The US Department of Homeland Security published notice on 19 October 2026 (filed for public inspection at 8:45 am ET, 8:45 pm Perth; formally published in the Federal Register on 20 October, FR Doc. 2026-21447, docket DHS-2026-0628) of a Federal Acquisition Supply Chain Security Act (FASCSA) order against Chinese AI developer Hangzhou DeepSeek Artificial Intelligence. Exclusion and Removal Order #2026-01 was signed by Homeland Security Secretary Markwayne Mullin with an original release date of 24 July 2026. It applies to federal civilian executive branch agencies; national security systems and sensitive compartmented information systems, which fall to the Defense Department and the Director of National Intelligence, are excluded. Agencies must immediately exclude DeepSeek, its affiliates and their products from procurement, including approved-product lists and e-commerce marketplaces, and must immediately remove products from DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from their IT systems, or seek an exception. Exception requests must be made in writing to CISA within 60 days with a compelling justification and alternative mitigations. Until removal is complete, agencies are encouraged to monitor traffic in and out, add logging and data-exfiltration controls for the affected systems, and flag unusual activity. The order's risk summary says DeepSeek's servers are in China and Chinese law gives the state wide powers to access company infrastructure; that DeepSeek-hosted services collect personal information and may track and fingerprint users; that prompts can send sensitive government or vendor data to China; that the models may contain malware or security weaknesses; and that independent research found multiple critical vulnerabilities in the DeepSeek iOS app. DHS will review the order within a year and every year after that. In Australia, PSPF Direction 001-2025 (4 February 2025) already requires Australian Government entities to prevent the use or installation of DeepSeek products, applications and web services and remove any existing instances from government systems and devices. Primary: Federal Register public-inspection notice with the signed order; wire: Bloomberg (19 Oct).
Federal Register (public inspection) — DHS notice of order: Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch IT Systems and Procurements (FR Doc. 2026-21447; filed 19 Oct 2026, published 20 Oct)
BILD reported, in an article dated 20 October 2026 (09:20 German time), that a website had published that day what it says are 421,179 emails (281 GB) from Germany's Alternative für Deutschland (AfD) party, along with AI-generated summaries of selected messages attributed to party figures including co-leader Alice Weidel, honorary chairman Alexander Gauland and Leif-Erik Holm. In a limited look at the material, BILD saw a photo of the identity card of Markus Frohnmaier, deputy leader of the AfD group in the Bundestag, other identity documents, invoices, bank statements, certificates, and membership applications and member lists from AfD district branches in North Rhine-Westphalia. An AfD spokesperson confirmed to BILD that in September 2026 a hosting provider used by the party was hacked and parts of a few mailboxes, most of them unused for years, appear to have been unlawfully copied. The party says the attack was stopped quickly, all affected users were informed, current mailboxes of the federal party were not affected, and it is examining the published material. According to B.Z., an internal AfD email to its state branches gives the same account. It is not yet confirmed whether the published files are genuine or whether they all come from the September intrusion. The hosting provider has not been named, and nobody has publicly claimed the attack or been identified. Wire: BILD (dated 20 Oct); B.Z. (20 Oct). Correction (24 Oct 2026): an earlier version said the emails were published on 19 October and that BILD reported it that evening; BILD's article is dated 20 October 2026, 09:20, and says the material was published that day. (source: https://www.bild.de/politik/inland/afd-offenbar-421-179-mails-nach-hackerangriff-im-netz-6ad6642951e5094f7a57232d)
BILD — AfD: Offenbar 421.179 Mails nach Hackerangriff im Netz (dated 20 Oct 2026; includes AfD spokesperson statement)
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin (more than 4 million active installations on WordPress.org) and the UpdraftCentral, UpdraftVault and UpdraftClone services, said on 19 October 2026 that it found unauthorised access to the teamupdraft.com website over the weekend of 17–18 October. The company believes its customer database was accessed. That database holds names, email addresses, billing addresses and order history; account passwords stored as hashes; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details are not stored (payments go through Stripe and PayPal). TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected, backups sent to customers' own remote storage (such as Google Drive, Dropbox or Amazon S3) were not affected, and self-hosted UpdraftCentral is not affected. The main risk is the cloud UpdraftCentral connection keys, which can send commands to connected WordPress sites. In response the company closed the access route and fixed the underlying weakness, signed out every teamupdraft.com account, disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated keys with payment providers and other connected services, added monitoring, and reported the incident to the UK Information Commissioner's Office and other authorities. It released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) to automatically disconnect old UpdraftCentral connections so the old keys stop working (this card earlier gave the cutoff as 22:00 BST on 18 October, from an earlier version of TeamUpdraft's page; the page now says 1.26.13 and 2.26.13 disconnect every UpdraftCentral connection made before 13:07 BST on 18 October, 8:07 pm Perth); 1.26.12 was published on WordPress.org on 19 October at 16:46 UTC (12:46 am Perth, 20 October) with the changelog entry 'Revokes UpdraftCentral Cloud keys created before the incident'. TeamUpdraft said on 21 October: 'We know the attacker used a compromised key to access our site', and that 'The attacker exploited the connection to users’ sites to create admin accounts, install malicious plugins etc – the extent of that is unknown'. It has not said how many accounts are affected. No Australian impact has been reported, but Australian agencies, hosts and businesses that manage WordPress sites through cloud UpdraftCentral are in scope. UPDATE (21 Oct; Patchstack, Nethemba, TeamUpdraft): the stolen keys were used. Patchstack (Critical, CVSS 9.8; no CVE, as this is a key compromise rather than a code flaw) says an attacker holding valid UpdraftCentral dashboard keys sent correctly signed plugin.upload_plugin commands to connected sites between 18 October 15:32 UTC and 19 October 09:23 UTC (11:32 pm 18 Oct to 5:23 pm 19 Oct Perth), installing at least 99 differently named backdoor plugins (the name 'Site Health Cache' recurs; every sample carries the description 'Small maintenance toolkit: keeps option storage tidy.'). The backdoor creates an Editor-looking account that also holds manage_options and install_plugins and logs the attacker in by cookie, bypassing the login form and 2FA; the account survives removal of the plugin. Early samples crashed sites with HTTP 500 errors; Nethemba documents a working newer variant and says two of its three targeted sites, running WordPress 7.1.3 and UpdraftPlus 2.26.11, were backdoored. Patchstack notes sites can hold a key without anyone choosing UpdraftCentral, because connecting a TeamUpdraft.com account ticks 'Add this website to UpdraftCentral' by default, and keys do not expire. Published indicators include source addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, accounts such as data-ops43 and media-staff96 with @example.org emails and display name 'Site Tools', and an option ending in _sync_token. Nethemba found that 1.26.12 / 2.26.12 did not actually remove the old keys because of a bug; UpdraftPlus 1.26.13 (WordPress.org changelog: 'Properly apply the revocation in 1.26.12') and 2.26.13 shipped on 19 October just after 22:00 BST (5:00 am 20 Oct Perth). TeamUpdraft's 20 October 16:25 BST update says the unauthorised access was resolved and 1.26.13 / 2.26.13 block that route, but still asks users to check their sites. With around 10% of UpdraftPlus sites estimated to hold an UpdraftCentral or Migrator key, roughly 400,000 sites may have been exposed (BleepingComputer). UPDATE (23 Oct 2026; TeamUpdraft incident page, last updated 23 Oct 05:26 BST): in its 21 October 10:23 BST update (5:23 pm Perth) TeamUpdraft said it had found that the attacker used a compromised key to access its site, that 'The speed of the exploits following the breach combined with the initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack', that it had brought in an external cyber security firm, and that it had 'contacted the relevant authorities (including the police)'. At 15:35 BST on 21 October (10:35 pm Perth) it asked UpdraftPlus Premium users to check their websites for signs of unusual activity 'even if you’ve never used UpdraftCentral', and took its support form offline because of the PHP vulnerabilities. At 14:42 BST on 22 October (9:42 pm Perth) it said the support form was back, that 'If a site is listed that you didn’t knowingly connect since the 19th Oct, please check it for signs of compromise', and that it is 'seeing a pattern of unexpected ‘editor’ roles'; it asks users to log in to UpdraftCentral through My Account and check the sites listed there for unexpected users, unrecognised plugins and unknown IP addresses in logs. Correction (24 Oct 2026): an earlier version quoted TeamUpdraft as saying 'Any site listed before this incident has potentially been exposed to the attacker'; that sentence is no longer on its incident page (last updated 23 Oct 05:26 BST), whose 22 Oct 14:42 BST update now asks users to check any listed site they did not knowingly connect since 19 October. (source: https://teamupdraft.com/blog/security-incident-october-2026/)
TeamUpdraft — TeamUpdraft security incident: What customers need to know (19 Oct 2026, last updated 23 Oct 05:26 BST)
NorForge researcher Snorre Fagerland published 'Inside Cairn' on 19 October 2026, after scanning Shodan and Censys for AI hacking harnesses whose web panels were left open (searches began after Gambit Security's September report of Strix, Cairn and Hermes being used against online retailers). Cairn is an open-source, state-based 'problem-solving engine': each project has a start point and an end goal, and AI agent workers post facts and intents to a shared blackboard until the goal is met. NorForge found more than 20 exposed Cairn panels it assesses as likely malicious and financially motivated, in three clusters. AIA0001, a Chinese-language actor (high confidence malicious), ran more than 1,100 attack projects across 14 panels, mostly hosted on AS56594 (Cgi Global Limited). Its automated pipeline feeds in real US, Canadian, Japanese and Australian online shops with 200,000 to 1.5 million visits, already checked with Playwright that orders can be placed, and tells the agents to find unauthenticated remote code execution (login SQL injection, unauthenticated endpoints, file uploads, deserialisation, authentication bypass, account takeover) and plant an 'uploader' webshell, aiming at persistent access to e-commerce and payment systems. NorForge's first case study is an Australian e-commerce site where the panel recorded the goal as met; NorForge confirmed a shell giving command execution on its web server, reached through a chain starting with unauthenticated account modification. AIA0002, an English-language crew on about 10 panels mostly on AS20473 (The Constant Company/Vultr), openly tasks agents to steal card data and cryptocurrency and used DeepSeek models through OpenRouter; AIA0003 is a smaller, lower-confidence English-language panel. Successful AIA0001 projects took a little under 23 hours on average, and NorForge estimates a success rate of about 10% across these harnesses. Running Trufflehog over the panel data found hundreds of exposed secrets, 11% verified as valid, and the panels appeared to expose full admin controls; NorForge also found legitimate red-team engagements exposed the same way. NorForge has redacted panel addresses and is working with Reuters to notify victims and with hosts to take panels down. Reuters (19 Oct), which reviewed the attacker's own records, reported (as relayed by The Hacker News and The Verge) that the hacker broke into websites of more than 100 companies, out of more than 1,200 attempted, including Deere, SharkNinja and Cummins: Deere said it took remediation actions and has no indication sensitive information was accessed; SharkNinja said a standalone product-support site was hit and contained; Cummins told The Verge it is investigating a potential attack on a website run by a third-party vendor. Cairn's creator says the platform was never a hacking tool and misuse is a human decision. No Australian victim has been named publicly.
NorForge — Inside Cairn: Open windows into massive AI-driven cyber operations (19 Oct 2026)
Security firm Claroc reported on 18 October 2026 that shared conversations from Meta's Muse personal AI agent (launched 8 September) could be found and opened by people who were never sent the link. Muse publishes a shared chat as a public page under cf.metaaiusercontent.com and builds the hostname from the conversation's title plus a random ID. The first time anyone opens a share, the full hostname is resolved through DNS, and commercial passive-DNS services record it, so the random ID offers no protection once looked up. One passive-DNS query returned more than 6,800 share hostnames, readable by title, and pages opened without an account or sign-in; urlscan.io also held more than 75 saved scans of Muse share pages. Opening a few hundred, Claroc found mostly harmless material but also dozens of personal records and internal business documents, including a job candidate's notes for a confidential executive-search call with a frontier AI lab (naming the internal contact and meeting time), a bank fraud alert with a partial account number, a real-estate investor's internal return and mortgage figures, and a staff leave calendar. Muse's robots.txt keeps search and AI crawlers off share pages, but that does not stop direct access. After Ars Technica contacted Meta, Meta told it on 20 October that it has paused the sharing feature while it reviews the report; Claroc says 40 shares it rechecked that day no longer opened, but the hostnames, titles included, remain in passive-DNS history. Primary: Claroc; wire: Ars Technica (20 Oct).
Claroc — GhostShares: a shared Muse chat exposed prep for a confidential call with a frontier AI lab leader (18 Oct 2026; updated 20 Oct)
The Pillow maintainers released Pillow 13.0.0 on 16 October 2026 (UTC) and published 40 GitHub security advisories for it on 17 October: two rated critical, 13 high, 22 medium and three low. The most serious, CVE-2026-112398, is a heap buffer overflow in the FlashPix (FPX) JPEG-tile decoder; the reporter shows code execution from a single crafted file passed to Image.open(), and because Pillow detects FPX by its content rather than its extension, any service that opens or thumbnails untrusted uploads is reachable when the optional olefile package is installed. Other high-severity fixes include JPEG encoder and decoder heap overflows (CVE-2026-96778 when re-saving a JPEG with its colour profile, CVE-2026-112403 via Image.thumbnail()), TIFF out-of-bounds reads that can leak heap memory into pixels, and a heap-buffer-overflow write in the OpenJPEG library bundled in every Pillow wheel since 11.1.0 (CVSS 3.1 8.1), which a patched operating system does not fix. CVE-2026-112900 is a Ghostscript argument injection in EPS handling when a file name starts with a dash. Most of the rest are denial-of-service bugs (decompression-bomb bypasses, infinite loops, quadratic parsing). Some were found by Anthropic using Claude and validated by Ada Logics. Red Hat began listing the CVEs on 19 October. A further medium advisory published 19 October (Arrow export leaking heap memory when PILLOW_ALIGNMENT is above 1) also affects 13.0.0 and has no fixed release yet. No exploitation has been reported. Primary: Pillow on GitHub. UPDATE (23 Oct 2026): The CVE records published by GitHub, the CVE numbering authority, on 19 October (UTC) score four of the flaws 9.2 under CVSS 4.0: CVE-2026-112398 (FlashPix decoding), CVE-2026-112403 (JPEG decoding after draft()), CVE-2026-112393 (heap buffer overflow when saving TIFF to BytesIO) and CVE-2026-112900 (argument injection in the Ghostscript call, potentially leading to code execution). The maintainers' own advisories rate those four critical, high, high and medium respectively. In the same records, CISA's ADP enrichment records a public proof of concept for CVE-2026-112398, CVE-2026-112403 and CVE-2026-112393, and no known exploitation for CVE-2026-112900. Pillow 13.0.0 remains the fixed release. (source: CVE.org records)
Pillow GHSA-5x8w-8jj5-q52h — FlashPix (FPX) JPEG decoding heap buffer overflow leads to code execution (CVE-2026-112398, critical; 17 Oct 2026)
Bullhorn, a US company whose cloud applicant-tracking and CRM software is used by staffing and recruitment firms (more than 10,000 customers worldwide, according to the company), disabled access to its platform after detecting what it calls a cyber incident on the Bullhorn Platform. Its status page shows login errors across all ATS/CRM clusters, including the Australian clusters CLS61 and CLS62, from 05:24 EDT on 17 October (5:24 pm Perth), a system-wide outage by 08:04 EDT, and at 15:28 EDT (3:28 am Perth, 18 October) the statement that a cyber incident had been detected, access had been temporarily disabled to contain the activity, and CrowdStrike specialists were assisting. Bullhorn brought its Australian, EMEA/UK and US regions back online on 19 October; at 16:54 EDT (4:54 am Perth, 20 October) it said all regions were online and that it had fixed sign-in problems for SSO customers. In its customer FAQ (last updated 19 October, 5:15 pm ET) Bullhorn says it has isolated the issue and removed the immediate threat, that the incident affected Bullhorn ATS/CRM, and that there is no indication other Bullhorn products, including its Salesforce-based products, Bullhorn Automation, SourceBreaker and VMS Sync, were affected. Its forensic investigation is ongoing and it has not yet determined whether customer data was exfiltrated; it says it will contact affected customers and meet notification obligations if data was affected. Non-SSO users must reset their password at their next login (with two-factor verification), API user passwords have been expired and must be changed, and client secrets will have to be rotated later. Bullhorn Back Office passwords were not reset and were not affected. To reduce risk Bullhorn removed the underlying technology behind a significant number of features, so some functions remain offline or changed while they are rebuilt, including the legacy ATS/CRM SOAP APIs, several integrations and job publishing. Bullhorn warns that criminals may pose as Bullhorn staff by email, text or phone using the incident as a pretext, and says it will never ask for passwords, MFA codes or verification tokens. It has not said what kind of attack it was or who was behind it. UPDATE (23 Oct 2026; Bullhorn status page): In an update posted at 6:28 pm US Eastern on 22 October (6:28 am Perth, 23 October), headed 'Update on PHP Vulnerabilities and Service Restoration', Bullhorn said Talent Platform access had been fully restored and listed Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal and Akyla as 'Upgraded to address the vulnerabilities and fully available', with the Back Office (BBO) 'Upgrade in progress'. It said: 'We recommend that customers plan for BBO to remain unavailable through the end of this week.' In a separate 'Status Update: Bullhorn Back Office' posted at 6:30 pm US Eastern on 22 October, Bullhorn said: 'Whilst we are in this extended outage, we will not be able to provide user access to enter time sheets and we recommend using alternative approaches', adding that Bullhorn Support can run payroll reports for customers. On 23 October (Perth) the status page listed every ATS/CRM cluster, including the Australian clusters CLS61 and CLS62, as 'Degraded Performance' and Bullhorn Back Office, including BBO SYD, as 'Major Outage'. Bullhorn's 22 October update links the Back Office work to the PHP vulnerabilities; it does not say whether it is connected to the 17 October incident. Primary: Bullhorn status page and customer FAQ; wire: BleepingComputer (19 Oct). UPDATE (24 Oct 2026; Bullhorn status page): in an update headed '[6:30 PM EST 10/23/2026]' (incident first posted at 3:01 pm US Eastern on 23 October, 3:01 am Perth 24 October) Bullhorn said 'Access to BBO has been restored', that time entry with existing credentials is available and password changes are not required. In a separate update with the same heading it said 'All products are available, but some features are still impacted', that Canvas in the ATS is not yet available and that some users are still having login issues. On 24 October (Perth) the status page listed BBO SYD as 'Degraded Performance' and the Australian ATS/CRM clusters CLS61 and CLS62 as 'Under Maintenance'.
Bullhorn Status — Update on PHP Vulnerabilities and Service Restoration; Status Update: Bullhorn Back Office (22 Oct 2026); earlier: Bullhorn ATS/CRM service disruption (17–19 Oct 2026)
STAR Labs (Singapore) published a teardown on 17 October 2026 of an Android remote-access trojan family it calls Black Hawk, after its operator panel, which brands itself 黑鹰安卓远控 ('Black Hawk Android Remote Control') or, on a second host, 雄鹰安卓远程 ('Eagle Android Remote'). The researchers analysed 64 samples first seen between 15 September and 16 October 2026. Each is a small dropper that asks for permission to install other apps and then installs a packed second-stage WebSocket RAT. The same RAT is dressed up as many different apps: Japan's e-Tax service, Rakuten and Mitsui Sumitomo (SMBC) card points, Saison, Mercari, LINE points, a fake SpaceX '6G' investment app, dating apps and live-TV players. App names carry invisible zero-width characters between letters so simple name-based detection rules miss them, and each fake app opens the real brand's website as cover. Droppers are packed either with a simple native XOR stub (libsa.so, whose key sits in plain text) or with the open-source nmmp VM protector, which STAR Labs says can be undone because its VM is a reshuffled copy of Android's own interpreter. All samples are signed with the public Android debug certificate, so grouping by certificate is useless. Once installed, the RAT talks to its panel over an authenticated, certificate-pinned WebSocket; streams and remotely drives the screen through Accessibility gestures; captures the lock-screen password, PIN and pattern and keystrokes; scrapes typed values from Alipay and WeChat; injects JavaScript into WebViews; and can launch or block apps. It also pairs with the phone's own wireless ADB service to grant itself WRITE_SECURE_SETTINGS, and persists through device-admin, boot, push-message, job and alarm hooks running in a separate process. STAR Labs judges the operation financially motivated and commodity-grade. Two panels (www.mm2mm[.]xyz and www.hyzj[.]shop) were live on 16 October; C2 and distribution hosts sit mostly on Alibaba Cloud and rotate often. Published indicators include C2 domains www.mengm[.]shop, cihqobpe.receivewelfarebenefits[.]com, www.collectpointsjp[.]com, www.knjw[.]shop and tnt.freedomdf[.]xyz, and the romance front datingparadise[.]vip. No CVE or vendor patch is involved, and the lures target Japanese users; no Australian victims are reported. Primary: STAR Labs.
STAR Labs — Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands (17 Oct 2026)
OpenCode, the open-source AI coding agent, said on its official X account on 17 October 2026 (UTC) that it had a security breach the previous night, related to what it called a large-scale distillation attack, that affected 1.4% of OpenCode Console users. The company said it notified all affected users by email that morning, that users who did not get an email were not affected, and that the affected group was a subset of users who had external providers set up. An earlier version of the post said the incident was ongoing, so OpenCode could not share more details yet. OpenCode has not said how the attackers got in or how many people 1.4% represents. No Australian impact has been reported. UPDATE 19 October 2026 (BleepingComputer, 19 Oct): OpenCode's email to affected users says the external-provider API keys they had linked to OpenCode Console were exposed, with the earliest possible exposure at 00:30 UTC on 17 October (8:30 am Perth), and that no other data appears to have been exposed. Co-founder Dax Raad said attackers using AI agents had targeted OpenCode's systems for at least 48 hours. Affected users reported unauthorised API charges ranging from several hundred US dollars to about US$1,700 overnight, and some said Google suspended their Google Cloud projects for 'abusive activity consistent with hijacked resources'. OpenCode says it is working with Google, OpenAI and Anthropic, and its email raises the possibility of reimbursement. Correction (22 Oct 2026): removed an unconfirmed claim about OpenAI key revocation and refunds that rested only on a third-party forum post.
OpenCode (official X account) — security breach affecting 1.4% of OpenCode Console users (17 Oct 2026)
Australian cosmetics brand Napoleon Perdis has emailed customers to say a third party it used to store customer records, Retail Express, was hit by a cyber attack. According to the email, reported by the ABC on 17 October 2026, Napoleon Perdis was told in June, and in August 2026 Retail Express confirmed that an unauthorised party had access between November 2025 and June 2026, affecting approximately 339,055 customer records. The affected records belong to customers from before June 2025. Information accessed includes names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The company says the system did not hold bank account or card details or napoleonperdis.com account passwords, that the incident has been contained and the system permanently shut down, and that its current online store was not affected. The Office of the Australian Information Commissioner has been notified. Napoleon Perdis warns customers to watch for scam calls or emails impersonating the brand and to monitor bank transactions. Context: on 9 June 2026 Cyber Daily reported that the forum actor known as 2019 had listed Napoleon Perdis and claimed 339,100 customer records (including loyalty points, transaction history and spending totals), released free on a hacking forum; the company had not confirmed that claim at the time. Primary: Napoleon Perdis customer email as reported by ABC News (17 Oct 2026).
ABC News — Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients (17 Oct 2026, quoting the customer email)
Lightning AI's security incident notice says that on 15 October at 11:00 PM UTC it identified a security incident on the Lightning Platform involving unauthorized access to credentials, and that it revoked all user access to the platform on 16 October at 1:00 AM UTC. Lightning says the incident involves Lightning Studio Platform services such as Studio, Deployments, Pipelines and Drive, and not the GPU cluster rental infrastructure or managed services like Kubernetes and SLURM. Lightning says it believes certain customer credentials were compromised to gain access to environments and connected third-party services, that it has revoked all identified credentials used in the incident, and that it is working with an independent external cybersecurity firm. Lightning says customers identified as potentially affected to date have been notified, and that users who have not received a notification have not been identified as affected based on its investigation to date. The notice itself carries no date; Lightning's status page first reported emergency maintenance at 03:08 UTC on 16 October, linked the notice at 20:34 UTC that day, last updated the incident at 12:49 UTC on 19 October, and still listed it as unresolved ('Service is down to address a security incident') when checked on 26 October (Perth).
Lightning AI — October 2026 Security Incident (undated notice; linked from Lightning's status page 16 Oct 2026, 20:34 UTC)
The California Department of Education (CDE) said on 16 October 2026 that ETS, the nonprofit assessment organisation that runs California's statewide student assessments (CAASPP and ELPAC), has begun notifying students and families of a data breach. According to the ETS notice published by CDE, ETS found unauthorised activity on 25 September on a secure file transfer protocol (SFTP) site used to exchange statewide assessment information with CDE; an unauthorised party had used a compromised login credential at various times between 22 May and 18 September 2026 to copy files of California student information. Data on all students enrolled in the three previous school years was accessed and copied, as well as some former students, and may include names, dates of birth, home addresses, schools, districts and grade levels, statewide and local student identifiers, gender, race or ethnicity, primary language, country of origin and English learner status, disability and Section 504 status, assessment accommodations and primary disability type, eligibility for Title I, McKinney-Vento (homeless) and military-connected programs, and English proficiency and assessment results. More than 5.7 million students were enrolled in California in the 2025 school year. Social Security numbers, licence and passport numbers, financial and card details, passwords and parent or guardian information were not involved. ETS disabled the account, took the SFTP site offline and built a new one, paused normal enrolment data processing and some assessment activities, and says it has taken steps with law enforcement and cybersecurity experts to reduce the risk of the data being published and has found no sign so far that it has been. No group has claimed the attack. Notices began on 16 October and will continue into early November, in 27 languages, with two years of free Experian IdentityWorks identity protection. CDE says it is reviewing ETS's compliance with its data-security and contract requirements. Primary: CDE news release and ETS notice (16 Oct); wire: The Record (20 Oct).
California Department of Education — ETS begins notifying California students and families following data security incident (16 Oct 2026)
