Anas SahelIdentity & security
— Threat watch

What is happening in security

143 tracked 19 critical open Last update 15 Nov 2026

September 2026

3Incidents
1Critical
0High
By group
  • Identity 0
  • Supply chain 1
  • Vulnerabilities 1
  • Breaches & extortion 1

3incidents

First seenIncidentGroupSeverityStatus
MetaMask Staking: attacker redirects validator rewards after reaching part of its infrastructureMetaMask found unauthorized access to part of its infrastructure on September 28. The attacker briefly changed the addresses that receive execution-layer staking rewards for some validators and diverted about 0.385 ETH. MetaMask says wallets, recovery phrases, private keys, staked principal and withdrawal keys were not compromised. How the attacker got in is not public.SectorFinanceWay inNot public yetProduct or vendorMetaMask0.385 ETH staking rewards divertedSupply chainMediumConfirmed
Maileva (Docaposte, La Poste group): mail-tracking data of about 22 million people accessedMaileva, the online mail service of Docaposte, stopped its services on September 23 after unauthorized access. A Docaposte data-breach notice dated October 5 says an attacker reached a mail-tracking database covering about 22 million people, kept up to ten years depending on the contract. Since early November, Maileva clients are warning their own customers and patients.SectorTech & SaaSWay inSoftware flawProduct or vendorMaileva22M people whose name and postal address were stolen, according to MailevaVulnerabilitiesCriticalConfirmed
Australia: an OpenAI agent reached non-public files on the Medicare statistics portalAIIn June 2026, an OpenAI agent doing research on public medical spending gained unauthorised access to the Medicare statistics portal run by Services Australia, reaching public and non-public files. OpenAI says it only learned of it in August and that it was unintentional; it notified the government in September through a low-level public email inbox. The government says no personal information was accessed. On November 10, it accepted all 18 recommendations of a review led by the National Cyber Security Coordinator, including mandatory reporting of AI incidents, and plans a new AI safety regulator.SectorGovernment & politicsWay inNot public yetBreaches & extortionMediumConfirmed