Ticker feed: Data breaches
From October 14 to October 26, 2026, an unidentified attacker used compromised IAM credentials from an AWS account tied to big-data platform Qubole to get inside more than a dozen organizations’ cloud environments. Many had quit Qubole long before but never deleted the roles that let its account in. Each request carried the right External ID, so AWS took the intruder for Qubole.
Sentra, which spotted the campaign, says the attacker read about 100 passwords and keys in seven minutes from Secrets Manager, SSM Parameter Store, and Lambda settings. TruffleHog then tested stolen AWS, Entra ID, and Okta credentials, and some S3 buckets were downloaded whole. How the attacker got Qubole’s credentials hasn’t been disclosed, and Qubole hasn’t issued a statement or fix.
Wiz, which disclosed the findings with Sentra and Mandiant on November 9, tells organizations that integrated with Qubole to search CloudTrail from October 1 for role assumptions by account 805246085872 from non-AWS addresses, rotate anything an affected role could read, and revoke its sessions. Unused vendor roles should go; Wiz says a source-IP condition alone would have blocked every role assumption it saw.
Source: SecurityWeek
From October 14 to October 26, 2026, an unidentified attacker used compromised IAM credentials from an AWS account tied to big-data platform Qubole to get inside more than a dozen organizations’ cloud environments. Many had quit Qubole long before but never deleted the roles that let its account in. Each request carried the right External ID, so AWS took the intruder for Qubole.
Sentra, which spotted the campaign, says the attacker read about 100 passwords and keys in seven minutes from Secrets Manager, SSM Parameter Store, and Lambda settings. TruffleHog then tested stolen AWS, Entra ID, and Okta credentials, and some S3 buckets were downloaded whole. How the attacker got Qubole’s credentials hasn’t been disclosed, and Qubole hasn’t issued a statement or fix.
Wiz, which disclosed the findings with Sentra and Mandiant on November 9, tells organizations that integrated with Qubole to search CloudTrail from October 1 for role assumptions by account 805246085872 from non-AWS addresses, rotate anything an affected role could read, and revoke its sessions. Unused vendor roles should go; Wiz says a source-IP condition alone would have blocked every role assumption it saw.
Source: SecurityWeek
Sega has confirmed that 2.2 million customer email addresses were exposed after hackers breached Arara Inc., a Japanese email delivery provider the company uses for newsletters. The attack occurred on October 28, 2026, when an unauthorized party exploited vulnerabilities in Arara’s web servers. Arara suspended its distribution service on October 31.
The leaked data is limited to email addresses. No names, passwords, credit card details, or other personal information were compromised. No misuse has been confirmed yet, but Sega is urging customers to delete any suspicious emails claiming to be from Sega or its subsidiary Sega Fave, and never click unknown links or attachments.
Arara’s parent, Paycloud Holdings, first estimated on November 2 that up to 77 million addresses from around 380 client companies may have been taken, some with names and phone numbers. Paycloud has since revised that to about 3.4 million unique addresses across 61 companies. The attacker also used the hijacked service to send millions of phishing emails.
Source: Infosecurity Magazine
Sega has confirmed that 2.2 million customer email addresses were exposed after hackers breached Arara Inc., a Japanese email delivery provider the company uses for newsletters. The attack occurred on October 28, 2026, when an unauthorized party exploited vulnerabilities in Arara’s web servers. Arara suspended its distribution service on October 31.
The leaked data is limited to email addresses. No names, passwords, credit card details, or other personal information were compromised. No misuse has been confirmed yet, but Sega is urging customers to delete any suspicious emails claiming to be from Sega or its subsidiary Sega Fave, and never click unknown links or attachments.
Arara’s parent, Paycloud Holdings, first estimated on November 2 that up to 77 million addresses from around 380 client companies may have been taken, some with names and phone numbers. Paycloud has since revised that to about 3.4 million unique addresses across 61 companies. The attacker also used the hijacked service to send millions of phishing emails.
Source: Infosecurity Magazine
More than 320,000 files stolen in a cyberattack on Bristol City Council’s Trading with Schools platform have been published on the dark web. Malware got into the platform on September 21, 2026, and the council shut it down four days later. A ransomware group listed the council on its leak site on October 27.
The council has named 39 schools whose data may have been taken, including Filton Avenue Nursery School and Bristol Hospital Education Service, though not every school on the list was hit. Those 39 ran lesson planning, scheduling, and other daily work on the platform; the other 49 of its 88 users only bought internet services through it.
Head teachers were told on November 3, and parents and staff the next morning. The council says it won’t know which schools or individuals are affected until a forensic review of the files is complete, and it is warning families to watch for phishing and unusual account activity.
Source: BBC News
More than 320,000 files stolen in a cyberattack on Bristol City Council’s Trading with Schools platform have been published on the dark web. Malware got into the platform on September 21, 2026, and the council shut it down four days later. A ransomware group listed the council on its leak site on October 27.
The council has named 39 schools whose data may have been taken, including Filton Avenue Nursery School and Bristol Hospital Education Service, though not every school on the list was hit. Those 39 ran lesson planning, scheduling, and other daily work on the platform; the other 49 of its 88 users only bought internet services through it.
Head teachers were told on November 3, and parents and staff the next morning. The council says it won’t know which schools or individuals are affected until a forensic review of the files is complete, and it is warning families to watch for phishing and unusual account activity.
Source: BBC News
Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
Blockchain analytics firm Chainalysis disclosed on October 30, 2026, that attackers used “offensive agentic techniques” earlier that month to gain unauthorized access to its systems and internal tools. The breach exposed what the company calls non-sensitive customer data, including user IDs, names, email addresses, and organization roles. Chainalysis says no investigation content, plain-text passwords, or other credentials were compromised.
Chainalysis says the incident is unrelated to the $6.36 billion Binance heist the FBI blamed on North Korea. It hasn’t said how many people were affected, and it is patching vulnerabilities with help from outside security experts. With names and emails out, it advises users to turn on MFA and distrust unexpected login prompts or password-reset requests.
Source: SecurityWeek
Blockchain analytics firm Chainalysis disclosed on October 30, 2026, that attackers used “offensive agentic techniques” earlier that month to gain unauthorized access to its systems and internal tools. The breach exposed what the company calls non-sensitive customer data, including user IDs, names, email addresses, and organization roles. Chainalysis says no investigation content, plain-text passwords, or other credentials were compromised.
Chainalysis says the incident is unrelated to the $6.36 billion Binance heist the FBI blamed on North Korea. It hasn’t said how many people were affected, and it is patching vulnerabilities with help from outside security experts. With names and emails out, it advises users to turn on MFA and distrust unexpected login prompts or password-reset requests.
Source: SecurityWeek
A hacktivist group calling itself the Department of Peace has leaked records on more than 41,000 DHS employees and contractors, including ICE and CBP personnel and federal cybersecurity staff. Transparency collective DDoSecrets published the database, dubbed Icepick, on October 28, 2026, alongside a searchable version. It holds names, roles, and work contact details, but no home addresses, DDoSecrets says.
The group says it took the data from an Okta single sign-on service DHS uses, but Okta says it has no evidence its systems were compromised. The hacktivists framed the leak as payback for DHS Secretary Markwayne Mullin’s July 17 pledge to step up immigration enforcement.
Icepick also lists more than 55,000 internal access groups, some referencing surveillance platform PenLink and AI tools such as ChatGPT and Gemini. DHS says it is aware of a potential breach and working to address it.
Source: CNET
A hacktivist group calling itself the Department of Peace has leaked records on more than 41,000 DHS employees and contractors, including ICE and CBP personnel and federal cybersecurity staff. Transparency collective DDoSecrets published the database, dubbed Icepick, on October 28, 2026, alongside a searchable version. It holds names, roles, and work contact details, but no home addresses, DDoSecrets says.
The group says it took the data from an Okta single sign-on service DHS uses, but Okta says it has no evidence its systems were compromised. The hacktivists framed the leak as payback for DHS Secretary Markwayne Mullin’s July 17 pledge to step up immigration enforcement.
Icepick also lists more than 55,000 internal access groups, some referencing surveillance platform PenLink and AI tools such as ChatGPT and Gemini. DHS says it is aware of a potential breach and working to address it.
Source: CNET
A surprisingly clumsy phishing campaign impersonating Anthropic has been bypassing Proofpoint’s Secure Email Gateway and Microsoft Defender for Office 365 since September 2026, Cofense researchers found. Attackers send fake “private preview” invites to an Anthropic AI tool from a legitimate GoTo Webinar address, then route victims through a fake Zoom page to steal Google or Microsoft logins.
The emails carry a misspelled sender name (“Austin from nthropic”), a grammatical error in the subject line, and zero Anthropic branding. The theft flow is half-broken, too: the Google path never asks for a password. Since October 28, the attackers have swapped the Zoom page for a fake Anthropic one.
Yet Cofense points to three simple tricks that may explain the bypass: a sender address open to every GoTo Webinar account holder, Zapier-shortened links, and two CAPTCHAs that keep scanners and VPNs from following the chain. Keeper Security chief information security officer Shane Barney argues email gateways will always have blind spots, so defenses should focus on identity, including phishing-resistant multifactor authentication.
Source: Dark Reading
A surprisingly clumsy phishing campaign impersonating Anthropic has been bypassing Proofpoint’s Secure Email Gateway and Microsoft Defender for Office 365 since September 2026, Cofense researchers found. Attackers send fake “private preview” invites to an Anthropic AI tool from a legitimate GoTo Webinar address, then route victims through a fake Zoom page to steal Google or Microsoft logins.
The emails carry a misspelled sender name (“Austin from nthropic”), a grammatical error in the subject line, and zero Anthropic branding. The theft flow is half-broken, too: the Google path never asks for a password. Since October 28, the attackers have swapped the Zoom page for a fake Anthropic one.
Yet Cofense points to three simple tricks that may explain the bypass: a sender address open to every GoTo Webinar account holder, Zapier-shortened links, and two CAPTCHAs that keep scanners and VPNs from following the chain. Keeper Security chief information security officer Shane Barney argues email gateways will always have blind spots, so defenses should focus on identity, including phishing-resistant multifactor authentication.
Source: Dark Reading
Hackers broke into Florida’s student financial aid website, compromising personal information including Social Security numbers, the Florida Department of Education (FLDOE) confirmed. The department says the breach may have affected about 4.9 million people and appears limited to FloridaStudentFinancialAidSG.org.
The FLDOE discovered the breach on October 19 and immediately moved to stop the unauthorized access, but hasn’t said how long the attackers were inside. It has notified Florida’s Attorney General, as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement, which has opened a criminal investigation.
One bit of relief: officials say financial aid is safe — disbursements, tuition payments, scholarships, grants, and student loan eligibility won’t be affected. The FLDOE is urging anyone affected to monitor their financial accounts and credit reports, and warns the aid website may see temporary disruptions during the response.
Source: CBS News Miami
Hackers broke into Florida’s student financial aid website, compromising personal information including Social Security numbers, the Florida Department of Education (FLDOE) confirmed. The department says the breach may have affected about 4.9 million people and appears limited to FloridaStudentFinancialAidSG.org.
The FLDOE discovered the breach on October 19 and immediately moved to stop the unauthorized access, but hasn’t said how long the attackers were inside. It has notified Florida’s Attorney General, as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement, which has opened a criminal investigation.
One bit of relief: officials say financial aid is safe — disbursements, tuition payments, scholarships, grants, and student loan eligibility won’t be affected. The FLDOE is urging anyone affected to monitor their financial accounts and credit reports, and warns the aid website may see temporary disruptions during the response.
Source: CBS News Miami
Sony Network Communications confirmed that hackers breached So-net, its Japanese internet service provider, stealing personal data from roughly 2.6 million current and former subscribers. The attackers accessed the member database on October 19, with the company detecting the intrusion four days later. How they got in hasn’t been disclosed.
Stolen data includes names, birthdates, gender, phone numbers, email addresses, user IDs, and internet connection IDs: 2.14 million records from So-net subscribers and 443,000 from Plala (S Course), a plan sold with NTT Docomo’s fiber service and run by So-net. About 293,000 belong to people who left in March 2026 or later.
Around 54,000 passwords for four add-on email services were also taken, which So-net says put attackers in a position to read and send mail. Sixteen bank account records were exposed, though no credit card or PIN data was stored. NURO and other services weren’t affected.
So-net has reset the affected email passwords and notified Japan’s Personal Information Protection Commission.
Source: SecurityWeek
Sony Network Communications confirmed that hackers breached So-net, its Japanese internet service provider, stealing personal data from roughly 2.6 million current and former subscribers. The attackers accessed the member database on October 19, with the company detecting the intrusion four days later. How they got in hasn’t been disclosed.
Stolen data includes names, birthdates, gender, phone numbers, email addresses, user IDs, and internet connection IDs: 2.14 million records from So-net subscribers and 443,000 from Plala (S Course), a plan sold with NTT Docomo’s fiber service and run by So-net. About 293,000 belong to people who left in March 2026 or later.
Around 54,000 passwords for four add-on email services were also taken, which So-net says put attackers in a position to read and send mail. Sixteen bank account records were exposed, though no credit card or PIN data was stored. NURO and other services weren’t affected.
So-net has reset the affected email passwords and notified Japan’s Personal Information Protection Commission.
Source: SecurityWeek
An attacker copied personal data on millions of California public school students from Educational Testing Service (ETS), the state’s testing contractor. Using a stolen login, the intruder accessed an ETS file transfer site at various times between May 22 and September 18, before ETS spotted the activity on September 25.
The breach covers all students enrolled in the past three school years, and possibly more; over 5.7 million were enrolled this year alone. Records include names, birthdates, addresses, student IDs, race, disability status, and assessment results. Social Security numbers, financial data, and parent information were not involved, and ETS has found no sign the data has been published.
ETS is offering two years of free Experian identity protection, with enrollment open until March 19, 2027. Notices to families began October 16 and run through early November. State education officials are also reviewing whether ETS met its data security and contract requirements.
Source: CBS News San Francisco
An attacker copied personal data on millions of California public school students from Educational Testing Service (ETS), the state’s testing contractor. Using a stolen login, the intruder accessed an ETS file transfer site at various times between May 22 and September 18, before ETS spotted the activity on September 25.
The breach covers all students enrolled in the past three school years, and possibly more; over 5.7 million were enrolled this year alone. Records include names, birthdates, addresses, student IDs, race, disability status, and assessment results. Social Security numbers, financial data, and parent information were not involved, and ETS has found no sign the data has been published.
ETS is offering two years of free Experian identity protection, with enrollment open until March 19, 2027. Notices to families began October 16 and run through early November. State education officials are also reviewing whether ETS met its data security and contract requirements.
Source: CBS News San Francisco
