Socket (28 August 2026) reports that ten versions of npm package @7nohe/openapi-react-query-codegen were published that day after a comment-triggered GitHub Actions trusted-publishing workflow was abused. An untrusted GitHub account could comment a publish trigger on a pull request and ship fork code under the repository OIDC identity. Versions named by Socket and Step Security are 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, 3.0.4, plus two 0.0.0-sha prerelease tags. Stable releases ran obfuscated JavaScript 3FWCvzduYZg.js via binding.gyp and/or a preinstall hook. Socket describes Mini Shai-Hulud-consistent self-propagation. Install-time code targeted cloud credentials, package-registry credentials, GitHub Actions secrets and AI-agent configuration. All ten carried valid npm provenance. Pin known-good 0.5.3, 1.6.2, 2.2.0 or 3.0.2, isolate affected hosts, then rotate tokens. This desk does not attribute the package to TeamPCP; Socket and Step Security do not name that group.
Socket (28 Aug 2026)
tech cloud identity
Hasbro's Massachusetts consumer letter (OCABR 2026-1427, posted in the August 2026 breach-letter list) says a data security incident may have involved employee personal information after a compromised employee account. Hasbro says it disabled that account, terminated unauthorised access, and added safeguards. The letter says involved information varied and may have included name plus one or more of email, address, phone number, national ID number, or financial information. BleepingComputer, citing the Massachusetts 2026 Data Breach Notification Report, says 436 Massachusetts employees had Social Security numbers, financial-account information, credit/debit card numbers, or driver's-licence information involved. Hasbro has not published a nationwide total. Hasbro did not link this notice to its March 2026 incident. No customer impact is stated in the letter.
Hasbro MA consumer letter (2026-1427)
breaches identity
Cyber Daily's 28 August 2026 report quotes a Sharp Motor Group spokesperson confirming the Tweed Heads, NSW dealership is aware that its third-party IT provider has been involved in a cyber incident. The company said it is working with independent cyber specialists and relevant authorities, has notified the OAIC, and that staff and customer privacy remain the priority. Cyber Daily reports the Storm ransomware group listed Sharp Motor Group in a 23 August leak-site post and published sample files it claims were taken (including identity documents and financial material); those actor claims and any data-volume figures are not independently confirmed in the company statement and are not treated as verified facts on this desk. Storm has also listed other Australian automotive and machinery firms this month; company responses for those other listings were not confirmed in the same report.
Cyber Daily (28 Aug 2026; quotes Sharp Motor Group)
australia retail
Incidents
Fri 28 Aug
Updated Sat 24 Oct
McKesson's 28 August 2026 customer notice and Form 8-K say it discovered a cybersecurity incident on 25 August 2026 affecting its information systems. The company says the investigation is in early stages and involves third-party applications plus unauthorised access and exfiltration of data. Updates are posted at mckesson.com/cybersecurity. A 29 August 2026 customer note on that page (heading: McKesson Cybersecurity Incident Investigation and Response Update) says McKesson continues to serve customers across all lines of business and accept orders, distribution centres remain operational, and shipping continues. That note does not add scope, named applications, or confirmation of actor claims. As of the 8-K filing date, McKesson had not determined the incident to be material or reasonably likely to have a material impact on financial condition or results of operations. The company has not publicly named the applications involved, the access path, or what was taken. Correction (24 Oct 2026): removed a reference to an extortion group's unconfirmed claims about patient records and access methods; McKesson's notice and 8-K do not confirm them. (source: https://www.mckesson.com/cybersecurity)
McKesson cybersecurity notice
breaches healthcare
iTnews (28 August 2026), citing an NSW Police statement, reports that a 30-year-old telecommunications employee was arrested at a police station in Sydney's west and charged over allegedly accessing customer data through his employment and selling it to criminal groups. Police allege the information was then used to commit fraud against multiple victims. Charges listed in that report are 12 counts of deal with identity info to commit an indictable offence, 12 counts of unauthorised function with intent to commit a serious offence, and 10 counts of agent corruptly receive benefit (34 offences). The arrest followed a Queensland Police referral. iTnews does not name the employer. The National Tribune reprint of the police release dates the arrest about 9.30am on Thursday 27 August 2026, refused bail to Liverpool Local Court the same day. These are allegations before a court.
iTnews (28 Aug 2026; quotes NSW Police)
australia identity
Incidents
Thu 27 Aug
Updated Mon 26 Oct
The US Bureau of Alcohol, Tobacco, Firearms and Explosives said in a press release, as reported by BleepingComputer (27 August US time; 27 August, 4:13 pm Perth), that a standalone system was breached in what it described as a 'major incident', which it is investigating with the Justice Department. BleepingComputer quotes ATF as saying the impacted system operates separately from the ATF enterprise network, that there is no indication the incident has affected the enterprise network, the ATF eForms system or any other ATF system, that on discovery ATF immediately terminated connections to the affected environment and initiated incident-response and forensic activities, and that it is coordinating closely with the Justice Department to investigate; BleepingComputer adds that ATF said the incident did not affect the agency's operations. BleepingComputer reported that Qilin added ATF to its data leak portal on 26 August without saying whether it had stolen files or demanded a ransom, and that ATF published its press release the same day. Actor claims are not treated as verified facts on this desk. UPDATE (25 Oct 2026): ATF said on X on 31 August (US time) that it is aware of claims about the possible publication of data allegedly obtained in the incident, which involved a standalone system used in connection with CALEA; that it is working with the Justice Department and other federal partners to assess the claims; that the affected system was separate from ATF's enterprise network; and that it has not confirmed the authenticity, nature or scope of the materials. (source: ATF on X) Correction (26 Oct 2026): ATF's press release cannot be read by this desk, so its text is now credited to BleepingComputer, which quotes it; an earlier correction saying the release was readable and was the primary source was wrong. Details that BleepingComputer does not report (the release's printed date, the designation of the event by senior Department officials, completed notifications and a statement about ATF's missions) and an unlinked SecurityWeek credit have been removed. The card date has moved from 28 to 27 August 2026, the Perth date of BleepingComputer's report. Earlier, on 25 Oct, we removed SecurityWeek's description of the Qilin post and credited the listing to BleepingComputer. (source: BleepingComputer)
BleepingComputer — ATF confirms "major incident" after recent Qilin breach claims (27 Aug 2026; quotes ATF press release)
breaches
Incidents
Thu 27 Aug
Updated Thu 22 Oct
MAG’s 27 August 2026 statement said an unauthorised third party obtained customer data from car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports (emails, phones, vehicle registrations, postcodes; no bank details; operations unaffected). SecurityWeek (3 September 2026) reports the FulcrumSec extortion group published roughly 550GB of uncompressed data after MAG reportedly refused a ransom, claiming access via exposed admin keys. Have I Been Pwned, which ingested the dump, put the scale at about 8.8 million email addresses and phone numbers, with names, browser agents, purchases and vehicle plates also present. FulcrumSec claimed on the order of 2.48 million purchases in the set. MAG’s original mediacentre statement remains the operator notice; treat FulcrumSec/HIBP figures as leak-site and breach-notification telemetry refining scope. Correction (22 Oct 2026): the headline previously stated the leak came 'after ransom refusal' as fact; SecurityWeek reports MAG 'reportedly' refused, and MAG has not said so. (source: https://www.securityweek.com/manchester-airports-group-data-on-8-8-million-people-leaked-after-ransom-refusal/)
MAG statement (27 Aug 2026)
breaches identity
Hachette Australia told ABC News that unauthorised activity on the computer systems of its distribution subsidiary Alliance Distribution Services (ADS) was believed to have occurred on 18 July 2026. As of the 27 August 2026 ABC report, Hachette said it was still restoring systems and services, could not yet confirm a timeline for a full return to normal operations, and that restoring full operations securely remained its top priority. The disruption has hit book supply to Australian bookshops and authors ahead of the busy trading period. Hachette has not publicly confirmed whether the incident involved ransomware, data theft, or another form of attack. Secondary commentary that labels the event ransomware remains unverified by the company.
ABC News (quotes Hachette)
australia supply chain
Joint AFP, Western Australia Police Force and FBI release: two West Australian men were charged on 26 August 2026 with a combined 14 offences after Perth search warrants. Police allege a syndicate inserted malicious code into software on an open-source repository that other developers then pulled in. The AFP estimates more than 1,000 organisations globally, more than 500,000 credentials, and at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. The FBI statement in that release names the group TeamPCP. The men are not named in the AFP release. The investigation continues; further arrests have not been ruled out. NEW GTIG/THN (Sep 2026): Google Threat Intelligence Group tracks TeamPCP as Altered Spider / UNC6780 and describes credential stealers SANDCLOCK and DUSTMAKER plus an autonomous multi-agent framework used in a large-scale credential harvest completed in under six hours.
AFP media release
australia supply chain
Incidents
Wed 26 Aug
Updated Fri 23 Oct
Boston Scientific's customer updates say it identified a cybersecurity incident on 25 August 2026 that resulted in a network outage and disruption to its operations; the incident affected access to certain operating systems and business applications, including the ability to manufacture products and to process and ship customer orders (updates of 26, 27 and 29 August). The company filed an 8-K on 26 August describing a global disruption to its operations. It worked with CrowdStrike and other third-party cybersecurity experts. Its 30 August update (8:25 p.m. ET) said it saw no indication of unauthorised activity in its environment related to the incident since 25 August, that there was no impact to its cloud-based systems and applications, and that the unauthorised activity was limited to certain on-premise systems. Its 27 August update said its investigation to date showed no impact to implantable cardiac rhythm management (CRM) device function or to remote monitoring of CRM devices monitored before the disruption, while new remote-monitoring activations were impacted. Actor identity is unknown on this desk. UPDATE (23 Oct 2026): Boston Scientific's 22 September 2026 update shares CrowdStrike's final investigation summary: the threat actor gained access to an external-facing network device and then to a limited portion of the on-premises IT environment. CrowdStrike found no evidence of ongoing threat actor activity after the 25 August containment measures, no evidence of compromise within Microsoft Office 365 applications (including email), other cloud-based applications or the listed business systems (manufacturing maintenance, product and software development, medical device maintenance, human resources and employee benefits, and SCADA environments), and no evidence that the actor accessed, staged or exfiltrated data from those systems and applications, including customer or patient data. Boston Scientific says customers and partners may safely continue normal business activities and system connections. (source: Boston Scientific (news.bostonscientific.com))
Boston Scientific — Update on the August 25 cybersecurity incident (22 Sep 2026)
breaches
Incidents
Fri 21 Aug
Updated Fri 23 Oct
Origin Energy confirmed unauthorised access to personal information of approximately 900,000 current and former customers in July 2026. Categories include name, address, date of birth, contact phone, account details, and partial payment data (last four digits of a credit card or last three of a bank account). On 21 August 2026 Origin said a completed review found about 60 customers had full bank account numbers accessed, about 100 had an ID document number accessed (number only, no scans), and about 15,000 had government concession-scheme numbers accessed. Origin told ABC the alleged attacker had not publicly leaked customer data. The company is working with ASD's ACSC, the National Office of Cyber Security, AFP and OAIC; a criminal investigation continues. Earlier reporting linked the incident to a former Accenture Manila call-centre worker; Accenture declined to comment to ABC. UPDATE (23 Oct 2026): AAP reports that at Origin's annual meeting on 14 October 2026 chairman Scott Perkins said: 'We have seen no evidence of the information being published on the internet or the dark web to date; however we note this risk remains and affected customers will need to remain vigilant to any suspicious activity or scams.' (source: AAP)
ABC News (quotes Origin 21 Aug update)
breaches australia
Oz Hair and Beauty's official statement says its online purchase and order platform was briefly accessed by an unauthorised third party. Limited personal information of some customers who purchased before August 2026 was involved: full name, email and/or mobile, and purchase data (currency, total spend, purchase location, customer creation date). The company says credit cards, passwords, payment information and invoice details were not accessed. It reported the incident to ACSC, OAIC and New Zealand's Office of the Privacy Commissioner. Customers not emailed by 22 August 2026 were, on that statement, not identified as impacted on the investigation to date. The company has not published a count of affected records.
Oz Hair and Beauty statement
breaches australia
