{"category":"breach","changes":[{"body":null,"category":"breach","date":"2026-10-29","incident":"vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to","incidentTitle":"VAPOR PANDA (China-nexus) used ARTEX AI agents running DeepSeek to target 200+ organizations in 11 days, compromising at least nine (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/","status":"live","title":"CrowdStrike discloses VAPOR PANDA's ARTEX campaign: 200+ organizations targeted, nine compromised","url":"https://helix.ml/threat-watch/i/vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to"},{"body":null,"category":"breach","date":"2026-10-29","incident":"amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records","incidentTitle":"Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/","status":"live","title":"Japan Airlines confirms ~92,000 passengers' data exposed via breach at Amadeus's Passenger Service System","url":"https://helix.ml/threat-watch/i/amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records"},{"body":null,"category":"breach","date":"2026-10-29","incident":"suspected-hack-behind-military-base-freezer-failures-us-pentagon-bases-food-spoilage-linked-to-french-supermarket-attack","incidentTitle":"Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/202073/hacking/us-probes-suspected-hack-behind-military-base-freezer-failures.html","status":"live","title":"Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack","url":"https://helix.ml/threat-watch/i/suspected-hack-behind-military-base-freezer-failures-us-pentagon-bases-food-spoilage-linked-to-french-supermarket-attack"},{"body":null,"category":"breach","date":"2026-10-29","incident":"navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency","incidentTitle":"Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/extent-of-crime-stoppers-data-breach-unknown-sault-police-chief/","status":"live","title":"Sault Ste. Marie police pause Crime Stoppers ties as breach scope remains unknown","url":"https://helix.ml/threat-watch/i/navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://cyberscoop.com/dhs-employee-breach-icepick-database-takedown/","status":"live","title":"Icepick DHS data archive faces takedown pressure — contractor removal request and hosting blocks, but it finds a new home","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"breach","date":"2026-10-29","incident":"florida-department-of-education-student-financial-aid-breach-unauthorized-access-may-expose-data-of-4-9-million-people","incidentTitle":"Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/florida-education-department-says-data-breach-may-affect-4-9-million-people/","status":"live","title":"Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people","url":"https://helix.ml/threat-watch/i/florida-department-of-education-student-financial-aid-breach-unauthorized-access-may-expose-data-of-4-9-million-people"},{"body":null,"category":"breach","date":"2026-10-29","incident":"rizap-employee-uploaded-726-members-health-records-to-personal-generative-ai-chat","incidentTitle":"RIZAP: employee uploaded 726 members' health records to personal generative AI chat","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/29/a-rizap-employee-uploaded-726-peoples-health-records-to-a-personal-ai-chat/","status":"live","title":"RIZAP: employee uploaded 726 members' health records to personal generative AI chat","url":"https://helix.ml/threat-watch/i/rizap-employee-uploaded-726-members-health-records-to-personal-generative-ai-chat"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://therecord.media/php2shell-successful-exploitation-reports-emerge","status":"live","title":"Limited real-world exploitation of PHP2Shell bugs confirmed: half-dozen exploitations listed and suspected Chinese campaign breached U.S. government-affiliated servers","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/unm-health-addresses-cyberattack-in-new-mexico-after-ransomware-group-claims-responsibility/","status":"live","title":"UNM Health confirms it is aware of ransomware group's claims of responsibility for the cyberattack","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-29","incident":"amadey-botnet-australian-signals-directorate-severs-c2-access-to-180-000-infected-computers","incidentTitle":"Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/29/australia-severs-criminal-access-to-180000-computers-after-breaching-amadey-malware-backend/","status":"live","title":"Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers","url":"https://helix.ml/threat-watch/i/amadey-botnet-australian-signals-directorate-severs-c2-access-to-180-000-infected-computers"},{"body":null,"category":"breach","date":"2026-10-29","incident":"frontline-education-breach-student-ssns-medicaid-ids-and-dobs-exposed-via-frontline-central-and-school-health-management","incidentTitle":"Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/student-ssns-and-medicaid-ids-exposed-in-frontline-school-software-breach/","status":"live","title":"Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management","url":"https://helix.ml/threat-watch/i/frontline-education-breach-student-ssns-medicaid-ids-and-dobs-exposed-via-frontline-central-and-school-health-management"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/","status":"live","title":"Leaked DHS records confirmed searchable, exposing contact details and sensitive assignment info of 41,000+ current and former employees/contractors","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456","status":"live","title":"China-linked actors used a custom PHP2Shell exploit to root 25 servers and likely retain access to a US government-affiliated network","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127","incidentTitle":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/","status":"live","title":"UAT-11473 observed deploying custom KeyDrift malware framework via Cisco SD-WAN CVE-2026-20127 exploitation","url":"https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127"},{"body":null,"category":"breach","date":"2026-10-29","incident":"bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks","incidentTitle":"BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/us-bankruptcy-courts-it-contractor-says-no-data-stolen-cyberattack","status":"live","title":"BAE Systems confirms no data was extracted in the bankruptcy courts cyberattack","url":"https://helix.ml/threat-watch/i/bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"other","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/php2shell-day-after-tomorrow","status":"live","title":"Aikido warns PHP2Shell-style chained firewall RCEs will multiply (Brocolli2Shell), with defenders expected to catch up","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline","incidentTitle":"Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/10/29/belgiums-tax-agency-confirms-cyberattack-pulls-services-offline/5306409","status":"live","title":"Belgian tax agency confirms the cyberattack and extends tax deadlines to November as services remain offline","url":"https://helix.ml/threat-watch/i/cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/","status":"live","title":"CISA warns of the chained Linux kernel privesc as PHP2Shell attacks root 25 servers, including US government systems","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks","incidentTitle":"BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.securityweek.com/bae-says-no-data-extracted-in-incident-hitting-bankruptcy-courts/","status":"live","title":"BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks","url":"https://helix.ml/threat-watch/i/bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks"},{"body":null,"category":"breach","date":"2026-10-29","incident":"cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline","incidentTitle":"Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/cyberattack-disrupts-belgian-tax-services-before-deadline","status":"live","title":"Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline","url":"https://helix.ml/threat-watch/i/cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline"},{"body":null,"category":"breach","date":"2026-10-29","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/new-mexico-cyberattack-hospital","status":"live","title":"University of New Mexico restores hospital systems and urges no contact with hackers","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-29","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/","status":"live","title":"Lumen Black Lotus Labs details Volt Typhoon's 'Silent Train' rotating relay network used to hide intrusions into enterprise control planes","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.securityweek.com/over-41000-dhs-employee-records-leaked-online/","status":"live","title":"DHS/Okta SSO breach: 41,000+ employee records now leaked online by hacktivists","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"breach","date":"2026-10-29","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html","status":"live","title":"Lumen Black Lotus Labs details three-year Silent Train tracking: disposable relay chains hid at least four Volt Typhoon zero-day attacks","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"breach","date":"2026-10-29","incident":"keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127","incidentTitle":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/","status":"live","title":"Cisco Talos links the SD-WAN key-stealing exploitation to infrastructure overlapping Volt Typhoon's 'Silent Train' network","url":"https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/icepick-dhs-leak-ice-undercover-agents/","status":"live","title":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"breach","date":"2026-10-29","incident":"engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france","incidentTitle":"ENGIE: French customer contact and contract data stolen through a partner marketing platform breach","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html","status":"live","title":"ENGIE confirms attackers accessed French customers' contact and energy contract data via a partner sales tool; banking data unaffected","url":"https://helix.ml/threat-watch/i/engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france"},{"body":null,"category":"breach","date":"2026-10-29","incident":"keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127","incidentTitle":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html","status":"live","title":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — attackers exploited auth-bypass flaw to steal AES traffic keys (CVE-2026-20127)","url":"https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127"},{"body":null,"category":"breach","date":"2026-10-29","incident":"irhythm-data-breach-8-2m-patients-data-stolen-from-third-party-hosted-apps-ransom-demanded","incidentTitle":"iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.securityweek.com/hhs-filing-puts-irhythm-data-breach-toll-at-8-2-million/","status":"live","title":"iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded","url":"https://helix.ml/threat-watch/i/irhythm-data-breach-8-2m-patients-data-stolen-from-third-party-hosted-apps-ransom-demanded"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html","status":"live","title":"Palo Alto Networks warns of active PHP2Shell exploitation against internet-exposed management interfaces","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":"As of 12:40 JST GMO says its white-hat team has obtained information that may help identify the attacker and will submit it to the police and other agencies that day. The bounty site had received 270 tips by 11:30 JST. GMO asks the public not to track down or contact suspects themselves and to report new leak sites through onamae.com/abuse/. The entry vector and the number of affected customers are still undisclosed.","category":"breach","date":"2026-10-29","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"status","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/261/","status":"live","title":"GMO 15th report: white-hat team hands possible attacker leads to police; 270 bounty tips","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/ghost-php2shell-coordinated-disclosure-faster","status":"live","title":"Commentary on PHP2Shell coordinated disclosure: AI-accelerated exploit development sparks debate over disclosure speed","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":"AI editor revision: Palo Alto Networks warns of active PHP2Shell exploitation against internet-exposed management interfaces","category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"status","patchStatus":"partial","severity":"critical","sourceUrl":null,"status":"live","title":"Patch status changed from unknown to partial","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":"GMO Internet's filing to the Tokyo Stock Exchange lists the incident costs it bears: the ¥5,000 goodwill payment, compensation for realized losses on trades GMO recognises as unauthorized, a replacement PC for any customer hit by ransomware (none confirmed as of the 10th report), the special payments for published data, and support for affected customers. The parent, GMO Internet Group, funds the US$1M bounty. It says no total can be calculated yet because the number of affected customers, the extent of the published data and the review of compensable trades are not settled. GMO Internet Group says its checks so far have found no unauthorized access or data leak from this incident in any group service other than Onamae.com Desktop Cloud.","category":"breach","date":"2026-10-28","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/ir/pdf/irlibrary/gmointernet_j_disclose_20261028.pdf","status":"live","title":"Exchange filing: financial impact not yet calculable; no other GMO group service affected","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"GMO's 13th report (11:00 JST) says the domain of the site publishing customer information, mirrors included, was suspended at about 04:00 JST, working with the operators involved. GMO says it will take down any new copy, is logging posts that spread the URLs and reporting them to X and the police, and may pursue sender disclosure and damages.","category":"breach","date":"2026-10-28","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"status","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/259/","status":"live","title":"Leak site and its mirrors taken down (~04:00 JST)","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":null,"category":"breach","date":"2026-10-28","incident":"amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records","incidentTitle":"Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents","status":"live","title":"Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records","url":"https://helix.ml/threat-watch/i/amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records"},{"body":null,"category":"breach","date":"2026-10-28","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html","status":"live","title":"Lumen attributes Volt Typhoon's Silent Train covert relay network to four zero-day exploitation campaigns; network now disrupted","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/","status":"live","title":"Wordfence reports no confirmed WordPress compromises via PHP2Shell as of Oct 28; urges updating PHP itself, not just WordPress","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html","status":"live","title":"PHP2Shell attack rooted 25 servers including a U.S. government-affiliated network, described as AI-assisted","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-28","incident":"so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords","incidentTitle":"So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/sony-isp-subsidiary-data-breach-exposes-25-million-customer-records/","status":"live","title":"Sony Network Communications confirms breach exposing ~2.5 million customer records","url":"https://helix.ml/threat-watch/i/so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords"},{"body":null,"category":"breach","date":"2026-10-28","incident":"moldova-government-digital-services-breach-750-000-citizens-personal-data-possibly-stolen-further-cyberattacks-warned","incidentTitle":"Moldova government digital services breach — ~750,000 citizens' personal data possibly stolen; further cyberattacks warned","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/moldova-investigates-possible-foreign-involvement-cyberattacks","status":"live","title":"Moldova PM says government cyberattack may be part of broader foreign campaign targeting citizens' data and infrastructure","url":"https://helix.ml/threat-watch/i/moldova-government-digital-services-breach-750-000-citizens-personal-data-possibly-stolen-further-cyberattacks-warned"},{"body":"The report covers about three years of tracking, four confirmed zero-day campaigns plus a suspected Quest KACE zero-day, more than 27 abused device classes, and hundreds of victims notified. Black Lotus Labs says it has quietly disrupted the framework.","category":"breach","date":"2026-10-28","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework","status":"live","title":"Lumen Black Lotus Labs publishes the 'Silent Train' report on Volt Typhoon","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"breach","date":"2026-10-28","incident":"times-car-data-breach-driver-s-license-data-of-1-46-million-leaked-5-5-billion-loss-reported","incidentTitle":"Times Car data breach: driver's license data of 1.46 million leaked, ¥5.5 billion loss reported","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/28/jpn-times-car-reporting-%c2%a55-5-billion-loss-has-firms-bracing-for-data-breach-fallout/","status":"live","title":"Times Car data breach: driver's license data of 1.46 million leaked, ¥5.5 billion loss reported","url":"https://helix.ml/threat-watch/i/times-car-data-breach-driver-s-license-data-of-1-46-million-leaked-5-5-billion-loss-reported"},{"body":null,"category":"breach","date":"2026-10-28","incident":"afd-email-breach-345-000-addresses-leaked-via-hacked-wordpress-site","incidentTitle":"AfD email breach: 345,000 addresses leaked via hacked WordPress site","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/10/28/afd-data-breach-email-leak/","status":"live","title":"AfD email breach: 345,000 addresses leaked via hacked WordPress site","url":"https://helix.ml/threat-watch/i/afd-email-breach-345-000-addresses-leaked-via-hacked-wordpress-site"},{"body":null,"category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/","status":"live","title":"InfraTrust report confirms active exploitation of PHP2Shell flaws across firewalls, VPNs and application delivery controllers","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-28","incident":"bithumb-internal-mobile-system-breach-data-leak-under-investigation","incidentTitle":"Bithumb internal mobile system breach — data leak under investigation","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/28/kr-bithumb-discloses-data-leak-after-internal-system-breach-one-of-three-financial-firm-breaches-reported-that-day/","status":"live","title":"Bithumb internal mobile system breach — data leak under investigation","url":"https://helix.ml/threat-watch/i/bithumb-internal-mobile-system-breach-data-leak-under-investigation"},{"body":null,"category":"breach","date":"2026-10-28","incident":"hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months","incidentTitle":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/10/28/doj-ukrainian-ransomware-hacker-sentenced/","status":"live","title":"Hive/Nefilim affiliate Artem Stryzhak sentenced to 5 years 10 months; $11M reward offered for co-conspirator","url":"https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months"},{"body":null,"category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/","status":"live","title":"PHP2Shell / Fragnesia: internet-facing firewalls — China-linked hackers chain PHP RCE with Linux kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-28","incident":"royal-darwin-hospital-privacy-breach-pregnant-women-s-medical-records-posted-to-instagram-by-medical-observer","incidentTitle":"Royal Darwin Hospital privacy breach — pregnant women's medical records posted to Instagram by 'medical observer'","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/28/au-northern-territory-health-backtracks-on-claim-only-five-patients-impacted-by-rdh-privacy-breach/","status":"live","title":"Royal Darwin Hospital privacy breach — pregnant women's medical records posted to Instagram by 'medical observer'","url":"https://helix.ml/threat-watch/i/royal-darwin-hospital-privacy-breach-pregnant-women-s-medical-records-posted-to-instagram-by-medical-observer"},{"body":null,"category":"breach","date":"2026-10-28","incident":"ransomware-attack-on-nz-coronial-services-delays-investigations-grieving-families-left-waiting","incidentTitle":"Ransomware attack on NZ coronial services delays investigations, grieving families left waiting","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/28/nz-grieving-families-incredibly-stressful-wait-for-answers-after-major-nz-cyber-attack/","status":"live","title":"Ransomware attack on NZ coronial services delays investigations, grieving families left waiting","url":"https://helix.ml/threat-watch/i/ransomware-attack-on-nz-coronial-services-delays-investigations-grieving-families-left-waiting"},{"body":null,"category":"breach","date":"2026-10-28","incident":"hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months","incidentTitle":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/28/ukrainian-national-sentenced-for-role-in-hacking-hospitals-businesses-and-governments-as-part-of-ransomware-conspiracies-causing-over-100-million-in-losses/","status":"live","title":"DOJ press release confirms Artem Stryzhak sentenced to 70 months for ransomware conspiracies causing over $100M in losses","url":"https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months"},{"body":null,"category":"breach","date":"2026-10-28","incident":"skyw4lker-device-code-phishing-campaign-targeting-u-s-organizations-via-microsoft-365-token-theft","incidentTitle":"Skyw4lker: device code phishing campaign targeting U.S. organizations via Microsoft 365 token theft","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://thehackernews.com/2026/10/american-organizations-under-attack.html","status":"live","title":"Skyw4lker: device code phishing campaign targeting U.S. organizations via Microsoft 365 token theft","url":"https://helix.ml/threat-watch/i/skyw4lker-device-code-phishing-campaign-targeting-u-s-organizations-via-microsoft-365-token-theft"},{"body":null,"category":"breach","date":"2026-10-28","incident":"hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months","incidentTitle":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/nefilim-and-hive-ransomware-affiliate-gets-70-months-in-prison/","status":"live","title":"Ukrainian Hive/Nefilim ransomware affiliate sentenced to 70 months for 2018–2021 attacks on hospitals, governments and high-revenue businesses","url":"https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months"},{"body":"GMO's 14th report (18:20 JST) says the US$1M bounty site received 113 tips in its first six hours and that 20 warning notices went to X posts spreading the leak site. Analysis of the customer PCs GMO collected has still found no malware or ransomware; the investigation continues. Customers are told to scan and back up before reusing a PC.","category":"breach","date":"2026-10-28","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"status","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/260/","status":"live","title":"Bounty site opens (12:00 JST): 113 tips in six hours; still no malware on analysed devices","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":null,"category":"breach","date":"2026-10-28","incident":"navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency","incidentTitle":"Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/privacy-commissioner-of-canada-to-investigate-data-breach-involving-crime-stoppers/","status":"live","title":"Privacy Commissioner of Canada opens investigation into Navigate360 over Crime Stoppers tipline breach","url":"https://helix.ml/threat-watch/i/navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency"},{"body":"Customers whose information appears in the published material get an extra payment per data category: ¥10,000 (basic contact details), ¥15,000 (financial or authentication data such as account IDs and passwords), ¥25,000 (sensitive personal data). Categories add up, to at most ¥3M per disclosure, on top of the ¥5,000 goodwill payment and the loss compensation. GMO also creates a 'GMO Cybercrime Bounty' of at most US$1M in total (about ¥150M) for verifiable information identifying the attackers, opening 28 Oct 12:00 JST, and repeats that it will never meet the demand. A 24-hour support line is set up.","category":"breach","date":"2026-10-27","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/258/","status":"live","title":"GMO 12th report: special payments for customers whose data was published; US$1M bounty announced (19:10 JST)","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"Affects Mail Service (G), A-Box, So-net VAIO Mail and PostPet Mail. Users must set a new password via So-net My Page. The 7 password-reset notice letters were also reset.","category":"breach","date":"2026-10-27","incident":"so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords","incidentTitle":"So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords","kind":"patch","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.so-net.ne.jp/support/faq/qa202610_01/","status":"live","title":"So-net force-resets the 54,401 leaked mail passwords (from ~10:00 JST, no advance notice)","url":"https://helix.ml/threat-watch/i/so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords"},{"body":"Reported to Japan's Personal Information Protection Commission. Cause still under investigation; no secondary harm confirmed as of disclosure.","category":"breach","date":"2026-10-27","incident":"so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords","incidentTitle":"So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.so-net.ne.jp/info/2026/20261027_0001.html","status":"live","title":"Sony Network Communications discloses So-net member database breach: 2,585,481 records, 54,401 mail passwords","url":"https://helix.ml/threat-watch/i/so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords"},{"body":null,"category":"breach","date":"2026-10-27","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/","status":"live","title":"UNM Health ransomware attack confirmed to disrupt patient care and surgeries","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-27","incident":"navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency","incidentTitle":"Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/navigate360s-lack-of-transparency-is-catching-up-with-them-more-organizations-tell-people-not-to-use-their-tiplines/","status":"live","title":"Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency","url":"https://helix.ml/threat-watch/i/navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency"},{"body":null,"category":"breach","date":"2026-10-27","incident":"hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months","incidentTitle":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/nefilim-hive-ransomware-operator-70-months-prison","status":"live","title":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to five-plus years after guilty plea","url":"https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months"},{"body":null,"category":"breach","date":"2026-10-27","incident":"university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data","incidentTitle":"University of Copenhagen data breach: hackers access test environment exposing 525,000 people's data","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/university-of-copenhagen-data-breach-exposes-data-of-525000-people/","status":"live","title":"University of Copenhagen breach adds 20,000 more staff and students to the affected total","url":"https://helix.ml/threat-watch/i/university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data"},{"body":null,"category":"breach","date":"2026-10-27","incident":"fec-electronic-filing-system-outage-after-hacking-attempts-ahead-of-november-3-elections","incidentTitle":"FEC electronic filing system outage after hacking attempts ahead of November 3 elections","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/hacking-attempts-against-us-federal-election-commission-system-triggered-outage-email-shows/","status":"live","title":"FEC electronic filing system outage after hacking attempts ahead of November 3 elections","url":"https://helix.ml/threat-watch/i/fec-electronic-filing-system-outage-after-hacking-attempts-ahead-of-november-3-elections"},{"body":null,"category":"breach","date":"2026-10-27","incident":"cyberattack-on-italy-s-chamber-of-deputies-email-accounts-including-account-assigned-to-pm-meloni","incidentTitle":"Cyberattack on Italy's Chamber of Deputies email accounts, including account assigned to PM Meloni","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/201867/hacking/italys-parliament-under-cyber-pressure-why-the-attack-on-the-chamber-matters.html","status":"live","title":"Cyberattack on Italy's Chamber of Deputies email accounts, including account assigned to PM Meloni","url":"https://helix.ml/threat-watch/i/cyberattack-on-italy-s-chamber-of-deputies-email-accounts-including-account-assigned-to-pm-meloni"},{"body":null,"category":"breach","date":"2026-10-27","incident":"moldova-government-digital-services-breach-750-000-citizens-personal-data-possibly-stolen-further-cyberattacks-warned","incidentTitle":"Moldova government digital services breach — ~750,000 citizens' personal data possibly stolen; further cyberattacks warned","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/moldova-issues-warning-about-new-cyberattacks-following-a-data-breach/","status":"live","title":"Moldova government digital services breach — ~750,000 citizens' personal data possibly stolen; further cyberattacks warned","url":"https://helix.ml/threat-watch/i/moldova-government-digital-services-breach-750-000-citizens-personal-data-possibly-stolen-further-cyberattacks-warned"},{"body":null,"category":"breach","date":"2026-10-27","incident":"ohio-auditor-web-server-cyberattack-state-server-taken-down-amid-possible-foreign-state-actor-involvement","incidentTitle":"Ohio Auditor web server cyberattack — state server taken down amid possible foreign state actor involvement","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/ohio-auditor-cyber-attack-on-state-server-carried-out-by-possible-foreign-state-actors/","status":"live","title":"Ohio Auditor web server cyberattack — state server taken down amid possible foreign state actor involvement","url":"https://helix.ml/threat-watch/i/ohio-auditor-web-server-cyberattack-state-server-taken-down-amid-possible-foreign-state-actor-involvement"},{"body":null,"category":"breach","date":"2026-10-27","incident":"bajaj-hospital-ransomware-attack-all-9-servers-encrypted-sensitive-patient-data-stolen","incidentTitle":"Bajaj Hospital ransomware attack: all 9 servers encrypted, sensitive patient data stolen","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/in-9-servers-of-bajaj-hospital-hacked-in-cyberattack-at-3-am-sensitive-data-stolen-systems-encrypted/","status":"live","title":"Bajaj Hospital ransomware attack: all 9 servers encrypted, sensitive patient data stolen","url":"https://helix.ml/threat-watch/i/bajaj-hospital-ransomware-attack-all-9-servers-encrypted-sensitive-patient-data-stolen"},{"body":null,"category":"breach","date":"2026-10-27","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/cyberattack-forces-university-of-new-mexico-health-to-divert-ambulances-cancel-appointments/","status":"live","title":"UNM Health cyberattack forces ambulance diversions and cancellation of appointments at 30+ clinics","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-27","incident":"covered-california-agent-data-exposed-via-phishing-attack-on-spreadsheets-no-cve","incidentTitle":"Covered California: agent data exposed via phishing attack on spreadsheets (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/covered-california-agent-data-exposed-in-phishing-attack/","status":"live","title":"Covered California: agent data exposed via phishing attack on spreadsheets (no CVE)","url":"https://helix.ml/threat-watch/i/covered-california-agent-data-exposed-via-phishing-attack-on-spreadsheets-no-cve"},{"body":null,"category":"breach","date":"2026-10-27","incident":"hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months","incidentTitle":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://cyberscoop.com/nefilim-hive-ransomware-affiliate-artem-stryzhak-sentenced/","status":"live","title":"Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months","url":"https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months"},{"body":null,"category":"breach","date":"2026-10-27","incident":"conduent-80m-settlement-62-2m-record-healthcare-data-breach-class-action","incidentTitle":"Conduent $80M settlement — 62.2M-record healthcare data breach class action","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/conduent-to-pay-80m-to-settle-3rd-largest-healthcare-data-breach/","status":"live","title":"Conduent $80M settlement — 62.2M-record healthcare data breach class action","url":"https://helix.ml/threat-watch/i/conduent-80m-settlement-62-2m-record-healthcare-data-breach-class-action"},{"body":null,"category":"breach","date":"2026-10-27","incident":"iphone-malware-drive-by-campaign-crypto-thieves-serve-malware-via-hundreds-of-infected-websites-and-malicious-ads","incidentTitle":"iPhone malware drive-by campaign: crypto thieves serve malware via hundreds of infected websites and malicious ads","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/hackers-are-serving-malware-to-iphones-via-hundreds-of-infected-websites/","status":"live","title":"iPhone malware drive-by campaign: crypto thieves serve malware via hundreds of infected websites and malicious ads","url":"https://helix.ml/threat-watch/i/iphone-malware-drive-by-campaign-crypto-thieves-serve-malware-via-hundreds-of-infected-websites-and-malicious-ads"},{"body":null,"category":"breach","date":"2026-10-27","incident":"capcom-breach-of-capcom-id-service-exposes-11-7-million-email-addresses-and-account-details","incidentTitle":"Capcom: breach of CAPCOM ID service exposes 11.7 million email addresses and account details","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/hacker-breached-capcom-id-obtained-data-from-11-million-accounts-and-started-changing-passwords/","status":"live","title":"Capcom confirms hacker accessed 11.7M Capcom ID accounts and began changing account passwords","url":"https://helix.ml/threat-watch/i/capcom-breach-of-capcom-id-service-exposes-11-7-million-email-addresses-and-account-details"},{"body":null,"category":"breach","date":"2026-10-27","incident":"dmdc-data-breach-pentagon-sued-by-marines-over-pii-leak-enabling-scams","incidentTitle":"DMDC data breach — Pentagon sued by Marines over PII leak enabling scams","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/27/pentagon-ignored-cybersecurity-flaws-before-data-breach-marines-lawsuit-says/","status":"live","title":"DMDC data breach — Pentagon sued by Marines over PII leak enabling scams","url":"https://helix.ml/threat-watch/i/dmdc-data-breach-pentagon-sued-by-marines-over-pii-leak-enabling-scams"},{"body":null,"category":"breach","date":"2026-10-27","incident":"discover-tech-ad-network-spyware-governments-deliver-zero-click-spyware-via-malicious-online-ads","incidentTitle":"Discover-Tech ad-network spyware: governments deliver zero-click spyware via malicious online ads","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/governments-are-hacking-people-with-zero-click-spyware-by-showing-them-online-ads/","status":"live","title":"Discover-Tech ad-network spyware: governments deliver zero-click spyware via malicious online ads","url":"https://helix.ml/threat-watch/i/discover-tech-ad-network-spyware-governments-deliver-zero-click-spyware-via-malicious-online-ads"},{"body":null,"category":"breach","date":"2026-10-27","incident":"quest-diagnostics-unauthorized-access-to-quanum-lsm-exposed-patient-records","incidentTitle":"Quest Diagnostics: unauthorized access to Quanum LSM exposed patient records","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/quest-diagnostics-incorporated-notifies-sec-of-incident/","status":"live","title":"Quest Diagnostics discloses Quanum LSM unauthorized access in SEC 8-K filing dated October 21, 2026","url":"https://helix.ml/threat-watch/i/quest-diagnostics-unauthorized-access-to-quanum-lsm-exposed-patient-records"},{"body":null,"category":"breach","date":"2026-10-27","incident":"safepay-ransomware-600-victims-across-us-and-europe-since-august-2024-per-fbi-advisory","incidentTitle":"SafePay ransomware: 600+ victims across US and Europe since August 2024 per FBI advisory","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/27/fbi-says-safepay-ransomware-gang-among-most-active-with-more-than-600-victims-since-2024/","status":"live","title":"SafePay ransomware: 600+ victims across US and Europe since August 2024 per FBI advisory","url":"https://helix.ml/threat-watch/i/safepay-ransomware-600-victims-across-us-and-europe-since-august-2024-per-fbi-advisory"},{"body":"BleepingComputer reports that no ransomware operation or extortion gang had claimed the breach before publication, and ENGIE has not attributed it.","category":"breach","date":"2026-10-27","incident":"engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france","incidentTitle":"ENGIE: French customer contact and contract data stolen through a partner marketing platform breach","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/","status":"live","title":"No group has claimed the ENGIE customer-data theft","url":"https://helix.ml/threat-watch/i/engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france"},{"body":null,"category":"breach","date":"2026-10-27","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690","status":"live","title":"Day 2 of canceled classes at University of New Mexico as Health Sciences Center recovery continues in phases","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":"The inspectorate says the Police Digital Service and the NPCC reported multiple cyberattacks on third-party ICT suppliers holding police data since 2021. It withheld the count, the suppliers, the forces and any data-loss detail. The report also gives 252 policing cyber incidents and 796 near misses in Q1 2026.","category":"breach","date":"2026-10-27","incident":"uk-police-data-breached-via-third-party-it-suppliers-since-2021-hmicfrs-watchdog-report-finds","incidentTitle":"UK police: hackers repeatedly breached IT suppliers holding police data since 2021, HMICFRS finds","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report","status":"live","title":"HMICFRS publishes its police and fire cyber inspection: repeated supplier breaches since 2021","url":"https://helix.ml/threat-watch/i/uk-police-data-breached-via-third-party-it-suppliers-since-2021-hmicfrs-watchdog-report-finds"},{"body":"Ambulances were diverted to health systems in Albuquerque and Santa Fe for about two hours on Monday. Outpatient surgeries and appointments were suspended for the rest of the day (The Record).","category":"breach","date":"2026-10-27","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident","status":"live","title":"UNM hospital diverted ambulances for ~2 hours and suspended outpatient surgeries/appointments due to the cyberattack","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":"SecurityWeek reports that Denver Health Medical Plan is notifying 238,083 members whose information was in a SquareML-maintained database that the leaked read-only key could reach. The article gives no date for the member notices.","category":"breach","date":"2026-10-27","incident":"squareml-access-key-leak-exposes-data-of-238-000-denver-health-medical-plan-members","incidentTitle":"SquareML: leaked read-only access key exposed data of 238,083 Denver Health Medical Plan members","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.securityweek.com/vendor-key-leak-puts-data-of-238000-denver-health-plan-members-at-risk/","status":"live","title":"SecurityWeek reports DHMP notice to 238,083 members over SquareML key leak","url":"https://helix.ml/threat-watch/i/squareml-access-key-leak-exposes-data-of-238-000-denver-health-medical-plan-members"},{"body":"The BYOD group took credit on Monday evening, claiming 36,000 machines and theft of student, employee and patient data. Its claimed databases and systems have not been confirmed. UNM says the matter is an active law enforcement investigation.","category":"breach","date":"2026-10-27","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack/","status":"live","title":"BYOD posts unconfirmed claims on its leak site; UNM says investigation is active","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-27","incident":"university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data","incidentTitle":"University of Copenhagen data breach: hackers access test environment exposing 525,000 people's data","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/10/27/university-of-copenhagen-cyberattack-data-breach/","status":"live","title":"University of Copenhagen rules out second cyberattack; Monday shutdown of Workzone, Nimbus and other admin systems tied to previously disclosed breach","url":"https://helix.ml/threat-watch/i/university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data"},{"body":"BleepingComputer reports ENGIE's confirmation that attackers stole French customer contact and contract data from a platform used by business partners for prospecting and marketing. ENGIE says it cut off the attackers' access to the platform. The article gives no attack or detection date.","category":"breach","date":"2026-10-27","incident":"engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france","incidentTitle":"ENGIE: French customer contact and contract data stolen through a partner marketing platform breach","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/","status":"live","title":"ENGIE confirms customer data stolen from partner marketing platform; attacker access cut off","url":"https://helix.ml/threat-watch/i/engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france"},{"body":null,"category":"breach","date":"2026-10-27","incident":"afd-data-breach","incidentTitle":"AfD data breach: 345K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://haveibeenpwned.com/Breach/AfD","status":"closed","title":"Have I Been Pwned loaded 345K breached AfD accounts","url":"https://helix.ml/threat-watch/i/afd-data-breach"},{"body":"GMO repeats that it will not pay, warns of phishing by email, SMS and phone that exploits the incident, and asks the media to avoid coverage that could cause secondary harm to customers.","category":"breach","date":"2026-10-27","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/257/","status":"live","title":"GMO 11th report: phishing warning and request for restrained coverage (14:55 JST)","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"GMO confirms at 12:30 that a party believed to be the attacker published information about GMO and its customers; some of it may be inaccurate. In the 10th report (13:55) GMO warns that people who visit the site have their own information captured, asks the public not to access or share it, says no ransomware attack had been confirmed, and starts preparing disclosure requests and criminal complaints against malicious spreaders.","category":"breach","date":"2026-10-27","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"exploitation","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/256/","status":"live","title":"Attacker publishes data claimed to be GMO and customer information (12:30 JST)","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"GMO's 8th and 9th reports tell customers to scan, back up, then disconnect and power off PCs before 12:00. Trend Micro and other security and AI companies offer help. As of 11:59 no malware, ransomware included, had been found on the devices analysed so far, though GMO says the safety of all devices is not confirmed. Customers hit by ransomware will get a replacement PC.","category":"breach","date":"2026-10-27","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"status","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/255/","status":"live","title":"Deadline day: no malware found on analysed customer devices (11:59 JST)","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"Docomo outsourced the S Course member database server to Sony Network Communications. Other plala plans are not affected. Docomo published its own notice on 2026-10-27.","category":"breach","date":"2026-10-26","incident":"so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords","incidentTitle":"So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.docomo.ne.jp/info/notice/page/261027_05_m.html","status":"live","title":"NTT Docomo notified: 443,495 docomo hikari \"plala (S Course)\" customer records held in So-net's database are affected","url":"https://helix.ml/threat-watch/i/so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords"},{"body":"The Record reports the group took credit on Monday evening. It claimed 36,000 machines on the main campus and hospital and theft of student, patient and employee information. UNM did not answer whether ransomware was used.","category":"breach","date":"2026-10-26","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident","status":"live","title":"BYOD posts unconfirmed intrusion claims on its leak site","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":"Help Net Security reports the announcement at 2:30 p.m. MDT on Monday. The internal message said the breach was detected around 11:30 a.m., and staff were told to shut down and unplug computers about 40 minutes later. The center said state and federal law enforcement were notified.","category":"breach","date":"2026-10-26","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack/","status":"live","title":"UNM Health Sciences Center announces the cyber incident and orders computers shut down","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":"BleepingComputer reports that the test environment held personal data of 525,000 people. The article gives no calendar date for the detection or disclosure.","category":"breach","date":"2026-10-26","incident":"university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data","incidentTitle":"University of Copenhagen data breach: hackers access test environment exposing 525,000 people's data","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/","status":"live","title":"Press coverage reports 525,000 people affected","url":"https://helix.ml/threat-watch/i/university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data"},{"body":"Commentary (e.g. Hiroki Miyano) describes a possible path from a compromised remote-desktop server back to the connecting user's PC through RDP drive redirection, citing the attacker's own claims. GMO has not confirmed any customer PC was infected, and has not disclosed how the intruder entered the service.","category":"breach","date":"2026-10-26","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://note.com/hirokimiyano/n/ne929648b027f","status":"live","title":"Attacker's claims about customers' PCs are not verified","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"The 7th report (23:10 JST) discloses the ~¥8 billion demand and says the attacker set 12:00 JST on 27 October for publishing customer information and launching a ransomware attack. GMO is collecting customers' PCs so its white-hat team can look for malware, and tells customers to scan, back up and not respond to anyone offering to recover losses for a fee.","category":"breach","date":"2026-10-26","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/253/","status":"live","title":"GMO 6th and 7th reports: account protection steps; extortion details and 27 Oct 12:00 deadline","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"The university first disclosed the breach on this date, after detecting the intrusion on 2026-10-20 (Help Net Security). It says it contained the attack and blocked the attacker's access. Press coverage later reported 525,000 people affected.","category":"breach","date":"2026-10-26","incident":"university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data","incidentTitle":"University of Copenhagen data breach: hackers access test environment exposing 525,000 people's data","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/","status":"live","title":"University of Copenhagen first discloses breach of a test environment","url":"https://helix.ml/threat-watch/i/university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data"},{"body":"Have I Been Pwned records the breach date; the incident previously showed the date HIBP loaded the record.","category":"breach","date":"2026-10-26","incident":"sharecare-data-breach","incidentTitle":"Sharecare data breach: 318K accounts exposed","kind":"correction","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/sharecare","status":"closed","title":"Breach date set to 2026-08-12 (Have I Been Pwned breach date)","url":"https://helix.ml/threat-watch/i/sharecare-data-breach"},{"body":"Have I Been Pwned records the breach date; the incident previously showed the date HIBP loaded the record.","category":"breach","date":"2026-10-26","incident":"crunchbase-data-breach","incidentTitle":"Crunchbase data breach: 559K accounts exposed","kind":"correction","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/crunchbase","status":"closed","title":"Breach date set to 2026-01-22 (Have I Been Pwned breach date)","url":"https://helix.ml/threat-watch/i/crunchbase-data-breach"},{"body":"Have I Been Pwned records the breach date; the incident previously showed the date HIBP loaded the record.","category":"breach","date":"2026-10-26","incident":"gitesdefrance-data-breach","incidentTitle":"Gîtes de France data breach: 117K accounts exposed","kind":"correction","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/gitesdefrance","status":"closed","title":"Breach date set to 2026-05-16 (Have I Been Pwned breach date)","url":"https://helix.ml/threat-watch/i/gitesdefrance-data-breach"},{"body":"Have I Been Pwned records the breach date; the incident previously showed the date HIBP loaded the record.","category":"breach","date":"2026-10-26","incident":"assuranceretraite-data-breach","incidentTitle":"Assurance Retraite data breach: 70K accounts exposed","kind":"correction","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/assuranceretraite","status":"closed","title":"Breach date set to 2024-09-01 (Have I Been Pwned breach date)","url":"https://helix.ml/threat-watch/i/assuranceretraite-data-breach"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/breach/changes.json","json":"https://helix.ml/threat-watch/c/breach/feed.json","llms":"https://helix.ml/threat-watch/c/breach/llms.txt","page":"https://helix.ml/threat-watch?c=breach","rss":"https://helix.ml/threat-watch/c/breach/feed.xml"},"generatedAt":"2026-10-30T06:06:40Z","site":"https://helix.ml/threat-watch"}