Monthly roundup
35 incidents across 17 countries. 28 confirmed by the organization or authorities; the rest are under investigation or claimed by attackers.
November 2026 brought 35 breaches and cyber attacks that we could verify, in United States, Germany, Global, Japan, Not stated in the notice and more. If you use any of these services, expect phishing that mentions the incident, and follow our data breach checklist.
DigiCert told customers that a February 2025 server migration exposed an internal archive system to the internet, and that an account created through a self-registration feature read archived data between 27 June and 2 July 2026. It confirmed the access on 19 October. DigiCert says certificate issuance and validation were not affected.
Queens Public Library in New York City confirmed on 4 November 2026 that a ransomware attack had disrupted its systems. Public computers, Wi-Fi, checkout machines, digital media and the mobile app were affected at its 66 branches. No group has claimed it, and the library has not said whether data was stolen.
RevSpring, a technology company that runs online bill-pay for healthcare providers, says it found on 17 August 2026 that an unauthorized person may have reached a support tool for its bill-pay platform. The person used it between 15 May and 1 June 2026 to obtain patient information. Notices began 4 November 2026.
mSeven Software notified mSecure customers on 3 November 2026 that an unauthorized actor obtained an encrypted copy of a database of current and former users. The company says it has no evidence the contents were accessed and that only users syncing with mSecure Cloud are affected, but has not said how the breach happened.
The BYOD ransomware gang listed Michigan State University on its leak site on 2 November 2026, claiming data on 1.3 million current and former students. MSU says it has not determined that personal information was compromised, and has not confirmed a link to the suspicious activity that led it to force password resets on 1 October.
WorkOS said it found unauthorized access to an internal application used by its sales team on 30 October 2026. It says an AI-assisted offensive security framework automated the attacker's reconnaissance and that there is no evidence production services or WorkOS application data were reached.
Mindfactory told customers on 6 November 2026 that its systems were hacked and that it cannot rule out access to addresses, email addresses, phone numbers and encrypted passwords. The retailer says there is no sign plaintext passwords or payment data were involved. It reset all shop passwords and notified the data protection authority and police.
The Technical University of Munich says unknown attackers breached its old myTUM portal, captured passwords entered there and used a TUMonline administrator login to reach the central campus system. About 60,000 people may be affected. TUM says grades and application data show no sign of access so far.
Mittwald, a German hosting provider, says an attacker gained unauthorized access to its MCP server on 27 October 2026 and read user session tokens, then used them in the mStudio control panel. The company detected the activity on 4 November and says no passwords were stolen. Customers who never used the MCP server are not affected so far.
Vioma, which runs the CST7 reservation system for hotels, says unusual automated requests on 2 November 2026 led to booking data being retrieved without authorization. The company closed the gap the same evening. It says credit card data and passkey logins were not affected and rates the phishing risk for the data as elevated.
Crissy Field, a German security firm, analyzed 159,041 sites built with the AI app builder Lovable and found that 24,664 of the Supabase-based ones returned database records to any visitor without logging in. The researchers blame poorly configured Supabase databases. Whether any data was misused is not known.
Level Infinite said on 4 November 2026 that the NIKKE PC launcher's script files may have been tampered with by a third party. A researcher reports that modified files on the official CDN, in place since 27 September, installed a remote-access agent on some players' PCs.
Todyl, a security vendor, reports that since 1 November 2026 one operator has used still-valid stolen Entra application secrets to sign in as MSP workloads, then searched tenants and bulk-downloaded files. It calls the activity ongoing and has not attributed it. Only vendor reporting was available when this was written.
BTCPay Server said on 1 November 2026 that it had received reports of Bitcoin and Litecoin stolen from hot wallets on servers running version 2.4.1 or earlier. It advises operators to move to a fresh server with a new wallet and seed, because updating alone may not remove an attacker's access.
NTT Docomo said on 5 November 2026 that it detected unauthorized external access to the Docomo Online Shop and My docomo and that some customer information had leaked, up to about 300,000 customers. The cause and route were still under investigation, and both services were in emergency maintenance.
SMBC Consumer Finance said on 5 November 2026 that a third party accessed the system it uses for card loan guarantee work and that data containing personal information was sent out of it. The company puts the number of people at up to 320,118 and says the cause is still under investigation.
istyle, the operator of the beauty site @cosme, said on 2 November 2026 that a third party had accessed @cosme and that about 3 million members' information leaked. The company confirmed the leak on 28 October and said login passwords and credit card details were not involved, as currently confirmed.
Chainstack, a blockchain node provider, disclosed on 3 November 2026 that an attacker entered through a third-party component, reached a development environment on 26 October and some production systems on 29 October. It detected the intrusion on 31 October and says customer nodes, console and API were not modified.
GitBook says an attacker exploited a flaw in its SSO login flow on 2 November 2026 to create sessions as GitBook staff, then reached internal code, a Cloudflare API key and production secrets. GitBook took the app offline, rotated secrets and invalidated API tokens.
Trigger.dev said on 1 November 2026 that an attacker gained unauthorized access to environment variables for a subset of organizations. It says the exploit has been blocked and that affected account owners were emailed, but it has not given a count, a root cause or a time window.
FGC, the fund that pays out guaranteed deposits and investments in Brazil, said unauthorized parties accessed personal data in internal environments used for its guarantee payment process. The suspected incident was identified on 26 October 2026. FGC reports no evidence of misuse and no financial loss.
Mercado Bitcoin, which calls itself Latin America's largest digital asset platform, said it contained a security incident overnight on 2 November 2026 and suspended deposits and withdrawals. Blockchain security firms estimate $40 million or more was drained. The company says customers suffered no loss, which some analysts dispute.
Crédit Mutuel Arkéa confirmed on 4 November 2026 that it suffered a sophisticated external attack. It says attackers entered through a service provider's platform and used the bank's own account to send transfers, while customer accounts and assets were not affected.
The Etablissement francais du sang (EFS) said on 3 November 2026 that a cyber incident at its refrigeration equipment provider disrupted the supervision of cold rooms at three sites, pushing temperature and defrost thresholds to very high levels. EFS says alarms caught it quickly, no health impact was identified and no blood products were lost.
A spreadsheet published in February 2023 in response to a freedom of information request contained hidden sickness absence data for 7,715 Royal Cornwall Hospitals staff. It stayed publicly accessible until November 2025. The trust told its board it caused significant distress and that the ICO has closed its case.
Bitdefender's incident response team says a 3AM ransomware affiliate worked inside a UK school estate from 10 to 19 September 2026, stole credentials and finance files and encrypted about 37 systems. Bitdefender suspects parts of the intrusion were driven by an AI model, but could not confirm the mechanism.
NSW Health reported unauthorised access to a website for its Oral Health Fee For Service Scheme on 29 October 2026, and Cyber Security NSW declared a major incident. Police say about 4GB of provider data was taken and suspects are believed to be overseas. A forum poster claims 100,000 documents, which has not been verified.
In the night to 2 November 2026, refrigeration controls were tampered with at supermarkets in Belgium, Luxembourg and Sweden, and an Edeka store in Reisbach, Bavaria reported the same night. The pattern matches the French attacks of mid-October. Police in Germany have not confirmed the cause, and no data theft is reported.
Norad said on 3 November 2026 that attackers logged in to its Grants Portal by abusing 27 user accounts after the attack was discovered on 30 October. Names and email addresses of 20,614 registered users may have been accessed, and application data from three foreign organizations was confirmed compromised.
OPSSHIELD says an attacker used compromised credentials on 2 November 2026 to push a malicious script through the cPGuard update channel. Versions 5.88.12 to 5.88.19 installed a backdoor and collected sensitive files. The vendor detected it within 12 hours and has issued fixed versions.
Beget, one of Russia's largest hosting and domain providers, said attackers gained access to the systems that manage its infrastructure overnight on 1 to 2 November 2026 and ran scripts that erased data. Cloud data and binary VPS backups were lost, while file-level backups survived.
On 4 November 2026 Turkey's data protection authority KVKK published breach notices from Vava Cars Turkey Otomotiv and KVK Teknik Servis. Each says cyber attackers gained unauthorised access to customer chat files stored at a data processor: 8,268 records for Vava Cars and 624 for KVK Teknik Servis.
The Kyiv Independent said hackers gained access to its website management system and a newsletter service, posted false messages and sent emails to subscribers in Russian and English. The outlet calls it a suspected Russian cyberattack, without technical evidence of attribution.
Late on 1 November 2026, Ukraine's Air Alert app sent fake radiation, chemical and street-fighting alerts, and Ukraine's Air Force said it had likely been compromised. Russia's emergency ministry then said its own app faced a cyberattack that spread false information.
Equipple, an app many Northern Ireland schools use to book parent-teacher meetings, found unauthorised access to part of its cloud-hosted environment. Schools told parents that contact details and some pupil information may have been accessed, and warned them to watch for unexpected contact.