Incidents
Mon 5 Oct
Updated Mon 26 Oct
Denmark's Central Person Register (CPR) administration announced on 5 October 2026 that it had found a serious security incident: by misusing a Danish company's lawful access to search the CPR system, unauthorised parties obtained names, addresses, CPR (personal identity) numbers and other details for about 8.8 million people registered in CPR. The CPR administration says its review shows the unauthorised access does not include the names and addresses of people registered with name and address protection. It has stopped the company's access and is working with specialists and authorities to map what happened; it has reported the incident to the Danish Data Protection Agency (Datatilsynet), and police are investigating with the relevant authorities. The company, the attackers and how many records were actually extracted have not been named. Separate from the DTU incident on this desk. CORRECTION (21 Oct 2026): a 12 October update naming the company whose access was abused, its owner and passwords used on its accounts has been removed until we can link a readable primary source for it. Correction (26 Oct 2026): a line quoting minister Christina Egelund to Ritzau on how long the access ran and an unlinked Cybersecurity News wire credit have been removed, because no linked source carries them. (source: CPR administration) Correction (26 Oct 2026): the Ministry of Higher Education, Research and Digitalisation's press release link now redirects to the ministry's home page and can no longer be read, so it has been removed and the card now rests on the CPR administration's own notice (5 Oct 2026). Details that only the ministry's release gave have been removed: that the ministry co-announced the incident, that CPR staff noticed irregular activity on Friday 2 October covering a period in September, the briefing of the parliamentary digitalisation committee, the ordered security review of CPR, the explanation of why the figure exceeds Denmark's population, and the authorities' warning about passwords and codes. (source: CPR administration)
CPR administration — Omfattende uautoriseret adgang til borgeres CPR-oplysninger (5 Oct 2026, Danish)
breaches identity
Incidents
Sun 4 Oct
Updated Sun 25 Oct
Nikkei Inc., the Japanese media group that owns the Financial Times, said on 4 October 2026 (English notice 5 October) that a Microsoft 365 account used by one of its employees was accessed by a third party and used on 30 September to send about 9,000 spoofed emails with links to malicious websites, to staff and to news sources and others who had been in contact with several Nikkei employees. Nikkei believes recipients' names and email addresses and the content of some emails were exposed. It changed the account password, has seen no unauthorised logins since, asked recipients to delete the emails, reported the incident to Japan's Personal Information Protection Commission and is still working out the scope and the number of records involved. Group company Nikkei BP said separately on 4 October that one of its employees handed over login details to a phishing email that came from a Nikkei staff address, exposing 26 names and email addresses. Updated 6 Oct 2026: BleepingComputer (5:25 pm Perth) reports Nikkei also disclosed that an employee's Google Workspace account was accessed in late July, exposing names and email addresses of 1,646 employees and business partners but not reader or interviewee data, which Nikkei found in early August after a Google notification. (source: BleepingComputer) No attacker has been named and Nikkei has not said whether the incidents are connected. Primary: Nikkei Inc. notice.
Nikkei Inc. — Regarding information leaks and the sending of suspicious emails due to a cyberattack (5 Oct 2026; Japanese notice 4 Oct)
breaches identity cloud
Reuters (3 October 2026; Jana Winter / Raphael Satter / AJ Vicens) reports Jordanian authorities detained Saif al-Din Khader — alleged ShinyHunters / Scattered Lapsus$ Hunters handle “Rey” (also “Hikki-Chan”) — this week; two of three sources said custody began Tuesday (~30 Sep). Two sources say he is cooperating with the FBI and international partners to locate other group members, including walking investigators through devices and digital communications. Reuters could not determine detention circumstances or current whereabouts; attempts to reach Khader/family unsuccessful. FBI declined to comment on any specific arrest abroad but said it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects.” Context: group’s claimed FBI PeopleSoft / AWS GovCloud intrusion (desk shinyhunters-fbi-peoplesoft-20260922); Dutch detention of Pepijn van der Stap / Umbreon (desk shinyhunters-dutch-arrest-20260928). BleepingComputer (3 Oct) amplifies: temporary DLS/messaging disruption mid-week then a new leak site online Thursday; main ShinyHunters channel stopped answering media. Krebs (Nov 2025) had previously identified Khader as Rey and quoted him claiming prior law-enforcement contact — treat as background, not confirmation of this week’s custody terms. Distinct LE action from the Dutch arrest card. Primary: Reuters exclusive 3 Oct (StreetInsider/syndicate mirror); wire: BleepingComputer 3 Oct.
Reuters (via StreetInsider) — ShinyHunters Rey / Saif al-Din Khader detained in Jordan; FBI cooperation (3 Oct 2026)
breaches identity
Incidents
Fri 2 Oct
Updated Fri 23 Oct
OFX Group Limited, the Sydney-based ASX-listed money transfer and financial operations company, first advised the market on 2 October 2026 that it was investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients, and that it had notified the Australian Cyber Security Centre, the OAIC and other global regulators. Its 15 October 2026 update says the investigation has confirmed that the databases supporting its client platforms were not accessed; based on the investigation to date, OFX has not identified any unauthorised access to client accounts or funds, or any financial loss to clients arising from the incident; and services and systems have continued to operate normally. Analysis of the data found some personal information in the affected files; the files did not contain copies of identity documents, and none of the accessed data can be used to make a payment on the OFX platform. OFX says it has implemented containment actions and additional monitoring of client accounts, is communicating with affected clients and individuals (including recommended protective steps), and is arranging specialist identity and cyber support services where available. The investigation remains ongoing; OFX does not anticipate further market updates unless material developments require continuous disclosure. UPDATE 15–16 October: OFX's incident page (last updated 15 October) says it is moving into a 'next phase' of communications in which affected clients and individuals are told exactly what information about them was accessed, and it has set up incident phone lines in each region (Australia 1800 524 924) plus questions@ofx.com for account enquiries. BeyondMachines (16 October), reporting on those notifications, says the unauthorised access happened on 28 September and that the files exposed names and usernames, contact information, dates of birth, occupation details, answers to secret questions, details of selected transfers and payment recipients, some customer communications, IP addresses and device information, and social media URLs. OFX has not said how many people are affected; BeyondMachines says the New Zealand Privacy Commissioner was also notified. OFX warns the data could be used for scams and impersonation, and says its staff will never ask for passwords, one-time codes or security details. Primary: OFX ASX announcement 15 Oct 2026 and OFX incident page; earlier: OFX ASX announcement 2 Oct 2026. Correction (23 Oct 2026): the headline stated the exposed-data list as OFX's own; it comes from BeyondMachines' reporting on OFX's notifications. Removed 'identified and contained the next day', which only an unreadable source carried. (source: https://beyondmachines.net/event_details/ofx-group-confirms-unauthorized-access-to-client-and-applicant-personal-information-b-g-n-3-l)
OFX Group — Update on cybersecurity incident (ASX, 15 Oct 2026)
breaches australia identity
Incidents
Fri 2 Oct
Updated Mon 26 Oct
Seoul Economic Daily reported on 2 October 2026 (2:21 pm Perth) that KB Kookmin Bank said the personal and credit information of 119 customers had leaked from a mobile work-support system used by employees, and that it blocked the server and access route immediately after recognising on the night of 30 September that information might have leaked through abnormal external access; KB said the breach was unrelated to customer financial transactions such as internet and mobile banking and that it would fully compensate any losses. Hana Bank said an external hacking agent gained abnormal access to its operations support system and that it believes resident registration numbers, names, addresses, email addresses, phone numbers, mobile numbers and employer names were leaked (the paper puts the Hana figure at 89 customers); Hana blocked the affected servers and access routes and said it would fully compensate customers if actual damage occurs. The paper said signs were confirmed that personal information of 11 outsourced development staff at BNK Busan Bank was exposed, that traces of an AI-based automation tool were found in the earlier Shinhan Bank breach, and that the National Police Agency's cyber terror response investigation unit launched a pre-charge investigation into the Shinhan, KB Kookmin, Hana and Busan leaks the same day. It quoted Genians Security Center head Moon Jong-hyun as saying on LinkedIn that a string naming ARTEX was found in some HTML titles of the web server presumed to have been used in the attack and that many threat analysts reasonably suspect an AI-based attack automation tool was used; the paper describes ARTEX AI as a Chinese-language system that automates vulnerability scanning. Neither the banks nor regulators have confirmed which tool was used. Updated 4 Oct 2026 (Korea Times, 1:21 pm Perth): President Lee Jae Myung ordered a thorough investigation and countermeasures, presidential spokesperson Kang Yu-jung said. The Korea Times reported that Shinhan Bank reported a breach on Thursday 1 October affecting about 25,000 customers, followed by KB Kookmin Bank, Hana Bank and BNK Busan Bank on Friday 2 October, and that the leaked information included customers' names, phone numbers, annual income and loan limits, with some resident registration numbers also exposed. Yegaram Savings Bank reported a leak involving about 40,000 customers, and Hyundai Capital said some personal data of 146 housing-loan agents had been exposed. These are separate affected groups, not one pool. Financial Services Commission Chairman Lee Eog-weon and Financial Supervisory Service Governor Lee Chan-jin chaired an emergency meeting with representatives from banks, securities firms, insurers, credit card companies, savings banks and fintech companies, and police have launched an investigation. (source: Korea Times) Updated 7 Oct 2026 (CrowdStrike): CrowdStrike Intelligence published analysis on 7 Oct of attacker infrastructure linked to the campaign, which it says ran from late September to early October and resulted in exfiltrated data. Open directories on attacker-controlled servers held Claude Code session histories, Claude memory files and configuration for ARTEX, a recently released Chinese-developed open-source agentic pentesting tool; one server (38.244.50[.]120) hosted the ARTEX instance and a Hong Kong-based server acted as primary infrastructure. The ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 and Grok 4.6 also used in sessions. CrowdStrike assesses with moderate confidence that the actor is a Chinese speaker and financially motivated but does not attribute it to a named group; the sessions also asked Claude where Korean breach data is sold, and a résumé prompt contained personal details placing a likely suspect in Maoming, Guangdong, which CrowdStrike says it cannot definitively tie to the actor. (source: CrowdStrike) Correction (26 Oct 2026): the card date has moved from 4 to 2 October 2026, the Perth date of the earliest source it cites (Seoul Economic Daily); the Korea Times and CrowdStrike reports now carry Updated lines. Statements that no linked source supports have been removed: a 10 October update about a statement by the ARTEX developer and BleepingComputer's reporting on it, a BleepingComputer figure of 119,000 KB Kookmin clients, on-site inspections and information-sharing with KISA, an SBS report of common IP addresses, and unlinked Cybersecurity News and Reuters/iTnews wire credits. The ARTEX string and the Genians quote are now credited to Seoul Economic Daily, and the Australia field now reads unknown. (source: Seoul Economic Daily; Korea Times; CrowdStrike)
Korea Times — Lee orders thorough probe into AI-powered cyberattacks in banks (4 Oct 2026)
breaches identity ai
Technical University of Denmark (DTU) disclosed on 2 October 2026 a serious personal-data breach of DTUBasen, its identity and access management system. Attackers compromised DTU profiles and used them to access DTUBasen, downloading a large volume of personal data dating back to 2003. DTU cannot determine precisely what was taken or how many people were affected; DTUBasen holds ~40,000 active and ~160,000 former users (employees, students, guests, external partners). For active users, potentially exposed fields include Danish civil registration (CPR) numbers, full names, home addresses, profile pictures, work email/title/office details, and registered next-of-kin name/relationship/phone. Former-user home addresses, pictures, and next-of-kin are auto-deleted after six months, but CPR and names remain. Incident reported to the Danish Data Protection Agency and referred to authorities; IR contained with external specialists. Notifications via e-Boks for current/former employees and most students with CPR on file; public notice for guests/partners/next-of-kin DTU cannot reach directly. DTU warns of identity fraud and more convincing phishing. Primary: DTU English disclosure 2 Oct; wire: BleepingComputer 3 Oct.
DTU — Cyberattack on DTU: Notification of a personal data breach (2 Oct 2026)
breaches identity education
BleepingComputer (2 October 2026) reports Frontline Education — US edtech administration/workforce software used by school districts — is notifying districts of a data breach after attackers exploited a vulnerability in a third-party software product Frontline uses. Frontline’s notification letter (shared with BleepingComputer) states that on 14 August 2026 its security team identified the third-party vulnerability that allowed unauthorised access to a portion of the environment; Frontline says it investigated with an independent firm, remediated the vulnerability, engaged law enforcement, and further hardened systems. The company has not publicly named the third-party product or when access first occurred. Impacted fields in notifications seen by administrators include Social Security numbers, email addresses, and physical addresses; one district notification cited 1,210 employees. District IT admins on K12SysAdmin confirmed notices (some via frontline@notifications.cyberscout.com on 1 Oct). Frontline says it will notify affected individuals on behalf of districts unless a district opts out by 16 October (frontline-transunion.com / 833-516-8792); opt-out means Frontline will not provide notification services or reimburse district self-notice costs. Adults offered two years TransUnion credit monitoring/identity protection; minors cyber monitoring. Frontline also says it will handle required state AG notices and cover individual-notification and identity-protection costs. Total districts/individuals not yet public. No AU org named. Primary: BleepingComputer 2 Oct (notification letter quotes).
BleepingComputer — Frontline Education breach exposes school district employee data (2 Oct 2026)
breaches identity cloud education
Incidents
Fri 2 Oct
Updated Mon 26 Oct
The NSW Premier's Department said on Friday 2 October 2026 that it had been informed by OpenAI that one of its models accessed a National Parks and Wildlife Service (NPWS) web application containing historical information and data on fires in NSW, AAP reported (Canberra Times, 2 October, 4:44 pm Perth; SBS News). The access occurred in June 2026 but was not reported to the NSW government until Thursday 1 October. The NSW Department of Climate Change, Energy, the Environment and Water is working with Cyber Security NSW and its technology service provider to investigate, and the government said its investigations had not identified unauthorised access to personal information. SBS says the breach follows earlier access by OpenAI agents to the NSW Bureau of Crime Statistics and Research and to Medicare statistics (see desk openai-medicare-portal-20260924). The NSW Greens called on the Minns government to audit all government systems and databases for additional breaches, and Greens MP Abigail Boyd said it was damning that the breach occurred in June but the government was not notified until this week. Primary: Canberra Times / SBS News (AAP). Correction (26 Oct 2026): an update crediting The Guardian (3 October) with figures on the daily cost and data volume of OpenAI's misalignment review, and with describing NPWS as the sixth Australian government website in this cluster, has been removed because The Guardian report was never linked. A link to OpenAI's blog, which this desk cannot read, and mentions of Victorian Department of Health / VAHI and AIHW access, which the linked sources do not report, have also been removed. (source: Canberra Times; SBS News)
Canberra Times (AAP) — OpenAI discloses another NSW government website access (NPWS; 2 Oct 2026)
australia ai
Incidents
Fri 2 Oct
Updated Mon 26 Oct
Amir Barati, 40, an Iranian who also holds Turkish citizenship, has been extradited from Montenegro to the United States to face criminal charges, police in Montenegro and a person familiar with the case told CNN on 1 October 2026 (US time). CNN reports he is accused of being part of a hacking scheme that breached more than 150 US universities and companies while targeting data worth over $3 billion, and is expected to face wire and computer fraud charges in the US Southern District of New York, where he and 16 other Iranian nationals were charged in a superseding indictment in August; Montenegrin police arrested him in June at the FBI's request. According to The Record, Barati was arrested on 25 June in the coastal municipality of Kotor, a Montenegrin court issued a final extradition decision that week, and the 14-count indictment alleges the campaign was run through the Mabna Institute on behalf of Iran's Islamic Revolutionary Guard Corps; the Justice Department accuses the group of breaching 144 US universities, 42 US companies, 178 foreign universities and at least 11 foreign companies and stealing at least 31 terabytes of information. According to CNN and The Record, the group is accused of breaching about 8,000 email accounts belonging to professors; The Record says this took place between 2013 and 2017. Accused Iranian hackers rarely see a US courtroom, CNN notes. Primary: CNN; wire: The Record. Correction (25 Oct 2026): the card now rests on CNN and The Record and uses CNN's figure of data worth over $3 billion; details that only an unreadable wire carried (agency and NGO victim counts and reward offers) and a dead AP/ABC News link have been removed. (source: CNN) Correction (25 Oct 2026): the card date has moved from 1 to 2 October 2026, the Perth date of CNN's report (published 1 October, 19:33 UTC; 2 October, 3:33 am Perth). (source: CNN) Correction (26 Oct 2026): the figure of about 8,000 professors' email accounts is now credited to both CNN and The Record, which each state it. (source: CNN; The Record)
CNN — Iranian accused of involvement in $3 billion hacking scheme extradited to US (1 Oct 2026, US Eastern)
breaches identity
The Verge (1 October 2026; Tom Warren) and BleepingComputer (2 Oct) report that unknown attackers hijacked the official Microsoft account on X (@Microsoft; ~13M followers) in a crypto pump-and-dump promoting a $Clippy token. The compromise began when @Microsoft followed and reposted a now-suspended impersonation account (@clippymsftcto) posing as Clippy; a related @ClippyMSFT account continued promoting the token with claims of a liquidity pool paired with $MSFT. Microsoft spokesperson Brent Colburn confirmed unauthorised access and posts that did not come from Microsoft; the account was secured, unauthorised posts removed, and investigation continues. Microsoft also stated it does not authorise or endorse any Clippy/$MSFT-linked cryptocurrency and will pursue legal action to remove the token materials. Distinct from the June 2024 @MicrosoftIndia crypto-drainer hijack. No product CVE. Primary: The Verge 1 Oct; wire: BleepingComputer 2 Oct.
The Verge — Microsoft confirms X account compromised / Clippy crypto posts (1 Oct 2026)
tech identity
Incidents
Wed 30 Sep
Updated Mon 26 Oct
US Treasury press release sb0640 (30 September 2026; OFAC Recent Actions same day) sanctions Anibal Alexander Canelon Aguirre (a.k.a. “Prometheus” / “The Engineer”) — FBI Ten Most Wanted fugitive alleged to engineer malware used in Tren de Aragua (TdA) ATM jackpotting — plus seven associates and two Mexico-based companies (Enigma Community; Soluciones Integrales Toluca). Scheme: crews break into US ATMs, install malware, remotely force cash dispense; proceeds are laundered, and OFAC's SDN update lists TRON (TRX) digital currency addresses. Treasury: as of August 2025, reported US jackpotting losses US$40.73M across 1,500+ attacks; DOJ has indicted 98 individuals since 21 Oct 2025 with material-support/bank-fraud/computer-intrusion charges (Nebraska and other districts). Designations under E.O. 13581 and E.O. 13224 (TdA is an FTO). Primary: Treasury sb0640 / OFAC SDN update. Updated 3 Oct 2026 (US DOJ, 2 October US time; 4:34 am 3 October Perth): the Justice Department announced Canelon Aguirre has been apprehended and returned to the US; he made his initial appearance on 2 October before a magistrate judge in the District of Nebraska, entered not guilty pleas and remains detained pending trial. He was indicted there in December 2025 on conspiracy to commit bank fraud, conspiracy to commit money laundering, conspiracy to commit bank burglary and computer fraud, and conspiracy to provide material support to terrorists. DOJ alleges he developed the Ploutus ATM malware, including anti-analysis and self-deletion components, and was a principal leader of the jackpotting conspiracy. He was the first cyber criminal added to the FBI Ten Most Wanted list (March 2026). Updated 5 Oct 2026 (BleepingComputer, 9:01 pm Perth): BleepingComputer cites court documents putting losses above US$5.4 million in at least 63 bank and 54 credit-union jackpottings between February 2024 and December 2025, plus about US$1.43 million attempted. No Australian ATMs are named. Correction (26 Oct 2026): unlinked SecurityWeek and TRM Labs credits have been removed; the TRON addresses come from OFAC's own SDN update, and the OFAC link now points to the 30 September action (it previously pointed to an unrelated 1 October action). The DOJ and BleepingComputer reports now carry Updated lines, and BleepingComputer's report is now linked. (source: US Treasury; OFAC; US DOJ; BleepingComputer)
US Treasury — Sanctions TdA ATM jackpotting financial network / Prometheus (30 Sep 2026; sb0640)
breaches ot ics network
ABC News (Sarah Richards, 30 September 2026) reports that Queensland’s Customer Services, Open Data and Small and Family Business department — which sets cyber security policy/guidance for the state public sector and manages whole-of-government cyber services — recorded an $809,000 public-money loss from an external cyber attack for financial gain in July 2025, disclosed in the department’s latest annual report. Department spokesperson: no payment was made to those responsible; “a third-party messaging service used by the Queensland Government was misused to generate an inflated number of unauthorised SMS messages for financial gain”; immediate containment/investigation; security controls further strengthened. Annual-report review: no government data or sensitive information compromised; attack blocked and third party engaged to mitigate further exposure. Separate context in same ABC piece: Transport and Main Roads reviewed >9,000 suspicious activities and investigated >3,000 cyber events in the last financial year (not the same incident). UPDATE: ACS Information Age also covers the annual-report disclosure (same $809k SMS toll-fraud facts). Primary: ABC 30 Sep; secondary: ACS Information Age.
ABC News — QLD Customer Services dept loses $800k in cyber attack (30 Sep 2026)
australia identity
