Lightning AI's security incident notice says that on 15 October at 11:00 PM UTC it identified a security incident on the Lightning Platform involving unauthorized access to credentials, and that it revoked all user access to the platform on 16 October at 1:00 AM UTC. Lightning says the incident involves Lightning Studio Platform services such as Studio, Deployments, Pipelines and Drive, and not the GPU cluster rental infrastructure or managed services like Kubernetes and SLURM. Lightning says it believes certain customer credentials were compromised to gain access to environments and connected third-party services, that it has revoked all identified credentials used in the incident, and that it is working with an independent external cybersecurity firm. Lightning says customers identified as potentially affected to date have been notified, and that users who have not received a notification have not been identified as affected based on its investigation to date. The notice itself carries no date; Lightning's status page first reported emergency maintenance at 03:08 UTC on 16 October, linked the notice at 20:34 UTC that day, last updated the incident at 12:49 UTC on 19 October, and still listed it as unresolved ('Service is down to address a security incident') when checked on 26 October (Perth).
Lightning AI — October 2026 Security Incident (undated notice; linked from Lightning's status page 16 Oct 2026, 20:34 UTC)
breaches cloud identity ai
The California Department of Education (CDE) said on 16 October 2026 that ETS, the nonprofit assessment organisation that runs California's statewide student assessments (CAASPP and ELPAC), has begun notifying students and families of a data breach. According to the ETS notice published by CDE, ETS found unauthorised activity on 25 September on a secure file transfer protocol (SFTP) site used to exchange statewide assessment information with CDE; an unauthorised party had used a compromised login credential at various times between 22 May and 18 September 2026 to copy files of California student information. Data on all students enrolled in the three previous school years was accessed and copied, as well as some former students, and may include names, dates of birth, home addresses, schools, districts and grade levels, statewide and local student identifiers, gender, race or ethnicity, primary language, country of origin and English learner status, disability and Section 504 status, assessment accommodations and primary disability type, eligibility for Title I, McKinney-Vento (homeless) and military-connected programs, and English proficiency and assessment results. More than 5.7 million students were enrolled in California in the 2025 school year. Social Security numbers, licence and passport numbers, financial and card details, passwords and parent or guardian information were not involved. ETS disabled the account, took the SFTP site offline and built a new one, paused normal enrolment data processing and some assessment activities, and says it has taken steps with law enforcement and cybersecurity experts to reduce the risk of the data being published and has found no sign so far that it has been. No group has claimed the attack. Notices began on 16 October and will continue into early November, in 27 languages, with two years of free Experian IdentityWorks identity protection. CDE says it is reviewing ETS's compliance with its data-security and contract requirements. Primary: CDE news release and ETS notice (16 Oct); wire: The Record (20 Oct).
California Department of Education — ETS begins notifying California students and families following data security incident (16 Oct 2026)
breaches identity
Russia's federal education supervisor Rosobrnadzor said on 19 October 2026 that it had restored its online systems after a cyberattack on its resources and those of the Federal Institute for Education Quality Assessment (FIOKO), its subordinate body that runs national education-quality testing. During the attack on Friday 16 October, students answering questionnaires on the Edutest assessment platform were shown messages urging them to join an underground movement against President Vladimir Putin instead of the next question, and assessments at schools and vocational colleges across the country were suspended. The disruption hit a major stage of the programme, which runs from 12 to 29 October, when 9th-grade students in 29 regions were due to sit questionnaires; the results rate institutions, not individual students. A pro-Ukrainian group calling itself Black Spark claimed responsibility on Telegram and denied trying to recruit minors. Rosobrnadzor has not said how the attackers got in or whether any data was taken. Primary: Rosobrnadzor statement (MAX channel); wire: The Record (20 Oct).
Rosobrnadzor — statement on restoration of online resources after the attack (MAX channel, 19 Oct 2026; Russian)
breaches
Nikkei Inc. said on 16 October 2026 that a cloud service it uses for system development was accessed without authorisation and that, as of 16 October, about 1.83 million items of personal information had leaked. About 150,000 items contained at least one of name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The other roughly 1.68 million items held only identifiers that cannot identify a person on their own. No credit card information was involved. Nikkei says the credentials used were stolen by unknown means, the access took place from the early hours to the morning of 7 October, and personal information stored in the cloud was taken. It has disabled the credentials, reported the incident to Japan's Personal Information Protection Commission on 11 October, and will contact each person whose information is confirmed to have leaked. As of 16 October it had found no misuse of the data, no system outages and no data tampering. Nikkei has not named the cloud service or an attacker. This is a separate incident from the hijacked Microsoft 365 account that sent about 9,000 phishing emails on 30 September and the earlier Google Workspace account compromise, both covered on this desk (/n/nikkei-m365-email-phish-breach-20261004); Nikkei has not said whether they are connected. Primary: Nikkei Inc. notice (English and Japanese, 16 Oct); wire: BleepingComputer (19 Oct).
Nikkei Inc. — Personal Information Leak Due to Unauthorized Access (16 Oct 2026)
breaches cloud identity
Incidents
Fri 16 Oct
Updated Sun 25 Oct
ConnectWise says it found unauthorised access to application identities in its Cloud Backup environment (the Microsoft 365 and Google Workspace backup service for MSPs, formerly SkyKick). Its Trust Center advisory, first posted 16 October 2026 and updated 17 October 05:01 UTC, says it has shut off Cloud Backup application access as a protective step, which interrupts backups until further notice; it has no indication so far that partner backup data was compromised and the existing backup archive is not affected. Huntress, which found the activity, says the app's Microsoft 365 credential (API secret) is in an attacker's hands: on 15 October between 06:13 and 08:34 UTC it was used from 144.172.64[.]128, a hosting-provider address, to obtain Microsoft Graph tokens in customer tenants, moving through tenants in sorted order a few seconds apart, which points to a script. As of 19:00 UTC on 16 October Huntress had confirmed unauthorised sign-ins in 162 tenants, and says the credential works in every tenant where the app is consented, so any organisation with it installed is exposed. The app's consent covers mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, and some directory reads leave no audit trail. Huntress also saw the same IP password-spraying four law-firm tenants on 13 and 14 October, and in one tenant a ConnectWise Cloud Management app for Teams added itself to Global Administrator and added new secrets to an MSP management app and Huntress's own app; it has not tied that earlier activity to the same operator. Todyl separately reported the same Graph sign-ins and notes that revoking user sessions does not end app access. No country breakdown has been published. Primary: ConnectWise Trust Center advisory; research: Huntress (16 Oct); wire: The Hacker News (18 Oct). UPDATE 17 October (ConnectWise, 17:00 UTC): ConnectWise says it suspended the Cloud Backup service by revoking the certificates used for the affected application connections for all users, so the shared credentials previously used for Cloud Backup are no longer valid. It has brought in an outside incident response firm, has not seen successful threat activity in the environments it monitors since the mitigations, and has no evidence that the encrypted backup archives were accessed; archives are preserved but backup and restore remain unavailable until service is restored. ConnectWise says Cloud Backup gives it no visibility into partner and customer tenants, so it cannot tell whether a given Microsoft 365 tenant saw unauthorised activity; partners must check their own. UPDATE 17 October (Huntress, 21:15 UTC): Huntress now counts almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, more than 300 of them successful, although tenants without the app's service principal could not be accessed. It also found a second, targeted wave on 15 October against 16 tenants in the policy, national security, trade and critical-minerals sectors, most of which do not use ConnectWise products; an automated sweep for Graph tokens (09:25 to 12:35 UTC) was followed by what looked like a manual sweep (13:54 to 14:20 UTC) aimed at Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs, and failed where the app was not present. The credential added to a Huntress application in one tenant came from private Azure IPv6 space rather than the earlier IP. Huntress has received unverified outside reports of similar, apparently hands-on activity in other tenants. UPDATE 18 October (ConnectWise, 01:00 UTC): ConnectWise says it first identified the issue on 14 October and at 07:00 UTC on 17 October disabled seven of its application identities: ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and six ConnectWise Cloud Management apps, the base app (2399d300-6fca-4e6a-a686-399fefe75b83) plus MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), MS Graph (0de14c77-b9b0-4137-9360-34878a929827), Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e) and SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb). It stresses that disabling them stops new sign-ins through those connections but does not undo changes already made inside a tenant, that previously issued access tokens may stay usable until they expire, and that any credentials, roles or consents an attacker added through other identities need separate clean-up. As a further precaution it has taken SaaS Security (monitoring and alerting) and Cloud Management (user and licence management) offline; Cloud Backup stays suspended with no restoration time, scheduled backups are not running and archives cannot be restored, though ConnectWise says they remain encrypted and it has no evidence they were accessed. It has engaged an outside forensics firm and says it has not yet established whether a product vulnerability was involved; how the credential was exposed is still under investigation. Huntress told The Hacker News it last saw malicious sign-ins from the original IP at 08:45 UTC on 15 October, with targeted manual activity until about 14:20 UTC, and has confirmed abuse of the Cloud Management Teams app in one tenant. UPDATE 18 October (ConnectWise, 18:45 UTC; 19 Oct 02:45 Perth): ConnectWise lists two further attacker IP addresses, 144.172.64[.]99 and 144.172.64[.]60, shared through downstream monitoring of partner and customer environments, alongside the original 144.172.64[.]128, and asks partners to include all three when reviewing Microsoft 365 sign-in and audit logs. Its 16:00 UTC update reported no new confirmed findings; Cloud Backup, SaaS Security and Cloud Management stay suspended, archives remain encrypted and isolated with no sign of compromise, and ConnectWise says that finding does not establish whether individual live tenants were affected. iTnews (19 Oct) reports that the rogue secrets added to the MSP management app and Huntress's app in the one tenant were both set to remain valid until 2028, which would have allowed a return after ConnectWise's own credential was cancelled; Huntress says it found and removed the credential on its app on 16 October. UPDATE 19 October (ConnectWise, 13:45 UTC; 21:45 Perth): ConnectWise says it has not seen successful threat activity in the environments it monitors since 17 October 05:00 UTC (1:00 pm Perth), with containment measures still in place. Cloud Backup, SaaS Security and Cloud Management remain suspended, scheduled backups, archive access and restores are still unavailable, and there is no confirmed restoration time; it will publish a timeline and any reconnection instructions once confirmed. It asks partners who serve customers through a reseller, distributor or marketplace to make sure the administrator of each customer tenant receives and acts on its remediation guidance. UPDATE 19 October (Huntress, 1:30 pm ET / 17:30 UTC; 1:30 am Perth 20 Oct): reviewing application sign-ins across more than 10,000 tenants with ConnectWise apps where it can see logs, Huntress says only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-ins. The other circulating addresses in the same provider range (AS14956, RouterHosting) showed only failed user logins or password spraying, which Huntress does not currently link to the app sign-ins: 144.172.64[.]99 (concentrated spray, 10–14 Oct), 144.172.64[.]60 (a few failed logins, 18 Oct) and 144.172.94[.]243 (broad, ongoing spray against many organisations). Huntress has found a second tenant with post-compromise activity. In both tenants the actions ran within two minutes of each other at about 03:45 UTC on 15 October (11:45 am Perth): the ConnectWise application granted itself Global Administrator, then planted new secrets on a few other applications registered in the tenant, apparently chosen at random and often low-privilege ones, to keep a foothold. Huntress found no mailbox or file tampering or user or policy changes in those two tenants, but notes Microsoft Graph directory reads leave no audit record. The last confirmed successful sign-in with the stolen credential was at 08:44 UTC on 15 October (4:44 pm Perth); since then it has seen only failed attempts. UPDATE 19 October (ConnectWise, 18:50 UTC; 2:50 am Perth 20 Oct): containment remains in place with no successful threat activity seen since 17 October 05:00 UTC; ConnectWise says it is monitoring its entire environment and sees no indication of impact beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, all three of which remain suspended with no restoration time yet. It has published a video walkthrough of its Cloud Backup technical investigation and remediation guide, and repeats that affected applications must stay disabled until it issues formal restoration instructions. UPDATE 20 October (ConnectWise, 00:45 UTC; 8:45 am Perth): ConnectWise says it has strengthened administrative-access protections and is resetting accounts and replacing application credentials in the affected environment, with third-party forensics still validating remediation; existing Cloud Backup archives remain encrypted, isolated and preserved with no indication they were compromised, though it stresses this does not show whether live Microsoft 365 tenants were affected, so each tenant still needs review. Services will come back in controlled phases, with partner instructions issued before anything is re-enabled; no restoration time yet, and the next update is due by 13:00 UTC on 20 October (9:00 pm Perth). UPDATE 20 October (ConnectWise, 13:01 UTC and 19:05 UTC; 9:01 pm 20 Oct and 3:05 am 21 Oct Perth): ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 19 October and is finishing security validation before restoring services in controlled phases, core infrastructure first, with extra review of the most sensitive connections. Once restoration starts it expects it to take several days; it will give a firmer timeline after the first full day of restoration work and will issue instructions before partners need to re-enable connections. Cloud Backup, SaaS Security and Cloud Management stay suspended, so scheduled backups, archive access, restores, SaaS Security alerting and Cloud Management user and licence management are still unavailable. It is still working with outside specialists to find how the access first happened and its full scope, sees no impact on other ConnectWise products, and has started partner technical webinars every two hours from 18:00 UTC on 20 October (2:00 am Perth 21 Oct) walking through Entra ID sign-in and audit logs, app registrations, credentials and permissions, including legacy backup integrations. UPDATE 21 October (ConnectWise status page, 14:35 UTC; 10:35 pm Perth): ConnectWise says it has begun restoring services in controlled phases after remediation and security validation, with each restoration step subject to security review, and expects restoration to take several days; it says service will return in stages and the start of restoration does not mean all capabilities are available. It will publish step-by-step instructions on when and how partners should reconnect affected services, including any reauthorisation and verification steps, and says partners should keep affected application connections disabled until then. Its investigation continues alongside restoration; existing backup archives remain encrypted, isolated and preserved with no indication of compromise, which it says does not establish whether individual partner or customer Microsoft 365 environments were affected, and it sees no indication that other ConnectWise products are impacted. Next update due by 19:00 UTC on 21 October (3:00 am Perth 22 Oct). UPDATE 22 October (ConnectWise status page, 00:52 UTC; 8:52 am Perth): ConnectWise says phased restoration is underway, with each step subject to security validation, and still expects restoration to take several days; partners should keep affected connections disabled until formal instructions apply to their service. It says existing backup archives remain encrypted, isolated and preserved with no indication of compromise, that it has no indication other ConnectWise products, services or offerings are impacted by this incident, and that individual Microsoft 365 tenants still require review for unauthorised changes or persistent access. ConnectWise says that beginning 22 October it will publish updates twice daily. UPDATE 22 October (attribution): In a Trust Center update at 22:00 UTC on 21 October (6:00 am Perth 22 Oct), ConnectWise says that, based on the evidence available to it, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on Cloud Backup, and that the group used an openly available agentic AI framework to automate and speed up its operation; ConnectWise says its containment and phased restoration do not remove unauthorised access that may already have been established within individual customer tenants, which require separate review. In a Microsoft Security Blog post (21 Oct, 18:23 UTC; 2:23 am Perth 22 Oct), Microsoft assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible for the ConnectWise supply chain compromise, and says the actor used ARTEX, an agentic AI penetration testing framework, to accelerate scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims. Microsoft says that following the unauthorised access Storm-0940 used ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in some environments the agents progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups and privileged roles, which Microsoft warns can remain active as a backdoor. Microsoft also says Storm-0940 infrastructure at 144.172.64.99 ran a cross-tenant password-spray campaign against 327 accounts across eight organisations between 10 and 14 October in which no successful authentication was observed, that the presence of an affected application or a successful sign-in does not necessarily mean customer data was accessed or exfiltrated, and that the activity did not result from a compromise of or vulnerability in Microsoft corporate systems, products or services. UPDATE 23 October (ConnectWise status page, 01:11 UTC; 9:11 am Perth): ConnectWise says service restoration work is progressing and it anticipates completing testing and security validation of the restored environment by the end of this weekend, which, subject to successful completion, will let it begin returning capabilities to partners in phases: first a process for partners who need to restore data from existing backups, which it currently anticipates enabling early next week, then phased full-service re-enrolment with step-by-step instructions. Partners should keep affected application connections disabled until ConnectWise provides instructions that apply to their service. ConnectWise says that starting 23 October it will move to once-daily updates. Updated 23 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says its teams and independent specialists are continuing restoration testing and security validation, which it expects to complete by the end of the weekend; it then anticipates enabling a process for partners to restore data from existing backups early next week, followed by phased re-enrolment supported by step-by-step instructions, video tutorials and webinars. Partners should keep affected application connections disabled until ConnectWise gives instructions for their service; existing backup archives remain encrypted, isolated and preserved with no indication of compromise; and ConnectWise will publish updates once daily at 14:00 UTC. (source: ConnectWise) Updated 24 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says services are being brought back online in a controlled sequence, including rotating certificates across its infrastructure, with restoration, testing and security validation continuing through the weekend and a target of beginning phased partner onboarding on Monday 26 October, subject to the required checks. It anticipates enabling backup restoration for partners on Monday, followed by phased re-enrolment, and says bringing infrastructure online does not mean all partner capabilities are available. Existing backup archives "remain encrypted, isolated and preserved, with no indication of compromise", and it has no indication that other ConnectWise products, services or offerings are impacted. (source: ConnectWise) Correction (24 Oct 2026): an earlier version said The Hacker News reported 173 affected tenants on 17 October; The Hacker News's article is dated 18 October and does not give that figure, so it has been removed. (source: The Hacker News)
ConnectWise Trust Center — Cloud Backup (formerly SkyKick) service interruption advisory (16–18 Oct 2026)
breaches cloud identity ai
Incidents
Fri 16 Oct
Updated Fri 23 Oct
Canny, a customer-feedback platform used by Sydney-based Canva, told Canva on 29 August 2026 that it was investigating unauthorised access to its systems. Canny was connected to Canva's Salesforce account, so the intruder reached limited information about some Canva enterprise customers, mainly larger customers handled by Canva's sales team. A Canva spokesperson told Capital Brief (21 September) that the exposed data included business contact details and contract information, that Canva immediately removed Canny's access and notified affected customers, and that Canva's own platform was not compromised and Canva accounts, passwords, designs and content were not accessed. Other Canny customers have published their own notices. VRChat (18 September) said Canny told it on 28 August that an unauthorised party had accessed one of Canny's internal systems, and that Canny's investigation with an outside forensics firm found no further unauthorised activity after 28 August. Anaconda (12 October) said it rotated all credentials and integrations connected to Canny and has stopped using it. A group calling itself The Seven Deadly Sins has claimed the attack; Canva has not confirmed the group's claims. The case shows how a SaaS-to-SaaS integration token can carry a vendor breach into a customer's CRM. Primary: Canva statement via Capital Brief; vendor-side notices: VRChat, Anaconda. UPDATE 19 October 2026 (Cyber Daily): Canva gave a fresh statement after the leak-site listing, saying unauthorised access to Canny reached 'some enterprise customer records' through its Salesforce connection, including business contact details and routine business documentation; that it removed Canny's access, informed affected customers where required, complied with its obligations and worked with relevant agencies; and that Canva's own platform, accounts, passwords, designs and content were not affected. Correction (23 Oct 2026): removed The Seven Deadly Sins' own claims about record counts, data types, time inside Canva's systems and a sale; Canva has confirmed only that some enterprise customer records were exposed through Canny. (source: https://www.cyberdaily.au/security/14317-exclusive-aussie-software-giant-canva-confirms-third-party-data-incident)
Capital Brief — Canva enterprise customer data exposed in third-party breach (Canva statement, 21 Sep 2026)
australia cloud
iTnews reported on 16 October 2026 that WAGD, an Australian dog-harness retailer on Shopify, remains closed on Shopify's advice after malicious JavaScript delivered through third-party theme extensions redirected at least one shopper to a fake checkout on 13 October. Logbase, maker of the Selleasy upsell app (claimed 49,000+ active stores), said an unauthorised party accessed an internal Selleasy tool and added a malicious script to store settings; the attack window was 07:47–15:00 UTC on 13 October (evening into early morning AEST). Logbase said Shopify confirmed at 15:40 UTC that malicious code delivered through Selleasy had been removed, then locked the abused setting, tightened authentication and hired a third-party firm. Selleasy is currently listed as unavailable on the Shopify App Store. HulkApps separately disclosed that unauthorised configurations altered its Hulk Product Options theme extension in a global attack; developer Roman Zipp documented a function named hijack that cancelled the real checkout click and sent shoppers to lookalike payment domains including biliing[.]top and checkout-confirm[.]top, firing only once per browser session. Shopify temporarily disabled the HulkApps extension while the code was removed. Logbase said it has no evidence of a breach of its own systems but cannot rule out customers entering details on the fake pages. Shopify did not reply to iTnews before publication. Primary: iTnews (16 Oct 2026); vendor notices: Logbase and HulkApps.
iTnews — Shopify tells Australian store to stay shut after hijacked extensions divert shoppers (16 Oct 2026)
australia cloud
ABC News reported on 16 October 2026 that newly surfaced emails show sensitive Australian federal court transcription data was sent to India more than a decade ago under Auscript, and that court leadership treated the 2014 disclosure as a minor issue despite contract language forbidding transfer of information outside Australia. Former Auscript national manager Paul Cutbush raised Public Interest Disclosures with the family court, Federal Court and AFP in December 2014; a 2016 family court reply said there was 'no express provision' preventing offshore work, while Cutbush says the contract did forbid it. ABC links that history to VIQ Solutions (Auscript's successor), which earlier in 2026 breached its Commonwealth contract by allowing highly sensitive court files to be accessed in India; shortly after ABC coverage of that breach, VIQ was put into liquidation amid calls for a forensic audit and national-security concerns. A Federal Circuit and Family Court spokesperson said current leadership was unaware of the earlier Auscript offshoring. Shadow Attorney-General Michaela Cash and Greens leader David Shoebridge called for investigation. Primary: ABC News.
ABC News — Federal courts knew Australian data was sent to India more than a decade ago but took no action (16 Oct 2026)
australia identity
Incidents
Fri 16 Oct
Updated Sun 25 Oct
Poole Group, a Sunshine Coast accounting and business advisory firm founded in 1980, was listed on the LockBit ransomware gang's leak site, according to Banking Daily (16 October). On 16 October a company spokesperson told Banking Daily / Cyber Daily that Poole Group is responding to a cyber incident that affected part of its IT environment in recent days: it implemented containment measures, engaged external cyber security specialists, and notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and the Australian Taxation Office. The investigation into nature and scope is ongoing; the firm says it will contact individuals directly if it determines any were affected. According to Banking Daily, the gang did not disclose what data it allegedly took or list a ransom value. Accounting firms hold tax file numbers, identity documents and financial records, so clients should watch for targeted phishing or invoice-redirection attempts. Primary: Banking Daily company statement (16 Oct). Correction (25 Oct 2026): removed a leak-site tracker link and the gang's publication countdown; the listing is now credited to Banking Daily. The card date has moved from 14 to 16 October 2026, the Perth date of Banking Daily's report (16 October 09:38 AEST, 07:38 Perth time (AWST)); the earlier date came from the tracker. (source: Banking Daily)
Banking Daily — Poole Group investigating LockBit ransomware attack; OAIC, ACSC, ATO notified (16 Oct 2026)
australia
An ABC investigation published on 15 October 2026 found that the same LinkedIn accounts used to groom businessman Alexander Csergo, the first person convicted of reckless foreign interference in Australia, also reached out to many other Australians. LinkedIn records the Australian Federal Police obtained during the Csergo case show two accounts posing as think-tank and consultancy representatives (including 'Vera Su' of 'Nesa Consulting') built thousands of connections worldwide; between 2016 and 2025 they targeted more than 100 people linked to Australia and messaged 58 of them, offering paid consulting work for 'valuable advice' and, in one message, asking for information 'from important people in the government'. Those approached included people listing jobs at Austrade, the Department of Foreign Affairs and Trade, Investment NSW, Invest Victoria and Tourism Australia, an AFP commander and senior federal officials; Steven Miles, now Queensland Opposition Leader, was connected to the Vera Su account in April 2021 while deputy premier, though the ABC saw no messages and understands he did not reply. Some recipients shared personal contact details or moved conversations to WeChat, phone calls or meetings. A fictitious security firm, 'Data 31', also sought retired Australian police officers as part-time 'security expert' consultants, contacting at least seven Australians, according to Information Age's summary of the ABC reporting. The AFP alleges the operation was run by China's Ministry of State Security (MSS); the Chinese embassy called the claims 'entirely groundless', and ASIO would not comment. Csergo was approached through LinkedIn in Shanghai in November 2021, convicted in March and sentenced in September to three years and six months' jail; the court heard his reports used publicly available material. The accounts have since been deregistered following the AFP investigation; LinkedIn told Information Age that fake accounts breach its terms and it is focused on state-sponsored abuse. The Five Eyes partners warned in June about Chinese intelligence recruiting through online job platforms.
ABC News — Alleged Chinese spies targeted former premier and AFP commander via LinkedIn (15 Oct 2026)
australia identity
Incidents
Thu 15 Oct
Updated Wed 21 Oct
Google Threat Intelligence Group (GTIG) and Mandiant, working with ManageEngine's Threat Analysis Lab, disclosed on 15 October 2026 that AOMEI Technology's origin update servers for AOMEI Backupper were repeatedly tampered with between April and July 2026. In confirmed windows on 28 May (10 minutes), 16 July (6 minutes) and 20 July (5 minutes) UTC, attackers briefly changed the unsigned down_html.ini and Notifycfg.ini files that Backupper polls over HTTPS so any client that checked for an update during those minutes downloaded and ran a trojanised package. There was no software vulnerability: the client trusted the MD5 checksum inside the same unsigned configuration file that named the download. GTIG tracks the cluster as UNC7017. On hit machines a CROSSROAD downloader staged a signed Radmin binary beside an attacker DLL that loaded the SHINYROAD implant (later Adaptix C2 on some hosts), set a scheduled task, and restored the local update file so the machine looked clean while the vendor's download page also looked clean again within minutes. GTIG telemetry spans IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States; victimology is opportunistic. AOMEI told Mandiant on 29 July that it had secured the servers; ManageEngine said it had not independently confirmed containment as of publication. Backupper's changelog through 8.5.0 (9 Oct) lists no change to update verification. Primary: Google Cloud / GTIG (15 Oct); vendor analysis: ManageEngine Threat Analysis Lab; wire: The Hacker News (16 Oct). UPDATE (19 Oct, BleepingComputer): ManageEngine says it first told AOMEI about the suspicious activity on 7 June, when AOMEI suggested the files may have been altered in transit (the researchers disagreed). After capturing the 16 July tampering, ManageEngine sent AOMEI the original and modified files, hashes and differences, advised it to preserve evidence before moving the configuration files to new infrastructure, and put it in touch with Mandiant. AOMEI told BleepingComputer it is treating the matter as a high priority, that its chief technology officer is leading an internal investigation, and that a more detailed response will follow. It has not said how the attackers got into its update infrastructure or confirmed that the compromise is fully resolved. UPDATE (19–20 Oct): AOMEI released Backupper 8.5.1 on 19 October as a security update for the tampering incident. Its changelog says it turns off the in-app entry points for promotional pop-up content and automatic software updates, adds asymmetric encryption to remote configuration files including the .ini files, stops using the old update domain www2.aomeisoftware.com, separates software updates from marketing configuration and download resources, and only accepts update files from official AOMEI websites. In an email to The Record on 20 October, AOMEI confirmed that attackers repeatedly altered configuration files on its update servers between April and July. It said its own investigation after ManageEngine's first warning 'rectified some potential vulnerabilities' but could not find the root cause, and that it only found traces of the intrusion in server logs after ManageEngine supplied the exact tampering times in July. AOMEI said it has not yet identified or notified infected customers, will assess and contact potentially affected users, has released a free detection tool, and saw anomalies only in Backupper, not AnyViewer. Google said it has notified the victims it identified, and that in the 20 July window the attackers also used an invisible pop-up to make machines send Windows password hashes to an attacker-controlled server, which could work even where the malware itself was blocked. Vendor: AOMEI changelog; wire: The Record (20 Oct).
Google Threat Intelligence / Mandiant — Investigating ephemeral supply-chain tampering (AOMEI / UNC7017, 15 Oct 2026)
breaches australia cloud
BK Japan (株式会社ビーケー・ジャパン), operator of Burger King restaurants in Japan, published a customer notice on 15 October 2026 saying a third party gained unauthorised access to the system that manages official smartphone-app member data. The access window was Friday 2 October through Wednesday 7 October 2026; the company says it confirmed the leak on Tuesday 13 October and immediately blocked the source. About 11.18 million member records were involved. Fields named in the notice include member ID, email address, registration type, prefecture, gender, date of birth, name (kanji and kana), phone number, whether the member had mobile-order history, and whether the email was verified. BK Japan says it does not hold credit-card numbers, so cards were not in the leak, and that login-password leakage has not been confirmed. It has not confirmed secondary misuse so far. Actions listed: cut off the attacker, temporary mitigations, an incident response team, a report to Japan's Personal Information Protection Commission, ongoing investigation with external specialists, and email notices to affected customers. Primary: BK Japan customer PDF notice (15 Oct 2026); wires: Kyodo (15 Oct) and BleepingComputer.
BK Japan — apology and notice on unauthorised access to official-app member information (15 Oct 2026, Japanese PDF)
breaches
