GMO Internet Group confirmed that attackers gained unauthorized access to its Onamae.com Desktop Cloud VPS service and installed malicious programs on nearly 27,000 customer server environments. The company began shutting down affected servers on October 21, 2026, taking all Desktop Cloud plans offline with no restoration date given. GMO says payment data was stored separately and wasn't affected, but customer-stored data may have been exposed.
bleepingcomputer.com
· 2026-10-21
A newly unsealed search warrant application says attackers remotely accessed Staples' internal customer-support application, dubbed Nexus, and pulled memory data that let them hijack active employee login sessions. Using those hijacked sessions, the group issued more than 15,000 gift cards worth over $5 million for retailers including Staples, Target and Sephora, then used the cards to buy electronics and other goods, much of it shipped to China. The filing does not name Staples directly, but 404 Media identified the retailer through corporate details and the Nexus system name.
techspot.com
· 2026-10-21
A threat actor claims to have exfiltrated 10.6 terabytes of data from PingCAP's TiDB Cloud platform over 88 six-hourly extractions spanning nearly two months, releasing an initial 200GB tranche publicly. The alleged haul includes control-plane databases, billing and cost records, source code, Jira and CRM data, and customer details covering 180,046 tenant organisations, 403,262 emails and over 115,000 plaintext API keys.
fulcrumsec.vg
· 2026-10-20
WordPress plugin maker TeamUpdraft disclosed that attackers breached its website over the weekend of October 17-18 and accessed its customer database, including password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The company says payment data was not stored and was unaffected, and that UpdraftPlus plugin files remain untouched, but researcher Oliver Sild of Patchstack says stolen keys are already being used to backdoor WordPress sites.
bleepingcomputer.com
· 2026-10-20
A Chinese crime ring breached Staples' internal customer support tool, Nexus, and used heap dump requests to hijack logged-in employee sessions, enabling them to issue more than 15,000 fraudulent gift cards worth over $5 million. The cards were then quickly spent by 'runners' at retailers including Target, Sephora and Lowe's before they could be canceled. The breach, reported to Homeland Security Investigations in October 2023, only became public after a related search warrant was unsealed last week.
tomshardware.com
· 2026-10-20
Revolut experienced a widespread service disruption starting Tuesday morning, affecting sign-ins, card payments, transfers, currency exchange, and live support for its app. The company said customer funds and data remain safe while it works to fix the issue, which reportedly stems from a power-related failure at a Google Cloud data center in London.
bleepingcomputer.com
· 2026-10-20
A Florida law enforcement agency reportedly stored Department of Motor Vehicles login credentials insecurely, allowing hackers to gain unauthorized access to the state DMV system. Details on the scope of the breach and the data accessed have not been fully disclosed.
yro.slashdot.org
· 2026-10-19
Nikkei Inc. disclosed that hackers used stolen credentials to access a development system on October 7, exposing 1.83 million personal data records stored in the cloud. The company said 150,000 records contained identifiable details such as names, emails, addresses, phone numbers or birthdates, while the remaining 1.68 million held no identifying information and no credit card data was exposed. Nikkei revoked the compromised credentials, notified Japan's Personal Information Protection Commission on October 11, and said it has found no evidence of misuse or system tampering so far.
bleepingcomputer.com
· 2026-10-19
The Florida Department of Highway Safety and Motor Vehicles confirmed that a hacker used compromised login credentials to access driver's license and motor vehicle records, including document images, on September 4, 2026. The agency is notifying affected residents and offering one year of free credit monitoring, though it says it lacks current contact information for some former Florida residents whose data was exposed.
arstechnica.com
· 2026-10-19
Model APIs made credentials directly spendable. A key in the wrong place is no longer just an access problem, it is an invoice, and the charges arrive before the alert does.
gokawiil.com
· 2026-10-19
Staffing software provider Bullhorn took its systems offline to contain a cyberattack that triggered a system-wide outage, starting with job-posting errors reported Friday and escalating to a full platform disruption by Saturday. The company says it has isolated and eradicated the immediate threat and is working with CrowdStrike to restore services, while a forensic investigation continues to determine whether customer data was exfiltrated.
bleepingcomputer.com
· 2026-10-19
Federal investigators tracking the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who had unusually close contact with the gang, according to sources cited by KrebsOnSecurity. One U.S.-based executive is suspected of helping the group operate a website used to pressure victims into paying ransoms. The probe follows ShinyHunters' breach of the FBI's recruitment site and the arrest of alleged member Pepijn van der Stap in the Netherlands.
krebsonsecurity.com
· 2026-10-19
GoKawiil