Attackers stole about $6.36 billion from Binance across 10 blockchains on October 29, according to TRM, which attributed the theft to North Korea’s TraderTraitor group. Binance linked the breach to a compromised DevOps laptop used to submit unauthorized withdrawals, suspended deposits and withdrawals, and said it would cover all losses.
Developer access and outside providers connect several other attacks: malicious code distributed through monitoring provider DebugBear forced Polymarket to halt trading, while leaked internal credentials let an attacker into Zeabur’s hosting infrastructure. Zeabur will shut down in December after its second breach in two months.
The damage also reaches millions of people whose records sit in government and healthcare systems. Florida’s financial-aid breach exposed Social Security numbers for 4.9 million applicants, while an HHS filing put the toll from iRhythm’s breach of third-party-hosted business applications at nearly 8.2 million people.
Attackers stole about $6.36 billion from Binance wallets across 10 blockchains on October 29, according to TRM, which attributed the theft to North Korea’s TraderTraitor group. Binance’s initial investigation linked the breach to a compromised DevOps laptop used to access a service container and submit unauthorized withdrawals. The exchange suspended deposits and withdrawals and said it would cover all losses.
Chinese threat actors breached 25 servers, including systems linked to US government-affiliated organizations, by targeting Palo Alto Networks firewalls running older PAN-OS versions, security firm Dream reported. The attackers chained PHP2Shell with the Linux privilege-escalation flaw Fragnesia, tracked as CVE-2026-46300, to gain persistent root access in under 15 minutes, then moved into internal networks and launched Active Directory attacks.
A breach of Florida’s Student Financial Aid website exposed Social Security numbers, dates of birth and contact information for 4.9 million financial aid applicants. The Florida Department of Education discovered the breach on October 19, took the site offline and said the incident was contained. The department said the breach will not affect financial aid or delay disbursements or tuition payments.
A hacking group calling itself the Department of Peace says it stole and published data on more than 41,000 US Department of Homeland Security workers. The records include work contact details, job titles and internal Active Directory group memberships, covering almost 6,600 ICE employees and more than 21,000 CBP staff. DHS says it is aware of a potential breach.
A publicly accessible database linked to civic software company CitySourced exposed roughly 42 million documents, including 450,000 JSON files containing personal information in plaintext. Researcher Jeremiah Fowler found names, addresses, email addresses, phone numbers and internal records dating from 2016 to 2026. CitySourced secured the database after Fowler disclosed the exposure.
Plainfield, Connecticut’s security system shut down and isolated an affected municipal network as a precaution during an investigation into a potential cyber breach. Most Town Hall systems remained operational Thursday while the town’s IT contractor investigated and worked to restore affected operations. Officials said separate voting systems were not compromised, and police continued providing public-safety services.
A cyberattack on Florida’s Department of Education financial-aid website compromised information including Social Security numbers, potentially affecting 4.9 million people. Staff discovered unauthorized access to FloridaStudentFinancialAidSG.org on Oct. 19, and the site remained offline Thursday. The department said it stopped the unauthorized activity and that financial-aid disbursements and tuition payments would not be delayed.
Polymarket temporarily halted trading Thursday after malicious JavaScript distributed through monitoring provider DebugBear targeted users’ cryptocurrency and prediction-market holdings on Polymarket.com. A suspected attacker wallet transferred about $2.57 million in POL tokens, though Polymarket has not disclosed total losses or the number of affected users. Trading resumed about an hour later, and the company promised full reimbursement.
Ransomnews researchers counted 484,142 publicly listable cloud storage buckets holding 18.05 billion files in October 2026, including 321,058 files with extensions associated with credentials and keys. Amazon S3 accounted for 72% of the buckets. Researchers analyzed metadata without opening files; many buckets were intentionally public, and the count does not establish breaches or confirm exposed live secrets.
The Bankruptcy Noticing Center, which distributes notices for all federal bankruptcy courts, is back online after a cyberattack halted services two weeks ago. Contractor BAE Systems said no data was stolen, no personal information was breached and no other systems were affected. Court officials said the center would process a backlog dating to October 7, with paper notices released in prioritized waves.
Chinese state-sponsored group Volt Typhoon exploited previously unknown flaws in enterprise management platforms to breach U.S. critical infrastructure networks. Black Lotus Labs issued hundreds of victim notifications over three years, helping investigations uncover four confirmed zero-day vulnerabilities and Silent Train, a covert access framework built from rapidly rotating chains of compromised devices.
A June 2026 data breach at cardiac monitoring equipment provider iRhythm affected 8,179,772 people, according to an HHS filing. Hackers compromised patient contact details, dates of birth, and account, device and insurance data in third-party-hosted business applications, then demanded a ransom and threatened to leak the data. iRhythm said it found no impact on its products, clinical systems or patient safety.
A hacker published 115 GB of Summit Public Schools data on PwnForums on October 22, exposing student and staff records from the network’s California and Washington schools. The files contain names, birth dates, home addresses, school records and approximately 21,000 email addresses. The account, Sp1d3yG0nz4l3s, claimed access through an unspecified cloud vulnerability but provided no technical evidence; the number of affected people remains unknown.
Sony Network Communications confirmed that unauthorized access to its So-net database exposed 2,585,481 current and former customer records, including names, contact details and user IDs. The October 19 breach also exposed 54,401 email addresses and account passwords, and affected NTT Docomo Hikari customers served through Sony. No banking or payment card data was exposed.
The U.S. Federal Election Commission shut down its electronic filing system on October 26 after detecting an attempted breach, blocking new campaign finance disclosures days before the November 3 midterms. The outage remained unresolved on October 27, while previously filed reports stayed accessible. The disruption affects financial reporting, not voting, and officials have not confirmed a successful breach or identified the attackers.
Attackers exploited the PolyShell flaw (CVE-2026-48356) in Adobe Commerce and Magento to breach hundreds of online stores and inject a malicious loader, according to Sansec. CISA added it and Google Brotli vulnerability CVE-2026-111497 to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Researchers also detected Brotli exploit traffic targeting Node.js, which fixed the flaw in versions 22.23.4, 24.22.1 and 26.12.1.
Hackers accessed Genesys’ internal learning management and CRM systems, exposing business contact and account information for existing and prospective customers. Genesys said it contained the attack by October 23 and confirmed that Genesys Cloud, Genesys Engage and Genesys Engage Cloud were not compromised. ScarlettGroup claimed responsibility, but Genesys has not identified the attacker and continues to investigate the scope of the breach.
Attackers stole 11,774,247 email addresses and account details from Capcom’s CAPCOM ID service in a breach discovered October 19. The stolen data included account creation dates, login records and IP addresses, with birth dates and other profile details exposed in 43 cases. Capcom also reset passwords on 196 accounts after attackers changed them; the service remains operational.
Quest Diagnostics took its Quanum Lab Services Manager offline Thursday after discovering unauthorized access and said it believes some patient data was accessed. The platform handles medical test orders and results. Quest is investigating the scope of the breach with law enforcement and said no other part of the company was affected, though it paused several other systems during the investigation.
The Everest ransomware group claims it stole 590.69 GB of PwC data, including HR records, training materials and internal documents, in a leak-site listing reported October 22. The alleged theft covers 108,426 files from internal HR and learning systems across Australia, China, Canada and the UK. The claims remain unverified, and PwC has not responded.
Railway warned that an unauthorized third party may have obtained decrypted customer environment variables containing API keys and other credentials. The cloud hosting provider, which has about 4.8 million users, urged all users to rotate stored secrets, though initial findings suggest only a subset was affected. Railway paused deployments during its investigation; delays remained after some builds resumed on October 22.
AI aggregator 302.ai exposed 17.6 million files totaling 22.72TB in a publicly accessible Azure storage bucket without encryption or password protection, Cybernews researchers found. The data included more than 144,000 chat logs containing prompts, AI responses and personal information, along with confidential business documents. Researchers discovered the exposure in early August 2026; the company secured the storage a month later.
Zeabur will shut down in December after its second breach in two months exposed information for 321,810 accounts and more than 3.2 million environment-variable records. An attacker used leaked internal credentials stored in plaintext to access hosting infrastructure and the production database on October 14–15. The shutdown begins December 1 and ends December 31, 2026.
Hackers stole sensitive data on all students enrolled in California public schools since 2023 in a breach of testing contractor Educational Testing Service. The theft ran from May 22 to September 18 and included names, addresses, student identifiers, disability information and test results. The breach also affected students who left California schools since 2006 without confirming a transfer with the state education department.
Attackers used the open source AI platform Cairn to automate attacks that breached more than 100 companies, including John Deere and SharkNinja, Reuters reported. Security firm Norforge identified three malicious activity clusters focused on persistent access and financial theft. The largest used Chinese and ran more than 1,100 attack projects targeting e-commerce and payment infrastructure in the US, Japan and Australia.
A data breach at Paradigm Healthcare Services, which processes Medi-Cal billing, affected more than 970,000 people. Files containing names, birth dates, gender and Medi-Cal identification numbers may have been accessed during an October 2025 network intrusion; its Student Health Network billing platform was not affected. Notification letters were dated September 14, 2026, roughly 11 months after Paradigm detected the intrusion.
Nikkei disclosed its third data breach in about a month, exposing 1.83 million records after hackers used stolen credentials to access a development system on October 7. About 150,000 records contained identifying information, including names, email addresses and other personal details; the remaining 1.68 million contained no identifiers. Nikkei revoked the credentials and said no credit card information was exposed.
An intruder accessed a legacy OpenCode system on October 16, potentially exposing OpenAI, Anthropic and Google API keys stored by 1.4% of Console users. OpenCode notified affected users to revoke and replace their keys; keys stored locally by its command-line and desktop apps were not affected. The company has not confirmed that any keys were copied or used.
Anne Arundel County, Maryland, confirmed that hackers stole files from government systems in an incident detected August 28. Officials are reviewing whether the files contained residents’ information. The Rhysida ransomware gang claimed responsibility and threatened to leak 2.6 terabytes of documents unless the county paid $2 million; officials said the breach was separate from last year’s ransomware attack.
CenterPoint Energy disclosed a data breach affecting 1,062,060 Texas residents, exposing names, addresses, Social Security information and driver’s-license numbers. The utility confirmed that an unauthorized party obtained customer information through an external-facing system. A threat actor using the alias “4d722e4d656f77” claimed to have stolen roughly 7.49 million customer records; the company’s investigation remains ongoing.
Heber City, Utah, restored its government systems by Thursday after a cyberattack breached its network Saturday. No essential services were suspended, and the separately hosted city website and online bill payments remained available. The FBI is assisting a forensic investigation; the city has not identified the attackers or said whether municipal data was accessed or stolen.
A publicly accessible database linked to Indian software platform Vibetech exposed 13.7 million records from previous breaches, including passwords and bank account details. Researcher Jeremiah Fowler found nearly eight million records tied to an AT&T leak and 1.2 million labeled Amazon. Access was restricted after Fowler notified the company and hosting provider.
Attackers used stolen employee credentials to access Meta’s GitHub repositories and steal product source code and personal information linked to roughly 1,500 people, mostly U.S. employees. Meta confirmed the breach on October 13, saying it had blocked access and rotated exposed secrets. The company said its internal systems were not breached and did not identify the affected products or attackers.
The FBI announced on October 9 that it arrested another suspected ShinyHunters co-conspirator in its investigation of the FBIJobs.gov breach, which exposed bureau employees’ personal information. The FBI said a contractor failed to install an available security patch on a third-party platform. Reported exposed data included Social Security numbers, home addresses and emergency contacts; officials did not name the suspect or disclose charges.
A federal judge approved AT&T’s $177 million settlement on October 2, 2026, resolving lawsuits over two breaches disclosed in 2024 without an admission of wrongdoing. One exposed personal information tied to about 73 million current and former account holders; the other involved call and text records stolen from AT&T’s Snowflake workspace and affected nearly all its cellular customers.
Medical device maker iRhythm disclosed a June cyberattack that exposed personal and patient data belonging to at least 360,000 people. Attackers used social engineering to access third-party-hosted business applications between June 3 and June 8, stealing names, birth dates, insurance numbers and other information. The company said the attack did not affect clinical systems or medical devices or disrupt operations.
Asos confirmed hackers stole customer names and contact information from a third-party platform and sent an unauthorized notification through its app. The attackers, calling themselves Xuanye Group, claimed they compromised Asos data hosted on Snowflake and threatened to publish it unless the retailer engaged with them. The number of affected customers was not disclosed.
A breach of EY’s tax-support platform exposed personal and financial data belonging to Goldman Sachs wealth management and Man Group clients. An unauthorized party downloaded documents between March 28 and April 12, 2026, including names, addresses and tax identification numbers. EY attributed the breach to a Checkmarx software vulnerability; neither financial firm’s own systems were compromised, and the number of affected individuals remains unknown.
A breach at the Pentagon’s Defense Manpower Data Center affected 2.76 million living people and 294,000 deceased individuals. Attackers exploited a vulnerability in an unspecified file-sharing system to access unencrypted personal records. They reportedly had access from October 2025 to July 2026, exposing Social Security numbers, names, birth dates and military service details.
JetBrains says an unidentified threat actor breached its Cadence cloud GPU service between August 8 and 24, 2026, by exploiting CVE-2026-63077, a critical TeamCity deserialization flaw (CVSS 9.8) that CISA added to its Known Exploited Vulnerabilities catalog in early August. The attackers accessed a 2024 Cadence server backup containing AWS IAM credentials, S3 bucket files, PyCharm project source code, and user personal data, prompting JetBrains to take the server offline, invalidate plugin access tokens, and urge all Cadence users to rotate credentials and audit their AWS and repository environments.
