Singapore-listed Alliance Healthcare Group said in an SGX filing on 24 October 2026 that its subsidiary Alliance Medinet Pte. Ltd. recently experienced a cyber incident involving unauthorised access to its system containing its membership database, and that, based on investigations to date, the personal data of approximately 110,000 members in that database had been compromised by a third party. The company said the types of personal data potentially affected include names, personal identification numbers and contact information, and that, based on its initial assessment, 7 members might have had bank account information compromised and 1 member's medical diagnosis might have been breached. It said affected members are being notified by Medinet and/or its partners and relevant clients, that it engaged independent cybersecurity and forensic specialists, put in place 24-hour network monitoring and dark web monitoring, and reported the incident to Singapore's Personal Data Protection Commission on 21 October 2026; investigations are ongoing and the rest of the group is not affected. Insurers Income Insurance and Singlife said some of their customers were affected through Alliance Medinet and that there is currently no evidence their own systems were compromised, according to The Straits Times. Primary: Alliance Healthcare Group SGX announcement (24 Oct 2026); wires: The Straits Times, CNA.
Alliance Healthcare Group — General Announcement: CYBER INCIDENT (SGX, 24 Oct 2026)
breaches
Incidents
Fri 23 Oct New
Updated Sun 25 Oct
Japanese transport company Sagawa Express has announced that up to about 53.23 million sets of personal information may have been compromised due to unauthorised access to its delivery tracking service, according to The Japan Times (Jiji, 24 Oct 2026). According to The Japan Times, the affected data includes the names, addresses and phone numbers of senders and recipients on shipping labels from 21 June to 30 September, as well as the addresses and phone numbers of corporate customers; Sagawa Express said the figure does not necessarily reflect the number of affected customers because there are many overlaps between senders and recipients. Sagawa Express announced the figure on 23 October in a follow-up to the unauthorised access it disclosed on 30 September, according to ITmedia NEWS, which reports that the data also covers members of its 'Smart Club' web service (including email addresses and member IDs), that credit card information and passwords are not included, and that the cause is still being investigated with outside specialists. The company has resumed the tracking service but some other web services remain suspended, according to both outlets. Sources: The Japan Times; ITmedia NEWS. Correction (25 Oct 2026): the card date has moved from 24 to 23 October 2026, the date of ITmedia NEWS's report (23 October, 17:38 Japan time; 4:38 pm Perth), the earliest source cited. (source: ITmedia NEWS)
The Japan Times — Sagawa Express says 53 million sets of personal info possibly compromised (24 Oct 2026)
breaches
Incidents
Fri 23 Oct
Updated Sat 24 Oct
Quest Diagnostics says in a notice on its website, 'An update on an incident involving one of our systems', that it has identified an incident involving unauthorised access to its Quanum LSM system, which certain clients use to place test orders and receive and look up results. Quest says it paused access to the system on discovery and is continuing to investigate, that its core business operations are not impacted, and that providers using direct-customer LIS interfaces or EMRs to order testing can keep doing so because those interfaces were not affected. According to The Record (23 Oct), the system was taken offline on Thursday (22 Oct, US time); Quest's statement and FAQ say the company believes some patient data within the system was accessed; Quest is working with law enforcement and investigating what patient data was affected; customers can use paper requisitions in the meantime; and Quest said the incident did not involve the recent PHP vulnerabilities. The Record says a Quest spokesperson declined to comment on the nature of the incident. Primary: Quest Diagnostics notice; wire: The Record. UPDATE (24 Oct 2026): Quest's notice, now marked 'As of 8:00 am ET, October 23, 2026', adds FAQs. Quest says it believes some patient data within Quanum LSM was accessed and that, 'based on our investigation to date, personal information and patient records were affected'; it is still working to determine the specific data and the affected patients and providers, and as the covered entity will make notifications as required by applicable law, with letters describing resources including credit and identity monitoring. Quest says there is no more access to Quanum LSM, that it is communicating with law enforcement, that no data was accessed in its Essential Insights and LabHQ systems although it paused access to them as a precaution, and that the incident is not related to a PHP programming language issue. Quanum LSM is redirecting clients to Quanum eLabs, where they can log in with the same credentials. According to BleepingComputer (23 Oct), Quest said in a filing with the US Securities and Exchange Commission that it learned of the unauthorised access on 21 October 2026, and BleepingComputer could not find a threat group claiming the attack. (source: Quest Diagnostics; BleepingComputer)
Quest Diagnostics — An update on an incident involving one of our systems
breaches
Incidents
Thu 22 Oct New
Updated Sun 25 Oct
Fisher & Paykel Healthcare Corporation Limited, the respiratory care and sleep apnoea device maker, said in a statement issued from Auckland on 22 October 2026 that it had been made aware of unauthorised and unlawful access to two employee email accounts and a subset of company files, and that it immediately activated its response protocols to contain the incident and investigate. The company said some of the files accessed contained personally identifiable information, that it is in the process of notifying those affected and that it has notified relevant authorities. It said there has been no impact to its products, manufacturing operations or supply chain, that there is no evidence the activity compromised the system that maintains patient data, that it has identified no evidence of ransomware or malware, that it believes the incident has been contained, and that it does not expect any material impact on its financials or operations. The company has not said what kinds of personal information were in the files, how many people are affected or how the accounts were accessed. Primary: F&P Healthcare statement (22 Oct 2026); exchange filing: NZX announcement; wire: CNA.
Fisher & Paykel Healthcare — F&P Healthcare statement regarding cyber incident (22 Oct 2026)
breaches identity
Incidents
Thu 22 Oct New
Updated Sun 25 Oct
Web hosting provider Hostwinds said on its status page on 22 October 2026 (posted 14:44 UTC, 10:44 pm Perth) that it had 'identified unauthorized access to the system that runs the Hostwinds client area and billing', proactively took the client area offline as a precaution, is working with an independent forensic and cybersecurity firm, and has notified the appropriate law enforcement agencies. Hostwinds said customer servers and websites remained online, but that as a precaution it had disabled access to potentially impacted services, so some customers might not be able to sign in to their server. In an update posted on 24 October (18:11 UTC, 2:11 am Perth 25 Oct), Hostwinds said the client area is back online at clients.hostwinds.com, having reopened on the evening of 23 October on a newly built system; that as part of its response it has reset every client area password, so old passwords no longer work; that it has emailed customers with full details and steps to take; and that its investigation with an independent forensic firm is continuing. In that update Hostwinds said PayPal payments were temporarily unavailable while it reconnected them and that the affiliate portal (affiliates.hostwinds.com) remained offline. Hostwinds has not said what data, if any, was accessed or how the attacker got in. Hostwinds warns that it will never ask for passwords, SSH keys or full card numbers by email, chat or phone, and that a password reset email only arrives after the customer selects 'Forgot password' themselves. Primary: Hostwinds status page; vendor guide: Hostwinds password-reset instructions (23 Oct). UPDATE (25 Oct 2026): In a status post at 19:51 UTC on 24 October (3:51 am Perth 25 Oct), Hostwinds said PayPal payments are working again, that customers whose PayPal payment failed should try again, and that access to the client area remains restored; it said its investigation with an independent forensic firm is continuing. (source: Hostwinds System Status)
Hostwinds System Status — Security incident: PayPal payments restored (24 Oct 2026), Security incident: client area back online, action needed (24 Oct 2026) and Security incident: Hostwinds client area offline (22 Oct 2026)
breaches cloud identity
Capcom Co., Ltd. said in a press release on 22 October 2026 that certain customer information tied to CAPCOM ID, the unified account used for its web services and needed to play some Capcom games online, was subject to unauthorised access by a third party. Capcom says the affected information (as of 22 October) is 11,774,247 records worldwide of email addresses plus system identifiers (account creation date and time, last login date and time, number of logins and the client IP address used at the last login); 43 of those records also included date of birth, gender, country/region and nickname, and login passwords on 196 accounts were changed without authorisation and have since been reset. Capcom says it has not confirmed any compromise of passwords originally set by customers and that credit card information was not included. According to Capcom's timeline, it detected suspicious activity on 19 October and confirmed unauthorised access the same day, set up an incident response headquarters on 20 October and confirmed customer information was affected, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. Capcom says it has identified and addressed the attack method, without saying what it was; services that use CAPCOM ID, including games, remain available; it will notify affected customers and has set up dedicated support channels by region, including Asia (excluding Japan) and Oceania. Capcom warns that the information could be misused for fraudulent emails or messages impersonating Capcom. BleepingComputer reported the disclosure on 22 October. Source: Capcom press release (22 Oct 2026); wire: BleepingComputer (22 Oct).
Capcom — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (press release, 22 Oct 2026)
breaches identity
The city of Columbia, the capital of South Carolina (about 150,000 residents), said it is responding to a cyberattack that has shut down several government systems, according to The Record from Recorded Future News (22 Oct). A city spokesperson told The Record that the city's IT department recently identified suspicious activity and contacted the South Carolina Law Enforcement Division (SLED), which is now leading the investigation. According to The Record, the affected systems include the MyColaSC platform residents use to pay utility bills, report non-emergency issues and reach other city services, as well as Geographic Information Systems and systems supporting animal services; residents were asked to phone in concerns such as potholes, fallen trees and broken streetlights while MyColaSC is down. A city official told The Record that critical public safety and utility systems remain operational, including the Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the Payment Center, including online payment services. The city has not said what kind of attack it was, and The Record says no hacking group had taken credit for the incident as of Wednesday. No Australian impact. Source: The Record (22 Oct).
The Record (Recorded Future News) — South Carolina officials offer assistance after state capital hit with cyberattack (22 Oct 2026)
breaches
INTERPOL announced on 22 October 2026 the results of Operation Serengeti III, which it describes as one of Africa's largest cybercrime enforcement operations. INTERPOL says investigators from 21 countries, under its coordination, targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion between 29 June and 31 August 2026, arresting 1,462 suspects, disrupting 10,909 malicious networks and recovering more than US$105 million in illicit funds. INTERPOL says authorities identified 65,929 victims and linked the criminal activity to losses exceeding US$385 million. INTERPOL's highlights: in Uganda, two transnational fraud rings were dismantled and 365 foreign nationals arrested over online investment and pension fraud targeting victims across Asia; in Angola, two illegal cryptocurrency mining centres were dismantled, nine suspects arrested and more than 2,000 mining devices seized; in Nigeria, a suspect was arrested over a large-scale phishing and business email compromise operation that harvested software credentials and amassed about 2.1 million email addresses. INTERPOL says partners including Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance supported the operation, and that several investigations remain active. The participating countries INTERPOL lists are 20 African nations and the United States; INTERPOL names no Australian victims.
INTERPOL — Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million (22 Oct 2026)
breaches
Incidents
Wed 21 Oct
Updated Sat 24 Oct
Toronto Crime Stoppers said in a statement dated 21 October 2026, on behalf of chair Sean Sportun, that it is pausing its program effective immediately: it has removed the Tip Submit feature from its website, advised its vendor Navigate360/P3 to suspend intake for Toronto Crime Stoppers, and directed Canada's National Anonymous Call Centre to stop accepting or processing new information meant for it. Toronto Crime Stoppers says hackers stole data in March from P3, the tip software it has used since 2018, which is owned by Navigate360. It says Navigate360 told it that 176,859 Toronto tips, dating from January 2022 to November 2025, were in the stolen data and that Navigate360 has found 14,973 names in those tips, without saying whether the names belong to tipsters, people named in tips, or both; its timeline says Navigate360 told it on 6 July that 12,392 of those tips 'potentially' contained personal information. Toronto Crime Stoppers says some original tips containing potentially identifying information were stolen, that Navigate360 has not given it the text of the stolen tips despite numerous requests through its legal counsel, and that Navigate360 told it in April that Toronto's data had not been taken before saying on 9 June that it was affected. It asks people not to send tips by phone, online or through the app until it has a safer way to protect them, and to call 911 if someone is in danger. Source: Toronto Crime Stoppers statement (21 Oct 2026). Updated 22 Oct 2026: The Record reported Toronto's pause, saying it came hours after Canada's CBC reported that more than 1.5 million tips from Crime Stoppers chapters across the country were exposed in the breach; according to The Record, about half of the 1.5 million leaked tips CBC studied, some dating back 25 years, contained personal information, and CBC reporters reviewed hacked data made available to them in March by Distributed Denial of Secrets (DDoSecrets). The Record says a hacktivist collective known as Internet Yiff Machine claimed responsibility for the March breach. (source: The Record, including its account of CBC's reporting)
Toronto Crime Stoppers — Statement from Toronto Crime Stoppers on the P3 data breach (21 Oct 2026; PDF with timeline)
breaches
Incidents
Wed 21 Oct
Updated Sat 24 Oct
Railway's security disclosure, posted by Jacob Cooper on 21 October 2026, says Railway detected anomalous activity that morning involving systems that store customer environment variables, and that its investigation to date indicates an unauthorised third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Railway notes environment variables may contain secrets such as API keys or database and registry credentials. Railway says it believes this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers, and that it has notified those upstream providers to revoke all keys proactively. Railway says its initial analysis suggests the impact may be limited to a subset of users, but it recommends that all users immediately roll every environment variable stored in Railway, including API keys, and any private registry credentials, and review logs for those services for unusual activity; it says it will email affected customers directly as it confirms which accounts were affected. Railway's status page carries the incident as 'Railway Platform Outage', first posted at 07:24 UTC on 21 October (3:24 pm Perth); at 09:28 UTC (5:28 pm Perth) Railway said its dashboard, API and CLI were unavailable and new builds paused in all regions, and at 21:59 UTC (5:59 am Perth 22 Oct) it linked the security notice. At 22:10 UTC (6:10 am Perth 22 Oct) Railway said it was rotating all Railway bucket credentials, with new credentials appearing in dashboards automatically but services unable to be redeployed to pick them up until builds are restored; at 22:45 UTC (6:45 am Perth 22 Oct) it said builds remained paused and that the credential revocations shown in customers' audit logs, carried out by a Railway employee, are expected. Railway has not said how the attacker gained access or how many accounts are affected. UPDATE 22 October (Railway status page): at 01:22 UTC (9:22 am Perth) Railway published guides on recommended next steps, covering checks for unexpected usage at OpenRouter, Anthropic, OpenAI, Grok and Stripe, checks for anomalous GitHub, AWS and GCP access, rotation of PostgreSQL, MySQL, MongoDB and Redis database credentials, and redeploying buckets and reconnecting GitHub after the credential reset; Railway says some steps require a redeploy and will have to wait until builds are available, but others can begin now. In its 03:00 UTC update (11:00 am Perth) Railway said builds remained paused and it expected to have an update for Enterprise users soon. UPDATE 22 October, later (Railway status page): at 03:32 UTC (11:32 am Perth) Railway said builds for Enterprise workspaces are now available, so Enterprise customers can complete the guide steps that require a redeploy, including applying new credentials, with Pro, Hobby, then Free and Trial plans to follow in stages. At 04:17 UTC (12:17 pm Perth) Railway said that, in accordance with its security disclosure, it has invalidated all Railway API tokens, so integrations using the Railway Public API need new tokens. From 04:39 UTC Railway reported deployments stalling at stages such as 'Running pre-deploy command'; at 06:01 UTC it said it was still working on enabling builds for Pro, Hobby, then Free and Trial, and at 06:12 UTC (2:12 pm Perth) it said Enterprise deployments were moving through each stage at normal speed. UPDATE 22 October, evening (Railway status page): at 06:29 UTC (2:29 pm Perth) Railway said builds are now available for Pro and Enterprise workspaces, so Pro customers can complete the guide steps that require a redeploy. At 10:15 UTC Railway said some builds were still failing more often than usual and many deployments remained queued; in its 11:47 UTC update (7:47 pm Perth) it said deployment wait times were coming down, though some deployments may still take longer than usual to start, and that it was still working on enabling builds for Hobby, then Free and Trial. UPDATE 23 October (Railway status page): at 21:08 UTC on 22 October (5:08 am Perth 23 Oct) Railway said builds are now available for Hobby workspaces and that new signups remain temporarily paused; at 21:59 UTC (5:59 am Perth) it said builds are enabled for Hobby, Pro and Enterprise workspaces, are generally completing successfully but may take longer than usual, and that it will update when it enables builds for Free and Trial workspaces. Correction (23 Oct 2026): an earlier version put Railway's 'dashboard, API and CLI unavailable' post at 11:33 UTC on 21 October, the security-notice link at 22:10 UTC and the bucket-credential rotation notice at 22:37 UTC; Railway's status page shows those posts at 09:28 UTC, 21:59 UTC and 22:10 UTC. (source: https://status.railway.com/) UPDATE (24 Oct 2026): Railway's preliminary report, published at 23:31 UTC on 22 October (7:31 am Perth 23 Oct), says the incident led to unauthorised access to a subset of internal Railway systems and that early investigation indicates the attacker was trying to obtain AI provider API keys to perform distillation attacks. Railway puts the attack between 13:58 UTC on 20 October and 03:32 UTC on 22 October, when it confirmed the attacker no longer had access to any internal systems. Railway says the attacker pulled secrets in encrypted form, later accessed credentials for its CI environment and decrypted artifacts holding additional API access, and ran an unauthorised query of encrypted environment variables, a subset of which were decrypted using the compromised credentials. Railway says at most 1.85% of all workspaces, about 100,000, had some environment variables potentially compromised; because it cannot tell which variables were decrypted, it is also contacting other users it considers high risk. Railway says the attacker did not access Railway user accounts, that it is not ruling out access to user source code until its final forensic report, and that it gave vendors such as GitHub and SpaceXSI all API keys on the platform, so a revocation notice from a vendor does not by itself mean a user's credentials were affected. Railway says existing deployments stayed online, builds for all tiers are restored, and it has engaged external incident response experts and the authorities. (source: Railway preliminary report)
Railway — Security Disclosure: Wednesday October 21st (21 Oct 2026)
breaches cloud identity
In a notice on Onamae.com dated 21 October 2026 (status as of 4:00 Japan time, 3:00 am Perth), the operator of Onamae.com Desktop Cloud apologised and said a third party had gained unauthorised access to the service, and that on 20 October it confirmed malicious programs had been installed in some customers' server environments. The notice says information stored on the servers may have been viewed and puts the number of servers that may be affected at 26,739; it says that so far it has not confirmed any leak of customers' personal information it holds or any misuse of viewed information, and that it does not hold payment information, including credit card details. To prevent further damage, the operator says it began shutting down customers' servers in stages from 4:00 on 21 October, covering all Desktop Cloud plans, and will announce a restart date once it is decided; its investigation of customer servers continues. It asks customers who stored or used credentials such as IDs and passwords on their servers to change them promptly, including anywhere the same password is reused, and warns of phishing emails and suspicious contacts exploiting the incident, saying it never asks for passwords or card details by email or phone. According to BleepingComputer, Onamae.com is operated by GMO Internet, part of GMO Internet Group, and the Desktop Cloud service is marketed for running MetaTrader 4 automated FX trading.
Onamae.com — Desktop Cloud unauthorised access notice (Japanese, 21 Oct 2026, as of 4:00 JST)
breaches cloud
State Bank of India (SBI), India's largest bank, told the BSE and NSE stock exchanges on 21 October 2026 that it 'has experienced an incident involving the loss of certain data'. On 16 October it received alerts from its threat intelligence provider, India's Defence Cyber Agency and CERT-In about suspected exposure of SBI customer data on the dark web. In a preliminary analysis of about 375,000 records available there, the bank identified 3,897 customer records containing personal information. The filing says the exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata from loan and lead records and related files. Account numbers, passwords, card details and government ID numbers are not among the categories listed. SBI says it activated its incident response and containment procedures, engaged an independent CERT-In-empanelled firm to investigate the authenticity, source and extent of the exposure, and that there is no material impact on its core operations. The filing does not say whether SBI's own systems, a subsidiary or a third party were the source, or whether affected customers will be notified. The Hacker News notes the data was advertised on a cybercrime forum and that the details are useful for impersonation calls and messages. Primary: SBI Regulation 30 disclosure to BSE/NSE (21 Oct 2026); wire: The Hacker News (21 Oct).
State Bank of India — Regulation 30 disclosure: Incident involving Data Loss (NSE/BSE filing, 21 Oct 2026)
breaches
