Breaches and Incidents

What happened, why it matters, and what to do about it: incident analysis without the press-release rewrite.

An ultra-realistic photograph of an enterprise cloud data center corridor showing rows of rackmounted server chassis with patch cables and status indicators.

Breaches and Incidents6 Nov 2026

Destructive wiper attack on Russian host Beget destroys cloud VPS and disk backups

A destructive wiper cyberattack on Russian web host Beget erased virtual private servers, cloud storage, and all binary disk-image backups. More than 1,000 physical servers face manual inspection.

An ultra-realistic photograph of a high-security cryptocurrency validator operations vault with illuminated hardware security modules and consensus telemetry displays.

Breaches and Incidents6 Nov 2026

MetaMask discloses staking infrastructure intrusion diverting execution-layer rewards

MetaMask and Consensys disclosed an infrastructure breach that diverted 0.385 ETH in validator execution-layer rewards. Staked 32 ETH principal and withdrawal credentials remained safe from compromise.

An ultra-realistic photograph of an automated grocery logistics fulfillment warehouse at night with automated guided vehicles, conveyor rollers, and an elevated glass control mezzanine showing network flow charts.

Breaches and Incidents6 Nov 2026

Ahold Delhaize estimates cyberattack will erase up to €250 million in fourth quarter sales

Ahold Delhaize discloses that an October 2026 cyberattack will reduce Q4 net sales by €200M to €250M and cut operating income by €75M to €100M. Supply chain freezes and e-commerce shutdowns triggered full-year earnings guidance downgrades.

An ultra-realistic photograph inside a financial intelligence data vault showing an open brass key-archive box with removed tags beside an enterprise hardware security module and darkened compliance monitoring consoles with amber status lines.

Breaches and Incidents6 Nov 2026

Chainalysis confirms universal credential exposure and shuts down compliance services following agentic intrusion

Chainalysis confirms universal credential and token exposure across all users following an on-path attack. Core compliance tools forced offline for up to 92.5 hours (derived) as phased restoration requires mandatory IP allowlisting.

An editorial architectural photograph of a secure certificate authority identity verification archival vault with an examination desk and steel document trays.

Breaches and Incidents5 Nov 2026

DigiCert server migration leaked customer identity documents for 513 days

DigiCert reveals an internal server migration exposed customer records for 513 days. Technical breakdown of the open self-registration authorization flaw, compromised passport and driver license files, 109-day triage delay, and unaffected CA root keys.

The rear loading bay of an operations building at night, under orange sodium light on wet asphalt. A grey cash transport van stands with its back doors wide open and its lit steel hold empty, an empty steel trolley beside it. Behind, a service door stands open with warm light spilling out, a grey toolbox and a folded high visibility vest left beside it, and a wall camera points the other way. The headline reads: attackers used the bank's own account, via a supplier, 118 million euros.

Breaches and Incidents4 Nov 2026

Crédit Mutuel Arkéa says attackers used its own account via a supplier, and accepts the €118m scale

What the French banking group's two notices of 4 November state and leave out: the supplier route, the own account, possible conversion to crypto, an unconfirmed 118 million euros set against its own results, and a ranked checklist.

A packing hall at night under cold teal tube lights. A stainless steel inspection table in the foreground holds one plain grey box, opened to show a small brass lever taped inside a fold of the pale lining. Behind it a conveyor carries rows of identical sealed grey boxes towards a lit loading dock where white delivery vans wait with their rear doors open. A plain clock and a row of blank lamps, one amber, hang on the wall. The headline and a 2,950 servers stat are drawn over the left.

Breaches and Incidents4 Nov 2026

OpsShield says a fake cPGuard update ran as root on about 2,950 servers; its two notices differ in places

The 72 minutes between the disclosure's two times against its own 'about 70 minutes' and an advisory log that runs to 12:46: eight places the vendor's two notices differ, four counts that do not merge, and a ranked checklist.

A quiet sales office at night. A desktop rotary card file with a fan of blank cream cards and one card lifted out of its slot stands on a walnut desk beside a black headset on a chrome stand. Behind it are a wall board of blank coloured sticky notes in four columns, a glass door with a badge reader showing an amber light, and a blue violet city through a tall window. A mug steams in the foreground. The headline and a 4 data types stat are drawn over the left side.

Breaches and Incidents3 Nov 2026

WorkOS says an AI-assisted attack reached an internal sales app holding CRM contacts and call summaries

What WorkOS's bulletin states and does not state: four data categories, the accessed versus provided access wording, what no evidence means, who names ARTEX, the derived dates, and a ranked checklist for customers.

A data centre cage at night seen through a mesh door. A grey steel key cabinet stands open at the right with four rows of brass hooks, every hook holding a brass key except one empty hook, and a single key lying on the perforated floor tiles below it. Three racks of black servers with cyan and amber lights stand behind, with a coil of orange and blue cables on a trolley in the foreground. The headline and a 5 days stat are drawn over the left side.

Breaches and Incidents3 Nov 2026

Chainstack says an attacker reached password hashes and credential systems; 5 days passed before detection

What Chainstack's incident page states and does not state: the four dates and derived day counts, what was accessed versus treated as exposed, what a hash protects, the rotation documentation, the one page that names Chainstack in a campaign, and a ranked checklist.

A university records archive at night in teal and amber light. One deep file drawer is pulled out of a long wall of olive green and oak filing cabinets, packed with blank manila folders, with a sealed dark envelope lying on top. Beside it on a wooden desk a green banker's lamp glows and a monitor shows two blank password boxes with rows of dots. The left side carries the headline and a stat drawn over it: 31 days.

Breaches and Incidents2 Nov 2026

Michigan State says no evidence other data was stolen; a gang lists it and claims 1.3 million students

What Michigan State's status page, student newspaper and spokesperson say, what a leak site claim and a tracker's copy say, the derived 31 day gap, what the sources do not establish, and a ranked checklist. Live incident, time stamped.

A dim bank back office at dusk with teal windows. A tall slate steel filing cabinet on casters stands at the centre, several drawers fastened with brass padlocks and a small amber beacon lamp glowing on top. To the right a wooden loan desk holds trays of blank manila folders and a monitor glowing amber with empty table rows, two other monitors dark. The headline and a stat are drawn over the calm left side: 68 hours 46 minutes.

Breaches and Incidents2 Nov 2026

Abrigo kept Sageworks offline about 69 hours; its status page says only "irregular activity"

Nine status entries, 68 hours 46 minutes from disable to restore (derived), and no statement of cause, data or credentials. What Abrigo's own pages say, what they do not, and a ranked checklist for lender customers.

A steel workbench in a dim operations room lit amber and violet. A tall cabinet of small plain steel drawers with blank label holders stands at the right, one drawer pulled open and empty. A loose arc of several dozen brass keys is spilled across the bench in front of it. A laptop shows an abstract flow chart of empty boxes. The left half is calm indigo, with the headline and a stat drawn over it: no count.

Breaches and Incidents2 Nov 2026

Trigger.dev says an attacker accessed environment variables of some organisations; no count or times given

What Trigger.dev's own blog notice and status entry of 1 November 2026 establish, what they leave out, how they compare with the vendor's 6 October report, and a ranked checklist for customers.

A supermarket frozen food aisle at night, no people. A tall freezer cabinet stands with its glass door open and dripping, its back panel glowing hot orange, its shelves holding blank teal, yellow and coral boxes and pouches slumped in melt water, with a puddle on the floor. Beside it a grey wall mounted controller box shows amber bars on its display. The aisle to the left is icy blue. The words say stores report freezers hit, same method as France, one installer says so, 21 days.

Breaches and Incidents2 Nov 2026

Reports say supermarket freezers were hit again; 'same method as France' is attributed to one installer

Store counts by country and source, what is said about the defrost mechanism and by whom, what CERT-FR and Copeland say about the October units, what is not stated, and a ranked checklist for refrigeration and security teams.

A massive round steel vault door stands ajar in a dim blue stone hall with warm amber light inside. Plain blank coins spill out across the floor towards a branching set of brass pipes, several of whose ends are sealed with red wax. On the left, drawn text reads FBI says North Korea stole more than $6 billion from Binance, with the figure 628 for the addresses the FBI lists to block, and a source line naming the FBI alert of 31 October 2026.

Breaches and Incidents1 Nov 2026

FBI says North Korea stole more than $6 billion from Binance and lists 628 addresses to block

The first government attribution of the Binance theft: what the FBI alert of 31 October states, what it leaves out, whose $6.43 billion figure is whose, what the 628 addresses cover, and a ranked checklist for virtual asset businesses.

A dim vault strong room in teal and amber light. A brushed steel board on the wall carries five rows of brass hooks, most of them empty, with two heavy rings of brass keys still hanging. Below it a sealed glass case holds a row of keys, and one single brass key lies alone on the steel shelf outside the case. The left side is dark teal with the headline and a stat drawn over it: 2 hours 15 minutes.

Breaches and Incidents31 Oct 2026

Northflank says assume all environment variables were decrypted; AI key misuse reported, no route or count

What Northflank's status page establishes about its security incident, the dates it gives and the one it does not, what Wiz's Black October report adds and omits, four labels that are not controls, and a ranked checklist for customers.

A tall dark oak wall cabinet stands open with rows of identical blank brass key tags hanging from small hooks. A handful of tags have been lifted off, leaving empty hooks, and lie together in a leather tray below. Beside it a heavy riveted steel case with two closed latches stays shut. Cool slate blue light with warm amber bokeh. On the left, drawn text reads Names, emails, role labels accessed. Route not stated, with a source line naming the Chainalysis notice.

Breaches and Incidents31 Oct 2026

Chainalysis says an actor using "offensive agentic techniques" accessed customer names, emails and role labels

What Chainalysis's 30 October 2026 notice states, what it does not (route, dates, count, which customers), what the phrase offensive agentic techniques can and cannot tell a reader, and a ranked checklist for customers, with questions to put to the vendor.

A quiet fashion boutique in teal and amber light with no people: a brass rail of plain linen shirts and dresses, each with a blank paper price tag, behind an oak counter where a dark card reader sits with a blank white card half inserted. On the left the headline reads: Revolve says card numbers may have been obtained; Texas lists 127,200. 127,200 Texans on the Texas listing, total not stated.

Breaches and Incidents30 Oct 2026

Revolve says an actor may have obtained saved card numbers and expiry dates; Texas lists 127,200 people

What Revolve's 8 K and the Texas listing state about saved card data, the four fields named, the six questions left open, the counts by state and the gap to an unknown total, with a ranked checklist.

A quiet records office in cold blue light: a tall grey steel filing cabinet with three drawers, each with an empty blank label card, a small brass lock on top, a stack of blank cream forms on a wooden table and a wall calendar page of empty day squares, with a warm lamp at the right edge. On the left the headline reads: FEC filing system offline, intrusion attempt per email. 6 DAYS from restoration to election day, derived.

Breaches and Incidents30 Oct 2026

FEC filing system offline 42 to 46 hours; email seen by Reuters cites breach attempt, FEC page gives no cause

What the FEC status page, its notices and Reuters state about the electronic filing outage of 26 to 28 October 2026, what none of them states, the 24 hour and 48 hour windows it landed on, and a ranked checklist for filers.

An evening courtroom judge's bench in warm lamp light: a wooden gavel on its block, a smartphone lying face down and a small stack of blank paper on a dark walnut bench top, with a green shaded brass lamp and a teal dusk window behind. The headline on the left reads: DOJ: 42 months for the fake White House explosion tweet. 42 MONTHS.

Breaches and Incidents30 Oct 2026

DOJ says 42 months for fake White House explosion tweet; its $136 billion is a Dow claim, Reuters said S&P 500

What the Department of Justice release of 29 October 2026 states about the 42 month sentence, the hoax post and the $136 billion figure, what it does not (plea, counts, method), the 2013 reports, and a ranked checklist.

A bookmaker's counter in a dim hall. A wide brass coin tray heaped with gold coloured tokens sits under a slate odds board whose slots are all blank coloured pills. A brass tap on the tray's underside lets a thin stream of tokens fall into a zinc bucket, beside three blank perforated ticket stubs. The left side carries the headline and the stat 1 HOUR.

Breaches and Incidents30 Oct 2026

Polymarket paused trading an hour; Hudson Rock links a DebugBear script to wallet draining, losses unverified

What the Polymarket status page, Hudson Rock and the news reports establish about the DebugBear script, whose number is whose, what the script did and did not do, and a ranked checklist for sites with wallet or payment pages.

A bank vault door standing open at night with amber light spilling from inside, a grey laptop on a steel trolley in front of it, and a thin line of blank gold coins spilling across the floor towards the left. The left side carries the headline and the figure $6.36B.

Breaches and Incidents30 Oct 2026

Binance says a DevOps laptop may be behind its $6.3 billion theft; TRM and Chainalysis blame North Korea

What Binance, TRM and Chainalysis say about the roughly $6.3 billion theft of 29 October 2026: the conditional laptop claim, the 20 minute sweep, what frozen means, and which part of the North Korea attribution is evidence and which is confidence.

A bright health coaching desk. A large monitor shows a chat window made only of blank rounded shapes, with a blank input bar. In front of it sit a stack of cream record folders with coloured blank tabs, loose sheets, a rolled blood pressure cuff and a wellness band. A warm lamp lights the desk. The left side is calm dark teal, with the headline and the figure 726 people drawn over it.

Breaches and Incidents30 Oct 2026

RIZAP health guidance data in a personal AI chat: 726 people at one client, 19,996 in the data, notices say

What RIZAP's notice of 3 September 2026 and four client notices print: the fields, three counts that do not add up, the dates, the provider's relayed reply, the PPC reporting page, and a ranked checklist against shadow AI.

A school records room in warm lamplight. A pale sage green steel filing cabinet has one drawer pulled open, packed with manila folders whose tabs are blank, with a stack of blank forms and a paperclip on top and an open brass padlock hanging from the drawer below. Boxes line a shelf behind. The left half is a soft teal wall carrying the headline and a stat drawn over it: 4.9 million.

Breaches and Incidents29 Oct 2026

Florida Department of Education says aid website breach may affect 4.9 million; route and window not stated

What the department's data breach page and release say, what they leave out, five dates kept apart, Florida's 30 day notice law, and ranked checklists for people who applied for aid and for any school or agency with a student portal.

A tax office service counter in teal and amber light. A corrugated steel shutter is pulled down over the service window behind a brass padlock. On the counter are a stack of blank forms, a brass desk bell and a desk calendar with one square circled in red. The left half is calm dark teal, with the headline drawn over it: Tax portal offline, Deadline moved, 16 NOV.

Breaches and Incidents29 Oct 2026

Belgium's FPS Finance says MyMinfin attack leaked no data; deadline for some returns now 16 November

What Belgium's FPS Finance states about the MyMinfin cyberattack, read in French and Dutch, how its wording moved in 25 hours, what is not stated, the three deadline dates, and a ranked checklist.

A clinic mail desk at dusk in teal and amber light. A large plain white wearable heart monitor patch with coral adhesive wings rests on its open clear tray, in front of a tall stack of blank white envelopes bound with a band and a fan of loose envelopes, with grey filing drawers and a lamp behind. The left side carries the headline and a stat: 116 days.

Breaches and Incidents29 Oct 2026

iRhythm, maker of Zio monitors, tells HHS 8,179,772 people were hit; letters came 116 days after detection

What iRhythm's notice, its sample letter, the HHS OCR portal and the Washington Attorney General establish about the June data theft, what they leave out, the 116 day gap and a checklist for hosted applications.

A late night office desk lit warm amber against teal and indigo. A large open laptop shows an email layout made only of empty rounded shapes, with a blank amber outlined button. A smartphone with a blank notification lies beside it, a plain cup stands at the edge, and the soft edge of a server panel with cables sits in the foreground, a blurred datacentre aisle behind. The left half carries the headline and a stat: 18 Sept, intrusion date given, customer count not stated.

Breaches and Incidents28 Oct 2026

123 Reg says an "AI-driven" attack read customer data and cites a China nexus; the evidence given is servers and tools

What 123 Reg's customer notice, as reported, establishes about an attack it calls AI driven and Chinese linked, and what it leaves out: the dates kept apart, the evidence for each claim, CrowdStrike's different assessment, the ICO tests and a ranked checklist.

A quiet home hallway at dusk. On an oak wall shelf sit a small white home internet router with four blank glowing pills, a wall socket with a coiled aqua fibre lead, a plain unaddressed envelope and a phone lying face down. A warm lamp glows in the room behind. On the left the headline and a stat are drawn over it: 2,585,481 records.

Breaches and Incidents28 Oct 2026

Sony's So-net says 2,585,481 records leaked, 16 with bank account details, and gives no count of people

What Sony's notice and questions page say about the So-net breach, the dates kept apart, how 2,585,481 is built, what leaked and what Sony says did not, where the news report differs, and a ranked checklist.

A night time home trading desk with three monitors in a row. The left and right monitors show empty grey panels made of blank rounded shapes, the middle monitor is dark with one amber power light. Behind them a black server rack with rows of teal and amber lights has one dark unit. Rain streaks a window with soft neon bokeh. Drawn over the left side: BREACHES, Hosted FX trading servers shut down after a breach, 26,739 servers that may be affected.

Breaches and Incidents28 Oct 2026

GMO says up to 26,739 FX trading servers may be affected and ransomware is threatened, not confirmed

What GMO's fourteen notices, two brokers' own pages and the service page establish about the Onamae.com Desktop Cloud attack: the dates, the 26,739 figure, the 8 billion yen demand, the reward against the payments, and what is not stated.

A dark desk with an open silver laptop whose terminal window shows rows of blank rounded bars with a short cyan bar at the start of each row, and beside it a grey rack mounted equipment unit with its front panel slid half open and one black cable hanging loose. The left half is empty dark navy, with the headline and a stat drawn over it: about 1% of users.

Breaches and Incidents27 Oct 2026

Warp says a vendor was exploited; BleepingComputer reports agent traces and telemetry may be exposed, about 1% of users

What Warp's chief executive is reported to have said about a vendor exploit, why four labels for the exposed data are not defined, what Warp's own documents say it collects, and a ranked checklist for teams using an AI terminal.

A dark hospital emergency entrance at dusk. A plain white ambulance stands with its rear doors open under a covered bay, beside shut glass doors and a blank overhead sign with one empty rounded outline. In the foreground an old beige desktop computer with a dark screen sits on a steel counter, its power cable unplugged and coiled beside a clipboard of blank sheets. The left side is empty dark blue with the headline and a stat drawn over it: 2 hours.

Breaches and Incidents27 Oct 2026

UNM Health says ambulances were diverted for two hours; ransomware, data theft and a recovery date are not stated

What UNM's own notices say about the 26 October cyberattack on its Health Sciences Center, what they leave out, a group's claim, three wordings of the diversion, and a ranked checklist for hospital downtime. Live incident, time stamped.

A dark desk at night. An open laptop shows a database table drawn as rows of blank pills with one pill glowing cyan. In front of it lie a loose fan of blank white member cards and a large brass key with a blank paper tag. The left half is dark, with the headline and a stat drawn over it: 417 days.

Breaches and Incidents27 Oct 2026

Denver Health Medical Plan says a vendor's public key could have opened records of 238,083 members for 417 days

What Denver Health Medical Plan's notice and the HHS breach portal entry establish about a vendor key published for 417 days, the fields listed, what the plan does not say about logs or a finder, and two ranked checklists.

A dark stockroom workbench. A black foam tray holds rows of identical small handheld devices with blank dark screens, with gaps in the front row. A grey steel scrap bin beside it holds devices, some snapped open to show green circuit boards. A brass key on a blank white tag lies on the bench. The left half is empty dark space carrying the headline and the figure 18,835.

Breaches and Incidents27 Oct 2026

Keystone says a website breach exposed its device authentication key, and it will destroy 18,835 unsold wallets

What Keystone's statement, as reported, establishes about the stolen verification key, the 18,835 unsold wallets, the owners of devices delivered after 20 October, the customer data that should have been deleted, and what its own pages still say.

A dark desk in cool blue and warm side light. An open unmarked graphite laptop shows a table made only of empty rounded pills with one row highlighted in red. In front lies a plain white identity card with a blank portrait square and two empty pills, and a small grey door card reader with a red indicator stands beside it. The left half is empty dark navy with the headline and 525,000 drawn over it.

Breaches and Incidents27 Oct 2026

University of Copenhagen says hackers reached a test system with 525,000 people's data, CPR numbers included

What the university's three dated entries state and leave out, the arithmetic behind 525,000 and 68 to 92 hours, what Datatilsynet says the 72 hour clock is, a stated and not stated table, and a ranked checklist for affected people and for organisations with identity data in test systems.

A dark desk lit by a cool screen. An open unmarked laptop shows a message window made only of empty rounded shapes, one outlined in red, with a blue button shape. In front of it sit a clear sealed evidence pouch holding a plain grey storage drive and a cream envelope with a red band. The left half is empty dark blue carrying the headline and a stat: Seoul police, AI used to hack 90 firms, 15 of 90 in the referral.

Breaches and Incidents27 Oct 2026

Seoul police allege a former pentester used AI on 90 firms; the referral covers 15 firms and 11% of 8.2 million records

The Seoul police release read on 27 October 2026: 90 companies, 8.2 million records and 38 extortion demands alleged, 15 firms and about 900,000 records referred, and no product named for the AI tool. What it does not say, and a ranked checklist for buyers of penetration tests.

A dark workstation bench in cool blue light. An open, unmarked black laptop shows a navy control panel window with six blank folder tiles and a list of five blank pills, the top two filled amber. A plain steel padlock and a brass key lie on the slate beside it, with a blurred server rack behind. The left of the picture is empty dark navy carrying the headline and a stat: 55 HOURS.

Breaches and Incidents26 Oct 2026

DreamHost says it reset email and FTP/SFTP passwords as a precaution; nine status updates in 55 hours name no cause

What DreamHost's own status page states and leaves out about its forced email and FTP/SFTP password resets, the clock from 23 to 25 October, the lockout that falls on account owners, and a ranked checklist for customers and agencies.

A dark editorial scene for the briefing, with its headline and key figure drawn over it.

Breaches and Incidents25 Oct 2026

More than 1.5 million Canadian Crime Stoppers tips were in a March vendor hack, CBC finds, and four Ontario programs stop taking tips

CBC's count of Canadian tips in the March 2026 hack of the P3 tip platform, what Toronto Crime Stoppers says it was told and when, and which programs have paused.

Breaches and Incidents25 Oct 2026

Railway says up to 100,000 workspaces may have exposed secrets, but the figure is a ceiling

Railway’s preliminary account describes CI credentials, artifacts and a subset of decrypted environment variables. The 100,000-workspace figure is an upper bound, while the entry route, exact keys and source-code question remain unresolved.

Sterile data corridors and server racks with glowing blue and crimson biometric data telemetry streams inside a medical facility.

Breaches and Incidents23 Oct 2026

Quest Diagnostics isolates Quanum clinical platform following unauthorized patient record access

Technical analysis of Quest Diagnostics SEC Form 8-K: unauthorized intrusion into Quanum LSM clinical portal exposes patient records across healthcare network.

Breaches and Incidents23 Oct 2026

Capcom ID breach leaks 11.7 million customer records with 196 passwords altered by attackers

Technical breakdown of the Capcom ID data breach: 11,774,247 customer records exposed, 196 unauthorized password changes, and sign-in IP telemetry weaponization.

Editorial illustration of an unbranded WordPress-style plugin dashboard on a laptop, with a blank checklist and security key on the desk. Headline says UpdraftCentral keys reached customer sites; affected-site count unknown.

Breaches and Incidents21 Oct 2026

UpdraftCentral: revoked keys do not remove backdoors already planted on sites

A validly signed remote command crossed the trust boundary into connected WordPress sites. Key revocation and removal of earlier site changes are separate tasks.

A dim data hall at night: a row of tall black server rack cabinets with perforated mesh doors, receding to the right. One cabinet in the middle is dark, its indicator lights off, between cabinets lit with rows of small cyan and green lights. A small amber lamp glows on the end wall. The left half is darkened, with the headline and the stat 38 PRODUCTS drawn over it.

Breaches and Incidents20 Oct 2026

Google says a power event hit one London zone: 38 products listed, UK banks and courts report faults

What Google's status entries say, minute by minute, what its documentation and SLAs promise when one zone fails, who said what in the UK, and what the PRA, FCA, ICO and Treasury regimes require. A developing incident, time stamped.

Editorial illustration for the briefing: Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

Breaches and Incidents20 Oct 2026

Bullhorn says service is restored 62 to 63 hours after its cyber incident notice; exfiltration 'not yet determined'

What Bullhorn's status page, FAQ and known limitations page state and do not state about its cyber incident, the credential changes, and what UK controllers and processors must do under the ICO and NCSC texts. Time stamped 20 October 2026.

A dark data-centre rack in cool blue light. A plain brushed-metal panel on the rack carries two blank, empty recessed plates and a small steel hook, from which a ring of six or seven plain metal keys in brass and steel hangs. The left half of the frame is empty dark blue, with the headline and a stat drawn over it: 1.4% of Console users, count not stated, as of 19 October.

Breaches and Incidents19 Oct 2026

As of 19 Oct, OpenCode says provider keys of 1.4% of Console users may be exposed; no count is stated

What OpenCode's X post, docs and status page state about the Console breach as of 19 October, what they leave out, the afternoon's timestamps with derived intervals, what the providers' pages say to do, the UK position, and a ranked checklist.

A dim hospital ward office at dusk. A single desktop monitor on a pale grey desk glows blue-white, its screen showing only blank rounded shapes where a patient record would be, with a plain keyboard and mouse in front, an empty office chair behind and a window with a deep blue sky to the left. No people appear. The left half is dark, with the headline drawn over it: 15 dismissed over access to victims' records, and the words still in testing.

Breaches and Incidents18 Oct 2026

NUH has dismissed 15 staff over Nottingham victims' records; its monitoring system is still in testing

What the Trust's 16 October statement establishes (34 hearing outcomes, 15 dismissals) and omits, how its own evidence says the access was found, what the ICO, NMC, GMC and NHS England pages say, and a ranked checklist for holders of health records.

A dark IT desk lit by a flat monitor. The screen shows a long client list made only of blank rounded bars, one row highlighted in pale cyan. Beside it an open cardboard archive box of plain unmarked folders and a coiled stethoscope rest on the desk. The left half is empty dark blue, with the headline and a stat drawn over it: 4 days.

Breaches and Incidents18 Oct 2026

XTIUM warned BCHP 4 days before BCHP saw activity; NY says XTIUM cannot definitively confirm its entry route

What New York's agreement with BCHP and XTIUM states and leaves out: 4 days from warning to detection, 18 client systems reached and one breached, $2.7 million announced against $4 million on paper, 825,000 or 820,000 New Yorkers, and what UK suppliers should check.

A dark school classroom desk lit by a flat monitor. The screen shows a generic file list made only of blank rounded bars, one selected in pale cyan. A stack of unmarked cream test booklets and a soft out-of-focus answer sheet with a pencil lie in front. The left half is empty dark blue, with the headline and a stat drawn over it: 126 days.

Breaches and Incidents17 Oct 2026

ETS says a login copied California student files from 22 May; found 126 days later, no student count stated

What the ETS notice filed with the California Attorney General states and leaves out: 119 days between its two dates, 126 to discovery, who says 7 million, what CDE's own pages could not be read for, other regulators' lists, and what UK suppliers should check. Defender level.

A dark steel corridor in low blue light. A long wall of identical closed steel mailbox doors, each with a plain lock and a blank recessed label well, recedes along the right. A single brass key on a plain steel ring lies on the ledge in front. The left half is empty dark blue, with the headline and a stat drawn over it: 3 counts, Huntress's 162, over 300 and almost 1,000 tenants.

Breaches and Incidents17 Oct 2026

ConnectWise Cloud Backup's app credential, not a person's: Huntress gives 162, over 300 and almost 1,000 tenants

What Huntress, Todyl and ConnectWise state about a stolen Cloud Backup application credential: 162, over 300 or almost 1,000 tenants, a 141-minute window, 35 h 34 min to the first advisory, and no confirmed data access. Where UK guidance and the Bill stop. Defender level.

A dark clerk's counter in low blue light. A tidy stack of plain cream envelopes, all blank, lies on a walnut counter beside an empty black wire tray. Behind them a flat computer monitor stands switched off, its screen dead black, and a blank brass plate sits on the counter edge. The left half is empty dark blue, with the headline and a date drawn over it: US bankruptcy notices halted since 9 October.

Breaches and Incidents17 Oct 2026

US bankruptcy notices halted since 9 October: BAE says 'isolated'; cause, data and end date are not stated

What the Judiciary, nine courts, the bankruptcy rules, BAE's newsrooms and the UK texts establish about the BNC outage, what they leave out, the arithmetic against 14, 21 and 28 day windows, what UK buyers of outsourced systems can rely on, and three ranked checklists.

A dark pathology laboratory bench in cool light. A pale grey rack of identical sealed sample tubes with blank white labels stands in front of a compact grey and white benchtop analyser whose black glass panel is switched off. The left half is empty dark blue, with the headline and a stat drawn over it: 865 days.

Breaches and Incidents17 Oct 2026

Alleged Qilin member held over a 2024 logistics attack; Synnovis 'included' on one BBC report, no charge reported

What German, Japanese and UK authorities have stated about the Qilin arrest and the Synnovis attack, what no record states, whose numbers the 4,000 and 140 million are, how the death link was established, which UK laws could apply and where each stops, and a checklist for suppliers and CISOs.

Editorial illustration of halted envelopes on a notice conveyor in front of a generic courthouse, representing the Bankruptcy Noticing Center outage

Breaches and Incidents16 Oct 2026

BAE Systems cyber incident stops US bankruptcy notices; courts diverge on deadlines

A source-led timeline, the operational split between filing and service, district-by-district orders, and the facts still missing about the BAE Systems incident.

A dark records archive. One long bank of pale grey steel shelving runs away on the right, filled with identical grey ring binders whose spines carry empty label slots, with a blank grey microfilm viewer in the foreground. At the far end of the aisle one desktop terminal glows with an empty pale screen. The left half is empty dark blue, with the headline and a stat drawn over it: legal aid breach data now goes back to 1978, 2010 to 1978.

Breaches and Incidents15 Oct 2026

Legal Aid Agency's stated data start moved from 2010 to 1978: about 250,000 pre-2007 records, no count of people

What the Legal Aid Agency's 14 October 2026 update states about records back to 1978, what it leaves out, the arithmetic behind the moving start date, why old records were online, what UK law and policy say, and a ranked checklist. Defender level only.

A dark glass-walled meeting room at night. A wall-mounted television is swung out on a black arm so that its plain back panel and an empty recessed socket bay are visible, and a handheld detector wand lies on the table at the lower right. The left half is empty dark blue with the headline drawn over it: An alleged recorder in an OpenAI meeting room, and the figure 9 days.

Breaches and Incidents14 Oct 2026

Alleged OpenAI room recorder: 9 days from discovery to arrest, and no motive, recipient or captured audio stated

What the complaint, the Justice Department and OpenAI each say about the alleged recorder in an OpenAI meeting room, where the press accounts differ, what the record does not establish, what UK guidance covers, and an ordered checklist for AI and R&D labs.

A dark meeting room in blue black light. A long bare dark table runs towards the upper right with one empty office chair at each end, a closed grey laptop in the middle and a plain cream envelope in front, with no writing anywhere and no people. The left half is empty dark blue, with the headline and a stat drawn over it: five docket lines, none describing an act.

Breaches and Incidents14 Oct 2026

Ransomware-response executive reportedly arrested in ShinyHunters case: five docket lines, none describing an act

What the court record, the FBI Director's post and the RCMP statement establish about a reported arrest, the 23 days since the Dutch arrest, what is not stated, what the NCSC, ICO, OFSI and Home Office pages say about choosing a response supplier, and an ordered checklist.

A shut service counter in a dim housing office. A silver roller shutter is pulled fully down behind a pale grey counter. On the counter lie a stack of buff cardboard case files with blank label panels and a cream rotary desk telephone. The left half is empty dark blue, with the headline and a stat drawn over it: 8,783.

Breaches and Incidents14 Oct 2026

Housing Ombudsman case-system incident: 8,783 determinations in 2025-26, and no count, supplier or date stated

What the Ombudsman's statement and its own published figures establish about a third-party incident in its case management system, what they leave out, the 72 hour clock, UK GDPR, NCSC and sponsor guidance, and ordered checklists for residents, landlords and small public bodies.

A dark desk lit by cool light. An open silver laptop on the right shows an abstract folder tree of blank rounded bars beside a panel of plain horizontal bars. In front of it lie a stack of plain white identity cards with a blank photo square and blank bars, and a loose ring of brass keys with a black fob. The left is empty dark blue, with the headline and a figure drawn over it: about 1,500.

Breaches and Incidents14 Oct 2026

Meta says 1% of the data taken from GitHub was personal, notifies about 1,500 people, and names no data types

What SecurityWeek's report of Meta's statements establishes, why the 1% cannot be turned into a count of people, the 14 to 42 day gap, what GitHub's controls document, the UK GDPR, NCSC and Cyber Essentials reading, and an ordered checklist. Defender level only.

A fashion boutique at night: a pale stone till counter holding a blank, switched-off card reader on a stand, a plain tissue parcel and an unprinted paper bag, with a long rail of plain dresses and jackets behind. The left of the picture is empty dark navy. Nothing in the picture carries any lettering.

Breaches and Incidents13 Oct 2026

TFG London's 163-word notice names three brands and no cause; its payment-data belief is not in it

What one company has stated about its Sunday incident, by whom and when, set against what customers must infer. Also H&M's denial of a ShinyHunters claim, the UK GDPR 72 hour limit counted from Sunday (derived), and two ordered checklists.

A dark supermarket distribution-centre loading bay at night. Four empty steel roll cages stand idle in a row in front of a closed grey dock door, with a hand pallet truck parked beside them. A rugged handheld scanner rests on the near cage with its screen dark and blank and one small amber lamp lit. The left half is empty dark blue, with the headline and a stat drawn over it: 6 sentences.

Breaches and Incidents12 Oct 2026

Ahold Delhaize says stores are open; Albert Heijn's chief says work has stopped at some distribution centres

What the group, Albert Heijn and Delhaize each state, the sentences reused from 2024, the day's disclosures to scale, the 2024 notices, what the NPSA, NCSC and ICO say, and ordered questions and actions for UK retailers and suppliers to European grocers. Defender level only.

A dark supermarket aisle at night. A long freezer cabinet with fogged glass doors and almost bare wire shelves stands on the right, with a small grey refrigeration controller on a steel post whose display window is dark and blank, and a pool of water on the floor. The left is empty dark blue, with the headline and a stat drawn over it: 436 days.

Breaches and Incidents12 Oct 2026

French fridge attack: CERT-FR adds Copeland and Dixell to the Danfoss controllers; no source names the flaw used

What CERT-FR, Danfoss, the retailers, the Prime Minister's office and the Paris prosecutor have each said, the counts that do not reconcile, the dates of Danfoss's fixes against the attack, what UK rules and the FSA say, and a ranked checklist. Defender level only.

A dark desk at night with a monitor showing a table of blank rounded rows, one row outlined in amber, and in front of it an open laptop whose address bar, a blank rounded pill, carries a small amber padlock outline. A coiled black network cable lies on the walnut desk. There is no lettering anywhere and nobody is in the room.

Breaches and Incidents7 Oct 2026

Three ccTLD hijacks, no certificate count: one passed check can back a certificate until 30 September 2027

Three ccTLDs, no certificate count, no dates, no CA names. Under the Baseline Requirements a validation completed this autumn can back a certificate valid to 30 September 2027, and CAA and Certificate Transparency are the owner's tools.

A smartphone lying on a dark desk showing a shopping app of blank product tiles, with one wide notification banner of empty rounded shapes dropped across the top, outlined in thin amber. Nothing carries any lettering.

Breaches and Incidents6 Oct 2026

ASOS confirms the 10am notification was unauthorised, cites third-party platforms and does not name Snowflake

The channel is confirmed and the Snowflake claim is not addressed. What the RNS says and leaves out, what UK GDPR and UK MAR say, and what to do about every platform that can message your customers.

A school office desk in low light with an open laptop showing a list of blank sign-in rows, a stack of plain buff folders, and a pegboard of coloured pegs and blank cards on the wall behind. There is no lettering and nobody in the room.

Breaches and Incidents6 Oct 2026

Bromcom found a legacy sign-on breach on 6 September; its first dated public post came 18 days later

A superseded sign-on service stayed in production because an internal system still called it. Bromcom found the breach on 6 September, posted on 24 September, and by 30 September called the central question ongoing.

A matte black laptop on a dark desk, its screen showing a social feed made only of blank rounded cards and empty pills, with a thin hollow amber padlock outline beside the feed, to suggest a lock that is drawn but not engaged.

Breaches and Incidents5 Oct 2026

Microsoft's X account: two unauthorised posts, 47 minutes apart by our arithmetic, and no word on the cause

Microsoft's 13-million-follower X account carried a disclaimer that told readers to trust only official channels, and Microsoft says it did not write it. The minutes, what is not stated, five routes in, and a UK checklist.

A quiet newsroom desk at night: an open laptop showing a contact list made only of blank rounded pills, and a plain closed notebook with one amber ribbon beside it. No people, no writing on the screen or the notebook.

Breaches and Incidents5 Oct 2026

About 9,000 spoofed Nikkei emails reached news sources among others; who was exposed is not yet counted

What Nikkei's notices say in Japanese and English, what they leave out, how Japanese and UK law treat the security of data held for journalism, and an ordered checklist for any organisation that holds the names of sources or whistleblowers.

Breaches and Incidents5 Oct 2026

Frontline's breach letters were first reported 48 days after it found the flaw, and name no software

A supplier to US school districts found a flaw on 14 August and was first reported notifying districts on 1 October, 48 days later. Staff Social Security numbers were taken; the product, the counts and the actor are not stated.

A dark government records room: an open laptop on a wooden desk shows a table of blank rounded rows beside a black server rack with a few indicator lights, and a shelf of identical blank grey ring binders sits behind. The headline reads Denmark's population register: 8.8 million of 11 million entries reached through one company, with the figure about 80 per cent.

Breaches and Incidents5 Oct 2026

Denmark says one company's lawful access reached 8.8 million of the 11 million entries in its CPR register

About 80 per cent of the register, more than the population, reached through one company's lawful access. What the ministry and Datatilsynet state, what CPR's own terms say about controls, and the checks a UK team can run.

A dark bank back-office after hours: a laptop open on an incident board of blank rounded tiles, a row of them hollow amber outlines, in front of a closed server rack, with an empty banking hall visible through a glass wall.

Breaches and Incidents5 Oct 2026

Korea's bank breaches: AI use is unconfirmed on the record, and the faults described are old ones

Shinhan, KB Kookmin and Hana name about 25,000, 99 and 89 customers. The AI-tool claim rests on a vendor researcher's page-title reading and an anonymous official; on the record it is 'cannot be ruled out'. What is stated, what is not, and a UK checklist.

A dim university office at dusk: a laptop on a wooden desk shows a directory list made only of blank rounded rows, beside a blank staff badge on a lanyard, with a brick campus building lit in the window behind. The headline reads DTU deletes former users' addresses after six months, but not their CPR numbers, with the figure 160,000.

Breaches and Incidents3 Oct 2026

DTU deletes former users' addresses after six months, not their CPR numbers, and holds about 160,000 of them

Four in five of DTU's up to 200,000 are former users, and the six-month deletion covers addresses, pictures and next of kin, not the CPR number. What the notice states, what it leaves out, and the checks a UK team can run.

Breaches and Incidents1 Oct 2026

KillSec takedown: five servers and 110 TB seized, but no release says how victims will be told

Three provisional arrests, five servers, five domains and 110 TB, in a case led from Hamburg with one arrest in the UK. The counts do not match, and no release describes how victims will be told or what happens to files already published.

Breaches and Incidents1 Oct 2026

Kiteworks published 125 advisories. None says which one, if any, is the shutdown flaw

The 10.0 flaw has a CVE, a score and a fixed version. The flaw Kiteworks said it found during the shutdown has none that any record attaches to it, and no advisory in the batch says whether it is there.

Editorial illustration for the briefing: By our count, MetaMask Staking queued 7,066 Lido validators to exit hours before its notice, naming no cause

Breaches and Incidents1 Oct 2026

By our count, MetaMask Staking queued 7,066 Lido validators to exit hours before its notice, naming no cause

The beacon chain shows 226,112 ETH of Lido stake queued to exit 6 to 12 hours before MetaMask's first notice. The notice and Lido's post name no cause, no count and no key status, and no funds lost are reported.

Breaches and Incidents1 Oct 2026

DIVD was breached through two Zammad flaws. One has no fix on record, and the AI claim is no stronger

Ten days on, DIVD's breach has a root cause: two Zammad flaws, one with no fix on record. The evidence for an AI agent is still tempo and comments in scripts, and the Zammad finding does not add to it.

Breaches and Incidents1 Oct 2026

The Pentagon's breach letter is dated 64 days after the flaw was found, and says accessed, not stolen

The Pentagon's personnel data centre dated its breach letter 64 days after discovering the flaw, after at least 258 days of access. What the notice states, what it leaves out, and the checks a UK team can run.

Editorial illustration for the briefing: SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Breaches and Incidents30 Sept 2026

SlowMist logs Bitget attacker activity from 31 August, Mandiant dates access to 24 September, neither names a product

Two forensic documents published on 30 September add a longer chain, two products, a web shell and a custom withdrawal tool. SlowMist's logs start on 31 August, Mandiant dates the appliance access to 24 September, and neither names a product, vendor or CVE.

Breaches and Incidents30 Sept 2026

Microsoft's Titan skipped the token signature check: 17.3 trillion rows counted, two sampled

Faav's write-up counts 17,333,335,124,315 rows from metadata and describes two one-row samples. The endpoint was locked down 4 days after the report, the bounty was $5,000, and Microsoft edited the only account.

Breaches and Incidents30 Sept 2026

France's tax authority learned of the theft 49 days after it began, from the thief's own claim

The French tax administration took 49 days to learn of a theft made with stolen staff passwords, and only from the attacker's own post. What the ANSSI report establishes, what it leaves out, and the checks a UK team can run.

Breaches and Incidents29 Sept 2026

DIVD says an AI agent hacked it. Its evidence is tempo and code comments, and the flaw is still unnamed

The record as of 29 September: an intruder that decided each step at machine speed, explained itself in code comments and fought its own tools. The flaw, the attacker, the model and the data outcome are all unstated.

Editorial illustration for the briefing: Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

Breaches and Incidents29 Sept 2026

Elsevier's domain record sat unchanged for 342 days, yet three of its addresses went to a LAPSUS$-branded page

A redirect changes where a name points, and the public record shows the registration layer stayed still. What is missing is the layer that moved, the real length of the window, and anything beyond Elsevier's own "no indication".

Editorial illustration for the briefing: Bitget says it found the root cause on 25 September. It described it three days later and names no product

Breaches and Incidents29 Sept 2026

Bitget says it found the root cause on 25 September. It described it three days later and names no product

Bitget's account moved from a compromised backend system to a flaw in an unnamed third-party security product. The two are layers of one chain, not rivals, but the wording around them keeps shifting and the report that would test it is late.

Editorial illustration for the briefing: ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

Breaches and Incidents29 Sept 2026

ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

The record moved in a day: a 40 word police post became a full statement with two suspicions, a custody ruling and a statement that the man was not arrested over Odido. The FBI claim is still a claim, and nothing official links the two.

Editorial illustration for the briefing: Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Breaches and Incidents29 Sept 2026

Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

Keio's first notice named no company. The group's own pages describe failures in payments, loyalty points, bookings, commuter-pass sales and inbound mail, while trains are reported unaffected and nobody has given a restoration date.

Breaches and Incidents29 Sept 2026

Kiteworks says it fixed a critical flaw. It has published no CVE, score or version

A 55-word notice and a press release close the Kiteworks shutdown. Neither carries a CVE, a score or a fixed version, and the vendor's own advisory register has nothing newer than 27 May 2026.

Editorial illustration for the briefing: Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Breaches and Incidents29 Sept 2026

Times Car confirms 6.6 million breached accounts, at most 1.65 times the 4 million members it announced in August

Times Car's parent says about 6.6 million accounts were breached, against a membership of more than 4 million announced in August. The notices name the data and the dates, and leave cause, attacker and headcount open.

Breaches and Incidents29 Sept 2026

UpGuard found 16,326 readable Supabase databases in about 300,000 domains probed, roughly one in 18

UpGuard probed about 300,000 Supabase-using domains and found 16,326 with readable tables, about 5.4 per cent. Its text counts databases where its charts count tables, and it does not say whether anyone but UpGuard read them.

Editorial illustration for the briefing: Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Breaches and Incidents26 Sept 2026

Revolut stopped sending customer data to this provider up to 33 months ago. The records were still there

Migrating away from a processor removes the future risk and leaves the historic risk exactly where it was. Storage limitation is a legal duty, and it is also the only thing that would have helped here.

Breaches and Incidents26 Sept 2026

Every container had its own microVM. The isolation that failed was one option on the disk pool

Firecracker per container is the strongest isolation on the market and it was not the boundary that mattered. A flag set for performance let a 4 KiB write expose the other 60 KiB of somebody else's block.

Breaches and Incidents26 Sept 2026

Kiteworks told customers to shut down for six hours. Its own press release says nine, twice

The public release says nine hours and federal intelligence authorities. The customer email, as quoted, says six hours and law enforcement. Both cannot be the number a defender acts on.

Breaches and Incidents25 Sept 2026

OnePlus confirmed the root chain, warned of legal liability, and shipped nothing in 159 days

The researcher agreed to hold publication until 17 September. He asked for an update twice and got no reply. He published on the 24th, with no CVE and no patch in existence.

Breaches and Incidents25 Sept 2026

Google's tracker says P1. Its panel says working as intended. The flaw makes a namespace user an org owner

A Google engineer wrote Nice catch and filed it. Eleven days later a panel called it working as intended. The case is still open at P1 and S1, and the researcher's page says it is still unpatched.

Editorial illustration for the briefing: Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Breaches and Incidents25 Sept 2026

Cloudflare skipped block zeroing for speed, and researchers read 5,614 directory blocks that were not theirs

Cloudflare has fixed a cross tenant exposure in Containers and Sandboxes. The flag took six hours to change. Clearing the blocks already mapped took fifteen days.

Breaches and Incidents23 Sept 2026

Gyazo's breach leaked the OCR text inside 490 million screenshots, and the IDs that open them

The Gyazo breach is being read as an account leak. Gyazo indexes the text inside every capture, so the 490 million metadata records are a transcript of what was on people's screens, and the leaked image IDs are the only lock those images had.

Breaches and Incidents22 Sept 2026

EvilTokens takedown: 226 domains in the court order, two arrests, and a phish MFA cannot stop

The court order lists 226 domains. Microsoft's own sworn declaration says device code theft cannot be stopped by multifactor authentication. What breaks the chain is a Conditional Access setting many tenants have never switched on.

Editorial illustration for the briefing: A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

Breaches and Incidents22 Sept 2026

A stolen Ribon app key pulled BigCommerce shopper data in one evening, then stayed live almost four days

The Ribon breach on BigCommerce: what each party has said, why app tokens cannot be revoked by merchants, the hours lost at each step, and why the app is not BigCommerce's sub-processor under UK GDPR.

Editorial illustration for the briefing: AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

Breaches and Incidents21 Sept 2026

AWS quarantines a leaked access key in 10 seconds, but the key keeps working for anything not on the deny list

AWS's AWSCompromisedKeyQuarantineV3 went on 10 seconds after a test leak. It is a deny list, not a lockdown: what it blocks, what it leaves open, and what you still have to do.

Editorial illustration for the briefing: September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

Breaches and Incidents21 Sept 2026

September Windows updates quietly stop File History backups; Entra's 1 February SMS cut-off has no opt-out

File History can stop backing up after September's Windows updates, mostly without a true error. Entra ID retires Microsoft-provided SMS and voice on 1 February 2027. What Microsoft requires, what it only recommends, and what to do.

A wall of screenshot thumbnails and metadata fragments interrupted by a broken digital lock.

Breaches and Incidents20 Sept 2026

Gyazo exposed about 492.4 million image records. Its notice cannot rule out private-image viewing

Gyazo confirmed exceptional metadata exposure and a list of private image files. The disclosed fields can reconstruct the context around screenshots and drive secondary compromise.

Breaches and Incidents18 Sept 2026

Brevo's attacker hostname sat in a public certificate log for 19 days before the ClickFix injection

A stolen Cloudflare key let an attacker rewrite Brevo's embedded scripts at the CDN edge, so origin files and their timestamps never changed. The earliest public evidence was a certificate logged 19 days before the injection.

A closed laptop with a steel padlock resting on it, beside keys, a circuit board, a network device and a monitor on a desk at night.

Breaches and Incidents17 Sept 2026

KB5124008 revives a dormant Credential Guard setting and breaks domain trust below Server 2025

KB5124008 makes Windows honour Machine Identity Isolation settings dormant since April 2025, breaking domain trust below Server 2025 level. What Microsoft says, what it does not, and the safe order of work.

AI-generated identity-security scene of one access badge opening several tenant mail compartments beside a mail conveyor.

Breaches and Incidents13 Sept 2026

Brevo’s SAML flaw crossed 138 customer accounts. Six sent phishing through legitimate infrastructure.

A Brevo SAML scoping failure let one organisation’s identity assertion cross into other customer accounts.

AI-generated conceptual airport illustration: waiting aircraft beneath a network of teal and amber routes; not a photograph of the incident.

Breaches and Incidents9 Sept 2026

NATS fixed the flight-processing system. The airport disruption kept moving.

The system was restored on 8 September. The aviation network still had a backlog to clear. A sourced timeline and worked recovery example explain the gap.

An antique brass wax seal stamp on its side beside a set pool of deep red sealing wax, both blank, on a dark surface lit by a cold indigo rim light.

Breaches and Incidents1 Sept 2026

Hundreds of fraudulent Pix transactions, and nothing was forged. The only sum Google names is tens of thousands.

Google reports Breeze Comet running two waves of fraudulent transactions through Brazilian payment systems. The count is a victim’s, the only money figure is in a different section, and no rail validates intent.

An airport car park barrier arm raised at night beside a weathered number plate recognition camera on its post, wet tarmac below, captioned two 72-hour clocks, only one of them started, and 8.7 million customers

Breaches and Incidents31 Aug 2026

Manchester Airports breach reaches 8.7 million customers. Two 72-hour clocks applied, and only one of them ever started

Gigabytes are not people. The verified finding is one authenticated record carrying far more than MAG disclosed, and a NIS duty that never engaged.

A white electrical plug hanging loose in front of a dark wall socket, captioned: six critical flaws, NVD scored none of them. 0 of 8 identifiers independently analysed.

Breaches and Incidents30 Aug 2026

Six critical WordPress flaws in ten days. NVD independently scored none of them, and the claim that plugins cause most compromises has no current source

The 91% figure describes the vulnerability catalogue, not the cause of breaches. The only quantified entry-vector number anyone can cite is a 2016 survey of about 222 sites.

A brass mechanical counter drum caught mid-rotation in deep shadow, captioned: the fix went public, the chains heard last. 20 hours 5 minutes from that release to the first drain.

Breaches and Incidents30 Aug 2026

Cosmos Labs published the security fix 28 hours before it warned the chains. Six networks were drained of about $5.7 million

Cosmos Labs' own policy calls for private distribution before public disclosure on a network-wide risk. The advisory also never reached the global GitHub database, so no dependency scanner ever raised it.

A long blank unprinted paper roll coiling away into darkness, captioned: 284 million records, not 284 million people. 14.9% of revenue, in the units named.

Breaches and Incidents30 Aug 2026

ShinyHunters claims 284 million McKesson records. It is a row count, and the units McKesson named are 14.9% of the business

Every technical detail of this intrusion is single-sourced to the attackers. The one number McKesson has published points the other way.

An empty meeting room at night with chairs pulled back and a cyan-lit screen casting light across a dark table

Breaches and Incidents5 Aug 2026