# Threat Watch by Helix — Breaches

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1848 incidents, 75 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 1041 incidents, 52 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 109 incidents, 96 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (52)

### [high] VAPOR PANDA (China-nexus) used ARTEX AI agents running DeepSeek to target 200+ organizations in 11 days, compromising at least nine (no CVE)
https://helix.ml/threat-watch/i/vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to · Breaches · no-fix-needed · since 2026-10-29
CrowdStrike reported on Oct 29, 2026 that VAPOR PANDA, a China-nexus espionage group active since 2021, ran the ARTEX agentic AI pentest framework against more than 200 organizations in at least 14 countries during an 11-day campaign that began Oct 17, 2026. The ARTEX agents ran mainly on the Chinese DeepSeek LLM, with a second subscription-based commercial model that CrowdStrike could not confirm. CrowdStrike OverWatch confirmed post-exploitation activity at nine organizations. They include two Latin American foreign ministries, with a third likely compromised, a Middle East interior ministry, a Greek government entity, telecoms in the US, Belgium and the Philippines, and two US pharmaceutical companies. At least 12 more organizations faced password spraying or credential scanning. The targets also included semiconductor, defense, nuclear, financial and think-tank organizations. Initial access came from several routes: an unsigned SAML assertion combined with an XXE flaw, which was then used to query the cloud metadata service for a role that could run commands on thousands of instances; web shells plus an unauthenticated orchestration service, which gave root in a production container environment; a 2022 directory export with unrotated keys, used to forge an admin token; VPN configs and a client key recovered from old mail leaks; and password spraying. Follow-on steps included LAPS password reads, resource-based constrained delegation abuse, mailbox access, JSP/PHP web shells, and the BLOODALCHEMY backdoor at two ministries. A human operator steered the agents in Chinese and had them look for Windows hosts without an EDR sensor. One intrusion's planning agents consumed about 1.4 billion input tokens. No CVE or product patch is named; the fixes are key rotation, SAML and IMDS hardening, and EDR coverage. CrowdStrike says this activity is separate from the ARTEX use Microsoft attributes to Storm-0940 in the ConnectWise Cloud Backup compromise, which suggests that several China-nexus actors have adopted the framework.
Do: Rotate signing keys, Kerberos preauthentication keys and service credentials after any suspected exposure, including keys that sit in backups and old directory exports; Enforce SAML signature validation on every service provider and reject unsigned assertions; Require IMDSv2 on cloud instances and restrict which roles may send commands to instances (for example SSM Run Command); Hunt for ARTEX markers: command lines containing 'artx' or 'artex', cloud roles with an 'artx' prefix, 'art18-' comments, and C:\ProgramData\artx5v\; Block or hunt the C2 domains published by CrowdStrike (nginxmysql[.]com, sqlserver-sqlite[.]com, www[.]ddduuuppp[.]com) and look for Chisel, SoftEther and Tor tunnels; Deploy EDR to every host, internal-only servers included; the operator specifically searched for Windows machines without a sensor; Patch internet-facing appliances and long-lived Linux servers, and review VPN configs or keys that have leaked by email

### [medium] Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records
https://helix.ml/threat-watch/i/amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records · Breaches · no-fix-needed · since 2026-10-28
Japan Airlines disclosed that Amadeus IT Group, which operates its flight reservation, ticketing and check-in systems, suffered a breach exposing reservation data for 92,000 JAL and Japan Transocean Air customers, including names, reservation codes and flight information. For about 2,000 customers, passport numbers, frequent flyer numbers, email addresses and phone numbers were stolen. Flight operations were unaffected and credit card numbers were not compromised. The breach is part of a wave of attacks on Japanese firms (Sony Network Communications ISP, Burger King Japan, Capcom), prompting emergency measures from PM Takaichi's government. JAL will contact affected customers individually with anti-phishing guidance; no fix applies beyond Amadeus's own response.
Do: Monitor for phishing and social engineering targeting customers using stolen reservation and passport data; Review third-party/IT-provider access to customer reservation data and enforce least privilege; Notify affected customers per regulatory requirements and warn against impersonation scams; Verify Amadeus's containment status and contractual incident-response obligations

### [medium] Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack
https://helix.ml/threat-watch/i/suspected-hack-behind-military-base-freezer-failures-us-pentagon-bases-food-spoilage-linked-to-french-supermarket-attack · Breaches · no-fix-needed · since 2026-10-29
The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, per Reuters sources. Officials treat the incidents as a possible hack and are coordinating with French investigators following a similar freezer-failure attack on a supermarket in France, suggesting a common actor or technique targeting refrigeration/OT systems. The attack caused physical supply-chain impact — spoiled food at military installations — rather than data theft. No CVE is involved; no technical details, attribution, or remediation have been published. Investigation is ongoing as of 2026-10-29.
Do: Review network segmentation and remote access for building management and refrigeration control systems at facilities; Monitor OT/BMS controllers for anomalous commands or firmware changes; Coordinate with DoD/cert authorities on indicators once released; Assess food supply integrity and contingency stock at affected sites; Harden vendor remote-maintenance access paths to cold-chain equipment

### [high] Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency
https://helix.ml/threat-watch/i/navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency · Breaches · no-fix-needed · since 2026-10-27
Navigate360, which operates school-safety and Crime Stoppers tiplines, suffered a data breach whose details the company has not transparently disclosed. Following investigative reporting by Valérie Ouellet and Michelle Allan into the Crime Stoppers data, multiple Ontario Crime Stoppers organizations, including Toronto Crime Stoppers, suspended use of Navigate360 tiplines, citing the breach and an unacceptable incident response. U.S. state education departments are collaborating to seek answers from the vendor. Affected parties include students, tipsters, and organizations relying on the tipline service; data exposed in the breach may include tipline submissions. No fix applies; remediation depends on the vendor providing disclosure and organizations deciding whether to continue using the service.
Do: Suspend or disable Navigate360 tipline use until the vendor provides a credible breach disclosure; Notify potentially affected tipsters and comply with breach-notification obligations; Assess what data your organization shared with Navigate360 and exposure risk; Demand contractual transparency and incident-response commitments from the vendor; Evaluate alternative tipline providers

### [high] Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents
https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents · Breaches · no-fix-needed · since 2026-10-29
A hacktivist group calling itself the Department of Peace leaked records of more than 41,000 DHS employees — names, offices, contact details and assignments — to DDoSecrets and hacker maia arson crimew, who published the 'Icepick' dataset on October 28, 2026. The group says the data came from an Okta single sign-on service used by DHS; Okta denies its systems were breached. Reuters verified details for several employees. A searchable tool at icepi.cx indexes 41,191 people and 55,603 internal groups, exposing HSI certified undercover agents, use-of-force instructors tied to ICE shootings, and operational group names. DHS says it is aware of a potential breach and is investigating. This is the third major federal data leak in about a month, following FBI and Pentagon incidents.
Do: Treat leaked DHS contact data as public; assume targeted phishing, doxxing and social engineering against staff, especially those in undercover or sensitive roles; Review and rotate credentials, tokens and sessions tied to the affected Okta SSO tenant; audit for unauthorized access; Harden identity provider logging, MFA and privileged access monitoring across DHS agencies; Assess operational risk to personnel named in undercover, use-of-force and intelligence groups and consider protective measures; Monitor for follow-on leaks or extortion referencing the dataset

### [high] Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people
https://helix.ml/threat-watch/i/florida-department-of-education-student-financial-aid-breach-unauthorized-access-may-expose-data-of-4-9-million-people · Breaches · no-fix-needed · since 2026-10-29
The Florida Department of Education disclosed that staff learned of unauthorized criminal access to its Florida Student Financial Aid website on October 19, 2026. The breach may have exposed personal information — including Social Security numbers — belonging to approximately 4.9 million people, making it one of the larger state education-sector breaches. The department activated its cybersecurity incident response upon discovery. Details on the attack vector, threat actor, and exact data types exposed have not been publicly confirmed, and the full scope remains under investigation. Affected individuals are users of Florida's state student financial aid programs. No patch applies; remediation centers on incident response, forensics, and notification to affected individuals.
Do: Monitor for follow-up notifications from the Florida Department of Education and enroll in any offered credit monitoring or identity protection; Place fraud alerts or credit freezes with the major credit bureaus given potential SSN exposure; Watch for phishing or scams that reference the breach or student aid applications; Organizations in the education sector should review web application access controls, monitoring, and incident response plans for similar aid/portal systems

### [medium] RIZAP: employee uploaded 726 members' health records to personal generative AI chat
https://helix.ml/threat-watch/i/rizap-employee-uploaded-726-members-health-records-to-personal-generative-ai-chat · Breaches · no-fix-needed · since 2026-10-29
On 20 August 2026 an employee of RIZAP Inc., a Japanese fitness and health-guidance group, extracted records from the health-guidance management system RIZAP operates for insurers and uploaded them to a generative AI service on a personal account that the company had never approved. The records covered 726 members of insurers using the service, exposing health-related personal data to a third-party AI platform outside corporate control. The incident is insider misuse rather than an external attack; no CVE or vendor patch applies. Remediation centres on policy enforcement, DLP, and AI access controls rather than software fixes.
Do: Review and restrict use of unapproved generative AI services on corporate systems and accounts; Deploy DLP/egress monitoring to detect bulk extraction of member records; Audit employee access to the health-guidance management system and enforce least privilege; Notify affected insurers and members as required by Japanese privacy law; Provide staff training on handling health data and approved AI tooling

### [high] UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data
https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data · Breaches · no-fix-needed · since 2026-10-26
UNM Health Sciences Center reports a cyberattack that its IT team detected at about 11:30 a.m. on Monday 2026-10-26, according to the Daily Lobo as reported by Help Net Security. Staff were told to shut down and unplug computers, and the center announced the incident at 2:30 p.m. MDT. Ambulances were diverted to health systems in Albuquerque and Santa Fe for about two hours on Monday, and outpatient surgeries and appointments were suspended for the rest of that day. All UNM hospitals were open on Monday, clinics were to resume appointments on Tuesday, and classes at four colleges stayed canceled that day. Reports say a synthetic voice message played on hospital computers claimed theft of student and employee data, SSNs and documents; this is reported, not confirmed. The BYOD group, which The Record describes as a new ransomware gang, claimed on its leak site on Monday evening: 36,000 machines compromised on the main campus and hospital; two Oracle databases; the Entra tenant; Banner student records; HR and payroll data; and Cerner EHR rosters. These are unconfirmed claims. The 36,000 figure counts machines, not people. UNM says it notified state and federal law enforcement and that the matter is an active investigation. Whether ransomware was used is unclear.
Do: Treat the incident as a likely large-scale PII breach; prepare identity-protection and notification processes for patients, employees, and students pending confirmation; Hunt for attacker persistence across the Windows/Entra environment before trusting restored systems; rotate credentials, tokens, and service accounts; Verify integrity of Oracle, Banner, and Cerner data and review access logs for exfiltration; Monitor BYOD leak site for data publication and validate any claims against internal evidence; Coordinate with law enforcement before public disclosure; preserve forensic evidence

### [critical] PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)
https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew · Breaches · partial · since 2026-10-28 · CVE-2026-109618, CVE-2026-109619, CVE-2026-46300
Dream reported a suspected China-nexus actor chaining two unauthenticated PHP RCE flaws (PHP2Shell, CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300, CVSS 7.8) to root internet-facing firewalls and deploy PHP root webshells. Using FOFA, attackers identified ~19,000 firewalls from one vendor, filtered targets in the US, Japan, Taiwan and South Korea running newer PHP, and on October 23-24 exploited 25 devices, rooting 24, including three systems tied to a US government-affiliated environment. On two of those they deployed a reverse SSH tunnel, pivoted to an internal firewall management server, stole configurations and credentials, decrypted an LDAP service account password, enumerated the domain, password-sprayed, and attempted AD backdoor accounts. Palo Alto Networks confirmed active exploitation against internet-exposed PAN-OS management interfaces; PHP fixes shipped October 21, 2026 (8.5.12, 8.4.27, 8.3.36, 8.2.35), and PAN-OS fixes are rolling out with some versions still pending. CISA added CVE-2026-46300 to KEV with a October 31, 2026 deadline for federal agencies.
Fixed: PAN-OS 12.2.4-h1; PAN-OS 12.1.4-h13; PAN-OS 12.1.7-h11; PAN-OS 12.1.10-h3; PAN-OS 11.2.4-h23; PAN-OS 11.2.7-h23; PAN-OS 11.2.10-h16; PAN-OS 11.2.13-h4; PAN-OS 11.2.16-h1; PAN-OS 11.1.4-h38; PAN-OS 11.1.6-h40; PAN-OS 11.1.7-h12
Do: Immediately restrict PAN-OS/Panorama management interface access to trusted internal IPs and remove management interfaces from the public internet; monitor for FOFA-indexed exposure; Upgrade PAN-OS to fixed versions where available (e.g. 12.2.4-h1, 12.1.4-h13, 11.2.4-h23, 11.1.4-h38, 10.2.7-h39) and apply remaining fixes as released; patch PHP to 8.5.12/8.4.27/8.3.36/8.2.35 and apply Fragnesia kernel fixes; Where fixes are unavailable, apply Palo Alto mitigations: route MGT traffic through a DP port, replace inbound management certificates, decrypt inbound management traffic, and enable threat prevention on management services; Check firewalls and PHP-enabled services for PHP root webshells and reverse SSH tunnels; review management server access logs and configurations for tampering; Rotate credentials stored on firewall management servers, including LDAP service accounts, and audit AD for suspicious or backdoor accounts

### [medium] Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers
https://helix.ml/threat-watch/i/amadey-botnet-australian-signals-directorate-severs-c2-access-to-180-000-infected-computers · Breaches · no-fix-needed · since 2026-10-29
The Australian Signals Directorate gained access to the backend of the Amadey malware operation and disconnected its command-and-control server from roughly 180,000 infected victim computers, cutting criminals' remote access to those machines. Amadey is a commodity malware loader used to deliver additional payloads such as infostealers and ransomware. The victims are a large, anonymous, multinational set of compromised computer owners rather than a single named organisation. The action is a disruption, not a vendor fix: infected hosts remain compromised locally, and the underlying infections that allowed Amadey in still need remediation. No CVE applies; exploitation was ongoing in the wild until the takedown.
Do: Check endpoints for Amadey and other malware indicators and fully remediate any infections rather than assuming disconnection from C2 means clean; Harden initial-infection vectors Amadey typically uses (phishing, cracked software, exposed RDP) with MFA, patching, and RDP restrictions; Monitor for reconnection attempts to known Amadey C2 infrastructure and block related indicators; Report suspected infections to national CERT/authorities to support further disruption efforts

### [high] Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management
https://helix.ml/threat-watch/i/frontline-education-breach-student-ssns-medicaid-ids-and-dobs-exposed-via-frontline-central-and-school-health-management · Breaches · no-fix-needed · since 2026-10-29
Frontline Education announced on Oct. 26, 2026, a cybersecurity incident affecting its Frontline Central and School Health Management products, which are used by school districts to manage employee and student health records. Data exposed may include Social Security numbers, dates of birth, and government ID numbers, including Medicaid IDs, for both adults and minors whose information was processed through these products. The vendor has not publicly detailed how the intrusion occurred, how many individuals or districts are affected, or whether data was exfiltrated. Affected individuals are being notified; no fix applies beyond the vendor's incident response, so organizations using the products should monitor vendor advisories and notifications.
Do: Check whether your district uses Frontline Central or School Health Management and await/verify vendor breach notifications; Identify affected students and staff and prepare identity-protection and notification obligations under FERPA/state breach laws; Monitor Frontline Education advisories for scope updates and indicators of compromise; Review access to and data sharing with Frontline products; consider credential resets for district accounts; Prepare communications for parents/guardians of minors whose SSNs or Medicaid IDs were exposed

### [critical] KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)
https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127 · Breaches · patched · since 2026-10-29 · CVE-2026-20127
Cisco Talos reported that attackers exploited CVE-2026-20127, a CVSS 10.0 unauthenticated auth-bypass flaw in Cisco Catalyst SD-WAN controller components, to deploy a malware framework dubbed KeyDrift. On Controllers, LittleFilch hooks vdaemon to capture AES-256 traffic-encryption keys, exfiltrating them RSA-encrypted via UDP; on Validators a fake aaamgr loads PolyFlame, an in-memory backdoor/C2 relay. Talos tracks the actor as UAT-11473, targeting space/satellite, defense/aerospace and policy research, and assesses with high confidence its infrastructure overlaps Volt Typhoon's 'Silent Train' covert access network detailed by Lumen's Black Lotus Labs, which says Volt Typhoon exploited the flaw by late 2025 against telecoms, governments, defense contractors, MSPs and critical infrastructure, likely for pre-positioning and espionage. Cisco patched in February 2026 with no workaround; upgrading may not remove implants, so incident response and key rotation are advised.
Fixed: 20.9.8.2; 20.12.6.1; 20.12.5.3; 20.15.4.2; 20.18.2.1
Do: Verify whether SD-WAN Controllers/Managers/Validators were compromised before upgrading — check for KeyDrift artifacts (/etc/sv/sshd run script, /etc/sv/aaamgr/, conf_sshd, rsshd, libdssl.so, libcommon.so, /tmp/system-vdaemon, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf); Upgrade to a fixed release (20.9.8.2, 20.12.5.3/20.12.6.1, 20.15.4.2 or 20.18.2.1 per train); migrate off EOL trains; Until patched, restrict ports 22 and 830 to known controller IPs on on-prem deployments; Deploy Talos Snort rules (67387–67416 Snort 2; 7:44–7:73 Snort 3) to detect C2; Follow Cisco's SD-WAN hardening guide; if compromise signs found, start incident response, contact Cisco TAC, and rotate AES keys; review exposure of other management/control-plane platforms targeted via Silent Train (Versa Director, N-able N-central, VeloCloud Orchestrator, Quest KACE)

### [medium] BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks
https://helix.ml/threat-watch/i/bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks · Breaches · no-fix-needed · since 2026-10-29
BAE Systems, which operates the federal judiciary's Bankruptcy Noticing Center (BNC) under contract with the Administrative Office of the US Courts, restored the service on October 26 after it stopped processing bankruptcy notices around October 9 due to an undisclosed incident. BAE states no data was extracted and no PII was breached, and that no other systems were affected, but has not disclosed the cause or confirmed whether it was a cyberattack. No ransomware or cybercrime group has claimed responsibility. The outage disrupted notice delivery for all US federal bankruptcy courts; the Judicial Conference declared a 'Bankruptcy Rules emergency' on October 22, allowing judges to extend deadlines and pause time periods. The BNC began clearing the backlog of delayed notices oldest-first after restoration.
Do: If your organisation files or depends on bankruptcy notices, verify notices you expected during Oct 9–26 were delivered and re-file/resend any missing ones; Use any extended deadlines or relief orders issued under the Bankruptcy Rules emergency for filings affected by the outage; Monitor AOUSC and BAE communications for the root-cause determination and any follow-on security guidance; Review contingency procedures for court-notice delivery outages in case of recurrence

### [medium] Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline
https://helix.ml/threat-watch/i/cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline · Breaches · no-fix-needed · since 2026-10-29
Belgium's FPS Finance took its main online tax platform, MyMinfin, offline on 2026-10-29 after a cyberattack, days before an October 31 filing deadline for certain income types. Affected taxpayers will receive extended deadlines. Authorities have not identified the attackers or the access method and say there is no indication of data breach or theft, though investigation continues. Services were suspended as a precaution while systems are secured; other government applications remain partially operational. The incident follows an earlier October shutdown of Belgian government websites over critical PHP vulnerabilities (remote code execution) affecting servers across Europe; no link between the incidents has been established.
Do: Monitor FPS Finance communications for revised filing deadlines and service restoration notices; Taxpayers with October 31 obligations should await the announced extension rather than assume the deadline stands; Be alert for phishing or scam sites impersonating MyMinfin while the official portal is down; Government operators should verify PHP servers are patched against the recently disclosed critical RCE vulnerabilities; Watch for updates on whether data exposure is confirmed

### [critical] Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms
https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure · Breaches · patched · since 2026-10-28 · CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20127
On 2026-10-28 Lumen's Black Lotus Labs published 'Silent Train', its name for the way China's Volt Typhoon has reached US targets since November 2023. It is not a standing botnet. For each operation the actor builds a fresh chain of four to six hops: two non-US VPSs (Ucloud, Alibaba Cloud and Huawei Cloud appear in examples), then hacked overseas SOHO and IoT gear (Intelbras modems, TP-Link, Ruckus, Zyxel, Cambium), then hacked US devices (Netgear Orbi), and sometimes a hacked enterprise box such as a FortiGate as the last hop. A chain can be stood up in under two minutes. Sessions average about four hours, and afterwards the temporary SSH services, keys and configs are wiped. Later chains added Chisel and FRP reverse tunnels, and from early 2025 hacked enterprise systems were kept for one to three months. Activity runs Monday to Friday, 09:00–22:00 China Standard Time. More than 27 device classes have been abused. Black Lotus Labs confirms four zero-day campaigns through Silent Train: Versa Director (CVE-2024-39717, 2024), N-able N-central (CVE-2025-8875/8876, 2025), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited by late 2025 and still after Cisco's February 2026 fix) and Arista VeloCloud Orchestrator (CVE-2026-16812, 2026). It also assesses with moderate confidence a Quest KACE SMA zero-day that hit more than 30 victims and fell off after Quest's October 2025 updates; no CVE has been assigned. After getting in, the actor used in-memory webshells, harvested credentials, abused built-in features such as endpoint control and file transfer to reach downstream customers, and erased logs. Hundreds of victims have been notified: telecoms, US government, the defense industrial base, satellite and emergency communications, MSPs and IT firms, ROTC-linked universities, and water, energy, transport, maritime, rail and aviation. Hawaii, California and Texas are the most targeted states. All four confirmed CVEs are in CISA KEV and have vendor fixes. Black Lotus Labs says it has quietly disrupted the framework, but warns that its view is not a complete census.
Fixed: VeloCloud Orchestrator 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1 (Arista SA-0144); Catalyst SD-WAN 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, 20.18.2.1; releases before 20.9 must migrate (cisco-sa-sdwan-rpa-EHchtZk); N-central 2025.3.1 or 2024.6 HF2; Versa Director 22.1.4 or later; Quest KACE SMA: current release with the October 2025 security updates
Do: Confirm every VeloCloud Orchestrator, Catalyst SD-WAN Controller/Manager/Validator, N-central, Versa Director and KACE SMA you run (or that an MSP runs for you) is on a fixed build: VCO 5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1, SD-WAN 20.9.8.2/20.12.5.3/20.12.6.1/20.15.4.2/20.18.2.1, N-central 2025.3.1 or 2024.6 HF2, Versa Director 22.1.4+, KACE with the October 2025 updates; Take these management interfaces off the internet: allow-list admin networks or jump hosts; on on-prem Catalyst SD-WAN restrict TCP 22 and 830 to known controller IPs; Hunt for compromise on those platforms, because patching does not evict an actor already inside. On SD-WAN, check /var/log/auth.log for 'Accepted publickey for vmanage-admin' from unknown IPs and vmanage-type control-connection peering events outside maintenance windows. On VCO, look for unexpected outbound HTTP(S) from the host and for the source IPs in Arista SA-0144. On Versa Director, look for in-memory JAR webshells. On all of them, look for admin logins, API calls, remote file transfers or endpoint-control jobs nobody scheduled; If a platform was exposed while vulnerable, rotate every credential it stores or brokers (domain, device and customer credentials), review its access to downstream customers, and rebuild it from trusted media instead of cleaning it in place; Ship management-plane, firewall and auth logs off-box with long retention. The actor wipes on-device logs, so the off-box copy may be the only record. Weight review toward 01:00–14:00 UTC on weekdays (09:00–22:00 China Standard Time); On edge and SOHO gear you own, especially FortiGate and Netgear Orbi, look for SSH listeners on non-standard ports (e.g. 2222), unexpected authorized_keys entries, and Chisel or FRP tunnels (e.g. TCP 8999). Replace end-of-life routers; Apply CISA AA24-038A (Volt Typhoon) and the joint advisory AA26-113A on China-nexus covert networks; for Cisco SD-WAN follow CISA ED 26-03 hunt and hardening guidance

### [medium] ENGIE: French customer contact and contract data stolen through a partner marketing platform breach
https://helix.ml/threat-watch/i/engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france · Breaches · no-fix-needed · since 2026-10-27
ENGIE says attackers stole contact and contract data of customers in France after breaching a marketing and prospecting platform that its business partners use to promote energy offers. The company says its own IT systems were not compromised, that it cut off the attackers' access to the platform after spotting unusual data access, and that no banking data was affected. The fields listed in customer notices are first and last names, postal and email addresses, phone numbers, PDL or PCE identifiers, customer IDs and contract numbers. ENGIE says it notified relevant authorities and contacted affected customers, but it has not given a count of affected people. No group has claimed the attack. A separate incident from a year earlier, in which the Scattered LAPSUS$ Hunters group leaked records from a Salesforce instance of a retail subsidiary of ENGIE North America, is not part of this breach.
Do: Warn customers of ENGIE France about phishing and fraud attempts using their stolen contact and contract details; Review access controls and monitoring on third-party/partner marketing platforms handling customer data; Audit partner integrations for excessive data access and enforce least-privilege access; Monitor for follow-on social engineering targeting energy customers using PDL/PCE and contract numbers

### [high] iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded
https://helix.ml/threat-watch/i/irhythm-data-breach-8-2m-patients-data-stolen-from-third-party-hosted-apps-ransom-demanded · Breaches · no-fix-needed · since 2026-10-29
Medical device maker iRhythm disclosed a June 2026 data breach in which hackers stole personal information from third-party-hosted business applications and attempted to extort the company with threats to leak the data. An HHS OCR filing and a notice to the Oregon Attorney General put the toll at 8,179,772 individuals. Stolen data includes names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data such as account/serial/insurance numbers and dates of service. The company says there is no evidence of identity theft so far and no impact to products, clinical or medical device systems, manufacturing, or patient safety. Notification letters began going out in October 2026; no free credit monitoring was offered.
Do: If you or your organisation's patients may be affected, watch for iRhythm notification letters and review the company's breach notice; Monitor for medical identity theft and insurance fraud; review explanation-of-benefits statements for unfamiliar claims; Enforce strong, unique credentials and MFA on iRhythm and healthcare portal accounts; Alert staff/patients to phishing that could leverage the stolen contact data; Review third-party-hosted application security and data exposure in your own vendor relationships

### [critical] Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand
https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand · Breaches · no-fix-needed · since 2026-10-21
GMO Internet's Onamae.com Desktop Cloud, a Windows virtual-desktop service marketed for running FX auto-trading tools such as MT4/MT5, was breached. GMO found malicious programs on some customers' servers on 20 October 2026 and stopped every plan on 21 October; up to 26,739 servers may be affected, which GMO stresses is a ceiling rather than a confirmed count. Trading-tool and brokerage logins stored on those servers were taken and used: customers report unauthorized trades at several brokers (individual losses of roughly ¥0.5–4M+ in press accounts, unverified), and from 24 October GMO confirms customer information left the service. GMO says an extortion email arrived on 21 October demanding about ¥8 billion ($50M) and threatening further unauthorized trading across 70+ brokers, leaks of customer and company data, and ransomware on customers' connected PCs. GMO refused to pay. After the noon-JST 27 October deadline the attacker published material it claims is GMO and customer data; GMO had the leak site and its mirrors taken down early on 28 October. As of 28 October GMO had found no malware or ransomware on the customer PCs it analysed. How the attacker got in has not been disclosed; GMO admits a security problem in the service and that its own white-hat staff had flagged issues beforehand. GMO will not restart the platform. It will compensate verified realized trading losses, pay ¥5,000 to each current customer plus ¥10,000–25,000 per category of published data (capped at ¥3M), and offer six months of a replacement service free. It has also opened a bounty of up to US$1M for information on the attackers (270 tips by 29 October) and is passing leads its white-hat team found to the police.
Do: Treat every credential saved on the server as compromised: change MT4/MT5 and brokerage passwords from a device that never connected to the service, then end all active broker sessions (some apps keep sessions alive after a password change) and enable 2FA; Review trade history and balances at every broker you used from the service; report unfamiliar trades to the broker and to GMO, and keep evidence for the loss-compensation claim (GMO says application details come by 6 November); Treat any PC that connected to the service as potentially exposed: run a full antivirus scan and back up to offline storage before reusing it (GMO has found no malware on the devices it analysed, but has not cleared all of them). As a precaution, review RDP drive/clipboard redirection and Startup-folder persistence; Do not visit, link to or repost the material the attacker published or its mirrors: GMO warns that visitors' information is captured, the content may be inaccurate, and it is pursuing people who spread it. Report new copies at onamae.com/abuse/; If your data was published, contact GMO's 24-hour support line about the special payment (¥10,000–25,000 per data category, up to ¥3M); Expect phishing and recovery scams that exploit the incident: GMO never asks for passwords or authentication codes, and any request for fees to 'recover your losses' is fraud. Send tips about the attackers only to GMO's official bounty site and do not contact suspects yourself; Do not trade through Onamae.com Desktop Cloud again; GMO will not restart the platform and is offering a replacement environment on separate infrastructure

### [high] So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords
https://helix.ml/threat-watch/i/so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords · Breaches · no-fix-needed · since 2026-10-27
A third party broke into the So-net member database run by Sony Network Communications, the Sony-owned Japanese ISP, on 2026-10-19. The company spotted the access on 2026-10-23, shut the server down and blocked the source. On 2026-10-24 it confirmed data had left, and it disclosed on 2026-10-27; it has not said how the attackers got in. Exposed: 2,141,986 So-net member records (1,869,771 current, 272,215 who left in March 2026 or later) and 443,495 records of NTT Docomo's docomo hikari "plala (S Course)" customers, whose accounts Docomo had outsourced to So-net's database (Docomo was told on 2026-10-26). Both sets hold name, phone, email address, My Page user ID, date of birth, gender and internet connection ID, but not login passwords. Separately, 54,401 mailbox addresses with their mail passwords were taken from four So-net mail services: Mail Service (G) 24,655 (gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp), A-Box 17,672, So-net VAIO Mail 7,005 and PostPet Mail 5,069. Anyone holding those passwords could read and send mail as the user, so So-net force-reset them without notice from 10:00 JST on 2026-10-27. Also taken: 16 bank account records (bank, branch, account type, number and holder, no PINs; So-net members only) and 7 password-reset notice letters. No card data was involved, and NURO, the Basic Mailbox and My Page login passwords are not affected. Members who left by the end of February 2026 are not in the data. The breach was reported to Japan's Personal Information Protection Commission. As of 2026-10-27 no secondary harm was known, no actor had claimed the attack, and the investigation was ongoing.
Do: Affected So-net mail users (@*.gyao.ne.jp, @*.gate01.com, @*.pbc.ne.jp, @*.highway.ne.jp, @abox*.so-net.ne.jp, @*.vaio.ne.jp, @postpet*.so-net.ne.jp): the old mail password no longer works — set a new one in So-net My Page, then update it in every mail client (Outlook, phone mail apps); If the leaked mail password was reused anywhere else, change it there now and turn on 2FA — especially accounts that use that mailbox for password resets; Check the mailbox for forwarding rules, filters, or sent mail you did not create between 2026-10-19 and the reset; Expect targeted phishing (email, SMS, phone) posing as So-net, Sony or Docomo using your real name, birth date and user ID; do not follow links or open attachments — So-net and Docomo say they will contact affected customers individually; So-net customers with a bank account on file: watch for debit fraud and calls claiming to be So-net or your bank; Help lines: So-net 0120-36-8887 (Mon–Sat 10:00–18:00); docomo hikari plala (S Course) 0120-035-700 (daily 10:00–19:00); Organisations: treat mail from the listed So-net domains received 2026-10-19 to 2026-10-27 as possibly sent by an attacker; if employees use these addresses for work accounts, force resets

### [medium] Moldova government digital services breach — ~750,000 citizens' personal data possibly stolen; further cyberattacks warned
https://helix.ml/threat-watch/i/moldova-government-digital-services-breach-750-000-citizens-personal-data-possibly-stolen-further-cyberattacks-warned · Breaches · no-fix-needed · since 2026-10-27
A cyberattack on Moldova's government digital services may have resulted in the theft of personal data belonging to approximately 750,000 people. Prime Minister Vasile Tofan warned that such attacks may become increasingly frequent and said the country needs to strengthen cybersecurity and invest more in securing government systems. Some online services were reportedly disrupted following the incident. Authorities have issued a warning about possible new cyberattacks in the wake of the breach. Details on the attack vector, threat actor, and exact scope of exfiltration have not been disclosed, and no technical fix or patch is applicable; the response is organizational and defensive.
Do: Monitor Moldovan government service status and official advisories for further attack warnings; Assume personal data of Moldovan residents may be compromised; watch for phishing and fraud attempts; Review and harden authentication and monitoring on government-facing digital services; Increase investment in cybersecurity controls and incident response readiness for state systems

### [high] Times Car data breach: driver's license data of 1.46 million leaked, ¥5.5 billion loss reported
https://helix.ml/threat-watch/i/times-car-data-breach-driver-s-license-data-of-1-46-million-leaked-5-5-billion-loss-reported · Breaches · no-fix-needed · since 2026-10-28
Times Car, a Japanese car-sharing service, disclosed a breach in which personal data of 1.46 million people, including driver's license information, was leaked following a cyberattack in September 2026. The company is reporting a loss of ¥5.5 billion, and the incident has prompted other Japanese firms to reassess the financial risk of weak cybersecurity. The breach is part of a broader wave of cyberattacks across Japan. No technical vulnerability or fix is applicable; the incident is a data breach with direct financial and privacy impact on customers whose licenses and personal information were exposed.
Do: If you are a Times Car customer, monitor for identity theft and phishing using your leaked driver's license data; Watch for suspicious use of your license details and consider fraud alerts with relevant authorities; Japanese firms handling similar PII should review access controls and breach-response plans; Prepare for potential regulatory and notification obligations following large-scale PII leaks

### [medium] AfD email breach: 345,000 addresses leaked via hacked WordPress site
https://helix.ml/threat-watch/i/afd-email-breach-345-000-addresses-leaked-via-hacked-wordpress-site · Breaches · no-fix-needed · since 2026-10-28
Hackers breached AfD's party-owned IT provider Alternita Dienstleistungs GmbH via a poorly secured WordPress site at wahlkampf.afd.de, reached the mail management system, changed officials' email passwords and exfiltrated data. The intrusion was detected 9 September 2026, but attackers returned on 14 September via undetected malware and copied more data. Over 345,000 unique email addresses and messages were exposed, later offered via torrent and added to HIBP on 27 October as a sensitive breach. Leaked emails also contained excerpts of state branch member databases and unencrypted population-register data, including first-time voters in Mecklenburg-Western Pomerania. AfD notified mailbox owners and the Berlin data protection commissioner on 20 October, though timing is disputed; notification of non-user third parties under GDPR Article 34 is uncertain. Der Spiegel and ZDF reported campaign donation revelations from the emails.
Do: Check whether your domain or email addresses appear in the breach via HIBP (domain search or verified owner login); Force password resets and review mailbox access logs for any accounts on affected party/provider mail systems; Notify individuals whose personal data (e.g. voter registry excerpts) appears in leaked emails per GDPR Article 34 if not yet done; Harden the WordPress site (patching, credentials, plugins) and scan for residual attacker backdoors; Assess whether retained voter-register data exceeded the one-month post-election deletion requirement

### [medium] Bithumb internal mobile system breach — data leak under investigation
https://helix.ml/threat-watch/i/bithumb-internal-mobile-system-breach-data-leak-under-investigation · Breaches · no-fix-needed · since 2026-10-28
South Korean crypto exchange Bithumb disclosed a data leak following a hack of its in-house mobile system, the platform employees use for internal communication. The breach was discovered on Tuesday and reported to authorities; the exchange is investigating the extent of the leaked data. It was one of three financial-firm breaches reported in South Korea that day. No details on attacker identity, data types, or customer impact were given, and no fix or remediation details are available yet.
Do: Monitor Bithumb advisories for confirmation of what data was exposed; Assume employee/internal communications may be compromised and review related credentials; Watch for phishing or social-engineering attempts leveraging leaked internal data; If a Bithumb customer, enable strong 2FA and monitor account activity

### [medium] Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months
https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months · Breaches · no-fix-needed · since 2026-10-27
Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in US prison for his role as a prolific affiliate of the Hive and Nefilim ransomware groups, attacking hospitals, government entities, law firms, and companies in oil and gas, aviation, chemical, insurance, construction and other sectors from mid-2018 to late 2021. Nefilim operators customized ransomware per victim, targeted firms with over $100M annual revenue in the US, Canada and Australia, and extorted victims by threatening to publish stolen data, encrypting networks in the US, Canada, Australia, Germany, the Netherlands, Norway and Switzerland. Stryzhak pleaded guilty in late 2025, was arrested in Spain in June 2024 and extradited in April 2025. Co-conspirator Volodymyr Tymoshchuk remains at large with an $11M reward offered.
Do: Review incident history for Hive/Nefilim indicators of compromise and confirm no residual access; Ensure offline, tested backups and ransomware-specific IR playbooks are in place; Harden perimeter access (MFA, VPN patching, network segmentation) against affiliate-style intrusions; Monitor for data-theft-plus-encryption extortion patterns and report incidents to law enforcement (FBI/CISA)

### [high] Royal Darwin Hospital privacy breach — pregnant women's medical records posted to Instagram by 'medical observer'
https://helix.ml/threat-watch/i/royal-darwin-hospital-privacy-breach-pregnant-women-s-medical-records-posted-to-instagram-by-medical-observer · Breaches · no-fix-needed · since 2026-10-28
A 'medical observer' at Royal Darwin Hospital shared pregnant women's confidential medical information in a post visible to roughly 28,000 Instagram followers. The Northern Territory health department initially claimed only five patients were affected, but backtracked after the ABC contacted multiple women impacted by the breach. The department has not confirmed the full number of affected patients. The breach involved misuse of access to patient records rather than a technical vulnerability, so no software fix applies; the incident raises questions about insider access controls and social media policies at NT Health facilities.
Do: Review and tighten insider access controls and audit logging for patient records at NT Health facilities; Enforce and audit social media and confidentiality policies for staff and observers; Notify and support affected patients and offer identity/privacy protections; Investigate how the observer accessed and shared the data and assess disciplinary and legal action; Review third-party/observer onboarding and supervision procedures

### [medium] Ransomware attack on NZ coronial services delays investigations, grieving families left waiting
https://helix.ml/threat-watch/i/ransomware-attack-on-nz-coronial-services-delays-investigations-grieving-families-left-waiting · Breaches · no-fix-needed · since 2026-10-28
A major ransomware attack on New Zealand's coronial services has caused significant delays to coronial investigations. One family has waited more than nine months for answers following their mother's unexpected death, describing the wait as 'incredibly stressful', and were told the ransomware attack contributed to the delay. The incident affects grieving families awaiting coronial findings across NZ. The report does not state when the attack occurred, which systems were compromised, whether data was stolen or leaked, or whether a ransom was paid. No technical details, CVEs, or named threat actor are given. As a breach of a public service, remediation rests on the responsible agency's incident response rather than a vendor patch.
Do: Organisations in the justice/coronial sector should review ransomware resilience, backups, and incident response plans; Agencies should communicate proactively with affected families about delays and expected timelines; Verify restoration of affected systems and monitor for follow-on extortion or data leaks

### [high] Skyw4lker: device code phishing campaign targeting U.S. organizations via Microsoft 365 token theft
https://helix.ml/threat-watch/i/skyw4lker-device-code-phishing-campaign-targeting-u-s-organizations-via-microsoft-365-token-theft · Breaches · no-fix-needed · since 2026-10-28
ANY.RUN researchers exposed Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations in manufacturing, technology, and healthcare. Victims receive password-protected documents posing as contracts or service proposals, are directed to pages hosted on sites.google.com, and are walked through a legitimate Microsoft device authorization flow initiated by the attacker. Completing the flow hands the attacker valid Microsoft 365 tokens, granting account access without credential theft and leaving minimal identity telemetry anomalies. A PHP backend collects victim IP and geolocation and polls for authentication completion. Because the authentication itself is legitimate, detection requires correlating document, web, and authentication activity. No vendor patch applies; mitigation relies on blocking device code flows where unneeded, user awareness, and behavioral detection.
Do: Block or restrict Microsoft device code authentication flows where not business-required; Warn staff about password-protected documents posing as contracts/proposals and unexpected device-code approval prompts; Hunt for anomalous device code authentications and tokens issued following visits to sites.google.com-hosted pages; Ingest relevant IOCs (URLs, domains, IPs) from ANY.RUN's published analysis into detection tooling; Enforce phishing-resistant MFA and conditional access policies on Microsoft 365 accounts

### [medium] Capcom: breach of CAPCOM ID service exposes 11.7 million email addresses and account details
https://helix.ml/threat-watch/i/capcom-breach-of-capcom-id-service-exposes-11-7-million-email-addresses-and-account-details · Breaches · no-fix-needed · since 2026-10-19
Capcom confirmed on 22 October 2026 that a third party gained unauthorised access to customer information held in CAPCOM ID, its single sign-on account for web services and some online games. Capcom detected suspicious activity and confirmed the unauthorised access on 19 October, stood up an internal incident response headquarters on 20 October and reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. The data taken covers 11,774,247 email-address records worldwide along with system identifiers such as account creation time, last-login time, login count and the IP address of the last login. Only 43 of those records also included date of birth, gender, country/region and nickname, and 196 accounts had their login passwords changed without authorisation; Capcom has reset those passwords. Capcom found no evidence that customer-chosen passwords were compromised and says credit card data was not involved, and CAPCOM ID services and games stayed online. No attacker has been publicly named. The practical risk is targeted phishing that impersonates Capcom using genuine account details.
Do: Treat unexpected CAPCOM ID emails as suspect: do not open links or attachments, and reach Capcom only through its published support channels; Reset the CAPCOM ID password from the site itself (not from an emailed link) and enable multi-factor authentication; If you reused that password or a similar email address elsewhere, change it there too and watch for credential-stuffing attempts; Because last-login IP and login counts were exposed, be wary of messages claiming to detect suspicious logins from a specific address — they will look credible

### [high] Quest Diagnostics: unauthorized access to Quanum LSM exposed patient records
https://helix.ml/threat-watch/i/quest-diagnostics-unauthorized-access-to-quanum-lsm-exposed-patient-records · Breaches · no-fix-needed · since 2026-10-23
Quest Diagnostics disclosed that on October 21, 2026 it learned of unauthorized access to its Quanum LSM system, the online platform clients use to place lab test orders and receive/look up results. The company believes certain patient records were exposed, but the number of affected patients and data types remain under investigation with external experts and law enforcement engaged. Quanum LSM has been taken offline; customers are directed to paper requisitions or Quanum eLabs, and access to Essential Insights and LabHQ was paused as a precaution. Customer-facing operations, direct LIS interfaces, and EMRs were reportedly unaffected. No threat group has claimed the attack, and Quest confirmed the breach is unrelated to the PHP2Shell vulnerabilities. Quest previously suffered breaches in 2016 (~34,000 people) and 2019 via AMCA (11.9 million patients).
Do: If you are a Quest Diagnostics client using Quanum LSM, switch to paper requisitions or Quanum eLabs for orders and results as recommended; Monitor Quest Diagnostics communications for breach scope updates and notification requirements; Review and rotate any credentials or API integrations tied to Quanum LSM and related Quest portals; Assess whether your organization's patient data may have been exposed and prepare HIPAA breach-notification obligations; Apply heightened monitoring for phishing targeting patients or staff referencing the Quest breach

### [medium] University of Copenhagen data breach: hackers access test environment exposing 525,000 people's data
https://helix.ml/threat-watch/i/university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data · Breaches · no-fix-needed · since 2026-10-23
The University of Copenhagen says an intruder reached one of its test environments, which held personal data of 525,000 people. The intrusion was detected on 2026-10-20 and first disclosed on 2026-10-23. In an update on 2026-10-25 the university said the same environment held PIN codes for the ID cards of about 20,000 staff members and students, and it added them to the count. The personal data types the university lists are names, national identity numbers, work and home phone numbers, and personal email addresses. The university restricted physical access to some campus locations while it issued new access codes, says it contained the attack and blocked the attacker's access, and says there is no indication that systems supporting daily operations were accessed or disrupted. It reported the incident to the Danish Data Protection Agency; no date is given for that report. The university later said that a Monday shutdown of administrative systems (Workzone, Nimbus and others) was a preventive measure and not a new attack. No group has claimed the attack.
Do: Warn students and staff to be vigilant for phishing and independently verify unsolicited requests; Rotate exposed PIN/access codes and review physical access controls; Isolate and audit test environments holding production personal data; purge unnecessary PII; Review logs for lateral movement from the compromised test environment into production systems; Complete GDPR breach notification and regulator engagement

### [medium] SquareML: leaked read-only access key exposed data of 238,083 Denver Health Medical Plan members
https://helix.ml/threat-watch/i/squareml-access-key-leak-exposes-data-of-238-000-denver-health-medical-plan-members · Breaches · no-fix-needed · since 2026-10-27
Denver Health Medical Plan is notifying 238,083 members after a SquareML access key was inadvertently published on a publicly accessible website on June 27, 2025. SquareML, a no-code healthcare analytics vendor, notified DHMP on August 14, 2026, and the key was revoked on August 18, 2026. During the exposure window the key could have been used to access a database containing names, dates of birth, ZIP codes, demographics, health metrics, plan eligibility, hospital admission, provider names, and discharge/transfer data. The compromised account was read-only, so data could not be downloaded, exported, deleted, or altered. No Social Security numbers or financial information were stored, and DHMP says there is no evidence data was viewed or misused. Passwords for all accounts with database access were reset, and additional remediation is underway.
Do: If you are a DHMP member, watch for breach notifications and consider credit/identity monitoring despite no SSN exposure; Review vendor agreements and require prompt disclosure of credential leaks from third-party processors; Audit and rotate any long-lived access keys or service credentials, especially those exposed in public repos or sites; Restrict third-party database accounts to least privilege and read-only where possible; Monitor database access logs for anomalous reads during the exposure window

### [high] UK police: hackers repeatedly breached IT suppliers holding police data since 2021, HMICFRS finds
https://helix.ml/threat-watch/i/uk-police-data-breached-via-third-party-it-suppliers-since-2021-hmicfrs-watchdog-report-finds · Breaches · no-fix-needed · since 2026-10-27
On 27 October 2026 His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published an inspection finding that police and fire and rescue services are not fully prepared for a growing cyber threat. The Police Digital Service and the National Police Chiefs' Council told inspectors about multiple cyberattacks since 2021 on third-party ICT suppliers that held police information. The published report removes the operational detail: it does not say how many suppliers were hit, which ones, which forces were affected, or whether data was stolen. The Police Digital Service recorded 252 cyber incidents affecting policing in January–March 2026 (malware, unauthorised access attempts, accidental disclosure by staff) and 796 near misses. Inspectors found that most supplier contracts carry no ongoing security assurance, that some staff could not say whether suppliers must report incidents promptly, and that supplier logs are usually not visible to in-house security teams. They also criticised the omission of policing and fire from the National Risk Register 2025, the January 2026 Government Cyber Action Plan and the Cyber Security and Resilience Bill. Publicly known incidents from the period include the 2023 ransomware attack on warrant-card printer Digital ID, which exposed Metropolitan Police and Greater Manchester Police staff details; the July 2026 theft of officer and staff contact details from the Police National Legal Database (PNLD), which West Yorkshire Police runs; and the September 2026 attack on Dyfed-Powys Police. The report does not say whether any of these are among the supplier cases it counts. There is nothing to patch: the fixes are supplier contracts, assurance and monitoring.
Do: If you supply ICT services to police or other public-safety bodies, check that your contract requires prompt incident reporting and that the customer can see your security logs; Police and public-sector buyers: list every supplier that holds your data and write ongoing security assurance and breach-notification deadlines into each contract; Feed supplier system logs into your own SOC, or get contractual access to them; Assume staff identity data held by suppliers (names, photos, warrant/collar numbers, work emails) is exposed, and warn staff about targeted phishing; Follow the Police Digital Service Third Party Assurance for Policing (TPAP) standard when onboarding suppliers

### [high] SafePay ransomware: 600+ victims across US and Europe since August 2024 per FBI advisory
https://helix.ml/threat-watch/i/safepay-ransomware-600-victims-across-us-and-europe-since-august-2024-per-fbi-advisory · Breaches · no-fix-needed · since 2026-10-27
The FBI, alongside Germany's BSI and the UK's NCSC, issued a joint advisory stating that the SafePay ransomware gang has breached at least 600 organizations across the U.S. and Europe since August 2024, making it one of the most active ransomware groups currently operating. The advisory is intended to help organizations recognize indicators of compromise and defend against the group's tactics, techniques, and procedures. No specific victim names, CVE, or technical exploitation details are given in the source excerpt. As a criminal campaign rather than a product vulnerability, there is no vendor patch; mitigation relies on standard ransomware defenses and applying the advisory's IOC guidance.
Do: Review the joint FBI/BSI/NCSC advisory and hunt for SafePay indicators of compromise in your environment; Verify offline, tested backups and confirm ransomware recovery procedures; Enforce MFA, restrict RDP/remote access, and segment networks to limit lateral movement; Patch internet-facing systems and monitor for unusual encryption activity or data exfiltration; Report suspected SafePay incidents to law enforcement (FBI/IC3 or national CERT)

### [high] Discover-Tech ad-network spyware: governments deliver zero-click spyware via malicious online ads
https://helix.ml/threat-watch/i/discover-tech-ad-network-spyware-governments-deliver-zero-click-spyware-via-malicious-online-ads · Breaches · no-fix-needed · since 2026-10-27
Citizen Lab reported that government spyware makers, including Israeli company Discover-Tech, are abusing global advertising networks to deliver zero-click spyware. Malicious online adverts served through ad networks are used to target and hack victims' devices without any user interaction, a novel delivery vector for commercial surveillance tools. Targets are individuals selected by government clients; the report was published Thursday (2026-10-22) by the University of Toronto lab. No CVE or technical fix is stated; mitigation relies on ad-network abuse detection and device-level protections rather than a vendor patch.
Do: Harden devices against drive-by/zero-click compromise: enable OS security updates, lockdown modes and mobile MDM controls for at-risk staff; Consider network-level ad and tracker blocking for high-risk users; Monitor for indicators of compromise published by Citizen Lab; Review exposure of staff in high-risk roles (journalists, activists, officials) to targeted surveillance; Follow Citizen Lab and vendor advisories for further technical detail

### [medium] DMDC data breach — Pentagon sued by Marines over PII leak enabling scams
https://helix.ml/threat-watch/i/dmdc-data-breach-pentagon-sued-by-marines-over-pii-leak-enabling-scams · Breaches · no-fix-needed · since 2026-10-27
Two Marines filed a class-action lawsuit in federal court in the District of Columbia against the Pentagon over a data breach at the Defense Manpower Data Center (DMDC). The complaint alleges the Pentagon ignored known cybersecurity flaws before the breach, allowing scammers to obtain and use the plaintiffs' personally identifiable information (PII). The suit claims the leaked PII was subsequently used by scammers, affecting Marine veterans whose data was held in DMDC systems. No technical details, breach date, or number of affected individuals are provided in the source. As a breach incident, no vendor patch applies; remediation centers on notification, monitoring, and fraud protection for affected personnel.
Do: Marines and DoD personnel whose data is in DMDC: watch for phishing/scams using your PII and consider credit/fraud monitoring; DoD: review DMDC security findings cited in the lawsuit and remediate ignored cybersecurity flaws; Monitor for follow-on identity-theft activity tied to leaked PII

### [high] iPhone malware drive-by campaign: crypto thieves serve malware via hundreds of infected websites and malicious ads
https://helix.ml/threat-watch/i/iphone-malware-drive-by-campaign-crypto-thieves-serve-malware-via-hundreds-of-infected-websites-and-malicious-ads · Breaches · no-fix-needed · since 2026-10-27
Researchers told Forbes that crypto thieves are targeting iPhone users at scale with a drive-by cyberattack that requires only viewing an ad or visiting an infected webpage — no user interaction beyond page load. Hundreds of websites have been compromised to serve the malware, and in at least one case a malware-laden ad was served. The attack appears aimed at stealing cryptocurrency from iPhone users. No CVE or named vulnerability is given; the compromise of the websites themselves is the vector, so remediation rests on site owners cleaning infections and users avoiding exposure rather than a vendor patch.
Do: Audit and clean any websites you operate for injected malicious scripts or ad code; Restrict and vet third-party ad networks and scripts served to visitors; Consider blocking or sandboxing untrusted web content for iOS users in your environment; Monitor for signs of compromise on iOS devices, especially unusual crypto-wallet activity; Keep iOS devices updated to the latest version

### [high] Conduent $80M settlement — 62.2M-record healthcare data breach class action
https://helix.ml/threat-watch/i/conduent-80m-settlement-62-2m-record-healthcare-data-breach-class-action · Breaches · no-fix-needed · since 2026-10-27
Business services provider Conduent has agreed to pay $80 million to settle class action litigation over what is reported as the third-largest healthcare data breach on record, exposing data on approximately 62.2 million people. The settlement was signed on October 16, 2026, with plaintiffs in the U.S. District Court for the District of New Jersey. The sources do not state the breach date, attack vector, or threat actor. Affected individuals face elevated risk of identity theft and fraud; the settlement provides compensation to class members. No vendor patch applies; remediation is legal and operational rather than technical.
Do: If you or your organisation may be a class member, check settlement claim deadlines and file claims; Monitor for identity theft and fraud; consider credit freezes or monitoring for affected individuals; Review vendor risk posture for business-process outsourcers handling healthcare data; Ensure breach-notification and downstream-contract obligations with Conduent-like vendors are current

### [medium] Covered California: agent data exposed via phishing attack on spreadsheets (no CVE)
https://helix.ml/threat-watch/i/covered-california-agent-data-exposed-via-phishing-attack-on-spreadsheets-no-cve · Breaches · no-fix-needed · since 2026-10-27
An attacker used phishing to gain unauthorized access to spreadsheets containing Covered California agent information on May 13, 2026, according to a sample breach notice letter posted on the California attorney general's website on October 16, 2026. Affected agents were notified that their information, along with that of other agents, was disclosed as a result of the incident. The breach notice was reported by DataBreaches.net on October 27, 2026. No details on the number of affected agents, the specific data elements exposed, or whether the attacker has been identified have been disclosed. As a phishing-driven credential compromise, remediation centers on credential resets, access review, and phishing-resistant MFA rather than a software patch.
Do: Review and reset compromised agent account credentials and enforce phishing-resistant MFA; Determine scope of exposed agent data and complete regulatory notification obligations; Provide credit/identity monitoring where appropriate to affected agents; Train staff on phishing indicators and verify data-sharing requests out-of-band

### [high] Bajaj Hospital ransomware attack: all 9 servers encrypted, sensitive patient data stolen
https://helix.ml/threat-watch/i/bajaj-hospital-ransomware-attack-all-9-servers-encrypted-sensitive-patient-data-stolen · Breaches · no-fix-needed · since 2026-10-27
Hackers attacked the digital systems of Kamalnayan Bajaj Hospital around 3 am, breaching all nine of the hospital's servers and encrypting their entire data in what appears to be a ransomware extortion attempt. Sensitive data was reportedly stolen in addition to the encryption, putting patient information and hospital operations at risk. The attack sent shockwaves through the city and disrupted the hospital's digital services. No ransomware group has been named in reporting, and no CVE applies; this is a breach/ransomware incident rather than a software vulnerability. Remediation depends on the hospital's incident response, restoration from backups, and law enforcement involvement; no vendor patch is applicable.
Do: Isolate affected servers and preserve forensic evidence before any rebuilding; Determine the ransomware strain and check for a free decryptor (e.g. No More Ransom); Restore systems from clean, offline backups after verifying no persistence remains; Assess scope of stolen patient data and prepare breach notifications per applicable law; Harden remote access, enforce MFA, patch exposed services, and segment hospital networks; Report the incident to law enforcement/CERT-In and engage IR specialists

### [medium] Ohio Auditor web server cyberattack — state server taken down amid possible foreign state actor involvement
https://helix.ml/threat-watch/i/ohio-auditor-web-server-cyberattack-state-server-taken-down-amid-possible-foreign-state-actor-involvement · Breaches · no-fix-needed · since 2026-10-27
Ohio Auditor Keith Faber announced that his office's web server was attacked by what he described as overseas cybercriminals and potentially foreign state actors, prompting the state to temporarily take the server offline. Faber stated there is no reason to believe Ohioans' personal financial information is at risk as a result of the attack. The attackers' identity and exact method remain unclear, and no data exposure has been confirmed. The server was taken down as a containment measure while the incident is investigated. Organizations running public-facing government web servers should review logs for similar probing, ensure systems are patched, and monitor for follow-on activity.
Do: Review web server logs for indicators of the attack and related scanning; Verify all internet-facing services are fully patched and hardened; Monitor for follow-on intrusion or data-exfiltration activity; Confirm no sensitive data was exposed before restoring service

### [medium] Cyberattack on Italy's Chamber of Deputies email accounts, including account assigned to PM Meloni
https://helix.ml/threat-watch/i/cyberattack-on-italy-s-chamber-of-deputies-email-accounts-including-account-assigned-to-pm-meloni · Breaches · no-fix-needed · since 2026-10-27
Italy's Chamber of Deputies confirmed a cyberattack targeting parliamentary email accounts, including one assigned to Prime Minister Giorgia Meloni (not her government account), former Justice undersecretary Andrea Delmastro, and lawmaker Paolo Formentini. Security measures were activated with the National Cybersecurity Agency (ACN). The Chamber said the incident had no emergency implications and noted intensified attacks on other Italian, European and international institutions, following an October 8 pro-Russian-linked DDoS attack on the Foreign Ministry. No technical details on access level or data exfiltration have been disclosed; the incident is viewed in the context of hybrid warfare risks, where compromised political correspondence could enable intelligence gathering, further intrusions, or influence campaigns. Investigation is ongoing.
Do: Review and reset credentials for affected and at-risk parliamentary accounts; enforce MFA; Audit email access logs to determine whether accounts were accessed and data exfiltrated; Harden email security (phishing-resistant authentication, monitoring for lateral movement and impersonation); Prepare transparent public communications distinguishing attempted vs confirmed compromise; Increase monitoring amid elevated cyber pressure on Italian and European institutions

### [medium] FEC electronic filing system outage after hacking attempts ahead of November 3 elections
https://helix.ml/threat-watch/i/fec-electronic-filing-system-outage-after-hacking-attempts-ahead-of-november-3-elections · Breaches · no-fix-needed · since 2026-10-27
Reuters reports, citing an internal email, that the US Federal Election Commission's website was targeted by a hacker or hackers, disrupting the agency's electronic filing system roughly a week before the November 3 elections. The FEC confirmed its electronic filing system was offline. The attackers' identity, methods, and whether any data was accessed have not been disclosed. The outage affects filers — campaigns and committees that submit reports electronically — during a peak pre-election filing period. No CVE or patch applies; this is an intrusion/attack incident under investigation.
Do: Monitor FEC status channels for restoration of the e-filing system and alternative filing instructions; Prepare contingency plans for paper or delayed filings if the outage persists through the pre-election deadline; Harden public-facing web infrastructure and review logs for related intrusion attempts; Watch for phishing or disinformation exploiting the outage

### [critical] TeamUpdraft (UpdraftPlus/UpdraftCentral): website breach exposed connection keys used to install backdoor plugins on WordPress sites (no CVE)
https://helix.ml/threat-watch/i/teamupdraft-updraftplus-updraftcentral-website-breach-exposed-connection-keys-used-to-install-backdoor-plugins-on-wordpr · Breaches · patched · since 2026-10-17
Unknown attackers breached teamupdraft.com over the weekend of Oct 17-18, 2026, accessing the customer database including hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Patchstack observed the attacker using valid UpdraftCentral dashboard keys to send signed plugin.upload_plugin commands that installed backdoor plugins on connected WordPress sites, creating rogue admin/editor accounts (e.g. 'data-ops43') persisting even after plugin removal. TeamUpdraft disconnected all pre-Oct 18 connections, reset keys and credentials, released UpdraftPlus 1.26.13/2.26.13, reported to the ICO, and advises users to rotate passwords, 2FA, and storage keys. The UpdraftPlus plugin itself and self-hosted UpdraftCentral are not affected.
Fixed: UpdraftPlus 1.26.13 (free) / 2.26.13 (Premium)
Do: Log in to each site's WordPress dashboard directly (not via UpdraftCentral), update UpdraftPlus to 1.26.12+/2.26.12+, and delete the UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools; Check Users and Plugins (including Must-Use) for unknown admin accounts or rogue plugins (e.g. Site Health Cache, Query Shelf, Wp Forge; accounts like system_team850, web.tech988) and remove them; change all admin passwords; Check for the backdoor user 'data-ops43' / 'Site Tools' and IOCs (IPs 43.250.53.42, 2a09:bac5:4e21:); if found, restore from a pre-Oct 17 backup; Change teamupdraft.com password and reset 2FA; change reused passwords elsewhere; re-authorise remote storage and rotate storage access keys; UpdraftVault users: reconnect sites with new credentials; UpdraftClone users: copy new client keys from My Account > UpdraftClone > Key Management; beware phishing emails posing as TeamUpdraft

### [high] Bullhorn: Cyberattack forced recruitment platform offline with possible data theft (no CVE)
https://helix.ml/threat-watch/i/bullhorn-cyberattack-forced-recruitment-platform-offline-with-possible-data-theft-no-cve · Breaches · no-fix-needed · since 2026-10-16
Bullhorn, a US-based staffing/recruitment software provider serving over 10,000 customers, suffered a cyber incident first flagged on 2026-10-16 via job-posting failures to Indeed, escalating to a full outage on 2026-10-17. The company disabled access to contain the activity and engaged CrowdStrike to investigate and restore services. Systems returned online in the UK, US, and Australia from Monday, but SSO issues, password resets, and degraded performance persisted across products including Talent Platform, Onboarding365, and Time & Expense. Recruitment agencies lost access to candidate records, applications, placements, and payroll systems. A forensic investigation has not yet determined whether customer data was exfiltrated; attackers and ransomware involvement remain unidentified. Bullhorn has forced password resets for non-SSO users and instructed API customers to rotate credentials.
Do: Rotate API integration credentials immediately if you use Bullhorn APIs; Complete forced password resets and verify MFA is enabled on all accounts; Beware phishing posing as Bullhorn staff requesting passwords, MFA codes, or tokens; verify via official channels; Monitor Bullhorn's status page and incident communications for data-breach notifications; Review access logs and watch for anomalous activity in downstream systems fed by Bullhorn data; Prepare contingency workflows for candidate records and payroll in case of renewed disruption

### [medium] Welsh ransomware breach: Ogi Networks & Data Cymru — weak passwords led to theft of 3,300 children's records (no CVE)
https://helix.ml/threat-watch/i/welsh-ransomware-breach-ogi-networks-data-cymru-weak-passwords-led-to-theft-of-3-300-children-s-records-no-cve · Breaches · no-fix-needed · since 2026-10-20
The UK Information Commissioner's Office reprimanded two Welsh organisations, Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru), after a ransomware attack resulted in the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. According to reporting by Alex Hickey, the incident stemmed from poor credential hygiene — accounts secured with passwords such as 'Password1' and 'Test 2' — which allowed hackers to gain access and deploy ransomware, exfiltrating children's personal data. The ICO issued reprimands rather than fines. No specific CVEs are involved; the root causes are weak passwords and inadequate access controls. Remediation centres on strong credential policies, MFA, and improved security governance at the affected organisations.
Do: Review and enforce strong password policies and ban weak/default credentials; Deploy multi-factor authentication across all accounts; Review ransomware defences: backups, segmentation, and exfiltration monitoring; Audit third-party and partner data-sharing arrangements for access controls; Ensure incident response and ICO breach-notification procedures are tested

### [medium] Parkview Health patient portal outage after suspected cyber incident
https://helix.ml/threat-watch/i/parkview-health-patient-portal-outage-after-suspected-cyber-incident · Breaches · no-fix-needed · since 2026-10-20
Parkview Health, an Indiana-based health system serving Indiana and Ohio, disabled its network on Monday, 2026-10-20, in response to suspicious activity consistent with a suspected cyber incident. The shutdown left patients without access to the MyChart patient portal and online doctor search, with urgent medical needs redirected to phone calls or walk-in clinics. Sources do not confirm data exfiltration, ransomware, or a specific attacker, and no CVE applies. Affected patients should use phone or in-person channels for urgent care. Organizations should treat this as an operational disruption event; monitoring for follow-up breach notifications is warranted until Parkview confirms the scope and whether patient data was accessed.
Do: If you are a Parkview patient, use phone or walk-in clinics for urgent needs and monitor official channels for updates; Watch for follow-up breach notifications before assuming data was or was not exposed; Healthcare peers should review network segmentation and incident-response plans for rapid network isolation

### [medium] Frontier Communications: $625,000 Connecticut settlement over April 2024 RansomHub ransomware data breach
https://helix.ml/threat-watch/i/frontier-communications-625-000-connecticut-settlement-over-april-2024-ransomhub-ransomware-data-breach · Breaches · no-fix-needed · since 2026-10-20
Connecticut Attorney General William Tong announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach. The breach was carried out by the RansomHub ransomware group and compromised sensitive personal information of Frontier customers. The settlement follows Tong's broader pattern of litigating data breaches affecting Connecticut residents. No new exploitation is reported; this is a legal/regulatory resolution of a previously disclosed 2024 incident. No vendor patch applies; remediation is contractual and regulatory in nature.
Do: Review state breach-notification obligations and settlement terms for compliance lessons; Harden against RansomHub-style ransomware: patch edge devices, enforce MFA, segment networks; Maintain tested offline backups and incident-response plans; Monitor for stolen customer data reuse; support affected customers with credit monitoring where applicable

### [high] OpenCode distillation attack breach — OpenCode Console users with linked AI providers had credentials exposed; attacker can run inference on victim accounts (no CVE)
https://helix.ml/threat-watch/i/opencode-distillation-attack-breach-opencode-console-users-with-linked-ai-providers-had-credentials-exposed-attacker-can · Breaches · no-fix-needed · since 2026-10-18
On 2026-10-18 OpenCode disclosed a security breach tied to a large-scale 'distillation attack' affecting 1.4% of OpenCode Console users who had external AI providers (Anthropic, OpenAI, Google) linked to their accounts. OpenCode says it emailed every impacted user the morning of October 18; users who received no email were not impacted. The incident is ongoing and the vendor has not published a root cause or said what data was accessed. Linked provider credentials are stored locally at ~/.local/share/opencode/auth.json (or the Windows equivalent); if exposed, attackers can run inference against the victim's provider account, causing unexpected spend and potential access to data the keys can reach. No affected CLI versions were identified — impact is scoped to Console accounts with linked providers, not CLI installs. Remediation centers on rotating linked API keys and reviewing provider usage dashboards.
Do: Check whether your organisation received OpenCode breach notification emails; per the vendor, no email means not impacted; Find machines running OpenCode (check which opencode, ~/.opencode/bin, ~/.config/opencode, ~/.local/share/opencode/auth.json, or scan with StepSecurity Dev Machine Guard); Inspect auth.json to identify linked Anthropic, OpenAI, or Google providers; Rotate any Anthropic, OpenAI, or Google API keys linked to OpenCode or OpenCode Console; Review provider usage dashboards for unauthorised inference requests and unexpected spend; Maintain an inventory of AI coding agents and linked credentials across developer machines

### [medium] BCHP / XTIUM 2024 healthcare data breach — $2.7M NY/CT settlement
https://helix.ml/threat-watch/i/bchp-xtium-2024-healthcare-data-breach-2-7m-ny-ct-settlement · Breaches · no-fix-needed · since 2026-10-17
New York AG Letitia James and Connecticut AG William Tong secured $2.7 million from Boston Children's Health Physicians (BCHP) and its IT vendor XTIUM over a 2024 data breach. Notably, both the healthcare provider and its IT services company were held liable, underscoring that organizations remain accountable for their vendors' security failures. The settlement includes a corrective action plan requiring improved data security practices. Affected individuals are BCHP patients whose data was exposed in the breach; the sources do not specify the number of affected individuals or the exact data types. No new exploitation is reported; the incident is now resolved via settlement and mandated remediation.
Do: Review vendor and business-associate agreements to ensure security obligations and breach liability are explicit; Assess third-party IT providers' security posture and incident response capabilities; Review state AG enforcement trends on vendor liability in breach settlements; Ensure breach notification and patient communication procedures meet NY/CT requirements; Implement or verify a corrective action plan covering data security controls

### [medium] State Bank of India: 3,897 customer records with personal data found on dark web in ~375,000-record leak
https://helix.ml/threat-watch/i/state-bank-of-india-3-897-customer-records-with-personal-data-found-on-dark-web-in-375-000-record-leak · Breaches · no-fix-needed · since 2026-10-16
State Bank of India confirmed in an October 21 stock-exchange filing that 3,897 customer records containing personal data were identified within a set of about 375,000 records offered on the dark web by a threat actor named Siriusim on BreachForums. Exposed fields reportedly include names, mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, and loan/lead metadata; account numbers, balances, passwords, OTPs, card details, PAN and Aadhaar are not listed. The alert came October 16 via CERT-In and the Defense Cyber Agency; an independent CERT-In-panel firm is investigating. The bank has not confirmed data authenticity, the source, whether SBI systems were breached, or customer notification. Main risk is impersonation/social-engineering against affected customers.
Do: Treat exposed fields (name, DOB, phone, address, CIF ID) as usable for convincing phishing and vishing; brief fraud and support teams on SBI-themed impersonation attempts; If you are an SBI customer or partner, be suspicious of unsolicited calls/messages citing your personal details or loan applications; verify via official channels and report to 1930 or report.phishing@sbi.co.in; Monitor for further disclosures on scope, authenticity, and affected customers; review third-party/loan-processing data handlers as a possible source; Harden KYC and loan-application data handling and vendor access controls at financial organisations handling similar data

### [high] Lightning AI: unauthorized access to credentials forced the Studio platform offline
https://helix.ml/threat-watch/i/lightning-ai-platform-credential-access-incident · Breaches · partial · since 2026-10-15
On 15 October 2026 at 23:00 UTC Lightning AI detected unauthorized access to credentials on the Lightning Platform, and at 01:00 UTC on 16 October revoked all user access to contain it. The incident affects the Studio-side services — Studio, Deployments, Pipelines and Drive — and not the GPU cluster rental infrastructure or managed Kubernetes and SLURM offerings. The company says customer credentials were abused to reach customer environments and third-party services connected to them; every credential it identified as used in the attack has been revoked, and keys tied to customer cloud accounts used on the platform were invalidated. The platform stayed inaccessible to all users while an external incident-response firm assisted, and potentially affected customers were notified with account-specific detail. The root cause, the number of affected accounts and what data was taken were not disclosed as of publication.
Do: If you used Lightning Studio, rotate every secret, API key and token stored in your Studios — GitHub credentials, cloud provider keys, model-provider keys, database passwords — from a machine outside the platform; Rotate credentials for any third-party service your Lightning virtual machines could reach, then review that service's access logs for the incident window starting 15 October, 23:00 UTC; Check your cloud providers for keys issued to or used from Lightning, disable them if the platform has not already, and audit billing and API activity for unusual calls; Treat anything the compromised environments could read or exfiltrate as exposed, including source code, datasets and internal network access; Watch for follow-on phishing and lateral attempts that use information taken from the platform

### [medium] n8n creators portal: templates still in review were readable without logging in
https://helix.ml/threat-watch/i/n8n-creators-template-library-unpublished-templates-readable-without-login · Breaches · patched · since 2026-10-16
On 16 October 2026 a creator reported that one of their unpublished n8n workflow templates had appeared on a third-party website. n8n found that parts of creators.n8n.io served templates still in review to anyone, without a login, and believes a third party used that to copy templates and list them elsewhere. n8n says the gap is closed and that it is reviewing the rest of the site for similar issues. Exposed for each template in review: its name and description, the submitter's creators.n8n.io username and the full workflow including node settings and any text the creator added; paid templates were exposed only as the settings-and-notes-stripped preview. n8n states that email addresses, passwords and account details were not exposed and that no one could edit or delete templates, and that exposed copies had already passed its automatic credential and personal-data removal, which it warns is imperfect. Creators are told to treat every template they submitted for review as public and that n8n does not retain original submissions, so a creator cannot check what was in the exposed copy. We are listing this as a supply-chain-adjacent exposure: a workflow template carries the embedded credentials, API keys and webhook URLs of whoever built it.
Do: Treat every template you submitted to creators.n8n.io for review as public: revoke or rotate any API key or credential that appears in a template you submitted, including ones removed by n8n's automatic scrub, since it is not guaranteed complete; Replace webhook URLs that could trigger your workflows, and consider disabling or rotating credentials tied to triggers you do not recognise traffic from; Ask third-party template aggregators to remove n8n templates copied from creators.n8n.io, and search for your workflow names outside n8n; If a template carried another person's personal data, contact n8n (help@n8n.io) so they can help with next steps; Audit n8n instance logs for executions triggered by unexpected webhooks or credentials that should no longer exist; Anyone running n8n at work should check whether creators submitted templates on the company's behalf and rotate those credentials

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.