St Andrew's Hospital, a private hospital in Adelaide, said on Thursday 8 October 2026 that it had been investigating a breach of personal information affecting "a group of individuals". Chief executive Angela McCabe said the investigation had progressed far enough for the hospital to contact affected people directly, in line with its regulatory obligations, and that they had been given information on how to protect their personal information. The hospital says it has notified the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre, and is working with government agencies to apply extra measures to detect and prevent suspicious and fraudulent activity. The number of people affected, what kind of information was involved and how the breach happened have not been disclosed. South Australian Premier Peter Malinauskas said the state government expected to be briefed later on 8 October, including on whether anything criminal had occurred. Wire: ABC News 8 Oct; no hospital web notice found at the time of this check.
ABC News — 'Group of individuals' impacted by data breach at SA hospital (8 Oct 2026)
australia identity
The US State Department's Rewards for Justice (RFJ) programme is offering up to US$10 million for information on Zhang Yu, a Chinese national it describes as a director at Shanghai Firetech Information Science and Technology Company working at the direction of China's Ministry of State Security Shanghai State Security Bureau. RFJ says that from early 2020 Zhang and his partner Xu Zewei, then general manager at Shanghai Powerock Network, gained unauthorised access to COVID-19 research at US universities and stole information from immunologists and virologists, and that in 2021 the pair exploited Microsoft Exchange Server flaws as part of the HAFNIUM mass-intrusion campaign, with victims including a US university and a law firm. Xu was arrested in Italy and extradited to the US in April 2026; Zhang remains at large. Cybersecurity News reported the offer on 8 October, citing the FBI Cyber Division; the RFJ page itself carries no date. The charges are allegations, not proof of guilt. Primary: Rewards for Justice.
Rewards for Justice — Zhang Yu (SSSB) (undated reward page, reported 8 Oct 2026)
breaches identity
DataBreaches.net reported on 7 October 2026 that internal chats of Silent Ransom Group (SRG, also tracked as Luna Moth and UNC3753, a Conti offshoot known for IT-support callback phishing against law firms) had leaked: 5,692 messages from two servers covering 27 August 2025 to 29 September 2026, shared with the site by researcher Tammy Harper. The chats mark completed payments as 'GOLD' for 27 named targets, totalling US$206.95 million, with a median of US$6 million, a low of US$100,000 and a high of US$30 million. The group never encrypts files; it tricks staff into granting remote access, steals documents and threatens to publish them. Crystal Intelligence's blockchain analysis dates the 27 claimed payments between 3 April and 24 September 2026 and found transactions matching several chat entries, including one collection wallet that took in about 344 BTC (about US$27 million) over six weeks, but could not tie individual victims to it. Nine of the 27 named firms disclosed breaches in the same period, yet no victim has confirmed that SRG attacked it or paid the amounts listed, and SRG disputes the leak. For defenders, the lesson is that data-extortion crews without ransomware can be highly profitable; staff need to verify any 'IT support' call before installing remote tools. Primary: DataBreaches.net; wire: Cyber Security News.
DataBreaches.net — Can you really make more than $200M in six months without encrypting victims? (7 Oct 2026)
breaches identity
Incidents
Wed 7 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added CyrusOne on 7 October 2026. HIBP says the data centre operator was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group then published data allegedly obtained from the company, including about 373,500 unique email addresses across records relating to users, sales leads and CyrusOne employees. HIBP says the data was largely corporate contact information (names, physical addresses, phone numbers, employers and job titles) and also included support tickets and other information about the company's operations. When ShinyHunters first made its claim in August, Cybernews reported that the group said it held 12.9 million Salesforce records, demanded US$13 million and listed floor plans, electrical diagrams and access-control records among the data; those are ShinyHunters' claims, and HIBP's description does not mention facility documents. CyrusOne had not commented publicly at the time of Cybernews' report, and no public statement from CyrusOne was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — CyrusOne breach (added 7 Oct 2026; breach August 2026)
breaches cloud
The US Justice Department said on 7 October 2026 that Zohar Pinhasi, 50, owner of Florida ransomware remediation company MonsterCloud LLC, was arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy (docket 26-CR-271; indictment filed 23 September). Prosecutors allege that from June 2018 to June 2023 MonsterCloud told ransomware victims not to pay and claimed to have proprietary tools and advanced decryption techniques, but in practice contacted the attackers, paid them for decryption keys and charged clients far more than the ransom. In one example cited by the Justice Department, about US$8,200 went to a ransomware operator and the client was billed about US$150,000. Over the scheme he allegedly charged clients more than US$19 million and paid more than US$8 million in ransoms, with BleepingComputer reporting hundreds of affected companies in the US and Canada. Pinhasi pleaded not guilty and was released on a US$2 million bond, according to the US Attorney's Office. Each count carries a maximum of 20 years. For Australian organisations the case is a reminder that a paid recovery or negotiation firm may still be paying the attacker on your behalf, which can bring the ransomware payment reporting obligation under the Cyber Security Act 2024 into play. Primary: US Department of Justice; wire: BleepingComputer.
US Department of Justice — Known cybersecurity expert and owner of Florida ransomware remediation company charged with defrauding clients (7 Oct 2026)
breaches
US energy group Southern Company is notifying roughly 400,000 utility customers that an unauthorised third party accessed their account information through its online customer portal, SecurityWeek reported on 7 October 2026. About 300,000 of the accounts belong to Georgia Power customers and about 100,000 to Alabama Power; Mississippi Power is named in the company's notice but no number has been given for it. The notice says the information reached was name, mailing address, phone number, email address or the last four digits of the US Social Security number, plus other basic account details, and that bank account numbers, payment card numbers and driver's licence numbers were not accessed. The company says it found the activity through its own monitoring, stopped it, brought in law enforcement and has found no sign of ongoing access. It has not said when the intrusion happened or how the attacker got into the portal. Affected customers are being told by email or letter and offered a year of Equifax credit monitoring. No Australian customers are involved. Primary: Southern Company / Georgia Power customer notice; wire: SecurityWeek.
Southern Company — Information regarding a recent incident involving customer information (customer notice; date not shown on page)
breaches identity ot ics
A 28-year-old Russian national believed to be a core member of the Qilin (also called Agenda) ransomware group was detained in Osaka, Japan, in May 2026 and handed over to German authorities on 2 October, SecurityWeek reported on 7 October. Germany wants him for breaking into a logistics company in September 2024, encrypting its data and extorting more than US$160,000 in cryptocurrency. Qilin has run as a ransomware-as-a-service operation since August 2022 and is one of the most active groups: it was blamed for the 2024 Synnovis pathology attack that disrupted London NHS hospitals, claimed the Asahi Group attack, listed about 400 victims on its leak site in 2025, and this year exploited the Check Point VPN and firewall authentication bypass CVE-2026-50751. Qilin listings regularly name Australian organisations, and the group was named after the August 2026 cyber incident at the US ATF. Neither the suspect's name nor a German prosecutor's statement has been published in the reporting. Source: SecurityWeek. UPDATE (8-9 Oct): Japan's National Police Agency confirmed the case in a press release dated 8 October 2026. It says Germany has announced the arrest of a Russian national believed to have led the Qilin group, and that after the suspect, wanted on a German warrant over a ransomware attack in Germany, arrived in Japan, the Kanto Regional Police Bureau's cyber investigation unit and local police worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office and Germany to hold him on a provisional detention warrant under Japan's extradition law and hand him over. BleepingComputer reported on 9 October that he had entered Japan as a tourist, and noted that Qilin has hit more than 2,350 known organisations in 62 countries, including Australia's Court Services Victoria, and has listed more than 450 victims since June. The suspect has still not been named.
National Police Agency of Japan — press release on Germany's arrest of a Russian ransomware suspect (8 Oct 2026, Japanese)
breaches
Oasis Security has analysed files recovered from an attacker-controlled, US-based server used against two of South Korea's largest churches, which it does not name. Researchers collected the files between 28 August and 1 September 2026; Cyber Security News reported the findings on 7 October. At the first church, a web shell on the enterprise resource planning (ERP) system let the attackers decrypt database settings, gain administrator access to Microsoft SQL Server and use xp_cmdshell to run commands and move to linked systems, opening member, accounting, access-control, library, chat and mail databases; they also got past a database-monitoring control, recovered a MariaDB root password and used hardcoded NAS credentials to reach backup storage. That haul held about 960,000 congregant records updated in the past two years, including names and resident registration numbers, about 330,000 donation records, 68,000 document records, more than 14,000 chats and 6,874 login accounts; 47.3 GB in 13,939 files was found staged in a compromised MinIO bucket. The second church was entered earlier with leaked credentials and insecure direct object reference (IDOR) flaws in its groupware and membership (SIMS) systems: from a normal member session the attackers could see other users' plaintext PINs and reset a manager-level account, then reached SAP and took about 89,000 congregant records, 383 employee records and approval documents. Oasis says third-party transfers mean the recovered volume is a lower bound and unique-person totals are unverified. Primary: Oasis Security; wire: Cyber Security News.
Oasis Security — Analysis of cyber intrusions targeting major religious organisations in South Korea
breaches identity cloud
The Office of the Victorian Information Commissioner (OVIC) has published its investigation into the student data breach the Department of Education reported on 7 January 2026, and found the department contravened Information Privacy Principles 4.1 (security) and 4.2 (destroying data no longer needed). The Australian Signals Directorate issued a critical alert at 10am on 27 October 2025; the department passed it to school technicians the same afternoon, but not every school patched, and the department had no way of checking that they did. Attackers got in through one school's internet-facing server on or before 6 November 2025. A vendor detected the activity on 2 December, forensic work confirmed data had left on 23 December, and media reporting began on 14 January. The stolen database held every government school student's first name and surname, school, year level, school email address and encrypted password, and the same details for hundreds of thousands of former students, which the department kept so email addresses would not be reissued. OVIC called that retention disproportionate. It also found the department's vulnerability scanning did not cover every school and that critical findings were not always fixed. OVIC saw no evidence of misuse soon after the attack but notes the copy could be used later, a particular worry for families escaping violence or under protection orders. OVIC made seven recommendations due by 31 December 2026, including a plan to align with the Essential Eight. The department has accepted them, promised an archive policy for old student records by December and an internal audit in 2027, and plans centrally provided vulnerability management for schools by the end of 2028. OVIC's report does not name the vulnerability. Primary: OVIC investigation report; wire: iTnews (7 Oct).
OVIC — Investigation into the data breach of student information held by the Department of Education (report, October 2026, PDF)
australia identity
Solar 4RAYS, the threat research team of Russian security company Solar, published an investigation (reported by Cyber Security News on 7 October 2026) into a long intrusion at a medical organisation that it links to the group it calls Partisan Zmiy, based on overlapping infrastructure and techniques. The earliest evidence dates to early 2024 and the investigation began in December 2025, so the attackers had access for about two years; how they first got in is not known. They ran commands remotely, then moved through the network over legitimate remote desktop and Windows file sharing. VMware Tools had been installed long before but was not in use, so its folder became a trusted, unwatched place to drop malicious files named like real virtualisation components, with timestamps changed to match. Shortly before discovery the attackers swapped a genuine VMware library for an unsigned malicious one, keeping the original under another name. Windows services with plausible names started a previously undocumented loader, which ran an updated Vasilek backdoor and GOST tunnels on a schedule, including one tunnel open only from 10pm to 11pm each Saturday, likely as a backup way in. The organisation had two-way trust relationships with many subsidiary medical institutions, and the researchers read the case as espionage rather than disruption. Solar did not name the victim. Primary: Solar 4RAYS blog (Russian); wire: Cyber Security News.
Solar 4RAYS — Partisan Zmiy: атаковала медицинскую организацию (blog, Russian)
breaches ai
Incidents
Wed 7 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added the Angel One breach on 7 October 2026, so people can now check whether their email address is in it. HIBP says that in July 2024 the Indian stock brokerage confirmed that data leaked online related to a breach in April 2023, and that the leaked data included 7.9 million user records with 6.8 million unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs, India's tax ID) and portfolio holdings; HIBP also lists dates of birth. In its July 2024 statement, reported by The Hindu BusinessLine, Angel One said no new data breach had occurred, that the issue related to an April 2023 incident that was promptly reported to the relevant authorities, and that "this incident has no impact on client securities, funds, or credentials". It also said the authenticity of the leaked data had not been validated. UPDATE 22 Oct 2026: added Angel One's own statement and attributed the breach details to Have I Been Pwned (source: The Hindu BusinessLine, 10 Jul 2024).
Have I Been Pwned — Angel One breach (added 7 Oct 2026; breach April 2023)
breaches
SOCRadar's Threat Research Unit published research on 6 October 2026 into CyberXero, a Russian-speaking, financially motivated initial access broker that pairs common attack tools with an AI orchestration layer on its own servers. Everything surfaced through one mistake: an open directory served the actor's live working folder, more than 90,000 files including AI session logs, scripts with plaintext tokens and stolen data, and the actor stayed active while researchers watched. On one workstation it configured up to 51 Claude Code agents for discovery, password testing, exploitation and data theft; a second setup connected PentAGI, an open-source AI penetration-testing framework, to a Cobalt Strike team server through an AI provider's API, with model choice and token budgets set per task. Session logs show the operator telling the model the targets were its own systems under authorised testing and, when refused, opening a fresh session with the same cover story; some refusals held, including requests to install a backdoor, disable a firewall, move across a network and plant a webshell. The broad campaign used an internal wp2shell package that abuses the WordPress REST API batch endpoint to inject SQL, create a rogue administrator and drop a WSO-family webshell, and it also hit Magento and used Support Board CVE-2026-4815 within 30 days of disclosure; one automated run scanned 4,708 targets, found 429 reachable WordPress admin panels and placed 32 shells in 61 seconds. A separate hand-picked pipeline mapped seven Ukrainian energy and utility organisations, including the national transmission operator; four Ukrainian organisations had confirmed data theft, a Kharkiv district-heating provider lost 564,073 subscriber records, and data on more than 628,000 Ukrainians was found. More than 40 organisations were affected worldwide, with activity also seen in Poland, China and Pakistan; SOCRadar found no direct proof of an access sale. Infrastructure was first seen in July 2026 across eight nodes in European hosting and Tencent Cloud. Primary: SOCRadar; wire: Cyber Security News (7 Oct).
SOCRadar — CyberXero: an AI-augmented initial access broker targeting Ukrainian critical infrastructure (6 Oct 2026)
ai
