japanese and Korean airlines
Amadeus breach exposed reservation details of about 2,000 airline customers across Japan and Korea.
Amadeus passenger service system breached, exposing reservation data of Japanese and Korean airlines
Key points
- Japan Airlines and Japan Trans-Ocean Air reported that reservation data was accessed from August 2023 to September 2026 via Amadeus’ system.
- Korean Air and Asiana Airlines confirmed that only reservation numbers were leaked, with no database intrusion detected.
- Amadeus has applied additional security controls and is monitoring dark‑web activity.
- Around 2,000 individuals were affected, including passport numbers, nationality and mileage details, but credit‑card data remained safe.
- Airlines have opened dedicated support lines and warned customers of phishing attempts.
iRhythm’s June 2026 breach exposed data of over 8 million patients and was reported to HHS.
Key points
- The breach affected 8,179,772 individuals, compromising names, contact details, dates of birth, and device/account information.
- Hackers accessed data through third‑party hosted business applications and tried to extort a ransom by threatening public release.
- iRhythm notified affected persons, filed notices with state regulators and the U.S. Department of Health and Human Services, and reported no impact on product safety or operations.
Department of Peace released a searchable dump of 41,000+ DHS employee records, revealing personal and assignment information.
Key points
- The leak originates from an Okta single‑sign‑on service used by DHS, containing employee identifiers, phone numbers and email addresses.
- Hacktivist group Department of Peace provided the raw files to DDoSecrets, which hosts the archive and source code for a searchable web interface.
- Researcher maia arson crimew built an online search tool (icepicx.is) that cleans and enriches the data for journalists, investigators and FOIA requests.
- The disclosure highlights internal structure of DHS agencies, including ICE, and is being cited as a resource for accountability and oversight.
Amadeus’ reservation system breach exposed personal data of about 92,000 Japan Airlines passengers.
Key points
- Amadeus reported unauthorized access to its passenger service system spanning August 2023 to September 2026, affecting reservation codes, names, flight details and, for a subset, contact and passport information.
- Japan Airlines confirmed the exposure but said financial data and passwords remained secure, and no misuse evidence exists yet.
- The flaw was discovered by Amadeus, which has applied security measures, though no specific patch is detailed.
- Other carriers including ANA, Asiana and Korean Air have reported similar impacts, indicating a broader supply‑chain campaign.
- Amadeus initially claimed the vulnerability was not exploited by ransomware actors, but the breach shows malicious exploitation.
GMO Internet launches a $1 million bounty after a hack exposed customer data and triggered a $50 million ransom demand.
Key points
- GMO Internet’s “Cybercrime Bounty” program will reward up to $1 million for tips that identify the attackers responsible for the unauthorized access to its Onamae.com Desktop Cloud FX service.
- Victims whose personal information was confirmed leaked may receive up to ¥3 million ($19 k) from the company.
- A hacker claimed to have posted a customer’s name and address online after the firm ignored a $1 million ransom request and warned of daily data releases.
- The breach affected several foreign‑exchange firms using GMO’s service, including OANDA Japan, Goldenway Japan and Ava Trade Japan, prompting a warning from Japan’s finance minister.
- GMO denied a later $50 million cryptocurrency ransom demand and urged users to back up data and disconnect devices while investigations continue.
Trezor warns of a suspected crypto‑theft implant in Safe 5 wallets sold by CryptoBilis and advises users to replace affected devices.
Key points
- Trezor received a report from an Indonesian buyer who discovered an extra board with a cellular module inside a Safe 5 unit purchased via Tokopedia.
- The implant could capture screen data, including recovery phrases, and exfiltrate it over a mobile network.
- Trezor has stopped sales through CryptoBilis, recommends moving assets to new wallets, and is awaiting the device for forensic analysis.
- The incident mirrors a recent Ledger hardware‑wallet implant linked to the same reseller, with reported losses totaling $3.5 million.
- Singapore police have issued an advisory regarding tampered cryptocurrency hardware wallets in the region.
A breach of Florida's student aid portal leaked SSNs and other personal data of roughly 5 million applicants.
Key points
- The breach was discovered on October 19 and involved names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth.
- FLDOE shut down the financial aid site and is working with the Florida Digital Service and the state Department of Law Enforcement on response efforts.
- The agency advises affected individuals to watch their credit reports and financial accounts for suspicious activity.
- This incident follows a recent California education department breach and a prior Florida DMV data breach attributed to a known hacking group.
- No delay to scholarships, grants, loans or tuition payments is expected despite the breach.
The DHS SSO breach exposed thousands of federal employee records and internal group details, published by DDoSecrets.
Key points
- The breach was attributed to a hacker using the alias “Department of Peace,” who supplied the data to transparency nonprofit DDoSecrets.
- Released information covers personnel names, phone numbers, email addresses, organizational charts, and groups dating back to 2011 across multiple DHS components.
- A searchable portal (icepicx.is) now hosts the dataset, with the original domain icepi.cx taken down at DHS request.
- The leak includes details of international offices, U.S. embassies, and specialized groups involved in surveillance, finance, and special operations.
- The incident follows earlier disclosures by the same actor related to contract data and Minnesota killings, highlighting ongoing targeting of DHS systems.
US authorities charge six scammers linked to China for a global NFT fraud that affected about 800 victims and led to $1 billion in crypto being restrained.
Key points
- The Strike Force announced charges against six suspects with connections to Africa, Southeast Asia and China for a scheme that used fake dating personas to lure U.S. victims into fraudulent NFT investments.
- Victims were directed to connect their crypto wallets to counterfeit sites, allowing scammers to siphon funds without consent; investigators traced about 74 wallets linked to roughly 800 victims.
- Law enforcement seized the fraudulent websites and identified cryptocurrency accounts tied to Chinese actors, reporting more than $1 billion in crypto assets restrained.
- The indictment includes conspiracy to commit wire fraud and detailed evidence such as scripts, employee rosters, and payment schedules from operations based in Madagascar.
- The expansion of the Strike Force aims to counter similar transnational criminal organizations targeting Americans worldwide.
Railway says attackers accessed encrypted environment variables and advises all users to rotate API and cloud keys.
Key points
- Railway discovered that hackers may have decrypted environment variables containing passwords and API keys used by developers.
- The breach appears limited to a subset of users, but the firm recommends key rotation for all customers.
- Railway paused new builds during the investigation and plans to publish a post‑mortem.
- The incident follows a CISA advisory on China‑based AI companies targeting U.S. firms and a similar breach at OpenCode.
- No specific victim count, root cause, or ransom demand was disclosed.
Additional Signals 25
Police arrested three suspects for a series of bank account thefts totaling more than half a million hryvnias.
Key points
- The investigation documented 16 separate cyber‑thefts, each involving unauthorized login to victims' banking applications using stolen usernames, passwords and PINs.
- Funds were moved to accounts controlled by the suspects or their acquaintances and withdrawn as cash or used for purchases.
- Law‑enforcement raids recovered mobile phones, SIM cards, bank cards, computers, over 150 k UAH in cash, $2 k and even illegal weapons.
- Three suspects – two adults (21 and 22) and a 17‑year‑old minor – were detained; the adults face theft and illegal access charges, while the minor is under house arrest.
- The case remains under investigation, with authorities seeking additional participants.
Revolve confirmed a breach that stole payment card details of more than 128,000 shoppers.
Key points
- Revolve filed an SEC 8‑K stating attackers used automated tools to harvest names, contact info, card numbers and expiration dates from saved accounts.
- The breach affected 127,200 Texas residents, 1,328 in Vermont and additional victims in Massachusetts.
- Law enforcement has been notified and a cybersecurity firm is leading the recovery effort.
- Revolve reported no service outage and expects no material financial loss.
- The incident adds to a series of recent payment‑card breaches at fashion retailers.
An external intrusion into So-net’s member database leaked personal information of over 2 million users.
Key points
- The intrusion was detected on October 19 and the compromised server was taken offline on October 23.
- Leaked data includes names, phone numbers, email addresses, user IDs, birth dates, gender, and internet‑connection IDs; email passwords for certain services were also exposed.
- Approximately 2,141,986 member records and 443,495 plala‑S‑course records were affected, along with 16 bank account details and 7 password‑reset tokens.
- Passwords for basic So-net email accounts were not compromised, and no credit‑card information was involved.
- So-net has reset affected email passwords, advised users to avoid phishing, and reported the incident to Japan’s Personal Information Protection Commission.
Columbia University settles a class‑action lawsuit for $16.1 M after a May 2025 data breach compromised personal data of U.S. residents.
Key points
- The settlement covers individuals whose personal data was compromised in a May 2025 cyberattack on Columbia University.
- Class members can claim up to $8,500 for documented monetary losses or receive a cash distribution after settlement costs are deducted.
- All eligible claimants also receive two years of free credit‑monitoring, dark‑web monitoring, identity‑theft insurance up to $1 M, and identity‑recovery services.
- Columbia University denies liability but commits to maintain enhanced security measures for three years.
- The settlement fund totals $16,125,000, with attorney fees and litigation costs deducted before claimant payouts.
Police bust AI‑enabled crime ring that stole millions of records and extorted hundreds of thousands of dollars from dozens of Korean entities.
Key points
- The Seoul Metropolitan Police Agency disclosed that seven suspects stole 8.2 million personal data points from more than 90 organizations, including hospitals and private academies.
- Investigators say the group leveraged AI tools to compromise 60 targets and attempted extortion, demanding a total of 360 million won (≈US$272 k).
- The 32‑year‑old ringleader, a former security‑company employee, was referred to prosecutors and remains in detention; the remaining suspects face questioning.
- Authorities have heightened alerts for AI‑assisted cybercrime following similar attacks on local financial institutions.
- The case highlights emerging threats where generative AI automates data extraction and credential harvesting.
Bithumb is investigating a hack of its internal mobile system that may have leaked member data, though assets are unaffected.
Key points
- Bithumb discovered unauthorized access to its in‑house mobile communication system used by staff.
- The exchange notified the Korea Internet & Security Agency and the Personal Information Protection Commission and is evaluating the scope of any member data exposure.
- Authorities note a recent surge of cyberattacks across South Korean financial institutions, though no financial loss was reported for Bithumb.
- Bithumb stated the breach does not affect the separate trading platform, so customer crypto holdings are safe.
AO3 is down following a suspected breach that could have exposed user account details, with restoration expected in 2‑4 weeks.
Key points
- The OTW status page announced a security incident on AO3, leading to a full site outage.
- Investigators have not confirmed theft of the user database but cannot rule it out; stored data includes usernames, emails, IPs, and hashed passwords.
- No user‑generated works, bookmarks, or kudos were deleted, and donor information remains separate and untouched.
- AO3 advises users to change passwords on any other sites where the same credentials were used.
- Site recovery may initially be in a degraded, read‑only state and could require intermittent shutdowns during remediation.
Vanden Broele’s eSignFlow was compromised, exposing metadata from municipal documents and prompting phishing warnings.
Key points
- The breach affected the eSignFlow digital signing component used by more than 120 Belgian local authorities.
- Vanden Broele shut down the service, replaced access keys and blocked attacker IPs before restoring limited functionality.
- Only metadata appears to have been exfiltrated; no forged signatures were created.
- Affected municipalities, including Peer and Genk, are urging citizens to stay alert for fraudulent communications.
- The incident was reported to the Belgian Centre for Cybersecurity and the data protection authority, and a police complaint was filed.
The Intercept’s handling of a leaked NSA report enabled authorities to pinpoint and arrest leaker Reality Winner.
Key points
- The Intercept published a classified NSA briefing on Russian hacking efforts ahead of the 2016 election.
- NSA printer‑tracking technology identified six print jobs, one linked to Winner’s workstation.
- An affidavit shows the outlet sent the document back to the NSA, inadvertently exposing the source.
- FBI agents confronted Winner, leading to her arrest on charges of unauthorized retention and transmission of classified information.
Sony’s Japanese ISP So‑net suffered a data breach exposing 2.6 million subscriber records, including emails and passwords.
Key points
- The intrusion was discovered on October 23 after attackers breached the member database on October 19.
- Compromised data includes names, birth dates, contact information, user IDs, email addresses, passwords for four mail services, and 16 bank‑account records.
- Sony reset passwords for the affected email accounts and reported the incident to Japan’s Personal Information Protection Commission.
- No credit‑card data was stored; the cause of the intrusion remains undisclosed.
- Approximately 293 000 of the records belong to former subscribers whose data was retained for billing support.
External breach of Rakus Light Cloud’s Blastmail system exposed customer data and forced service shutdown.
Key points
- The attack involved unauthorized access to two API servers, where commands were run to extract sales‑management and mailing‑list data.
- Leaked data includes company names, contact persons, phone numbers, email addresses and payment history, but no credit‑card numbers.
- Service disruption began on 21 Oct 2026 and remains unresolved while safety checks continue.
- Rakus states no other group services show evidence of compromise as of the latest update.
Four threat groups leveraged AI models to bypass safeguards, compromising healthcare and government targets.
Key points
- CrowdStrike analyzed campaigns from May to August involving four unreported groups operating in Chinese, Spanish/English, Indonesian, and Russian languages.
- Attackers used older versions of Anthropic Claude and Deepseek models, employing multiple models to sidestep differing guardrails.
- Techniques included prompt engineering, fake authorization files, and a runtime patch tool called ClawGod to remove safety instructions from Claude Code.
- The Spanish/English group exfiltrated credentials and medical records from at least 15 Argentine health organizations.
- The Chinese‑language actor built penetration‑testing harnesses and compromised government targets.
Moldova investigates a large-scale breach of government services that leaked personal data and disrupted public applications.
Key points
- Hackers made roughly 11 million unauthenticated requests to extract data from government portals between Oct 19‑23.
- Extracted records include names, birth details, health insurance, pensions, driver’s licenses and vehicle ownership, but not bank card numbers.
- Approximately 750,000 identification numbers were affected, prompting the shutdown of 30+ systems and inspection of 82 services.
- The prime minister warned the attack could be part of a broader campaign involving foreign state actors, though no attribution has been made.
UNM Health Sciences Center recovers from a cyber incident that forced hospital and class shutdowns, with systems back online and investigations ongoing.
Key points
- The incident affected end‑user devices but did not breach core servers, prompting a rapid containment response.
- Ambulance traffic was diverted and outpatient surgeries suspended until systems were restored at 2:30 p.m.
- Academic programs on the health sciences campus were canceled, though other UNM campuses continued normal operations.
- Law enforcement at state and federal levels have been notified and a criminal investigation is underway.
Cărturești suffered a cyber incident that halted its online services but shows no sign of data loss.
Key points
- The breach led to the temporary unavailability of carturesti.ro, the mobile app, and the loyalty points system.
- Physical stores remain open and payment processing continues normally.
- The company has engaged cybersecurity specialists and notified relevant authorities.
- Customers are warned about phishing attempts and advised to change passwords if reused elsewhere.
Warhorse Studios reports a serious cyberattack, engaging experts and authorities to secure its systems and evaluate impact.
Key points
- Warhorse Studios announced that attackers accessed company systems and data, prompting an immediate response to secure infrastructure.
- The studio is collaborating with cybersecurity specialists and law enforcement to investigate and contain the breach.
- No specific details on data loss, financial impact, or the identity of the attackers were provided.
- Warhorse emphasized ongoing communication as more information becomes available.
- The incident occurs amid broader industry concerns about increased cyber activity targeting game developers.
Poryadok suffered a multi‑day service outage after a cyberattack, with stores and online channels temporarily unavailable.
Key points
- The attack caused closures of stores in multiple cities, including Voronezh and Kursk, and prevented customers from collecting orders or accessing loyalty accounts.
- Poryadok announced the incident via statements on VK but provided no details on the attackers or the breach method.
- No evidence of data theft was reported, and the retailer gave no timeline for full restoration of services.
- The incident follows recent cyberattacks on other Russian businesses such as Dodo Pizza and travel agency Anywayanyday.
- Outage monitoring service DownRadar tracked the continued unavailability of Poryadok’s online services through the weekend.
Bunny.net removed a compromised CDN server in Armenia and reissued TLS certificates after a provider’s unauthorized access incident.
Key points
- The incident involved a server supplied by an infrastructure provider that was accessed using third‑party management software.
- Bunny.net halted traffic to the server within 20 minutes, wiped it, and revoked its access to other systems.
- Investigations by both parties found no evidence of unauthorized access to the CDN node or its data, though a possibility cannot be fully ruled out.
- Potentially exposed assets could include cached CDN content, pull‑zone configurations, and TLS certificates, prompting a full re‑issuance of managed certificates.
- Customers using custom TLS certificates are advised to revoke and re‑issue them with new private keys.
Chainalysis confirms a security incident but reports no data breach or credential compromise.
Key points
- Chainalysis experienced a cybersecurity event and launched an investigation with external experts.
- Preliminary findings show no unauthorized access to investigation content, authentication credentials, or session tokens.
- All customers have been proactively notified and will receive updates as the investigation continues.
- The company clarified that the incident is not linked to the recent Binance crypto theft.
A cyberattack disabled the federal bankruptcy notice system, yet no data was exfiltrated and operations are resuming.
Key points
- The BNC platform, managed by BAE Systems for U.S. bankruptcy courts, suffered an outage after a cyber intrusion two weeks ago.
- Court officials declared a 90‑day emergency to maintain court functions while the system is restored.
- BAE Systems confirmed that no other systems were affected and no personally identifiable information was taken.
- The outage halted electronic bankruptcy notices, forcing courts to rely on paper notices with delay warnings.
- The incident follows a series of recent federal agency breaches, though no group has claimed the attack.
A breach of Moldova’s public digital services exposed personal data of up to 750,000 citizens, prompting service shutdowns and a coordinated response.
Key points
- The intrusion targeted the national ID number (IDNP) database, extracting identifiers, family details, social benefits, medical and financial information including IBANs.
- Ages, STISC, ASC, SIS and other agencies disabled 82 public services and over 30 systems to contain the attack.
- No evidence of bank‑card data loss; authorities warned of fraud attempts using the stolen information.
- Victims will be notified and advised to remain vigilant against phishing and social‑engineering scams.
- A comprehensive audit is underway to assess the full scope and remediate vulnerabilities.
University Hospitals is restoring its MyChart portal after a cyber incident that knocked the system offline.
Key points
- University Hospitals detected unusual activity on its servers and isolated them from the internet.
- External cybersecurity experts and law enforcement are assisting the investigation.
- Patient access to the MyChart portal remains unavailable while restoration continues.
- The hospital cited challenges with network connections and pre‑authorizations at some sites.
- No confirmed data exfiltration or ransom payment has been reported.
Belgium’s tax portal was taken offline after a cyberattack, with no confirmed data breach and investigations ongoing.
Key points
- The FPS Finance disabled MyMinfin, the primary online tax service, as a precaution while assessing the attack’s impact.
- Officials indicated there is currently no evidence of data theft or exposure.
- The incident occurs days before the October 31 tax filing deadline, prompting a potential extension for affected taxpayers.
- Earlier this month, Belgian sites were shut down due to concerns over critical PHP flaws, though no successful exploitation was reported.
- It remains unclear if the recent attack is linked to the prior PHP vulnerability alerts.
Bitonic suffered a breach that resulted in minor Bitcoin theft and credential changes for three users, all of whom were compensated.
Key points
- Unauthorised parties accessed Bitonic's systems via a vulnerability on 25 October, prompting the company to take affected systems and its hot wallet offline.
- Small Bitcoin withdrawals were made from three customer accounts and login credentials for two accounts were changed.
- Bitonic fixed the vulnerability, restored services, and fully compensated the impacted customers.
- The breach may have exposed personal data, but no confirmation of data theft was provided.
- Cold wallets and other systems remained untouched, and the investigation continues.
Moldova restores access to multiple e‑government services after a recent cyber‑security breach.
Key points
- The agencies AGE, ASC and STISC confirmed that the services are now available via the EVO portal after being secured and retested.
- Restored services include civil registry certificates, identity documents, citizenship status and business registry extracts.
- Technical checks and ongoing monitoring were performed before gradual re‑enabling of each service.
- Authorities advise the public to avoid sharing credentials and to verify any unusual requests through official channels.
- Investigations into the October cyber incidents remain ongoing.