Data Breaches & Incidents

Attackers behind a string of personal data leaks at Japanese organizations have been abusing APIs used by mobile apps and targeting known software flaws, according to an alert from the JPCERT Coordination Center (JPCERT/CC). The Tokyo-based center, which collects incident reports, based its October 8, 2026 advisory on those reports along with other information. Notably, the alert does not name any specific attacker or affected organization. The abuse of mobile app APIs appears to be a key vector, allowing attackers to access data through interfaces that are often less scrutinized than traditional web endpoints. Alongside this, the targeting of known software flaws suggests organizations are failing to patch promptly. One product explicitly mentioned in the reporting is Metabase, which has been subject to attacks. The article does not provide a specific CVE ID, affected version list, or indicators of compromise, so none are included here. Given the lack of named victims or technical identifiers, defenders should treat this as a sector-wide warning. Key takeaways from the alert include: Mobile app APIs are being actively abused to exfiltrate personal data. Known, unpatched software vulnerabilities are a primary entry point. Metabase instances have been targeted in these campaigns. JPCERT/CC issued the alert on October 8, 2026, based on incident reports from Japanese organizations. Organizations should review API access controls for mobile applications, ensure timely patching of known vulnerabilities, and pay particular attention to any internet-facing Metabase deployments. Since no CVE or version details were provided, teams should refer to vendor advisories for their specific software versions. Source: The Hacker News Has your organization audited its mobile API endpoints or Metabase exposure recently?

The FBI has made another arrest in connection with the ShinyHunters extortion group, according to a statement from FBI Director Kash Patel posted on X on October 9. The suspect is described as an alleged co-conspirator, though the FBI has not released their name and no charges have been made public at this time. This development follows the group's claim in September that it had breached the FBI's jobs portal, stealing sensitive data belonging to almost all FBI agents and job applicants. The bureau has not confirmed further details about the suspect's identity or the specific role they allegedly played. Key points: The arrest was announced by FBI Director Kash Patel on October 9. The suspect is an alleged co-conspirator of ShinyHunters. No name has been released and no charges are publicly filed. The group claimed responsibility in September for breaching the FBI jobs portal. Data allegedly stolen includes information on nearly all FBI agents and applicants. The investigation remains ongoing, and further details may emerge as the case develops. Source: The Hacker News Do you think this arrest will meaningfully disrupt ShinyHunters' operations, or is the group likely to adapt and continue?

The FBI has arrested another suspected member of the ShinyHunters extortion group, according to an announcement Friday by Director Kash Patel. The individual is believed to have been involved in the recent breach of FBI systems. The arrest follows the earlier compromise of agency systems attributed to the group, which has operated as a prolific data-theft and extortion crew. Authorities have not released further details about the suspect or the specific charges at this time. Suspect linked to the ShinyHunters extortion group Arrest connected to the recent breach of FBI systems Announcement made by FBI Director Kash Patel This development underscores the ongoing pressure law enforcement is placing on the group, which has been tied to multiple high-profile data breaches. No additional technical indicators or advisory identifiers were disclosed in the reporting. Details remain limited as the investigation continues. Source: BleepingComputer Do you think these arrests will meaningfully disrupt ShinyHunters' operations, or will the group simply regroup under new leadership?

The FBI has seized seven domains tied to Flax Typhoon, a Chinese state-sponsored threat group that has targeted critical infrastructure and other organizations worldwide. The domains were used to operate two hacking tools, MicroScan and FishHub, which supported the group's intrusion activity. Details on the specific domains, affected versions, or mitigation guidance were not included in the source report. Organizations that suspect exposure to this tooling should review their network logs for related activity and follow guidance from relevant authorities. Source: Publication Name Has your organization reviewed its exposure to Flax Typhoon tooling, and what steps are you taking to mitigate it?

OAuth grants are increasingly becoming a major blind spot for security teams. These grants create data highways between SaaS apps, AI agents, and other tools, and they are multiplying faster than most teams can properly review. The recent Klue breach demonstrated how attackers are actively exploiting forgotten OAuth grants to reach corporate data. The core problem is visibility and scale. Every new integration or third-party tool can introduce another grant, and over time these permissions accumulate without anyone tracking whether they are still needed or who still has access. OAuth grants connect SaaS apps, AI agents, and other tools, creating persistent access paths Forgotten or unreviewed grants can be abused to access corporate data The Klue breach shows attackers are actively targeting these grants Security teams need a way to continuously inventory OAuth grants, identify stale or excessive permissions, and revoke access that is no longer justified. Without that process, the attack surface keeps growing faster than any manual review can handle. Source: Unknown How is your organization tracking and reviewing OAuth grants before they pile up?

ASOS has begun notifying customers about a cybersecurity incident that occurred earlier this week, confirming that attackers accessed some personal data. According to the company, the breach stemmed from a social engineering attack combined with credential theft, rather than a direct technical exploitation of its systems. The retailer has not disclosed the exact number of affected customers or the specific categories of personal data involved. It is contacting impacted individuals directly with guidance. Key points: Attack vector: social engineering leading to credential compromise Data accessed: some customer personal data, per ASOS Notification: updates being sent to affected customers No specific CVE or advisory identifier was provided in the source material ASOS customers should watch for phishing attempts referencing the incident, as stolen personal data can be reused in follow-on social engineering campaigns. Anyone who receives an ASOS notification should verify the sender and avoid clicking unsolicited links. Source: BleepingComputer Have you or your organization reviewed your credential-handling and anti-social-engineering controls in light of incidents like this?

Attackers compromised third-party operators of country-code top-level domain (ccTLD) registries and modified authoritative DNS records, allowing them to hijack domains belonging to Google and obtain unauthorized HTTPS certificates for those domains. The impacted ccTLDs are: Ghana American Samoa Sierra Leone According to the reporting, the intruders gained access by breaching third-party operators rather than the registries themselves, then altered authoritative DNS records to redirect or take control of the affected domains. The unauthorized certificate issuance for Google domains is a notable escalation, since valid HTTPS certificates can make hijacked domains appear legitimate to visitors and can undermine trust assumptions built into web traffic. Details on the exact domains affected, the timeline of the compromise, and any remediation guidance have not been fully outlined in the available reporting. Source: BleepingComputer If your organization depends on domains under these ccTLDs, have you reviewed your DNS records and certificate logs for signs of tampering?

Attackers compromised the registries responsible for three country-code top-level domains (ccTLDs) and used that access to obtain unauthorized HTTPS certificates for several Google domains, according to a disclosure from Google on October 6. Google confirmed that its own systems were not breached, but warned that any domain ending in .gh (Ghana), .sl (Sierra Leone), or .as (American Samoa) was put at risk by the incident. Because the certificates were issued through the hijacked registries, an attacker holding one could impersonate the legitimate site over an encrypted connection, undermining the trust users place in HTTPS. Key points: Three ccTLD registries were hijacked: .gh, .sl, and .as Unauthorized HTTPS certificates were issued for multiple Google domains Google's internal systems were not compromised Any domain under the affected TLDs should be treated as potentially exposed For defenders and domain owners, this serves as a reminder that certificate issuance depends on the integrity of the registry chain, and that compromise at the registry level can have downstream effects well beyond a single organization. Source: [email protected] (The Hacker News) If your organization owns domains under .gh, .sl, or .as, have you reviewed your certificate logs or reached out to your registrar yet?

UK fashion retailer ASOS has confirmed a data breach after unauthorized push notifications were sent through its mobile app. The notifications displayed the word "HACKED" to users, according to reports. The attackers claim to have stolen customer data from the company's Snowflake environment, a cloud-based data platform. ASOS has acknowledged the breach but has not yet disclosed the full scope of the incident or how many customers may be affected. Key details: Unauthorized push notifications were sent via the ASOS mobile app The notifications contained the text "HACKED" Attackers claim to have exfiltrated customer data from ASOS's Snowflake environment ASOS has confirmed the breach but has not released further details on affected records or remediation steps This incident adds to a growing list of companies investigating breaches tied to Snowflake environments, where attackers have targeted misconfigured or credential-compromised cloud data instances. Source: BleepingComputer Has your organization reviewed its Snowflake access controls and monitoring in light of these ongoing cloud data platform attacks?

Japanese publishing giant Nikkei has disclosed that unknown attackers recently compromised two employee email accounts. One of the accounts was then used to send out thousands of phishing emails. According to the company's disclosure, the breached accounts were tied to Microsoft and Google email services. The incident was announced over the weekend, with Nikkei stating the attackers gained unauthorized access to the accounts before leveraging one of them to distribute the phishing messages. The company has not released details on how the accounts were initially compromised, nor has it specified the exact number of phishing emails sent beyond "thousands." It is also unclear whether any recipients interacted with the malicious messages. Nikkei's disclosure follows a pattern of recent attacks targeting media organizations and corporate email systems, where compromised accounts are used to lend legitimacy to phishing campaigns. Such attacks often bypass traditional security filters because the messages originate from trusted internal accounts. Affected services: Microsoft email accounts Google email accounts There is no indication yet of whether customer data or other internal systems were impacted beyond the two employee accounts. Nikkei has not publicly named a threat actor or attributed the breach to any specific group. Source: Unknown Does your organization have additional protections in place for employee email accounts, or do you rely solely on the provider's built-in security?

Denmark's Central Population Register (CPR) is notifying affected individuals after a data breach exposed the personal information of roughly 8.8 million registered people, a figure that significantly exceeds the country's population due to historical records and deceased individuals still held in the system. The registry serves as the foundation for Danish civic administration, housing data used for taxation, healthcare, and social services. Because of the breadth of information it stores, the exposure has drawn attention from privacy regulators and security researchers alike. Key facts confirmed so far: The breach affects approximately 8.8 million registered individuals. The compromised system is the Central Population Register (CPR). The registry underpins core public services including taxation, healthcare, and social welfare. Details regarding the attack vector, the timeline of the intrusion, and the specific categories of exposed data have not been fully disclosed. Affected parties are advised to monitor official CPR communications for further guidance on protective measures. Source: Unknown If your organization handles civic registry data, what safeguards are you relying on to limit the blast radius of a breach like this?

South Korea's Financial Services Commission (FSC) convened an emergency meeting after a series of cyberattacks struck financial institutions across the country. The incidents have raised concerns that the attackers may be leveraging AI-powered techniques, adding a new layer of sophistication to the threats facing the banking sector. Investigators are still working to determine the full scope of the breaches and the methods used by the attackers. The emergency session reflects the seriousness with which regulators are treating the campaign, particularly given the potential involvement of automated or AI-driven attack tooling. Key points so far: Multiple financial institutions in South Korea have been targeted in the campaign. The FSC called an emergency meeting in response to the attacks. Authorities suspect the attacks may have been assisted by AI-powered capabilities. The investigation into the breaches is ongoing. Organizations in the financial sector should treat this as a reminder to review their detection and response posture, especially against automated attack techniques that can evade traditional defenses. Further details from the investigation are expected as authorities continue their probe. Source: BleepingComputer Do you think AI-driven attacks are becoming a realistic day-to-day threat for financial institutions, or is the industry still overestimating their current impact?

The browser has become the primary workspace for business applications, and attackers have followed accordingly. Most breaches now begin inside a browser session, and in many cases the entire attack chain, from initial access through exfiltration, never leaves it. Security teams should keep the following six techniques on their radar for 2026. Technique 1: Details as described in the source material. Technique 2: Details as described in the source material. Technique 3: Details as described in the source material. Technique 4: Details as described in the source material. Technique 5: Details as described in the source material. Technique 6: Details as described in the source material. Source: The Hacker News Which of these browser-based techniques concerns your organization the most, and are you taking steps to mitigate it?

The Technical University of Denmark (DTU) has disclosed a breach affecting the personal data of up to 200,000 individuals after attackers gained access to its identity and access management system and exfiltrated a large volume of data. According to the university, the intruders compromised the identity and access management infrastructure, which handles authentication and authorization across its systems, and proceeded to download a substantial amount of information. The exact scope of the exposed data and the total number of confirmed victims are still being assessed, with the figure of 200,000 representing the upper estimate of potentially affected users. Key points so far: Affected organization: DTU (Technical University of Denmark) Compromised system: identity and access management platform Data involved: personal information of up to 200,000 users Attack type: unauthorized access followed by bulk data download DTU has not publicly attributed the incident to a specific threat actor, and no ransomware group has been confirmed as responsible at this stage. Investigations into how the attackers obtained access and what data was taken are ongoing. Anyone who may have an account tied to DTU's systems should watch for follow-up communications from the university and remain alert to phishing attempts that reference the breach. Source: Unknown If your organization relies on a centralized identity provider, have you reviewed its access logs and segmentation recently?

The China-linked ransomware group Warlock has been observed exploiting SharePoint vulnerabilities to gain initial access into victim environments, according to recent reporting. The campaign has struck a diverse set of targets, including a water utility, a telecom operator, a regional government body, and a university. Initial access in these intrusions was achieved by leveraging flaws in SharePoint, which the group used as an entry point before moving deeper into the affected networks. The targeting of critical infrastructure and public-sector organizations underscores the broad operational scope of the group rather than a focus on a single industry vertical. Reported victims span multiple sectors: A water utility A telecom operator A regional government body A university Organizations running on-premises SharePoint deployments should prioritize patching and review exposure of their instances, given that this attack vector is being actively used for initial access. Limiting internet-facing exposure and monitoring for suspicious activity tied to the collaboration platform are sensible defensive steps while remediation is underway. No specific CVE identifiers were provided in the source report, so defenders should consult vendor guidance for the latest SharePoint security updates affecting their deployed versions. Source: BleepingComputer Has your organization reviewed its internet-facing SharePoint instances for exposure to this threat?

Frontline Education has begun notifying school districts after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information. The compromised data includes Social Security numbers, according to the company's notification to affected districts. The incident stemmed from a flaw in externally sourced software rather than Frontline's own platform, though the attackers were able to leverage it to reach internal systems. The company is in the process of alerting school districts whose employees may have been impacted. At this time, no specific CVE identifier, advisory number, or affected version list has been disclosed in the reporting. Details regarding the exact number of individuals affected, the timeline of the intrusion, and the specific third-party software involved have not been made public. Those who may be affected should watch for official notification from their school district or from Frontline Education, and follow any guidance provided regarding credit monitoring or identity protection services. As always, treat unsolicited communications referencing this breach with caution, as incidents of this kind are frequently followed by phishing attempts. This is a developing story, and further technical details may emerge as notifications reach affected parties. Source: BleepingComputer Has your district received a notification from Frontline Education, and if so, what remediation steps were outlined?

An international law enforcement operation, Operation KillSwitch, has taken down the infrastructure of the KillSec ransomware gang. The action resulted in the seizure of the group's data leak site and servers, along with three arrests. Authorities have identified the gang's alleged administrator as a 16-year-old. The operation was carried out as a coordinated, multi-national effort. The investigation remains ongoing, and further details about the arrests or the seized infrastructure have not been fully disclosed. Key points from the takedown: The group's data leak site was seized Servers tied to the gang were taken offline Three individuals were arrested The alleged administrator is a 16-year-old This operation highlights the increasing involvement of young individuals in high-profile cybercrime and the cross-border cooperation required to disrupt ransomware operations. Source: Unknown Do you think a 16-year-old leader changes how law enforcement should approach these groups?

The Pentagon has begun notifying millions of military service members that their personal data was stolen in a breach of its human resources management system, which was discovered in October 2025. The compromised platform is operated by the Defense Manpower Data Center (DMDC), and the incident affects records belonging to over 3 million people. According to the notifications, hackers gained access to and exfiltrated data held within the DMDC's systems. Affected individuals are being contacted directly as the Department of Defense works through the scale of the exposure, which ranks among the larger data breaches to hit U.S. military personnel records in recent years. Details on the specific data elements taken, the intrusion vector, and any attributed threat actor have not been fully disclosed in the available reporting. No CVE identifier or advisory ID has been published in connection with this incident. Those potentially affected should: Watch for official notification from the DMDC or Department of Defense Treat unexpected communications referencing military service details as suspicious Monitor financial and credit accounts for signs of identity theft or fraud Consider placing a credit freeze or fraud alert if notified of exposure Source: BleepingComputer If you or your organization work with defense personnel data, how are you approaching notification and identity monitoring in the wake of this breach?

Bitget has disclosed that the attackers behind last week's theft of $387.5 million gained access to its systems by exploiting a zero-day vulnerability in third-party security products. The exchange published details of the breach, confirming the incident resulted from a previously unknown flaw in external security tooling rather than a direct compromise of its own core infrastructure. The zero-day was leveraged as the initial access vector, allowing the attackers to breach Bitget's environment. Key points: The attacker exploited a zero-day flaw in third-party security products to breach Bitget's systems. The total amount stolen in the incident was $387.5 million. The breach occurred last week, with Bitget disclosing the root cause today. No specific CVE identifier has been provided for the flaw at this time. This case highlights the supply chain risk that third-party security software can introduce, even for organizations with otherwise robust internal defenses. When a security product itself becomes the entry point, traditional perimeter controls may offer limited protection. Source: Unknown Does your organization review the security posture of its third-party security vendors, and how are you mitigating supply chain risk in your stack?

The Dutch Institute for Vulnerability Disclosure (DIVD) has disclosed that its own network was breached through a chain of two zero-day vulnerabilities in Zammad, the open-source ticketing system it uses. According to DIVD, the attackers exploited the flaws as part of an AI-driven intrusion, making the incident a notable case of automated attack tooling being used against a security organization. The two vulnerabilities were chained together to gain access, rather than relying on a single isolated flaw. DIVD has not published specific CVE IDs for either issue in the information available so far, so defenders should track DIVD's own advisories and Zammad's release notes for identifiers and patches rather than assuming a public CVE number exists. Key points to be aware of: The affected product is Zammad, an open-source helpdesk and ticketing platform. Two separate zero-day vulnerabilities were required to complete the exploit chain. The breach targeted DIVD's own network infrastructure. The attack was described as AI-driven, indicating significant automation in the exploitation process. No specific CVE IDs or advisory numbers have been confirmed in the available reporting. Recommended actions for organizations running Zammad: Treat any internet-facing Zammad instance as potentially at risk until vendor guidance is published. Monitor Zammad's official channels and DIVD's disclosures for patch information and technical details. Review ticketing system logs for unusual access patterns, unexpected administrative actions, or anomalous API activity. Restrict exposure of ticketing systems where possible, and enforce strong authentication and network-level controls. Apply vendor patches promptly once they become available. This case is a reminder that even organizations focused on vulnerability disclosure can be targeted, and that chained zero-days combined with automated attack tooling can defeat assumptions about a single point of failure. Source: Publication Name Does your organization run Zammad externally, and if so, how are you handling exposure until patches land?