GoKawiil
Tech News
OpenCode said it suffered a security breach described as a large-scale distillation attack, which affected 1.4% of its Console users. The company notified affected users by email and says the incident is still ongoing, so further details are not yet available. OpenCode stated it is working with Anthropic, OpenAI, and Google to address the issue.
California's Department of Education disclosed that a stolen login credential was used to access and copy personal data—names, birth dates, and addresses—of millions of current and former public-school students who took state standardized tests. The breach, tied to testing vendor Educational Testing Service, affected files dating back to 2006 and involved unauthorized access occurring over several months in 2026. Officials are offering affected individuals free identity-protection and restoration services, and recommend credit freezes for minors.
Burger King Japan disclosed that unauthorized third parties accessed a server managing its official app's member data between October 2 and 7, 2026, exposing 11.18 million records including names, birth dates, gender, emails, phone numbers and order history. The company said it blocked the intrusion upon discovery, completed a follow-up investigation on October 13, and reported the incident to Japan's Personal Information Protection Commission.
Security researcher Azdoufal found that Energize Lab's Eiliko robot companion, which uses AI to converse with owners, stored conversation data on servers with no apparent access protections. The exposed database reportedly contained roughly 13 million conversations tied to about 68,000 active devices worldwide, including over 31,000 profiles linked to children in the US. The Verge says it purchased and tested the device, confirming a conversation was accessible almost immediately after being recorded.
The UK's Legal Aid Agency said further analysis of an April 2025 breach found that roughly 250,000 stolen records predate 2007, with the earliest verified record from 1978. Most stolen data covers applications, claims and payments from January 2007 to May 2025, but the agency confirmed a smaller, older trove was also taken. The agency had previously disclosed theft of applicant and provider data including contact details, national ID numbers, criminal history, financial information and portal credentials.
A hacker told Danish outlet Politiken that they accessed Denmark's Central Register of Persons by breaching accounts at Pays ApS, a private firm with authorized CPR access, several of which used the password '123456.' The breach exposed names, addresses and ID numbers of 8.8 million living and deceased Danes, and records show the attacker ran roughly 14 million automated searches over about ten days in September before a staffer at another government ministry flagged unusual billing activity.
A hacker claims they breached Denmark's Central Register of Persons by exploiting a Pays ApS account secured only with the password '123456'. The Danish government confirmed 8.8 million records were extracted, discovering the breach 12 days later via an unusual invoice, and Pays ApS's managing director Sophie Laursen confirmed the access point. The hacker says they do not intend to sell or leak the data.
The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive and ransomware expert, in connection with a hack that exposed sensitive data of current and former FBI employees. He faces extortion and threat-related charges and has been moved to Texas's Eastern District for a detention hearing. FBI Director Kash Patel announced the arrest without naming the suspect, but sources confirmed Dubrovsky's identity to CNN.
Danish newspaper Politiken reported that at least three accounts at Odense-based IT firm Pays, including an administrator account, used the password '123456' when hackers accessed Denmark's CPR civil registration database. The breach reportedly exposed data linked to about 8.8 million CPR numbers, with an anonymous hacker claiming access lasted over 21 days starting 10 September after obtaining a leaked password from a former employee of another small Danish firm.
A group calling itself Xuanye Group said it breached ASOS after impersonating a trusted contact to obtain one employee's login credentials, then used that access to reach multiple internal systems, including the platform used to send push notifications to ASOS's mobile app users. ASOS has around 17 million customers and 2,800 employees; the company says this incident is separate from a July breach at ASOS US that affected nearly 140,000 people via credential stuffing.
Jordanian authorities detained a suspected member of the ShinyHunters hacking group this month, following the gang's unverified claim that it stole data on nearly all FBI employees and applicants via a third-party jobs portal, which it also defaced. The suspect is reportedly cooperating with investigators, and the arrest follows a Dutch-FBI operation last month that netted another alleged member of the group.
FBI Director Kash Patel announced the arrest of another suspected ShinyHunters co-conspirator linked to the breach of the FBIjobs.gov platform. The New York Times identified the suspect as a Canadian citizen arrested in Pennsylvania, described as a primary participant in the intrusion, though the FBI has not released his name or charges. This marks the second arrest in days connected to the group behind the hack.