CyberStack — Australia cyber news desk

Latest cyber news, threats, security, and guidelines. Stack up.

Latest

Incident

Published 2026-10-24 New

Verified 2026-10-25

Alliance Healthcare Group says personal data of about 110,000 members in subsidiary Alliance Medinet's membership database was compromised by a third party; bank account details of 7 members and 1 member's medical diagnosis may also be affected

Singapore-listed Alliance Healthcare Group said in an SGX filing on 24 October 2026 that its subsidiary Alliance Medinet Pte. Ltd. recently experienced a cyber incident involving unauthorised access to its system containing its membership database, and that, based on investigations to date, the personal data of approximately 110,000 members in that database had been compromised by a third party. The company said the types of personal data potentially affected include names, personal identification numbers and contact information, and that, based on its initial assessment, 7 members might have had bank account information compromised and 1 member's medical diagnosis might have been breached. It said affected members are being notified by Medinet and/or its partners and relevant clients, that it engaged independent cybersecurity and forensic specialists, put in place 24-hour network monitoring and dark web monitoring, and reported the incident to Singapore's Personal Data Protection Commission on 21 October 2026; investigations are ongoing and the rest of the group is not affected. Insurers Income Insurance and Singlife said some of their customers were affected through Alliance Medinet and that there is currently no evidence their own systems were compromised, according to The Straits Times. Primary: Alliance Healthcare Group SGX announcement (24 Oct 2026); wires: The Straits Times, CNA.

Product: Alliance Medinet (Singapore managed healthcare / third-party administrator) — membership database
Versions: n/a — unauthorised access to membership database; access method not disclosed
Exploited in Australia?: unknown
Patch to: Members notified by Alliance Medinet, their insurer or employer: watch for phishing and scam calls that use your name, ID number and contact details, and never give out passwords or one-time codes. The 7 members told their bank details may be affected should alert their bank. Third-party administrators: restrict and monitor bulk reads of membership databases.

Primary: Alliance Healthcare Group — General Announcement: CYBER INCIDENT (SGX, 24 Oct 2026) · Vendor: Alliance Healthcare Group — Cyber Incident announcement (PDF, 24 Oct 2026) · The Straits Times — Personal data of 110,000 members of Alliance Medinet breached; Income Insurance, Singlife affected (24 Oct 2026) · CNA — Alliance Medinet cyber incident (24 Oct 2026)

breaches

Incident

Published 2026-10-23 New

Updated 2026-10-25

Verified 2026-10-25

Sagawa Express says up to about 53.23 million sets of personal information (with many duplicates) may have been compromised through unauthorised access to its parcel tracking service, according to The Japan Times

Japanese transport company Sagawa Express has announced that up to about 53.23 million sets of personal information may have been compromised due to unauthorised access to its delivery tracking service, according to The Japan Times (Jiji, 24 Oct 2026). According to The Japan Times, the affected data includes the names, addresses and phone numbers of senders and recipients on shipping labels from 21 June to 30 September, as well as the addresses and phone numbers of corporate customers; Sagawa Express said the figure does not necessarily reflect the number of affected customers because there are many overlaps between senders and recipients. Sagawa Express announced the figure on 23 October in a follow-up to the unauthorised access it disclosed on 30 September, according to ITmedia NEWS, which reports that the data also covers members of its 'Smart Club' web service (including email addresses and member IDs), that credit card information and passwords are not included, and that the cause is still being investigated with outside specialists. The company has resumed the tracking service but some other web services remain suspended, according to both outlets. Sources: The Japan Times; ITmedia NEWS. Correction (25 Oct 2026): the card date has moved from 24 to 23 October 2026, the date of ITmedia NEWS's report (23 October, 17:38 Japan time; 4:38 pm Perth), the earliest source cited. (source: ITmedia NEWS)

Product: Sagawa Express parcel tracking service (お荷物問い合わせサービス)
Versions: n/a — unauthorised access detected 30 Sep 2026; cause under investigation
Exploited in Australia?: unknown
Patch to: People who sent or received Sagawa Express parcels in Japan between 21 June and 30 September 2026: treat delivery-themed texts, emails and calls (missed-delivery notices, address checks, apologies) with suspicion, don't open their links, and check parcel status only through the official Sagawa site or a branch. Merchants shipping via Sagawa: prepare customer messaging and check your own breach-notification duties in Japan.

Primary: The Japan Times — Sagawa Express says 53 million sets of personal info possibly compromised (24 Oct 2026) · ITmedia NEWS — 佐川への不正アクセス、最大5323万件の個人情報流出か　9月末のサイバー攻撃で続報 (23 Oct 2026)

breaches

Incident

Published 2026-10-23

Updated 2026-10-24

Verified 2026-10-24

Quest Diagnostics says unauthorised access to its Quanum Lab Services Manager (LSM) system, used by some clients to order tests and look up results, affected personal information and patient records; access paused, investigation ongoing, core operations not impacted

Quest Diagnostics says in a notice on its website, 'An update on an incident involving one of our systems', that it has identified an incident involving unauthorised access to its Quanum LSM system, which certain clients use to place test orders and receive and look up results. Quest says it paused access to the system on discovery and is continuing to investigate, that its core business operations are not impacted, and that providers using direct-customer LIS interfaces or EMRs to order testing can keep doing so because those interfaces were not affected. According to The Record (23 Oct), the system was taken offline on Thursday (22 Oct, US time); Quest's statement and FAQ say the company believes some patient data within the system was accessed; Quest is working with law enforcement and investigating what patient data was affected; customers can use paper requisitions in the meantime; and Quest said the incident did not involve the recent PHP vulnerabilities. The Record says a Quest spokesperson declined to comment on the nature of the incident. Primary: Quest Diagnostics notice; wire: The Record. UPDATE (24 Oct 2026): Quest's notice, now marked 'As of 8:00 am ET, October 23, 2026', adds FAQs. Quest says it believes some patient data within Quanum LSM was accessed and that, 'based on our investigation to date, personal information and patient records were affected'; it is still working to determine the specific data and the affected patients and providers, and as the covered entity will make notifications as required by applicable law, with letters describing resources including credit and identity monitoring. Quest says there is no more access to Quanum LSM, that it is communicating with law enforcement, that no data was accessed in its Essential Insights and LabHQ systems although it paused access to them as a precaution, and that the incident is not related to a PHP programming language issue. Quanum LSM is redirecting clients to Quanum eLabs, where they can log in with the same credentials. According to BleepingComputer (23 Oct), Quest said in a filing with the US Securities and Exchange Commission that it learned of the unauthorised access on 21 October 2026, and BleepingComputer could not find a threat group claiming the attack. (source: Quest Diagnostics; BleepingComputer)

Product: Quest Diagnostics Quanum Lab Services Manager (LSM) test ordering and results system
Versions: n/a — unauthorised access to a hosted system; access paused; investigation ongoing (Quest)
Exploited in Australia?: unknown
Patch to: Clinics using Quanum LSM: order through direct LIS interfaces, EMRs, Quanum eLabs (same credentials) or paper requisitions while access is paused, and watch Quest's notice for restoration. Patients: Quest says it will notify affected patients as required by law; be wary of calls, texts or emails claiming to be from Quest about test results, billing or the breach.

Primary: Quest Diagnostics — An update on an incident involving one of our systems · Vendor: Quest Diagnostics — Quanum Lab Services Manager · The Record — Quest Diagnostics warns of potential data theft after attack on lab service system (23 Oct 2026) · BleepingComputer — Quest Diagnostics confirms data breach exposed patient records (23 Oct 2026)

breaches

Incident

Published 2026-10-22 New

Updated 2026-10-25

Verified 2026-10-25

Fisher & Paykel Healthcare says there was unauthorised and unlawful access to two employee email accounts and a subset of company files, some containing personally identifiable information; it says patient-data system not shown to be compromised and no ransomware or malware found

Fisher & Paykel Healthcare Corporation Limited, the respiratory care and sleep apnoea device maker, said in a statement issued from Auckland on 22 October 2026 that it had been made aware of unauthorised and unlawful access to two employee email accounts and a subset of company files, and that it immediately activated its response protocols to contain the incident and investigate. The company said some of the files accessed contained personally identifiable information, that it is in the process of notifying those affected and that it has notified relevant authorities. It said there has been no impact to its products, manufacturing operations or supply chain, that there is no evidence the activity compromised the system that maintains patient data, that it has identified no evidence of ransomware or malware, that it believes the incident has been contained, and that it does not expect any material impact on its financials or operations. The company has not said what kinds of personal information were in the files, how many people are affected or how the accounts were accessed. Primary: F&P Healthcare statement (22 Oct 2026); exchange filing: NZX announcement; wire: CNA.

Product: Fisher & Paykel Healthcare — employee email accounts and company files
Versions: n/a — unauthorised access to two employee email accounts and a subset of company files; access method not disclosed
Exploited in Australia?: unknown
Patch to: People contacted by Fisher & Paykel Healthcare about this incident: follow the company's notification and be wary of unexpected emails that appear to come from F&P staff. Organisations: protect staff mailboxes with phishing-resistant MFA, alert on unusual mailbox access and forwarding rules, and limit sensitive personal information kept in email and shared files.

Primary: Fisher & Paykel Healthcare — F&P Healthcare statement regarding cyber incident (22 Oct 2026) · Vendor: NZX announcement — F&P Healthcare statement regarding cyber incident (22 Oct 2026) · CNA — New Zealand's Fisher & Paykel Healthcare hit by cyber breach (22 Oct 2026)

breaches identity

Incident

Published 2026-10-22

Updated 2026-10-25

Verified 2026-10-25

Hostwinds says it found unauthorised access to the system that runs its client area and billing, took the client area offline and has since reset every client area password; client area back online on a newly built system

Web hosting provider Hostwinds said on its status page on 22 October 2026 (posted 14:44 UTC, 10:44 pm Perth) that it had 'identified unauthorized access to the system that runs the Hostwinds client area and billing', proactively took the client area offline as a precaution, is working with an independent forensic and cybersecurity firm, and has notified the appropriate law enforcement agencies. Hostwinds said customer servers and websites remained online, but that as a precaution it had disabled access to potentially impacted services, so some customers might not be able to sign in to their server. In an update posted on 24 October (18:11 UTC, 2:11 am Perth 25 Oct), Hostwinds said the client area is back online at clients.hostwinds.com, having reopened on the evening of 23 October on a newly built system; that as part of its response it has reset every client area password, so old passwords no longer work; that it has emailed customers with full details and steps to take; and that its investigation with an independent forensic firm is continuing. In that update Hostwinds said PayPal payments were temporarily unavailable while it reconnected them and that the affiliate portal (affiliates.hostwinds.com) remained offline. Hostwinds has not said what data, if any, was accessed or how the attacker got in. Hostwinds warns that it will never ask for passwords, SSH keys or full card numbers by email, chat or phone, and that a password reset email only arrives after the customer selects 'Forgot password' themselves. Primary: Hostwinds status page; vendor guide: Hostwinds password-reset instructions (23 Oct). UPDATE (25 Oct 2026): In a status post at 19:51 UTC on 24 October (3:51 am Perth 25 Oct), Hostwinds said PayPal payments are working again, that customers whose PayPal payment failed should try again, and that access to the client area remains restored; it said its investigation with an independent forensic firm is continuing. (source: Hostwinds System Status)

Product: Hostwinds client area and billing system (web hosting provider)
Versions: n/a — hosting provider incident
Exploited in Australia?: unknown
Patch to: Hostwinds (24 Oct): set a new client area password by typing clients.hostwinds.com into the browser and selecting 'Forgot password' (don't use links in emails), use a unique password and turn on two-factor authentication, and remove unrecognised users under User Management. Change root and administrator passwords, SSH keys and control panel passwords directly on your server, not through the client area, then back up your data; leave the Hostwinds security key described in its email in place. Check for user accounts, keys, DNS records or account details you didn't change, and change any password you shared with Hostwinds in a support ticket. Report signs of access to support@hostwinds.com.

Primary: Hostwinds System Status — Security incident: PayPal payments restored (24 Oct 2026), Security incident: client area back online, action needed (24 Oct 2026) and Security incident: Hostwinds client area offline (22 Oct 2026) · Vendor: Hostwinds Documentation — How to Manage and Reset Your Hostwinds Passwords (23 Oct 2026)

breaches cloud identity

Incident

Published 2026-10-22

Verified 2026-10-23

Capcom says a third party gained unauthorised access to customer information in its CAPCOM ID account service: 11,774,247 email-address records with login metadata worldwide, 43 also with birth date, gender, country and nickname, and passwords changed on 196 accounts; no credit card data

Capcom Co., Ltd. said in a press release on 22 October 2026 that certain customer information tied to CAPCOM ID, the unified account used for its web services and needed to play some Capcom games online, was subject to unauthorised access by a third party. Capcom says the affected information (as of 22 October) is 11,774,247 records worldwide of email addresses plus system identifiers (account creation date and time, last login date and time, number of logins and the client IP address used at the last login); 43 of those records also included date of birth, gender, country/region and nickname, and login passwords on 196 accounts were changed without authorisation and have since been reset. Capcom says it has not confirmed any compromise of passwords originally set by customers and that credit card information was not included. According to Capcom's timeline, it detected suspicious activity on 19 October and confirmed unauthorised access the same day, set up an incident response headquarters on 20 October and confirmed customer information was affected, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. Capcom says it has identified and addressed the attack method, without saying what it was; services that use CAPCOM ID, including games, remain available; it will notify affected customers and has set up dedicated support channels by region, including Asia (excluding Japan) and Oceania. Capcom warns that the information could be misused for fraudulent emails or messages impersonating Capcom. BleepingComputer reported the disclosure on 22 October. Source: Capcom press release (22 Oct 2026); wire: BleepingComputer (22 Oct).

Product: CAPCOM ID (Capcom's unified online membership account service)
Versions: n/a — unauthorised access to account data; detected 19 Oct 2026; attack method not disclosed
Exploited in Australia?: unknown
Patch to: CAPCOM ID users: expect phishing that uses your email address and Capcom branding; Capcom advises not opening links or attachments in suspicious messages. Change your CAPCOM ID password if you reuse it elsewhere, and use Capcom's regional support channels (listed in its notice) for questions. Account-service operators: alert on mass account-record reads and bursts of password changes, which Capcom says it saw on 196 accounts.

Primary: Capcom — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (press release, 22 Oct 2026) · Vendor: Capcom — press release (Japanese original, 22 Oct 2026) · BleepingComputer — Capcom confirms data breach affecting 11.7 million accounts (22 Oct 2026)

breaches identity

Incident

Published 2026-10-22

Verified 2026-10-22

City of Columbia, South Carolina (state capital) says it is responding to a cyberattack that has shut down several city systems, including the MyColaSC resident services platform; the city says police, fire, 911, water and payment systems remain operational, according to The Record (22 Oct)

The city of Columbia, the capital of South Carolina (about 150,000 residents), said it is responding to a cyberattack that has shut down several government systems, according to The Record from Recorded Future News (22 Oct). A city spokesperson told The Record that the city's IT department recently identified suspicious activity and contacted the South Carolina Law Enforcement Division (SLED), which is now leading the investigation. According to The Record, the affected systems include the MyColaSC platform residents use to pay utility bills, report non-emergency issues and reach other city services, as well as Geographic Information Systems and systems supporting animal services; residents were asked to phone in concerns such as potholes, fallen trees and broken streetlights while MyColaSC is down. A city official told The Record that critical public safety and utility systems remain operational, including the Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the Payment Center, including online payment services. The city has not said what kind of attack it was, and The Record says no hacking group had taken credit for the incident as of Wednesday. No Australian impact. Source: The Record (22 Oct).

Product: City of Columbia, South Carolina (US) — municipal IT systems including the MyColaSC resident services platform, GIS and animal services systems
Versions: n/a — municipal cyber incident (reported 22 Oct 2026)
Exploited in Australia?: unknown
Patch to: Columbia residents: use the city's phone lines for non-emergency reports while MyColaSC is down, and be wary of calls, texts or emails about city bills or services that use the outage as a pretext. Councils and utilities: check that resident portals, GIS and back-office systems can be isolated without taking down emergency and payment services.

Primary: The Record (Recorded Future News) — South Carolina officials offer assistance after state capital hit with cyberattack (22 Oct 2026)

breaches

Incident

Published 2026-10-22

Verified 2026-10-22

INTERPOL Operation Serengeti III: police in 21 countries arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than US$105 million in a 29 June–31 August crackdown on cybercrime across Africa

INTERPOL announced on 22 October 2026 the results of Operation Serengeti III, which it describes as one of Africa's largest cybercrime enforcement operations. INTERPOL says investigators from 21 countries, under its coordination, targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion between 29 June and 31 August 2026, arresting 1,462 suspects, disrupting 10,909 malicious networks and recovering more than US$105 million in illicit funds. INTERPOL says authorities identified 65,929 victims and linked the criminal activity to losses exceeding US$385 million. INTERPOL's highlights: in Uganda, two transnational fraud rings were dismantled and 365 foreign nationals arrested over online investment and pension fraud targeting victims across Asia; in Angola, two illegal cryptocurrency mining centres were dismantled, nine suspects arrested and more than 2,000 mining devices seized; in Nigeria, a suspect was arrested over a large-scale phishing and business email compromise operation that harvested software credentials and amassed about 2.1 million email addresses. INTERPOL says partners including Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance supported the operation, and that several investigations remain active. The participating countries INTERPOL lists are 20 African nations and the United States; INTERPOL names no Australian victims.

Exploited in Australia?: unknown
Patch to: Treat unsolicited investment, pension or crypto offers and payment-change requests by email as likely scams: confirm any change to bank details by phoning a number you already hold, and never move money or crypto on a stranger's instructions. Report losses to ReportCyber (cyber.gov.au) and Scamwatch, and call your bank immediately to try to stop a transfer.

Primary: INTERPOL — Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million (22 Oct 2026) · BleepingComputer — Authorities disrupt nearly 11,000 cybercrime networks in Africa (22 Oct 2026)

breaches

Incident

Published 2026-10-21

Updated 2026-10-24

Verified 2026-10-24

Toronto Crime Stoppers pauses all tip intake, saying 176,859 Toronto tips from January 2022 to November 2025 were in data stolen in March from P3, the tip software it has used since 2018

Toronto Crime Stoppers said in a statement dated 21 October 2026, on behalf of chair Sean Sportun, that it is pausing its program effective immediately: it has removed the Tip Submit feature from its website, advised its vendor Navigate360/P3 to suspend intake for Toronto Crime Stoppers, and directed Canada's National Anonymous Call Centre to stop accepting or processing new information meant for it. Toronto Crime Stoppers says hackers stole data in March from P3, the tip software it has used since 2018, which is owned by Navigate360. It says Navigate360 told it that 176,859 Toronto tips, dating from January 2022 to November 2025, were in the stolen data and that Navigate360 has found 14,973 names in those tips, without saying whether the names belong to tipsters, people named in tips, or both; its timeline says Navigate360 told it on 6 July that 12,392 of those tips 'potentially' contained personal information. Toronto Crime Stoppers says some original tips containing potentially identifying information were stolen, that Navigate360 has not given it the text of the stolen tips despite numerous requests through its legal counsel, and that Navigate360 told it in April that Toronto's data had not been taken before saying on 9 June that it was affected. It asks people not to send tips by phone, online or through the app until it has a safer way to protect them, and to call 911 if someone is in danger. Source: Toronto Crime Stoppers statement (21 Oct 2026). Updated 22 Oct 2026: The Record reported Toronto's pause, saying it came hours after Canada's CBC reported that more than 1.5 million tips from Crime Stoppers chapters across the country were exposed in the breach; according to The Record, about half of the 1.5 million leaked tips CBC studied, some dating back 25 years, contained personal information, and CBC reporters reviewed hacked data made available to them in March by Distributed Denial of Secrets (DDoSecrets). The Record says a hacktivist collective known as Internet Yiff Machine claimed responsibility for the March breach. (source: The Record, including its account of CBC's reporting)

Product: P3 tip-management platform (Navigate360 / P3 Global Intel), used by Crime Stoppers programs
Versions: n/a — data theft from a hosted tip platform in March 2026; Toronto tips dated January 2022 to November 2025 affected (Toronto Crime Stoppers)
Exploited in Australia?: unknown
Patch to: Tipsters: Toronto Crime Stoppers says it will never contact you first to ask for your tip number or password; treat any such approach as a scam. Operators of anonymous tip lines and whistleblower platforms: strip identifying details at intake rather than only before release, keep raw submissions no longer than needed, and require vendors to notify you promptly and give you the affected records so you can assess risk to the people involved.

Primary: Toronto Crime Stoppers — Statement from Toronto Crime Stoppers on the P3 data breach (21 Oct 2026; PDF with timeline) · The Record — Toronto crime tips org freezes operations after details of data breach come to light (22 Oct 2026)

breaches

Incident

Published 2026-10-21

Updated 2026-10-24

Verified 2026-10-24

Railway (cloud app deployment platform) says an attacker seeking AI provider API keys reached a subset of its internal systems between 20 and 22 October (UTC) and decrypted a subset of customers' environment variables, with at most 1.85% of workspaces (about 100,000) potentially affected; it urges users to roll secrets stored before 21 October, has invalidated all Railway API tokens and has restored builds for all tiers

Railway's security disclosure, posted by Jacob Cooper on 21 October 2026, says Railway detected anomalous activity that morning involving systems that store customer environment variables, and that its investigation to date indicates an unauthorised third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Railway notes environment variables may contain secrets such as API keys or database and registry credentials. Railway says it believes this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers, and that it has notified those upstream providers to revoke all keys proactively. Railway says its initial analysis suggests the impact may be limited to a subset of users, but it recommends that all users immediately roll every environment variable stored in Railway, including API keys, and any private registry credentials, and review logs for those services for unusual activity; it says it will email affected customers directly as it confirms which accounts were affected. Railway's status page carries the incident as 'Railway Platform Outage', first posted at 07:24 UTC on 21 October (3:24 pm Perth); at 09:28 UTC (5:28 pm Perth) Railway said its dashboard, API and CLI were unavailable and new builds paused in all regions, and at 21:59 UTC (5:59 am Perth 22 Oct) it linked the security notice. At 22:10 UTC (6:10 am Perth 22 Oct) Railway said it was rotating all Railway bucket credentials, with new credentials appearing in dashboards automatically but services unable to be redeployed to pick them up until builds are restored; at 22:45 UTC (6:45 am Perth 22 Oct) it said builds remained paused and that the credential revocations shown in customers' audit logs, carried out by a Railway employee, are expected. Railway has not said how the attacker gained access or how many accounts are affected. UPDATE 22 October (Railway status page): at 01:22 UTC (9:22 am Perth) Railway published guides on recommended next steps, covering checks for unexpected usage at OpenRouter, Anthropic, OpenAI, Grok and Stripe, checks for anomalous GitHub, AWS and GCP access, rotation of PostgreSQL, MySQL, MongoDB and Redis database credentials, and redeploying buckets and reconnecting GitHub after the credential reset; Railway says some steps require a redeploy and will have to wait until builds are available, but others can begin now. In its 03:00 UTC update (11:00 am Perth) Railway said builds remained paused and it expected to have an update for Enterprise users soon. UPDATE 22 October, later (Railway status page): at 03:32 UTC (11:32 am Perth) Railway said builds for Enterprise workspaces are now available, so Enterprise customers can complete the guide steps that require a redeploy, including applying new credentials, with Pro, Hobby, then Free and Trial plans to follow in stages. At 04:17 UTC (12:17 pm Perth) Railway said that, in accordance with its security disclosure, it has invalidated all Railway API tokens, so integrations using the Railway Public API need new tokens. From 04:39 UTC Railway reported deployments stalling at stages such as 'Running pre-deploy command'; at 06:01 UTC it said it was still working on enabling builds for Pro, Hobby, then Free and Trial, and at 06:12 UTC (2:12 pm Perth) it said Enterprise deployments were moving through each stage at normal speed. UPDATE 22 October, evening (Railway status page): at 06:29 UTC (2:29 pm Perth) Railway said builds are now available for Pro and Enterprise workspaces, so Pro customers can complete the guide steps that require a redeploy. At 10:15 UTC Railway said some builds were still failing more often than usual and many deployments remained queued; in its 11:47 UTC update (7:47 pm Perth) it said deployment wait times were coming down, though some deployments may still take longer than usual to start, and that it was still working on enabling builds for Hobby, then Free and Trial. UPDATE 23 October (Railway status page): at 21:08 UTC on 22 October (5:08 am Perth 23 Oct) Railway said builds are now available for Hobby workspaces and that new signups remain temporarily paused; at 21:59 UTC (5:59 am Perth) it said builds are enabled for Hobby, Pro and Enterprise workspaces, are generally completing successfully but may take longer than usual, and that it will update when it enables builds for Free and Trial workspaces. Correction (23 Oct 2026): an earlier version put Railway's 'dashboard, API and CLI unavailable' post at 11:33 UTC on 21 October, the security-notice link at 22:10 UTC and the bucket-credential rotation notice at 22:37 UTC; Railway's status page shows those posts at 09:28 UTC, 21:59 UTC and 22:10 UTC. (source: https://status.railway.com/) UPDATE (24 Oct 2026): Railway's preliminary report, published at 23:31 UTC on 22 October (7:31 am Perth 23 Oct), says the incident led to unauthorised access to a subset of internal Railway systems and that early investigation indicates the attacker was trying to obtain AI provider API keys to perform distillation attacks. Railway puts the attack between 13:58 UTC on 20 October and 03:32 UTC on 22 October, when it confirmed the attacker no longer had access to any internal systems. Railway says the attacker pulled secrets in encrypted form, later accessed credentials for its CI environment and decrypted artifacts holding additional API access, and ran an unauthorised query of encrypted environment variables, a subset of which were decrypted using the compromised credentials. Railway says at most 1.85% of all workspaces, about 100,000, had some environment variables potentially compromised; because it cannot tell which variables were decrypted, it is also contacting other users it considers high risk. Railway says the attacker did not access Railway user accounts, that it is not ruling out access to user source code until its final forensic report, and that it gave vendors such as GitHub and SpaceXSI all API keys on the platform, so a revocation notice from a vendor does not by itself mean a user's credentials were affected. Railway says existing deployments stayed online, builds for all tiers are restored, and it has engaged external incident response experts and the authorities. (source: Railway preliminary report)

Product: Railway cloud application deployment platform (environment variables, storage buckets, builds)
Versions: n/a — cloud platform incident
Exploited in Australia?: unknown
Patch to: Railway (21 Oct): immediately roll all environment variables stored in Railway, including API keys, and any private registry credentials, and review logs for those services for unusual activity. Railway is rotating all storage bucket credentials itself; the new credentials appear in the dashboard, but services cannot be redeployed to use them until Railway restores builds. Watch status.railway.com for build restoration and the email Railway says it will send to affected customers. Railway's 22 Oct guides (linked from status.railway.com) cover usage checks at OpenRouter, Anthropic, OpenAI, Grok and Stripe, GitHub, AWS and GCP access reviews, and PostgreSQL, MySQL, MongoDB and Redis credential rotation; steps that need a redeploy must wait until builds return. Railway (22 Oct, 04:17 UTC): all Railway API tokens have been invalidated, so create new API tokens for any Railway Public API integration. Enterprise workspaces can redeploy to apply new credentials since 03:32 UTC and Pro workspaces since 06:29 UTC; Hobby workspaces since 21:08 UTC on 22 Oct (5:08 am Perth 23 Oct); as of 21:59 UTC on 22 Oct, Free and Trial workspaces were still waiting for builds. Railway's preliminary report (22 Oct): builds for all tiers are restored; revoke and reapply sensitive environment variables stored on Railway before 21 October, check GitHub account audit logs and review all app access.

Primary: Railway — Security Disclosure: Wednesday October 21st (21 Oct 2026) · Vendor: Railway status page — Railway Platform Outage (updates to 11:47 UTC, 22 Oct 2026) · Railway — Preliminary Report: Oct 21st Security Incident (22 Oct 2026)

breaches cloud identity

Incident

Published 2026-10-21

Verified 2026-10-22

Onamae.com Desktop Cloud (Japan): operator says a third party gained unauthorised access and planted malicious programs in some customers' servers, with up to 26,739 servers possibly affected; all plans are being shut down from 21 October

In a notice on Onamae.com dated 21 October 2026 (status as of 4:00 Japan time, 3:00 am Perth), the operator of Onamae.com Desktop Cloud apologised and said a third party had gained unauthorised access to the service, and that on 20 October it confirmed malicious programs had been installed in some customers' server environments. The notice says information stored on the servers may have been viewed and puts the number of servers that may be affected at 26,739; it says that so far it has not confirmed any leak of customers' personal information it holds or any misuse of viewed information, and that it does not hold payment information, including credit card details. To prevent further damage, the operator says it began shutting down customers' servers in stages from 4:00 on 21 October, covering all Desktop Cloud plans, and will announce a restart date once it is decided; its investigation of customer servers continues. It asks customers who stored or used credentials such as IDs and passwords on their servers to change them promptly, including anywhere the same password is reused, and warns of phishing emails and suspicious contacts exploiting the incident, saying it never asks for passwords or card details by email or phone. According to BleepingComputer, Onamae.com is operated by GMO Internet, part of GMO Internet Group, and the Desktop Cloud service is marketed for running MetaTrader 4 automated FX trading.

Product: Onamae.com Desktop Cloud (all plans)
Versions: n/a — hosted service incident
Exploited in Australia?: unknown
Patch to: If you use Onamae.com Desktop Cloud: change any IDs and passwords stored or used on your servers, and the same passwords anywhere else you reuse them (operator's notice, 21 Oct). Ignore emails or calls asking for passwords or card details. Treat data stored on the servers as possibly viewed.

Primary: Onamae.com — Desktop Cloud unauthorised access notice (Japanese, 21 Oct 2026, as of 4:00 JST) · BleepingComputer — Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (21 Oct 2026)

breaches cloud

Incident

Published 2026-10-21

Verified 2026-10-21

State Bank of India discloses data loss: 3,897 customer records with personal details found in a set of about 375,000 records on the dark web, flagged by CERT-In and the Defence Cyber Agency on 16 October

State Bank of India (SBI), India's largest bank, told the BSE and NSE stock exchanges on 21 October 2026 that it 'has experienced an incident involving the loss of certain data'. On 16 October it received alerts from its threat intelligence provider, India's Defence Cyber Agency and CERT-In about suspected exposure of SBI customer data on the dark web. In a preliminary analysis of about 375,000 records available there, the bank identified 3,897 customer records containing personal information. The filing says the exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata from loan and lead records and related files. Account numbers, passwords, card details and government ID numbers are not among the categories listed. SBI says it activated its incident response and containment procedures, engaged an independent CERT-In-empanelled firm to investigate the authenticity, source and extent of the exposure, and that there is no material impact on its core operations. The filing does not say whether SBI's own systems, a subsidiary or a third party were the source, or whether affected customers will be notified. The Hacker News notes the data was advertised on a cybercrime forum and that the details are useful for impersonation calls and messages. Primary: SBI Regulation 30 disclosure to BSE/NSE (21 Oct 2026); wire: The Hacker News (21 Oct).

Exploited in Australia?: unknown
Patch to: SBI customers should expect impersonation attempts using their name, mobile number, date of birth, branch and customer ID; verify any call or message claiming to be from the bank through official channels and never share OTPs or passwords. SBI asks customers to report incidents to report.phishing@sbi.co.in or India's cybercrime helpline 1930.

Primary: State Bank of India — Regulation 30 disclosure: Incident involving Data Loss (NSE/BSE filing, 21 Oct 2026) · Vendor: State Bank of India — stock exchange filing (company statement) · The Hacker News — State Bank of India confirms data leak after 3,897 customer records found on dark web (21 Oct 2026)

breaches

Incident

Published 2026-10-20

Verified 2026-10-21

More than 300 Tor exit relays were hijacked in early October to intercept SSH logins made over Tor and harvest passwords; one operator found the Ebury 1.8.3 OpenSSH backdoor on his servers, and the Tor Project had removed all affected relays by 5 October

Attackers took over more than 300 Tor exit relays between 1 and 5 October 2026 and rewrote their exit policies to carry SSH (port 22) and plaintext mail, so that SSH connections made through Tor were redirected to 12 interception servers that could capture passwords. A researcher publishing as kaba noticed a changed host-key warning on 2 October, scanned all of Tor's roughly 3,000 exits that day and found 333 redirecting SSH to the same interception servers; he reported it to the Tor Project's network health team, which also spotted the policy change. Directory authorities flagged affected relays BadExit and MiddleOnly from 18:00 UTC on 4 October, and by 17:00 UTC on 5 October no relay with the attacker's policy remained in the consensus. A directory-data analysis on the tor-relays list counts 377 relays from 59 operators that switched to the attacker's policy between 1 and 4 October (about 7.46% of exit capacity at the peak), many hosted at FranTech/BuyVM. Only password logins could be stolen: a user had to connect to an SSH server over Tor in that window, hit one of the hijacked exits, accept the interceptor's host key and type a password; key-based logins cannot be relayed this way. The interceptor passed the session through to the real server, watched commands and could log in separately with the stolen password to check sudo and run an installer. Relay operator Zimmer (Quetzalcoatl family) wrote in a post-mortem on 7 October that two of his servers had been running the Ebury 1.8.3 OpenSSH backdoor since 28 August, after an attacker logged in with a reused password over SSH password authentication; this Ebury version is newer than ESET's published indicators. No victim count exists and who is behind the campaign is unknown. Primary: Tor Project notice to relay operators (5 Oct) and kaba's write-up (20 Oct); wire: The Hacker News (21 Oct).

Product: Tor exit relays (Linux hosts); OpenSSH password logins made over Tor; Ebury 1.8.3 OpenSSH backdoor
Versions: n/a — campaign; affected window 1–5 October 2026 (affected relays out of the Tor consensus by 17:00 UTC on 5 Oct)
Exploited in Australia?: unknown
Patch to: If you logged in to an SSH server over Tor with a password between 1 and 5 October and accepted a new or changed host key, treat that password as stolen: change it, review the server for unknown users, authorized_keys entries, cron jobs and systemd units, and check for Ebury (an unpackaged setuid /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2 with libkeyutils.so.1 pointing to it; dpkg -V and debsums will not catch it). Use key-based SSH and disable password authentication on internet-facing servers. Tor relay operators: check Relay Search and torrc (and included files) for ExitRelay, ExitPolicy, ContactInfo, MyFamily or Nickname changes you did not make, and follow the Tor Project's notice.

Primary: kaba — How I got over 300 Tor exit nodes removed (researcher write-up, 20 Oct 2026) · Vendor: Tor Project — Security incident affecting some relay operators (tor-relays list, 5 Oct 2026) · The Hacker News — Attackers hijacked over 300 Tor exit relays to intercept SSH connections (21 Oct 2026)

breaches network