Monthly roundup
45 incidents across 22 countries. 31 confirmed by the organization or authorities; the rest are under investigation or claimed by attackers.
October 2026 brought 45 breaches and cyber attacks that we could verify, in Japan, United States, Turkey, Australia, India and more. If you use any of these services, expect phishing that mentions the incident, and follow our data breach checklist.
Sony Network Communications said an unauthorized third party accessed the So-net member database on 19 October 2026. About 2.58 million member records were exposed, and passwords for 54,401 email accounts were taken. The company has reset those passwords and reported the breach to Japan's privacy regulator.
GMO Internet Group said attackers broke into its Onamae Desktop Cloud service in October 2026 and demanded about 8 billion yen (roughly $50 million). The company refused to pay. Attackers then published data that GMO says it is verifying.
Capcom confirmed that a third party accessed 11,774,247 CAPCOM ID records after it detected suspicious activity on October 19, 2026. The records mostly hold email addresses and login metadata. Capcom says card data was not affected and found no evidence customer passwords were stolen.
SourceNext, the Japanese software seller, said on 15 October 2026 that a third party misused its member information API and may have taken 22,519,960 records. The company says credit card data was not stored in the affected system.
Ride On Express Holdings said on 13 October 2026 that the server company hosting registration data for Ginno Sara, Kamatora and Sushi Jotatsu was hit by ransomware. Up to about 6.5 million records may have leaked, and online ordering is still suspended.
Daiichikosho, operator of Big Echo karaoke and DK Dining, said on 8 October 2026 that malware on one PC at its contractor Nippon Columbia Group may have exposed about 8.72 million records. The company has not confirmed that data actually left the PC.
Lawson announced on 8 October 2026 that unauthorized access to Lawson ID and the Lawson app reservation service exposed 2,155,345 ID records. A further 26 reservation records included names, phone numbers and partial card numbers.
On 29 October 2026, malicious code served through a DebugBear monitoring script on Polymarket sold or moved logged-in traders' positions to an attacker's wallet. Polymarket paused trading, said a third-party provider was compromised, and pledged to reimburse affected traders. Loss figures are analyst estimates, not an official total.
On October 28, 2026, Distributed Denial of Secrets published data on more than 41,000 DHS employees and contractors that a hacktivist group provided. DHS had not responded to press requests in the reports reviewed, and Reuters verified only part of the dataset.
Quest Diagnostics disclosed in an SEC filing on October 22, 2026 that an unauthorized party accessed its Quanum Lab Services Manager system, which clients use to order tests and look up results. The company says certain patient records were accessed, has not said how many people or what data, and says operations were not materially disrupted.
Richmond Public Schools in Virginia shut off internet access across its campuses on October 21, 2026 after ransom messages appeared on staff laptops. The district has not confirmed ransomware or data theft and says it is working with outside experts and law enforcement.
The California Department of Education said on October 16, 2026 that an unauthorized party copied student data from a file transfer site run by its testing contractor, Educational Testing Service (ETS), between May 22 and September 18. The state says Social Security numbers and financial information were not involved and that no evidence of public release has been found.
Frontline Education, which supplies administration software to U.S. school districts, says a vulnerability in a third-party application let attackers reach employee data including Social Security numbers, email addresses and home addresses. The company found the flaw on August 14, 2026 and notices reached districts in early October.
Turkey's data protection authority (KVKK) published a notice on 21 October 2026 saying ransomware had encrypted the database of DNC Sağlık Hizmetleri, a private health provider in Çankaya, Ankara. Staff found a Turkish ransom note on a server screen. The number of people affected is not yet known.
On 21 October 2026 Turkey's data protection authority (KVKK) published a notice saying an outside party reached a server run by a Güllüoğlu service provider. The data of 67,193 people was affected, including names, phone numbers, emails, addresses and stored passwords. The company learned of it on 8 October.
Turkey's data protection authority (KVKK) published a notice on 21 October 2026 saying an attacker reached a server run by a processor for coffee brand Kurukahveci Mehmet Efendi. Up to 15,303 customers and 18 admin panel accounts were affected, and the breach was confirmed on 7 October after the processor notified the company.
Turkey's Personal Data Protection Authority (KVKK) announced on 7 October 2026 that ransomware had hit the virtualization infrastructure of Yıldız Technical University in Istanbul. About 140,000 students and 4,500 staff may be affected. The university says its logs show no data left its network, but the data categories at risk have not been published.
Poole Group, a Sunshine Coast accounting and advisory firm, said it is responding to a cyber incident after the LockBit ransomware gang listed it on its leak site with a countdown to 25 October 2026. The firm says it has contained the incident and told the OAIC, the ACSC and the ATO.
Icon Oncology Group, which runs the Icon Cancer Centre network, said on 12 October 2026 that someone accessed patient information held on a supplier's system. A hacker using the name '2019' says they hold more than 31,000 documents and is selling them, a claim Icon has not confirmed.
OFX Group, the Sydney-listed money transfer company, said in October 2026 that someone gained unauthorised access to data, including some client data and information about job applicants. OFX says its client platform databases were not accessed and it has found no unauthorised access to client accounts or funds.
AU Small Finance Bank said on 30 October 2026 that it is investigating a possible data leak from a Salesforce-hosted platform holding limited vehicle loan data. A group calling itself ScarlettGroup claims it has KYC, PAN and Aadhaar records. The bank says core banking systems are not affected, and the claims are unverified.
A group calling itself ScarlettGroup claimed on 21 October 2026 that it had breached Rajasthan Police and put the data up for sale. A senior cybercrime officer has said the state received information that the group obtained data from several government departments, and personnel were told to change email passwords. The size and authenticity of the data have not been confirmed.
On October 21, 2026, State Bank of India told stock exchanges it was alerted, including by CERT-In, to suspected customer data on the dark web. A preliminary review found 3,897 customer records. SBI says it has not yet verified the data's authenticity or source.
Offerz, a Swiss online shop for gift cards and vouchers, said attackers got into a test environment on the night of 7 October 2026 that held a file of January 2026 order data for about 115,000 customers. The company cannot confirm the data was copied but assumes it was, and says passwords and card data were not in the file.
Ricardo, the Swiss online marketplace owned by SMG Swiss Marketplace Group, said it noticed suspicious activity on 7 October 2026 and that personal data from about 890,000 accounts was accessed. The company says email addresses and passwords were not affected and that no ransom demand has been made.
The Swiss federal government confirmed on 8 October 2026 that data left the systems of an external software supplier to the federal pension fund Publica after a cyberattack in late September. Netzwoche reports the ransomware group Akira is behind it and that more than 100,000 current and former federal staff may be affected.
Security firm Sansec reported on 27 October 2026 that attackers altered an analytics script on Convertr's servers so it copied payment details typed at checkout. According to Sansec, Convertr removed the code and said it is notifying merchants and payment providers. No count of affected shoppers has been published, and BleepingComputer had no direct statement from Convertr.
Ticketmaster Brasil began emailing customers on 14 October 2026 about a security incident involving a third-party data analysis tool. It says passwords and full card numbers were not involved, and that it has reported the case to the ANPD.
On the night of October 11 to 12, 2026, attackers altered refrigeration controls at hundreds of French supermarkets, including Intermarché, Carrefour and E.Leclerc stores. French authorities say the attacker is unknown, and no customer data has been reported exposed.
LDLC emailed customers from 2 October 2026 to say a malicious actor gained access to one of its information systems and that some personal data could have been viewed. The retailer says passwords, bank details and card numbers were not affected, and it has told the CNIL.
Rand Mutual Assurance said on 23 October 2026 it had received a cyber security alert that is under investigation. A threat actor claims to have stolen 366GB, including about 1.68 million claim records, and says it will release them after 5 November unless paid US$95,000. RMA has not confirmed any data was taken.
Ampath said it was hit by a cyberattack on 2 October 2026 and that a web server was accessed. A group called ByteToBreach claims it copied 80 million patient records, but Ampath says that figure counts database entries and that it has no evidence that test results or diagnoses were taken.
Pathao detected a cyberattack on 4 October 2026 and on 7 October confirmed that attackers obtained names, email addresses and phone numbers. It affected operations in Bangladesh and Nepal. Attackers claim 133 GB and 19 million users and demand USD 400,000, which Pathao says it has not verified.
Notebooksbilliger.de emailed customers on 14 October 2026 to say criminals had attacked its IT systems and that customer data was affected. It has not confirmed that data actually left its systems. The company later put the number of affected customers at a mid five-digit figure and says passwords are not affected.
Binance confirmed a security incident on 29 October 2026 and paused deposits and withdrawals. Binance put the theft at about $6.3 billion and said it would cover all losses. Blockchain analysts attribute the attack to North Korea, but Binance has not.
Indodax, Indonesia's largest crypto exchange, suspended rupiah and crypto deposits and withdrawals on 29 October 2026 after detecting a significant increase in cyberattack attempts. CEO William Sutanto said on 30 October that no funds or customer data were lost and extra security layers were added. No reopening date had been given.
Colmobil, which imports Mercedes-Benz, Hyundai, Mitsubishi, ORA and Jaecoo cars in Israel, said on 14 October 2026 that it had detected a security incident. Calcalist later reported, citing unnamed sources, that the ransomware group SETTRA was behind it and had threatened to publish customers' personal details. Colmobil has not confirmed that. It says it has returned to full operation and that no information has been exposed publicly.
Lembaga Tabung Haji (TH) halted its systems and services across all channels on 8 October 2026 after a cyberattack. TH says depositors' savings are safe, has lodged a police report and notified NACSA and the Personal Data Protection Department. Most services were back by 12 October, and TH has not said whether personal data was taken.
Grupo Xcaret said records from 21 October 2026 in its park sales systems were accessed without authorization, exposing contact details of about 8,300 customers. The company says no bank or card data was taken and warns that fraudsters may send fake payment requests for reservations.
Korean Air and Asiana said on 23 October 2026 that customer reservation data leaked from Amadeus, the airline IT provider. On 28 October JAL and JTA said about 92,000 of their customers' bookings were also viewed. Payment card numbers and passwords were not exposed, the airlines say.
Security firm Hunt.io reported on 28 October 2026 that logs on an exposed server show 27 database backups tied to Philippine overseas worker systems, 68.8 GiB in total, were copied on 6 September. The National Privacy Commission is investigating with the Department of Migrant Workers. The contents have not been examined or confirmed.
Starting 1 October 2026, Shinhan, KB Kookmin, Hana, BNK Busan and several smaller Korean financial firms reported intrusions. Yonhap reports that 16 firms leaked about 100,000 records, and police have opened a preliminary investigation.
On October 29, 2026, Synology warned that ransomware is hitting NAS devices running outdated DSM software and urged owners to update. Security firm 360 links cases to C3RB3R, which adds a .L0CK3D extension to files, though sources disagree on the entry point.
ASOS confirmed on 8 October 2026 that an unauthorized party impersonated a trusted contact to get an employee's login, then used it to reach customer data on third-party platforms. ASOS says payment card details and account passwords were not accessed. It has not said how many customers are affected.
Navigate360 acknowledged on October 23, 2026 that hackers broke into one of its systems and copied months of data, seven months after a hacktivist group claimed to have stolen millions of crime tips from its P3 Global Intel platform. The company says names, addresses, dates of birth and Social Security numbers may have been exposed.