Hardware wallet maker Ledger said on 9 October 2026 that it was investigating reports of stolen funds from users in Southeast Asia who bought its devices from CryptoBilis, a reseller listed in Ledger's official directory for Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments. Ledger advised anyone who bought from CryptoBilis in the last 90 days not to set up the device, and anyone who already had to move their assets to a new Ledger signer with a new recovery phrase. On 10 October Ledger Support confirmed that one affected user's device contained an unauthorised hardware implant, said it was contacting affected users and working with authorities and the SEAL 911 crypto incident-response group, and said CryptoBilis had suspended sales of its whole hardware-wallet inventory. Ledger says it believes the drained funds are limited to devices sold through CryptoBilis and has no indication that its own infrastructure, systems or services were compromised. The Block (9 October) reported on-chain estimates of suspected losses above US$72 million and above US$86 million across Bitcoin, Ethereum and Tron, which Ledger has not confirmed. Former Mt. Gox chief Mark Karpelès published teardown photos of a Malaysian-bought unit with a small component hidden under the screen, which researchers describe as a cellular implant that reads the 24-word recovery phrase off the display during setup and would still pass Ledger's genuine-device check; Ledger has not described its implant or said how it got into the device. Lesson for anyone holding keys on hardware: buy direct from the manufacturer where possible, and treat a recovery phrase shown on any device as exposed if the device's supply chain is in doubt. Primary: Ledger Support statements on X. On 14 October BleepingComputer reported that Ledger Donjon confirmed the implant's microcontroller decodes the 24-word recovery phrase shown during setup and exfiltrates it over LTE via a provisioned eSIM, without modifying the Secure Element, Ledger OS, transactions or signatures — so Ledger integrity self-checks still pass. Ledger ordered a broader sales halt covering distributors across Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong, and MediaMarkt pulled stock after users also reported modified devices from other sellers (including a Singapore airport Metapod retailer and MediaMarkt/Aqipa in Europe). Ledger still says confirmed fund losses are tied to CryptoBilis stock and that its own infrastructure and direct sales channel remain safe; Trezor separately said it will shrink its reseller network.
Ledger Support on X — situation update: unauthorised hardware implant confirmed in an impacted user's device (10 Oct 2026)
breaches
Incidents
Fri 9 Oct
Updated Sun 25 Oct
All Souls St Gabriels School has confirmed a cyber incident. A notice on its website says it is investigating a recent cyber incident involving unauthorised access to part of its systems. It took immediate steps to secure its systems and engaged specialist cyber security and forensic experts, and it has found no impact on day-to-day operations, with teaching and learning continuing as normal. It is aware of online claims naming the school, which its external specialists are assessing, and has put ongoing monitoring in place. It has notified the Australian Cyber Security Centre and will contact individuals directly if their personal information is found to be affected. It warns current and former community members to expect more phishing and scam contact and has set up dedicated support channels. A spokesperson told Cyber Daily (13 October) that parents and staff were told 'late last week'. According to Cyber Daily, the gang has not said how much data it holds or what it is demanding. The school is an independent Anglican co-educational boarding and day school in Charters Towers, about 120 km south-west of Townsville, teaching Pre-Prep to Year 12. The school was listed on The Gentlemen ransomware gang's leak site in a 9 October post, according to Cyber Daily. Cyber Daily has also reported The Gentlemen listing Mandurah SES in WA (see mandurah-ses-thegentlemen-20261002). Primary: school notice; wire: Cyber Daily. Correction (25 Oct 2026): removed leak-site tracker links and the gang's publication threat, which an earlier version wrongly attributed to the school's spokesperson; the listing is now credited to Cyber Daily. (source: Cyber Daily)
All Souls St Gabriels School — Important information about a cyber incident
australia
Incidents
Fri 9 Oct
Updated Wed 21 Oct
FBI Director Kash Patel said on X on 9 October 2026 that agents had arrested another suspected co-conspirator of the ShinyHunters extortion group, which the bureau blames for the recent FBIJobs.gov incident on a platform run by a third-party vendor. Patel called it the latest of several arrests in a matter of days but did not name the suspect or say where the arrest happened. The New York Times reported that the suspect is a Canadian citizen arrested in Pennsylvania and regarded as a primary co-conspirator in the intrusion; no name or charges have been made public. ShinyHunters told BleepingComputer in September that it got in through an alleged Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud systems, claiming 2 to 3 TB of data on current and former staff and job applicants; the FBI has since said a contractor-managed platform had not installed a security update, and the Times reports an internal memo assumed every employee was affected. Earlier actions: Dutch police arrested Pepijn van der Stap ('Umbreon') on 15 September, and Jordan detained Saif al-Din Khader ('Rey'), who sources say is cooperating with the FBI. Primary: FBI Director Patel on X; wire: BleepingComputer. UPDATE (10 Oct): Politico and KrebsOnSecurity named the man arrested in Pennsylvania as Edward Dubrovsky, 54, a Canadian cybersecurity executive whom Politico and BleepingComputer described as a co-founder of CYPFER and associated with CyberSteward, firms that help breach and ransomware victims negotiate with extortion groups; he was reportedly attending the NetDiligence Cyber Risk Summit. Public court records show he appeared in the Eastern District of Pennsylvania and was transferred in custody to the Eastern District of Texas, where charges were filed. The complaint is sealed, but the docket lists conspiracy to threaten to impair the confidentiality of information with intent to extort (18 U.S.C. 371 and 1030(a)(7)(B)) and Hobbs Act extortion and conspiracy (18 U.S.C. 1951). The FBI has not publicly confirmed that Dubrovsky is the suspect Patel described; KrebsOnSecurity cites multiple sources linking the arrest to the ShinyHunters investigation. The FBI says ShinyHunters and associates breached more than 140 organisations and collected more than US$70 million in extortion payments over the past year. Wire: BleepingComputer (10 Oct). UPDATE (12 Oct): Reuters (republished by iTnews on 12 October) says the partially sealed court papers filed in the Eastern District of Pennsylvania spell the defendant's surname 'Dobrovsky' or 'Dobrosky' and give no age, profession or employer; a person briefed on the matter told Reuters it is Canadian security executive Edward Dubrovsky. Reuters says federal prison records show a 54-year-old Edward Dubrovsky currently held at a federal detention centre in Philadelphia. The FBI referred Reuters to Director Patel's statement and declined further comment, and CyberSteward did not respond. UPDATE (19 Oct, KrebsOnSecurity): citing two sources close to the investigation, Krebs reports that FBI investigators believe at least one executive at a large US consulting firm with more than 1,000 associates helped operate ShinyHunters' victim-extortion site shinywire[.]com. Krebs does not name the firm or the person because no charges have been filed. The site ran from about 3 May to 16 October 2026 and had pages for nearly 100 breached organisations, each with samples of stolen files and a demand to negotiate; victims who did not respond within seven days had their data published on the group's Tor leak blog. Sources say Signal messages read when Dutch police arrested Pepijn van der Stap on 15 September showed frequent contact with Dubrovsky and with the US executive, who often knew about new victims before the victims did, and that Dubrovsky knew ShinyHunters had stolen FBI data but did not tell the bureau before the group threatened to publish it. The FBI has not commented and these claims are not in public court records; Dubrovsky's complaint remains sealed. CYPFER, in a 14 October statement quoted by KrebsOnSecurity, says it learned of his arrest from the media, that to its knowledge it is not a target of any investigation, that its business does not include making or facilitating ransomware payments, and that CyberSteward and CYPFER are separate companies with no officers, directors or employees in common. KrebsOnSecurity also reports that Daniel Tobok of CYPFER, in a legal dispute with Dubrovsky, said Dubrovsky has misrepresented himself as a CYPFER founder and is not a shareholder. CORRECTION (21 Oct 2026): this card earlier stated as fact that Dubrovsky co-founded CYPFER and that the firms help victims pay extortion demands; that description comes from Politico and BleepingComputer, and CYPFER disputes it.
FBI Director Kash Patel on X — another suspected ShinyHunters co-conspirator arrested (9 Oct 2026)
breaches identity
Incidents
Fri 9 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added Neogen on 9 October 2026. HIBP says the food and animal safety organisation was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group later published data it claimed had been obtained from Neogen. HIBP says the data consisted largely of corporate contact records and included about 436,000 unique email addresses from mailing lists, employee records and other contacts, with names, phone numbers, physical addresses, employers, job titles and salutations. Cybernews reported on 31 August that ShinyHunters had given Neogen until 1 September to respond and had not then published samples. No public statement from Neogen was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — Neogen breach (added 9 Oct 2026; breach August 2026)
breaches
MapRoulette, an open-source tool that helps OpenStreetMap (OSM) contributors fix map problems, published a security incident report on 9 October 2026. Maintainer Jake Low of OpenStreetMap US found the flaws on 7 October, took the service offline for about 15 hours, revoked every credential that could have been exposed and shipped fixes in v4.11.0 and v4.11.1. Four main problems were found: public API and GraphQL responses included each user's full record, including the stored OSM access token (which can edit the map as that user), MapRoulette API key and email address (since April 2020); API keys saved in OSM user preferences could be read by any app granted the common 'read your user preferences' permission (since October 2022); sending an empty API key matched the never-set default 'super key' and granted administrator rights (since March 2017); and several endpoints allowed SQL injection (oldest from November 2019). The server and application logs, covering 8 September to 7 October 2026, showed no malicious use, but older abuse cannot be ruled out because the bugs are years old. OSM passwords were never at risk. Users must log in again, old API keys no longer work, affected users are being emailed, and anyone running a self-hosted MapRoulette above v2.0.3 must update, reset stored OAuth tokens and check admin accounts. Primary: OpenStreetMap community forum post by the maintainer.
OpenStreetMap Community — MapRoulette security incident, October 2026 (Jake Low, 9 Oct 2026)
breaches identity
Incidents
Thu 8 Oct
Updated Fri 23 Oct
Canonical posted on Ubuntu Discourse at 15:09 UTC on 8 October 2026 (23:09 Perth) that its websites were under a sustained distributed denial-of-service attack, that some services might be intermittently unavailable, and that its team was working on it. A follow-up at 11:40 UTC on 9 October said the team was still restoring affected services and most were now available, and on 14 October Canonical said all websites were restored. The disruption hit Canonical's main web properties: ubuntu.com, canonical.com, blog.ubuntu.com, developer.ubuntu.com and the Ubuntu Security API and CVE notice pages. Developer-facing services (Launchpad and PPAs, the Snap Store, the CD image server and Ubuntu SSO) were reported as operational, and APT package mirrors are distributed separately. Canonical has not said how large the attack was, where it came from, or who was behind it, and no group appears to have claimed it. It is the second DDoS against Canonical this year. The late-April/May 2026 'sustained, cross-border attack' took down Launchpad and the Snap Store and stopped some users installing updates; a hacktivist group calling itself The Islamic Cyber Resistance in Iraq – 313 Team claimed that one. For defenders, the practical effect was that Ubuntu security notices and CVE status pages were briefly unreachable. Primary: Canonical on Ubuntu Discourse (8–9 Oct); wire: SecurityWeek (12 Oct). Correction (23 Oct 2026): an earlier version said the sites were offline for about four hours, a figure from an outlet not linked here; Canonical's own posts say restoration was still under way on 9 October and all websites were restored on 14 October. (source: https://discourse.ubuntu.com/t/ddos-on-canonical-and-ubuntu-websites/89064)
Ubuntu Discourse (Canonical) — DDoS on Canonical and Ubuntu websites (8 Oct 2026, update 9 Oct)
tech network
Japanese karaoke operator Daiichi Kosho said on 8 October 2026 that Nippon Columbia Group (NCG), which handles customer personal data on its behalf, found malware on one employee's PC between 1 and 2 October and cut that PC off the network on 2 October; NCG told Daiichi Kosho on 5 October. Personal data from work Daiichi Kosho had outsourced was temporarily stored on that PC, so leakage cannot be ruled out. About 8,724,000 records may be exposed: roughly 8,631,000 customers who registered or booked at its venues (about 5,558,000 Big Echo, 3,462,000 DK Dining, 74,000 Karaoke CLUB DAM, 43,000 Mega Big, 5,000 Banana Club and 4,000 B-GARAGE, less about 515,000 duplicates) and about 93,000 employees. The data is registered name, gender, date of birth, email address and phone number; passwords are not included and the company says points cannot be used with this data alone. Daiichi Kosho says it has not confirmed any actual leak or misuse, its own systems were not affected, NCG has reset passwords and other credentials, and NCG and outside specialists are still investigating. It opened a free-call enquiry line on 9 October. BleepingComputer (11 October) could not find a public statement from NCG. Lesson: a contractor laptop holding a working copy of a customer database is the breach; keep outsourced data on controlled systems, not endpoints. Primary: Daiichi Kosho notice (Japanese).
Daiichi Kosho — possible personal-data leak at a contractor (8 Oct 2026, Japanese)
breaches
The US Justice Department said on 8 October 2026 that Oleg Korniev, 42, a dual Ukrainian and Russian citizen, pleaded guilty to running the Your Mule Cashout (YMCO) money-laundering organisation, which recruited more than 15,000 US-based money mules to launder at least US$10 million stolen by hackers from over 750 US bank accounts. Mules were recruited through spam from fake companies and an apparently normal hiring process, told they were processing payments for real businesses, and then wired stolen funds through Western Union and MoneyGram to cash-out contractors abroad (BleepingComputer lists Moldova, Ukraine, Russia and Latvia). Korniev admitted YMCO caused more than US$14.7 million in actual and intended losses and that he laundered at least US$7 million; he was arrested in the Republic of Georgia, pleaded guilty to money laundering, computer-fraud and access-device conspiracies and aggravated identity theft, and faces two to 50 years at a later sentencing. Four other YMCO members were earlier extradited and sentenced to about 37 to 63 months. BleepingComputer, citing the case, reports that YMCO ran similar mule schemes in Germany, Italy, the UK and Australia since it began in 2007. For employers and job seekers, 'payment processing' job offers that move money through personal accounts remain a classic mule recruitment pattern. Primary: US DOJ; wire: BleepingComputer.
US Department of Justice — Ukrainian-Russian dual citizen pleads guilty to running international money laundering organisation (8 Oct 2026)
breaches australia
IDC Frontier (IDCF), a SoftBank Group subsidiary that runs the IDCF Cloud IaaS platform, said a third-party ransomware attack caused a disruption in East Japan Region 1 from about 3:40am JST on 7 October 2026. Its third notice (8 Oct) says 495 corporate and municipal customers were affected. Impacted zones named: tesla, henry, pascal and joule. Effects included virtual servers stopping and not restarting. IDCF isolated East Japan Region 1, stopped the management console across regions while it checked safety, and is working with an external security firm to find and block the intrusion path. For the four named zones it says customer data is difficult to retrieve or restore and that recovery currently depends on customers' own backups; it is guiding those customers to rebuild in a separate environment. Other East Japan 1 zones and other regions had no confirmed unauthorised access at the time of the notice, but customers were told to take their own backups. IDCF has reported to regulators and the Tokyo Metropolitan Police. Wire coverage (BleepingComputer, NHK, Mainichi) notes knock-on outages including Nissui logistics shipping and Ibaraki prefectural and police websites; IDCF has not itself confirmed every downstream victim in the notice. Threat-actor social posts claiming encrypted databases and hypervisors are unverified by IDCF. Primary: IDC Frontier notice 20261008001; wire: BleepingComputer.
IDC Frontier — Notice 3: unauthorised access / disruption on part of IDCF Cloud (8 Oct 2026, Japanese)
breaches cloud
BleepingComputer reported on 8 October 2026 that Jonathan Spalletta, 36, of Maryland (online 'Jspalletta' and 'Cthulhon'), has been found guilty of computer fraud and money laundering over the April 2021 hacks of Uranium Finance, an automated market maker on BNB Chain. In the first attack on 8 April 2021 he drained about US$1.4 million by abusing a smart-contract flaw with zero-token withdrawals, then pressured Uranium into a sham 'bug bounty' of nearly US$386,000. About three weeks later he exploited a second coding error, where transaction checks used 1,000 instead of 10,000, to withdraw nearly 90% of the liquidity pools, about US$53.3 million in total, and Uranium closed. Prosecutors say he laundered the funds through Tornado Cash and decentralised exchanges and bought rare collectibles, including Magic: The Gathering packs and a Black Lotus card, a first-edition Pokémon base set and a Roman coin. Agents seized the collectibles in February 2025 and recovered about US$31 million in crypto. He surrendered on 30 March and faces up to 10 years for computer fraud and 20 years for money laundering. Source: BleepingComputer, quoting the US Attorney's office.
BleepingComputer — Uranium crypto exchange hacker convicted for stealing $53 million (8 Oct 2026)
breaches
Incidents
Thu 8 Oct
Updated Fri 23 Oct
A territory-wide technical network outage knocked out telecommunications and digital systems across key Northern Territory government departments and agencies on 8 October 2026, including Police, Health and Education. It began at about 3am NT time (4.30am Sydney) and was resolved about 12 hours later through what the government called undisclosed workarounds by the Department of Corporate and Digital Development (DCDD). NT Police, Fire and Emergency Services issued a public advisory that non-emergency communications, including police assistance lines and phone lines to local police stations, were affected, while triple zero (000) stayed up and all Territory hospitals kept providing patient care. Other agencies reported problems with phone lines, email and network-connected servers. DCDD says it is still investigating the root cause and how to prevent a repeat; the government has not said what caused the outage, and nothing published so far points to a cyber attack. Primary: NT Police, Fire and Emergency Services public advisory; wire: iTnews. UPDATE (23 Oct 2026): iTnews (8 Oct), citing ABC News (8 Oct), reported that the problem was linked to a gateway in the core network, and that three calls were missed during the outage, although checks found they were routine police follow-ups rather than emergencies, which qualifies the government's line that triple zero kept working throughout. DCDD's root-cause review is still open.
NT Police, Fire and Emergency Services — Public advisory: technical network outage affecting non-emergency communications (8 Oct 2026)
australia network
BleepingComputer reported on 8 October 2026 that Raheim Hamilton, 30, who co-created and ran the Empire Market dark web marketplace from August 2017 until it went offline in 2020 amid extortion DDoS attacks and exit-scam claims, has been sentenced to 40 years in federal prison, citing the US Attorney's Office for the Northern District of Illinois. Empire facilitated more than 4 million transactions worth about US$430 million; drugs made up nearly US$375 million, but the site also sold counterfeit currency, stolen account credentials, hacking tools and personal information. At its peak in August 2020 it had about 1.68 million registered users, over 5,000 vendors and nearly 360,000 buyers. Hamilton pleaded guilty in January and agreed to forfeit three Virginia properties, about 1,230 bitcoin and 24.4 ether; co-defendant Thomas Pavey ('Dopenugget') pleaded guilty last year and is due to be sentenced later this month. Authorities seized about US$75 million in cryptocurrency when the pair were charged in July 2024. Primary: US Department of Justice (USAO Northern District of Illinois); wire: BleepingComputer.
US Attorney's Office, Northern District of Illinois — Co-creator of dark web marketplace sentenced to 40 years in federal prison
breaches identity
