Huntress reported on 13 October 2026 (14 Oct Perth) a credential-phishing campaign built on a lookalike download site for WatchGuard Mobile VPN with SSL. In an incident it investigated in early October, an administrator at a managed service provider searched Bing for a WatchGuard SSL VPN download and opened the fake site from a normal search result, which Huntress classes as SEO poisoning rather than malvertising. Choosing any download option opened a prompt asking for VPN server, login and password; about 150 lines of JavaScript sent the values as JSON to a separate collection server, always rejected the first attempt as 'Incorrect data' to collect a second set, then started a download of the genuine, validly signed WatchGuard Mobile VPN with SSL 12.11.5 installer from WatchGuard's own CDN, so there was no malicious file for endpoint security to flag. The same lookalike domain had been reported by WatchGuard in January with no working back end; it was registered again on 22 August and paired with a new collection domain. Huntress says the main domain was offline as of 13 October and that it notified WatchGuard before publishing. Earlier waves of the same VPN-impersonation activity (including Microsoft's Storm-2561 reporting) used fake signed installers and malicious DLLs instead. This is a phishing campaign against VPN users, not a flaw in WatchGuard products.
Huntress — Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client (13 Oct 2026)
tech identity network
Incidents
Tue 13 Oct
Updated Sun 25 Oct
US authorities announced a new crackdown on North Korean remote IT worker schemes on 13 and 14 October 2026. A four-count indictment charges Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, who were arrested, with helping North Korean IT workers obtain remote jobs by housing and configuring laptops issued by US employers so the workers appeared to be in the US. Prosecutors say the scheme ran from 2019 to July 2025, generated more than US$3 million and placed workers at over 70 US companies in communications, cyber support, healthcare, manufacturing and retail; ten China-based people are also charged. Separately, in Operation Lonestar Roundup, the FBI searched over 40 residences in Texas between 21 and 25 September that were known or suspected laptop farms, and seized approximately 187 laptops and KVM devices, according to the Justice Department. CrowdStrike, which tracks the activity as Famous Chollima and assisted the operation, says victims of the disrupted clusters span aerospace, energy, financial services, healthcare, cybersecurity, defence engineering, government technology and consumer technology, and expects the disruption to be short-lived. The FBI's new public service announcement (PSA261013) warns the workers increasingly pay witting and unwitting US residents to appear on camera, sit interviews, verify identities, ship packages or keep company devices online from home, and recommends layered identity checks across the employment lifecycle. No Australian victims are named. Primary: FBI IC3 PSA; US Justice Department release (13 Oct, US time).
FBI IC3 — North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (PSA261013, 13 Oct 2026)
breaches identity
Incidents
Tue 13 Oct
Updated Thu 22 Oct
The US Department of Justice said on 13 October 2026 that Abdulrahman Alfozan, 35, a Saudi national who had worked as an OpenAI engineer since July 2025, was arrested on 9 October and charged with using or trying to use a device to intercept oral communications. According to the complaint, OpenAI staff found a covert audio recording device on 30 September plugged into a USB port behind a television in an executive conference room in one of its San Francisco buildings. The device was wrapped in toilet paper, had been installed around 28 September and stored encrypted data. The room was used for meetings on proprietary research, product plans, business relationships and government work. Prosecutors say camera footage showed Alfozan near the room several times though he was not invited to meetings there; that he searched an internal productivity tool for office, meeting-room and executive schedule details; that a chatbot account linked to his spouse asked how to build and hide recording devices, including prompts naming the device's custom header and MAC address; and that on 5 October he returned to check behind the television, the same day security staff found a second similar recorder in a bag he left in another room. In a statement on X, OpenAI said it used its own AI models 'to understand the device and where it had come from' and referred the matter to the FBI after finding an employee had planted it, and it told TechCrunch it has no indication he accessed or took model weights, source code or customer data (as reported by The Hacker News, which says he has since been terminated). The charge carries up to five years in prison. UPDATE (19 Oct US time; Reuters via iTnews, 20 Oct): asking a judge to keep Alfozan in custody as a flight risk, federal prosecutors allege in a detention memo that he was in frequent contact with an unnamed member of the Saudi royal family, who had tried to recruit him for an AI role in Saudi Arabia, and that a Saudi military official paid for one-way flights for his wife and young son to return to Saudi Arabia after his arrest. Prosecutors say he built customised, encrypted recording devices to secretly record highly sensitive meetings involving senior OpenAI staff, business counterparts and government officials; meetings with government officials took place in the conference room around the time the device was installed. Before his arrest he had planned to fly to Riyadh during two months of parental leave. Prosecutors say the investigation remains active and further charges could follow. His lawyer says the planned trip was booked before any investigation, for family and immigration reasons, and has asked for his release on conditions; the Saudi government media office did not respond to Reuters. UPDATE (20 Oct; court filing via The Hacker News): a US court granted the government's request to keep Alfozan in detention on Monday 19 October (US time). The filing says photos on his iPhone dated 22 to 28 September show another concealed recording device and the TV input panels in OpenAI buildings, including a second conference room used for sensitive meetings; parts matching the devices were found at his home; and he opened a folder named "Saudi Gov Docs" on 4 October and used an OpenAI productivity agent to look up Saudi government engagements. His wife and son had already left the US before his planned 12 October one-way flight to Riyadh.
US Department of Justice — Saudi national arrested for installing surreptitious audio recording device at OpenAI (13 Oct 2026)
breaches ai
Incidents
Tue 13 Oct
Updated Thu 22 Oct
The UK Housing Ombudsman Service, the public body that settles disputes between social housing residents and landlords in England, said on 13 October 2026 that a third-party IT security incident affected its case management system. It says the incident is contained and it is working with its external supplier to establish the facts, including the extent of the data involved, and is still investigating whether personal information was affected. In an email bulletin sent the same day (13 October, 11:20 BST), it told recipients that "some contact details such as name, address, telephone number and postal addresses may have been copied" from its system and that this may include their data. It has reported the incident to the Information Commissioner's Office. While systems are restored, residents cannot submit a new complaint, view an existing complaint or use web chat and the web form, and are asked to email or phone instead. The service has not named the supplier, and BleepingComputer reported no claim of responsibility. Correction (22 Oct 2026): an earlier version said only that the Ombudsman was checking whether personal data was affected. Its 13 October email bulletin to people on its mailing list says some contact details, such as names, addresses and telephone numbers, may have been copied. (source: Housing Ombudsman Service email bulletin, 13 Oct 2026) UPDATE (22 Oct 2026): Housing Today reported on 21 October that the Ombudsman's online services were still offline, its website notice was unchanged and it had 'no further comment'. (source: Housing Today, 21 Oct 2026)
Housing Ombudsman Service — Statement: IT Security Incident (13 Oct 2026)
breaches
The Foschini Group told JSE shareholders on 13 October 2026 that its UK business, TFG London, identified a cybersecurity incident on 11 October affecting some IT systems for its Phase Eight, Hobbs and Whistles brands. Inside Story and White Stuff are not affected. TFG activated its incident response and business continuity plans, engaged external specialists to contain the incident and reported it to the relevant UK authorities. Stores remain open and trading although several IT systems are still unavailable. The group says TFG Africa and TFG Australia run on separate systems and are not affected. It is still working out whether personal or other sensitive information was compromised and will notify affected people or organisations if so. BleepingComputer found no public claim by a threat actor.
The Foschini Group JSE SENS announcement — Cybersecurity incident at TFG London (13 Oct 2026)
breaches
Incidents
Tue 13 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added Sharecare on 12 October 2026 (UTC; 13 October Perth time). HIBP says the digital health company was the target of a ShinyHunters 'pay or leak' extortion campaign in August 2026, and that the group then published data it claimed was taken from Sharecare's systems, containing about 318,000 unique email addresses. HIBP says most of the data was business-to-business sales and marketing records with names, physical addresses, phone numbers, job titles and employers, and that it also included a small number of Brazilian health insurance plan members with dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer IDs). When the data first appeared, BreachNews reported on 13 August that ShinyHunters claimed more than 3.4 million Salesforce records and more than 28 GB of internal data from Sharecare; those are the group's claims. No public statement from Sharecare was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — Sharecare breach (added 12 Oct 2026 UTC; breach August 2026)
breaches identity
The Older Persons Advocacy Network (OPAN), the national body behind the Australian aged-care advocacy line, says an unauthorised email titled 'The National Advocate – Special Appeal' was sent to people on its mailing list through a third-party mailing system on 11 September 2026. The email asked for donations and did not come from OPAN. In an update posted 12 October, OPAN says it stopped the email, contacted everyone who received it along with network members, government and sector partners and the National Anti-Scam Centre, and engaged independent forensic, legal and cyber advisers. That investigation is now complete, OPAN has strengthened its security, and it is contacting a small number of individuals directly where required under privacy laws; people who are not contacted need do nothing further. OPAN has not named the mailing provider or said what personal information, if any, was accessed. CEO Craig Gear apologised for the worry caused to older people and families. Primary: OPAN cyber incident update (12 Oct); listed on the Webber Insurance Australian breach list.
OPAN — Cyber incident update (12 Oct 2026)
australia
Incidents
Mon 12 Oct
Updated Sun 25 Oct
iRhythm Holdings, the US maker of the Zio wearable cardiac monitor, said on 2 October 2026 that its forensic investigation into the June incident was complete and that it had begun notifying affected individuals. The company detected unauthorised access to certain third-party-hosted business applications on or around 8 June 2026, and found that data was accessed and downloaded between 3 and 8 June. In its 15 June Form 8-K, iRhythm said the access was obtained through social engineering. A threat actor contacted the company on 9 June, claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it. The exposed fields are patient name, address, email, phone, date of birth, iRhythm patient account number, device serial number, insurance number and date of service. iRhythm says it holds no financial account or payment card data, and that products, clinical and medical-device systems, manufacturing and patient safety were not affected. The Record (9 Oct) reports breach notices covering 298,647 people in Texas and another 69,526 in South Carolina, and that iRhythm also filed breach notices in California. No group has publicly claimed the attack. iRhythm has not said whether it paid. Primary: iRhythm update (2 Oct, GlobeNewswire) and SEC Form 8-K (15 Jun); wire: The Record (9 Oct). Correction (23 Oct 2026): this card earlier credited the state-filing figures to two outlets (12 Oct) and added them together; they are now credited to The Record (9 Oct) and are not combined. UPDATE (23 Oct 2026): Oregon's Department of Justice breach database lists an iRhythm Technologies Inc. entry with 8,179,772 as the number affected, reported on 6 October 2026, giving 3 to 8 June 2026 as the dates of breach (the entry also shows a placeholder date of 1/1/0001), 8 June 2026 as the date of discovery and 2 October 2026 as the date notice was sent. The database says its entries show the information in an organisation's initial breach report and do not reflect later updates to affected numbers.
iRhythm — Provides update on cybersecurity incident previously disclosed in June 2026 (GlobeNewswire, 2 Oct 2026)
breaches identity cloud
Incidents
Mon 12 Oct
Updated Wed 21 Oct
France's CERT-FR issued alert CERTFR-2026-ALE-012 on 12 October 2026 (latest version 16 October) saying it knows of numerous compromises of remote controllers for refrigeration installations: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb. CERT-FR says exposing a management interface on the internet is contrary to good practice, warns that attack campaigns against this equipment are probably still under way, and says internet-exposed equipment without security fixes (end of life) is very likely to be compromised; a factory reset alone removes an intruder's persistence but leaves the unit vulnerable, so it will almost certainly be compromised again. CERT-FR has not named a vulnerability. Earlier public research gives a possible path: Claroty Team82 found a hidden date-based 'code of the day' login in the Danfoss AK-SM 800A that bypasses the admin password (CVE-2025-41450, fixed in R4.2), plus post-login command injection fixed in 4.3.1; CERT-FR does not say this flaw was used. UPDATE 14 October: ASD's ACSC issued a High alert (act within 48 hours), Protecting operational technology and edge devices, saying it is aware of incidents affecting commercial refrigeration systems overseas and has not seen active targeting in Australia. It recommends that Australian organisations running internet-connected OT, including commercial refrigeration, keep OT interfaces and edge devices off the internet, patch known vulnerabilities promptly, apply strong authentication, access control and segmentation, and monitor for unusual automated activity. CORRECTION (21 Oct 2026): this card earlier carried store counts, temperatures, losses, fires, a claim that Copeland acknowledged a vulnerability, and statements attributed to Danfoss, Les Mousquetaires, Carrefour, Coopérative U and others, from media reports we had not linked. We removed them; they will return only with a linked source for each claim.
CERT-FR — CERTFR-2026-ALE-012: Security incident targeting remote controllers of refrigeration installations (12 Oct 2026, latest version 16 Oct)
breaches ot ics
Incidents
Mon 12 Oct
Updated Tue 20 Oct
Ahold Delhaize said on 12 October 2026 (Zaandam, Netherlands, 08:29 Europe/Amsterdam) that it is experiencing a security issue within its network and is taking steps to assess and mitigate it, including taking some systems offline to help protect them. The company said its stores are open and serving customers, and that protecting infrastructure for customers, associates and partners is a top priority. The release is marked as inside information under the EU Market Abuse Regulation. BleepingComputer reported the same day that employees at Stop & Shop (US) had trouble accessing schedules and pay stubs, and that customers could not use websites, apps and customer-service platforms at Albert Heijn, Etos and Gall & Gall in the Netherlands and Delhaize in Belgium. An internal Food Lion memo described an IT outage that could leave stores unable to shop, stage or hand off online orders. Ahold Delhaize operates more than 9,400 stores across Europe, the United States and Indonesia. The company has not publicly confirmed ransomware, encryption, data theft or a named threat actor for this incident. It is separate from the November 2024 INC Ransom event that Ahold Delhaize previously disclosed as affecting more than 2.2 million individuals in its US systems. Primary: Ahold Delhaize newsroom (12 Oct); wire: BleepingComputer (12 Oct). UPDATE 13 and 19 October 2026 (Ahold Delhaize newsroom): on 13 October the company said it had begun a controlled re-launch of certain systems and had no evidence that customer, associate or partner data was taken. On 19 October it said the investigation confirmed the suspicious activity in its IT infrastructure resulted from the malicious actions of others. Taking systems offline, including brand websites and apps, affected most of its brands in Europe and the United States, while all stores stayed open. It notified the Dutch National Cyber Security Centre (NCSC) within 24 hours, has kept the NCSC, law enforcement and regulators updated, and filed a formal police report with the Dutch police on 19 October. Restoration: Albert Heijn's website and app are back, with home deliveries expected from Friday 23 October; Etos and Gall & Gall websites are available; Belgian e-commerce is fully operational; most websites and apps in Central and Southeastern Europe are available; e-commerce at the Ahold Delhaize USA brands (such as Food Lion and Stop & Shop) is expected back in the coming days. The company again says it has no evidence so far that sensitive customer, associate or partner data was taken, and it is not describing the attack type or saying whether a ransom is involved. Wire: The Record (19 Oct).
Ahold Delhaize newsroom — Takes precautionary measures following cybersecurity incident (12 Oct 2026)
breaches
Incidents
Mon 12 Oct
Updated Fri 23 Oct
Icon Oncology Group said on 12 October 2026 that it is managing a data breach involving unauthorised access to some patient information held on a supplier's system, and that at this stage the incident appears to affect Australia only. Its notice (last updated 15 October 2026, 8:15am AEST) states the incident involved an externally hosted and managed platform that converts incoming faxes to email — not Icon's main system for sending or receiving patient information — that it was contained immediately, and that core clinical and patient management systems were not affected, with all systems online and patient treatment unaffected. The group says it activated its incident response plan, reset access to the affected system, engaged specialist cyber security and forensic advisers, and notified the Australian Federal Police and relevant regulators. It has obtained a copy of the impacted records and is confirming which patients and what information are involved, and says it will contact those patients directly; people who may be concerned can also register for an update via privacy@icongroup.global. Icon believes the records are discrete documents associated with business correspondence rather than complete patient files. Icon Cancer Centre is headquartered in South Brisbane and describes itself as Australia's largest dedicated cancer-care provider, with more than 40 centres. Primary: Icon Group notice (12 Oct 2026, last updated 15 Oct 2026 8:15am AEST). Correction (23 Oct 2026): removed a forum seller's unverified claim about the number and content of documents; Icon's own notice is the only source for what was accessed. (source: https://icongroup.global/en/news/2026-10-12/important-notification-data-breach-incident/)
Icon Group — Important notification – data breach incident (12 Oct 2026; last updated 15 Oct 2026, 8:15am AEST)
breaches australia identity
A US federal judge granted final approval on 2 October 2026 to AT&T's US$177 million settlement of class actions over two customer data breaches it disclosed in 2024, according to Cyber Security News (10 October), which cites Bloomberg Law. Judge Sidney A. Fitzwater of the US District Court for the Northern District of Texas approved the deal; AT&T did not admit liability. It sets up a US$149 million fund for the first incident and a US$28 million fund for the second, with legal fees and administration paid from those funds. The first incident, announced on 30 March 2024, involved data on about 7.6 million current and 65.4 million former account holders that appeared on the dark web, including names, addresses, phone numbers, dates of birth, account passcodes and Social Security numbers, mostly dating from 2019 or earlier. The second, announced on 12 July 2024, involved call and text records for nearly all AT&T cellular customers stolen from AT&T's workspace on the Snowflake cloud data platform between 14 and 25 April 2024; it exposed phone numbers, interaction counts, call durations and some cell site identifiers but not message content or Social Security numbers. Claimants can recover up to US$5,000 (first incident) or US$2,500 (second) for documented losses; the claim deadline was 18 December 2025 and no payment date has been announced. The Snowflake theft was part of the 2024 campaign against many Snowflake customer accounts. Wire: Cyber Security News, citing Bloomberg Law.
Cyber Security News — AT&T to pay $177 million after two massive customer data breaches (10 Oct 2026, citing Bloomberg Law)
breaches cloud
