Anas SahelIdentity & security
— Threat watch

What is happening in security

143 tracked 19 critical open Last update 15 Nov 2026

October 2026

40Incidents
7Critical
27High
By group
  • Identity 11
  • Supply chain 10
  • Vulnerabilities 9
  • Breaches & extortion 10

40incidents

First seenIncidentGroupSeverityStatus
ISAE-Supméca: ransomware hits the engineering school's whole ITThe engineering school in Saint-Ouen says a ransomware attack on October 31 affected its whole IT infrastructure. Email and the website are back, classes continue, ANSSI is involved and a complaint has been filed. The school has not said how the attackers got in or confirmed any data theft.SectorEducationWay inNot public yetBreaches & extortionHighConfirmed
Rassemblement national: member data leaked from its membership toolThe French party confirmed an attack on the tool it uses to manage memberships and the unauthorised disclosure of some members' personal data. It notified the CNIL and filed a complaint. A hacker claims more than 432,000 records.SectorGovernment & politicsWay inNot public yet432,597 records claimed by the hacker (unverified)Breaches & extortionHighConfirmed
Name.com support account used to hijack 15 DeFi domainsAn account in a support team linked to the registrar changed the nameservers of 15 customer domains and sent visitors to a wallet drainer. About $138,000 was traced on EVM chains.SectorTech & SaaSWay inNot public yetProduct or vendorName.com$138K drained from visitors' wallets on EVM chainsSupply chainHighConfirmed
Chainalysis: password hashes and live tokens of all users exposedAIThe blockchain analytics company detected an outside actor using "offensive agentic techniques" inside its systems on October 30. A week later it says names, usernames, password hashes and live tokens for all its users were exposed, and asks every user to reset passwords and rotate API keys.SectorTech & SaaSWay inNot public yetProduct or vendorChainalysisBreaches & extortionHighConfirmed
Fake IT help desk calls on Teams led to certificates for privileged accountsMicrosoft describes two intrusions that began with someone posing as IT support on Teams. The attackers got users to open Quick Assist, then abused weak Active Directory Certificate Services settings to obtain certificates for privileged accounts and for a domain controller. In one case, data was copied out. No Teams flaw was used.SectorMany sectorsWay inPhishing, social engineeringProduct or vendorMicrosoft Teams, Quick Assist, AD CSIdentityHighConfirmed
Northflank: customers told to assume every environment variable was decryptedAfter a Wiz alert on 30 October, Northflank told all customers to assume their environment variables were decrypted and to rotate every secret. Users reported unauthorised use of AI API keys stored on the platform. Northflank has not yet published a root cause.SectorTech & SaaSWay inNot public yetProduct or vendorNorthflankSupply chainHighDeveloping
Abrigo: Sageworks lending platform for banks shut down after unauthorized accessAbrigo, a US software provider for banks and credit unions, disabled its Sageworks lending platform on October 30 after spotting "irregular activity in our environment". It later confirmed a "data security incident" and said the unauthorized access had been contained. Most of the platform came back on November 2; borrower-facing features stayed down. Abrigo has not said whether any data was taken.SectorFinanceWay inNot public yetProduct or vendorAbrigo SageworksSupply chainMediumConfirmed
Cholet: city and agglomeration services disrupted after a phishing attack on staff accountsSince October 30, the Ville de Cholet and Cholet Agglomération, in western France, have been dealing with a cyberattack on several user accounts. The city says it started with a fraudulent email sent to several staff members, linking to a fake login form. It cut internet access as a precaution, notified the CNIL and filed a complaint, and says it found no trace of malware or of massive data exfiltration.SectorGovernment & politicsWay inPhishing, social engineeringIdentityMediumConfirmed
WS Audiology: unauthorised access takes hearing aid apps offlineThe maker of Widex and Signia hearing aids says it is responding to unauthorised access to certain IT systems. It took some systems offline as a precaution, which disrupted the Widex MOMENT app and professional fitting tools. It says the hearing aids themselves were not affected.SectorHealthWay inNot public yetBreaches & extortionMediumConfirmed
Arara Message: an email delivery service leaks 81 million addresses from up to 380 client companiesJapanese company Arara says an attacker broke into its Arara Message email delivery service at the end of October 2026, took 81,329,467 unique email addresses belonging to the customers of up to about 380 client companies, and used the service to send up to about 7.13 million phishing emails posing as credit card companies. Client brands are now notifying their own customers one by one, among them MOS Burger (7.5 million addresses) and SEGA (2.2 million). The service has been suspended since October 31.SectorTech & SaaSWay inSoftware flawProduct or vendorArara Message81.3M unique email addresses leaked, from the customers of up to about 380 companiesVulnerabilitiesCriticalConfirmed
Binance: about $6.3 billion taken from hot walletsOn October 29, attackers used Binance's own withdrawal system to move about $6.3 billion out of its hot wallets. Binance traces the entry to a months-long campaign against its wallet engineers, and says it covers the losses, not its users.SectorFinanceWay inPhishing, social engineering$6.3B taken from 17 hot wallets; $2.7–3B frozenIdentityCriticalConfirmed
Cursor: a key held by Fireworks AI led to stolen agent traces and a tampered Claude Code extension in its marketplaceAIOn October 29, malicious copies of Anthropic's Claude Code extension (2.1.312 and 2.1.313, Windows and macOS) were served from the cache of Cursor's extension marketplace for about 11 hours, to at most 5,000 users. Cursor's November 13 update gives the root cause: an attacker obtained an access key Cursor had issued to its inference provider Fireworks, opened a shared storage bucket of coding agent traces, used credentials found in those traces to reach some of Cursor's SaaS tools, and then used a stolen credential to place the tampered builds on the marketplace cache.SectorTech & SaaSWay inSupplierProduct or vendorCursor, Fireworks AIUp to 5,000 users who may have received the tampered extension, according to CursorSupply chainHighConfirmed
Marathon Health: a fake IT worker got an employee's credentialsMarathon Health, a US provider of employer-sponsored health centres, says an attacker posing as a Marathon IT worker tricked an employee into giving up their credentials on August 24, then exported data from a cloud-hosted application within a few hours. Names, dates of birth and Social Security numbers were taken. Marathon has not published a total; reported counts range from about 272,000 in state filings to nearly 5.7 million.SectorHealthWay inPhishing, social engineering272K–5.7M people, depending on the filing countedIdentityHighConfirmed
Revolve: saved payment cards stolen from the online fashion retailerUS online fashion retailer Revolve told the SEC on October 29 that hackers gained access to multiple company systems and, "through automated means", took names, contact details, card numbers and expiry dates of customers who had saved a card. It told Texas regulators that 127,200 people in the state were affected; Malwarebytes found a total of 1,515,073 in the state portal's data, a figure Revolve has not confirmed.SectorRetailWay inNot public yet127K–1.5M people whose card data was taken (Texas filing vs. total in the Texas portal data, not confirmed by Revolve)Breaches & extortionHighConfirmed
Polymarket: traders drained through a hijacked DebugBear monitoring scriptOn October 29 a page-speed script that Polymarket loaded from the vendor DebugBear was replaced with a wallet drainer. It used signed-in traders' open sessions to move funds out. DebugBear says its DNS records were compromised through its domain registrar. Polymarket says it has returned $3.9 million.SectorFinanceWay inSupplierProduct or vendorDebugBear$2.7M taken from traders, per The Hacker NewsSupply chainHighConfirmed
Synology NAS: ransomware hits devices on outdated DSMSynology says attackers are exploiting a flaw patched in December 2024 to hit NAS devices on outdated DSM versions. Files are encrypted by C3RB3R, a Cerber variant according to the Chinese security firm 360, which points to two other flaws fixed in September 2026.SectorMany sectorsWay inSoftware flawProduct or vendorSynology DSMBreaches & extortionHighConfirmed
Iris Ohyama: data of about 7.7 million online store customers may have leakedIris Plaza, the online store of the Japanese home goods maker Iris Ohyama, found suspicious files in an external cloud service it uses on October 28. It confirms unauthorised access by a third party and says data on about 7.7 million people may have been viewed or taken. Card data was not stored there.SectorRetailWay inNot public yet7.7M people whose data may have been viewed or takenBreaches & extortionCriticalConfirmed
Auto-Planning: hack of a booking provider for French vehicle inspection centresAuto-Planning, which runs online booking and SMS reminders for French vehicle inspection centres, confirmed it was hacked after its home page was replaced by a ransom demand on October 28. The attacker claims hundreds of millions of booking records with names, phone numbers, emails and number plates, and put a database up for sale on November 7. The company has not confirmed the volumes.SectorTransportWay inNot public yetProduct or vendorAuto-PlanningSupply chainHighConfirmed
Amadeus: booking data of airline passengers accessed through a system account, at least six Asian airlines affectedAmadeus, the reservation provider of many airlines, told its customers that unauthorized parties could read booking-display data. Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines, ANA and Malaysia Airlines have reported impacts, and Qantas has also commented. Amadeus describes a vulnerability. Cathay says the access used credentials assigned to a system account, between August 2023 and September 2026.SectorTransportWay inSoftware flawProduct or vendorAmadeus92,000 Japan Airlines customers alone; other airlines also hitSupply chainHighConfirmed
ENGIE: customer data taken from a tool used by its sales partners in FranceThe energy group ENGIE told customers in France that it found unusual data access in a tool its partners use to prospect and sell energy offers. Names, contact details, contract numbers and meter references were exposed. ENGIE says its own IT systems were not compromised and no bank data is involved. It has not said how many customers are affected.SectorEnergyWay inSupplierSupply chainHighConfirmed
Fake IT support on Teams: email bombing, then a chat, then remote access in under 15 minutesArctic Wolf Labs reports more than 400 incidents at its customers where attackers first flooded a user's mailbox with newsletter sign-ups, then contacted them through Microsoft Teams external chat from a throwaway tenant, posing as "IT Support (Internal)". The user is talked into opening a remote access tool such as Quick Assist, AnyDesk or ScreenConnect, and a payload can follow in under 15 minutes. Arctic Wolf says no Teams vulnerability is used: the attackers rely on external access, which is on by default.SectorMany sectorsWay inPhishing, social engineeringProduct or vendorMicrosoft Teams, Quick Assist, AnyDesk, ScreenConnect, TeamViewer400+ incidents seen at Arctic Wolf customersIdentityHighConfirmed
Keystone: an attacker takes buyer data and the key that proves its hardware wallets are genuineHardware wallet maker Keystone detected unauthorized access to its official website on October 20, 2026. The attacker took 25,964 buyer records from its Shopify store and the WebAuth factory key used to check that a device is genuine. Keystone is destroying 18,835 unsold devices that carry that key, because someone holding it could make counterfeits that pass the check. It says recovery phrases and private keys were not involved.SectorConsumer apps & devicesWay inSoftware flawProduct or vendorKeystone25,964 buyer records taken from the online store, plus 12,873 unpaid checkout recordsVulnerabilitiesHighConfirmed
DreamHost: File Manager breach exposes FTP/SFTP passwords and some webmail loginsDreamHost says an attacker exploited a vulnerability in the third-party software behind its browser-based File Manager and took FTP/SFTP credentials, plus webmail logins for a limited number of users. Passwords were reset and webmail sessions ended. The investigation is ongoing.SectorTech & SaaSWay inSoftware flawProduct or vendorDreamHostVulnerabilitiesHighDeveloping
GMO Internet: attackers plant malware in an FX trading VPS service and demand about ¥8 billionOn October 20, 2026, GMO Internet found a malicious program on customer servers of Onamae.com Desktop Cloud, a VPS service used to run automated FX trading tools, and shut down every plan the next morning. Up to 26,739 servers may be affected. GMO confirms customer information was taken and that an apparent attacker demanded about ¥8 billion, which it refuses to pay. By November 12, users had filed about ¥3 billion in claims for losses on trades made in their accounts.SectorTech & SaaSWay inNot public yetProduct or vendorOnamae.com Desktop Cloud, GMO Internet¥8B ransom demanded by the apparent attacker (about), per GMO, which refuses to pay26,739 customer servers possibly affectedBreaches & extortionHighConfirmed
Railway: a build flaw let an attacker decrypt customer secrets and run up about $740,000 on stolen AI keysAICloud platform Railway published its full incident report on November 10, 2026. On October 20 and 21, an attacker escaped filesystem isolation in its shared build system, moved through internal systems and decrypted environment variables for at most 1.85% of workspaces, about 100,000. The attacker was after AI provider keys; Railway estimates unauthorised spend on the stolen keys at about $740,000 and says it will refund or cover it.SectorTech & SaaSWay inSoftware flawProduct or vendorRailway~$740K estimated unauthorised spend on the stolen AI keys, which Railway says it is getting refunded or will cover itselfup to ~100K workspaces (at most 1.85%) that could have had environment variables decrypted, an upper boundVulnerabilitiesHighResolved
LiteLLM: poisoned 1.107.0 release published through its own pipelineAIOn October 21 a malicious litellm 1.107.0 reached PyPI, Docker Hub and GHCR. LiteLLM says an administrative key committed to a public repository in May and never revoked led the attacker to maintainers' GitHub tokens, then to the release pipeline. The package steals credentials when Python starts.SectorTech & SaaSWay inStolen credentialsProduct or vendorLiteLLM, PyPISupply chainHighConfirmed
Monex Securities: up to 1.13 million email addresses may have leaked from a vendor-run account-opening systemJapanese broker Monex Securities says a third party accessed part of its account-opening system, run and managed by an outsourced vendor. On November 13, 2026 it said up to 1.13 million email addresses and 1,592 identity document images may have leaked. Account numbers and passwords sat in a different database and are not confirmed leaked, and no fraud has been reported so far.SectorFinanceWay inNot public yet1.13M email addresses that may have leaked (maximum so far, includes duplicates and unfinished applications), plus 1,592 ID document imagesBreaches & extortionHighConfirmed
DigiCert: self-registered accounts read archived customer dataDigiCert says a business system left reachable from the internet let outsiders register accounts without MFA and read archived customer validation data, including some identity documents. Certificates were not affected.SectorTech & SaaSWay inExposed or misconfiguredProduct or vendorDigiCertVulnerabilitiesHighConfirmed
Plex2Shell: four chained Plex flaws used to take over media servers and NASFour Plex Media Server flaws chain into remote code execution without a login. Plex says they are being "actively and widely exploited" to run crypto miners and proxy software, and QNAP says some customers' NAS were compromised this way. The fix is Plex Media Server 1.43.3.10861 or later.SectorMany sectorsWay inSoftware flawProduct or vendorPlex Media Server, QNAPVulnerabilitiesHighConfirmed
ConnectWise Cloud Backup: a stolen app credential used to sign in to Microsoft 365 customer tenantsAttackers used a compromised credential of ConnectWise Cloud Backup (formerly SkyKick), a backup app that managed service providers connect to Microsoft 365, to sign in to customer tenants with the permissions customers had granted it. Huntress confirmed unauthorized sign-ins in 162 tenants. ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management, reset credentials and says it has no evidence that backup data was compromised.SectorTech & SaaSWay inSupplierProduct or vendorConnectWise Cloud Backup, SkyKick, ConnectWise SaaS Security, ConnectWise Cloud Management162–173 Microsoft 365 tenants with confirmed unauthorized sign-ins, according to HuntressSupply chainHighConfirmed
Supermarket refrigeration controllers attacked in France, then across EuropeSince the night of October 11 to 12, attackers have remotely changed settings on refrigeration controllers in hundreds of French supermarkets, then in stores in several other European countries on November 1 to 2. Food was spoiled and, in France, at least 15 fires broke out. On November 9, France attributed the October attack to Shahid Kaveh, an offensive cyber unit of Iran's Revolutionary Guards.SectorRetailWay inExposed or misconfiguredProduct or vendorDanfoss, Copeland, Dixell, Schneider ElectricTens of millions of euros food losses in France, as estimated by the French governmentVulnerabilitiesCriticalConfirmed
French Shooting Federation (FFTir): second intrusion in a year, 64,000 ID photos copiedOn October 12, someone logged into the FFTir licensee area with a licensee's stolen or guessed credentials and copied about 64,000 ID photos and nearly 19,000 documents. The federation told licensees on October 22. It says no information on weapon ownership was touched.SectorAssociations & sportWay inStolen credentials586,854 people, as claimed by a forum seller (unverified)IdentityHighConfirmed
Ahold Delhaize: a cyberattack takes grocery websites and apps offlineThe Dutch-Belgian grocery group says malicious actions by others forced it to take websites, apps and other systems offline in Europe and the U.S. from October 11. Stores stayed open. It now expects the incident to cut fourth-quarter net sales by €200 million to €250 million.SectorRetailWay inNot public yet€200–250M expected cut to Q4 net salesBreaches & extortionCriticalConfirmed
CAF (France): data of 1.6 million families taken from the Vacaf holiday-aid platformFrance's family benefits network (Cnaf) says data of 1,619,893 Caf beneficiaries was taken from vacaf.org, the platform of its holiday-aid scheme. CERT-FR says attackers used partner account credentials stolen by infostealers, with no two-factor authentication, and a URL flaw that exposed file identifiers, to extract data automatically between October 8 and 10, 2026. Names, beneficiary numbers, household make-up, family quotient and children's names and birth dates were taken; no bank data, passwords or contact details, the Cnaf says. The platform reopened on November 2 with two-factor authentication.SectorGovernment & politicsWay inStolen credentials1.6M Caf beneficiaries concerned, according to the Cnaf (CERT-FR counts nearly 1.2 million files)IdentityCriticalConfirmed
Fireworks AI: attackers seeking to resell LLM access reached API keys, billing data and some customer modelsAIAI inference platform Fireworks AI first disclosed in October that internal credentials had been misused to capture API keys and tokens stored as secrets in some customer accounts. Its November 9 update widens the impact: account and billing data, and for a limited set of accounts, secrets, datasets and incomplete model weights. A second path ran through a third-party cloud provider hosting its R&D machines. Fireworks links the attackers to a financially motivated group that sells stolen access to LLMs.SectorTech & SaaSWay inStolen credentialsProduct or vendorFireworks AI, Notion, CursorIdentityHighConfirmed
France Travail: data of 60,000 agents and professionals taken through one agent's accountCERT-FR says an attacker compromised a France Travail agent's account, passing its SMS second factor, and exfiltrated data on September 26, 2026. On October 8, the sale of data on more than 60,000 agents and professionals (names, work emails, phones, roles, agencies, internal identifiers) was claimed on a cybercriminal forum. The account was revoked and the malicious IP addresses blocked.SectorGovernment & politicsWay inStolen credentials60K+ agents and professionals whose data was claimed for sale, according to CERT-FRIdentityHighConfirmed
AhsayCBS: two chained flaws used to plant web shells, crypto miners and a backdoor on backup serversHuntress says attackers chained an authentication bypass (CVE-2026-105133) and an unauthenticated remote code execution flaw (CVE-2026-105134) in the AhsayCBS backup server to run commands as SYSTEM. On servers breached between October 8 and 11, 2026, before Ahsay's hotfixes, it found five web shell families, two crypto miners, tunnelling and remote access tools, and a Python backdoor talking to a command server. Ahsay's hotfixes are 10.3.4.45 (v10) and 9.15.2.70 (v7 to v9).SectorMany sectorsWay inSoftware flawProduct or vendorAhsayCBS, Ahsay BackupVulnerabilitiesMediumConfirmed
Fake OpenAI, SpaceX and Anthropic events phish work accountsAIFake event pages ask visitors to sign in with a work account. The Microsoft button runs device code phishing on Microsoft's real page; the Google button is a reverse proxy.SectorMany sectorsWay inPhishing, social engineeringIdentityMediumConfirmed
Frontline Education: a flaw in third-party software exposes data of 3 million school staff and studentsFrontline Education, which sells software to US K-12 school districts, says a vulnerability in a third-party software product it uses allowed unauthorized access to part of its environment on August 14 and 15, 2026, in Frontline Central and School Health Management. Social Security numbers and other ID numbers of staff and students were involved. A filing with the Indiana Attorney General counts 3,085,266 people affected, according to SecurityWeek.SectorEducationWay inSoftware flawProduct or vendorFrontline Central, Frontline School Health Management3.1M people affected, per Frontline's filing with the Indiana Attorney General as reported by SecurityWeekVulnerabilitiesCriticalConfirmed
Calendar-invite phishing campaign steals live Google Workspace sessionsSince mid-August, Material Security says, a phishing campaign has used Google Calendar invites and a live proxy in front of the real Google sign-in page to steal signed-in sessions, even when the user types MFA codes. The figures come from Material alone. Google has made no statement.SectorMany sectorsWay inPhishing, social engineeringProduct or vendorGoogle WorkspaceIdentityMediumDeveloping