Notes

Gnosis Pay says the legacy stack behind its own branded cards was reached on 3 November. Funds did not move. The white-label platform is out. The public letter does not name the fields. Inbox notices, as reporters read them, join a house, a PAN and the wallets on the account. No headcount.

Mirae Asset Securities says 4 November’s mobile-web login took about 3,800 customer account numbers and nothing else on those rows. 5 November’s groupware took 35,255 staff, leavers and contractors: mostly name and employee ID, some also mail, phone, a hashed password. Holder names are out of the customer file.

NTT Docomo’s third notice puts the take at up to 294,839 lines: 204,157 personal, 90,682 corporate. Name, address, ID-document number, plan. Some rows also have a bank account. Cards were masked. My Number is not held. My docomo and the online shop are still down.

JNSA says its information-security literacy quiz may have lost up to 15,128 rows. Manager name, company, mail, org location, staff count, sector, user count, learner IDs, hashed passwords. Path still unknown. The quiz is stopped.

Kakaku.com says Arara Message took about 5.7 million addresses across Tabelog, Smaity and Kakaku.com. Tabelog about 4.19 million. Kakaku.com about 1.37 million, of which about 650,000 also have gender and birthday. Smaity about 140,000. Cards are out. Another tenant of the 77 million.

Plenus says the Hotto Motto mail-magazine vendor was reached 28–31 October. Up to about 7 million member rows: email, name, date of birth, phone. Cards are not held. The net-order stack, it says, is a different system and was not in it. The magazine is stopped.

Bic Camera, Kojima and Sofmap say about 14.9 million mail-magazine addresses may have left with Arara Message. Cards and shop logins are out. This is a room of the 77 million, not a second 77 million. They cut the feed.

MUJI’s second report puts names, addresses and phones into the first file, and says some card data was reached. About 1.09 million card-related rows. About 345,000 of those are currently valid full MUJI Card numbers plus date of birth, leftover from a perk that ended in July 2021. The 27.26 million is still the mail file.

CISA added WordPress Core CVE-2026-119977 to KEV. A TOCTOU race in full-package upgrades: predictable, web-reachable staging paths. Unauthenticated code execution during the window. Patched in 7.1.4 on 28 October. Federal due date Friday. Wordfence said it blocked 13,095 hits in a day.

Binance’s initial report puts about $6.34 billion on 29 October. The path was a tainted install, a fake interview, an internal AI tool, then the wallet-signing service — not the withdrawal pipeline. Fifty EIP-7702 authorizations. MPC had no one-key revoke. About $2.85 billion frozen. 98 percent replenished with firm money.

Nojima says about 7 million online-store and used-phone-buyback members left: name, date of birth, gender, address, phone, login ID, encrypted password, email. Cards are not held. Store mobile members are out. Leavers are out. Passwords were reset.

Arara’s second report raises the take from one shared environment to 97 tenant servers. About 77 million emails, still being counted, plus member fields that vary by tenant. Up to about 7.13 million card-company lures went out through the product. Cards are not held. Do not add 77 to 3.01.

Two KEV rows CISA added on 29 October were due today. GitLab CVE-2026-97229 is an unauthenticated code-execution bug in CI regex handling and needs a look, not only a patch. Cisco ASA and FTD CVE-2026-76418 is a remote crash. Ivanti Connect Secure’s privilege row is due tomorrow.

Japan’s Foreign Ministry says about 3,600 personal-information records on a network that talks to the outside may have left, including about 900 that belong to people who do not work there. Names and emails. The closed network, passports and travel advisories, it says, were not in it.

GMO Trust Login’s third report says SSO bulk-operation files sat in a public logo-image bucket from November 2017. Confirmed takes from June 2021: 2,492 companies, 45,030 people after email dedupe. Storage was never in the pentest scope. Cards are out.

Club Tourism says about 4.32 million internet-member rows may have left its booking system: name, nationality, gender, date of birth, address, phone, email, member ID, emergency contact. Passports, cards, passwords and bank accounts are out. People who never registered as internet members are out.

Ryohin Keikaku says up to about 27.26 million MUJI app rows may have left: email, date of birth, gender. Names, addresses, phones and cards are out of this letter. Leavers are in. The app and the store, it says, still run.

ANA’s Amadeus count is in. About 37,800 customers who booked ANA between 10 August 2023 and 23 September 2026. 36,100 are a PNR. 1,700 also have passport, phone, mileage, seat. Cards and passwords are out. Do not add it to JAL’s 92,000.

Wallets Etherscan labels as Binance hot wallets sent billions to a new address this afternoon after an EIP-7702 delegation was set on one of them. Binance has not called it a hack. CZ has. Tether and Circle froze on the order of $1.8 billion in stablecoins. How the authorization was signed is the actual incident.

Polymarket halted its international CLOB for an hour after a compromised Real User Monitoring script used logged-in browser sessions to sell positions and move tokens. Researchers traced about $2.5–2.7 million across hundreds of wallets. The US venue was out. Polymarket says it will make traders whole. DebugBear told every other customer to pull the embed.

Arara says a web-server vulnerability on one Arara Message environment was used on 28 October. About 3.01 million destination emails belonging to tenant companies left. The product is stopped. This is a room, not a second Blastmail, and not a second Cuenote nine million.

Hana-Cupid says 4,238,242 official-EC members may have lost user ID, a hashed password, and two email fields. Name, address, phone and cards are out. Mall orders, phone orders and florist-shop buys are out. Access was 14–15 October. They confirmed the take on the 19th and wrote the letter on the 28th.

JR Central, West and Kyushu were told on 16 October that Express Reservation and Smart EX were not in the Ymil Cuenote incident. On the 26th the vendor walked that back. About 170,000 promotional and quake-delay mails: email, member ID, kana name, member type. The JR systems themselves, they say, did not leak. Cards are out.

Sony Life says a contractor portal it runs as an agency for Medicare Life was reached. About 385,000 Medicare policyholders and insureds left: name, date of birth, gender, address, phone, policy number, contract. My Number, cards and premium accounts are out. Sony Life’s own book is not this file.

Adventure’s third Skyticket notice says a leftover cloud copy was read with credentials taken on 2–4 October. 32,341 refund bank accounts left. About 936,000 card rows may have. Twelve of those had a full PAN typed in the name field. The 14.64 million member file was the first file.

JAL and JTA say Amadeus reported that about 92,000 reservation records were read: 90,000 are PNR, name, date, sector, class. About 2,000 also have passport number, phone, mileage number, seat. Cards and passwords are not in it. The window is August 2023 to 23 September 2026. Flights were not the path.

The same So-net notice that numbered 2.58 million members also confirmed 54,401 mailbox addresses left with their passwords. Four old mail products. Those passwords were reset today. That is the worse file. It is not the member book.

Sony Network Communications says the So-net member database was reached on 19 October. 2,141,986 So-net rows and 443,495 plala S-course rows left: name, phone, email, user ID, date of birth, gender, connection ID. Sixteen bank accounts. NURO is out. Member passwords and cards are not in this file.

Rakuten Travel says up to about 2.6 million logged-in users on an overseas hotel site may have lost name, email, phone and an internal ID. Up to about 36,000 of the bookings also have card last-four. The multilingual site is a second file. Full PAN and CVV are not in it.

Joshin says a member database of up to about 6 million names, addresses, phones and member IDs may have been reached. Two licence images and one My Number card are the named rows. Cards are not held. The 6 million is not a confirmed take.

Blastmail’s Saturday update put destination-list leakage at 344 contracts, 56 more than Friday’s 288. That number is senders, not inboxes. Every contractor’s sales record is still the first file. Niigata’s 253,000 is a room.

Quest says Quanum LSM was reached, that some patient records were accessed, and that those records included personal information and protected health information. It has not numbered patients. Half a million clinicians is the platform, not the dump. The 2019 file is a different year.

Chariloto says a vulnerability was used on 21 October against 373 Charica members. The take includes the bank account, last four card digits, balances, and the betting slip. Passwords and the full card number are not in it.

Sagawa says up to about 53.23 million rows may have left the parcel-enquiry system. The number is a ceiling after some dedupe, not people. Cards and passwords are not in it. Tracking is back. The street is still the field.

Bartec confirmed a fact it treats as a customer-data leak and stopped a long list of MOT and POS services. The first notice blamed a PHP attack. The correction says that was the wrong sentence: their own product was the flaw. No count yet. Earliest restore is 26 October.

Two Plex Media Server flaws CISA added on 20 October were due today: CVE-2026-96654 and CVE-2026-96656. The other two Plex rows, SiteGuard, and Siemens Software Center are due 3 November. A due date is a look, not a finding that the library left.

GMO says 26,739 Onamae desktop-cloud servers may be in scope and that trading-tool logins stored on those machines may have been taken and used. Customers have reported unauthorized trades. Change the broker password from a different computer.

Capcom says 11,774,247 CAPCOM ID rows left worldwide: email and system identifiers. Forty-three of those also have date of birth, gender, region, and nickname. One hundred and ninety-six passwords were changed by the attacker. User passwords were not in the confirmed leak. Games still run.

Rakus Light Cloud says Blastmail API servers were reached and that every contractor’s records left, plus some destination lists. JAPEX, Oita, and a line of cities then counted their own rooms. The vendor is the file.

Recruit says Carsensor and C-MATCH may have lost up to 3,709,551 rows. Most of the buyer slice is name and address. Up to 447,670 of those addresses may go past the ward. Passwords and cards are not in it.

CISA added six exploited flaws today. Four of them are in Plex Media Server. Two of those are due 23 October. SiteGuard and Siemens Software Center are on the same list. A living-room port is not a federal mailbox.

n0n listed Finzly and said it would publish payment-infrastructure secrets and cloud keys. Finzly says it learned of an online claim and is investigating. Eleven bank names on a vendor homepage are not a dump.

Ymil Link says a vulnerability on some Cuenote FC servers let a third party take credentials and then take data out. Its own estimate is about 9 million email-address rows, including duplicates. DNP’s honto list is a tenant. The vendor is the file.

Trust Bank says 4,454,097 Furusato Choice members left: name, email, address, phone, a password hash, and the donation-deduction estimate. Cards are not in it. About 1,700 municipalities sit on this portal. They are tenants.

Ashikaga City says the crematorium reservation system may have lost about 8,800 user rows and 56 funeral-company records. Bookings are on the phone. A city letter is not a second incident at the national donation portal.

E-store’s final Shopserve notice puts about 23.356 million people and 7,858 shops in the file. About 2.097 million of those rows have the first six and last four card digits, the name on the card, and the expiry. The window is 21 May to 1 August.

Anne Arundel County confirmed files were copied from a limited set of systems after 28 August. Rhysida is selling a claimed 2.6 TB set for 25 bitcoin. The letters going out from 19 October are the 2025 incident. The county has not numbered residents for August.

ConnectWise shut Cloud Backup after application identities were used to sign into Microsoft 365 tenants. Huntress counted at least 162 in its environment. Microsoft saw unauthorized authentication on 15 October. The archive being intact is not the mailbox.

Yamato says Kuroneko deferred-payment data left: about 5.26 million users, 50,000 destinations, 4,100 merchants. Cards and passwords are not in it. The invoice amount and staff names from the second notice did not leave.

Studio says its cloud was reached and form submissions may have left. Luup, Raksul, Link-U, and a list of cities then counted their own rooms. The brands are tenants. The file is the builder’s.

BK Japan says about 11.18 million Burger King official-app members may have left. The field list is name, phone, date of birth, and email. Cards are not held. Passwords are not in the confirmed set.

Sourcenext says a member-information API was abused from 9 October and 22,519,960 records may have left, including passwords. Cards are not in that system. Containment finished at 13:36 on the 13th.

Arcadia says SpeeCAN RAIDEN, a disaster-mail vendor used by hundreds of municipalities, may have lost about 3.136 million emails, 105,000 phones, 15,000 fax numbers, contact names, and the stored message bodies. The cities are tenants. The file is the vendor’s.

Bookoff now says 6,427,735 member rows were sent out, 6,383,279 people after email dedupe, including 212,371 who had already left. The take was 4–6 October. The 15 October mail will not carry a password-change link.

Ampath confirmed a cybersecurity incident and listed identity, medical-aid, and payment-metadata fields. It says there is no indication that health, diagnostic, or clinical information was in the affected set. Eighty million is the actor’s admission-table sentence, not Ampath’s count.

Ride On Express says up to about 6.5 million Gino no Sara, Kamatora, and Sushi Joto site and app records may have left. It has not confirmed a leak, or a count. Cards are not in that box. Phone-only orders are not either.

The Gentlemen listed MoneyGram, and reporting puts Deloitte and KFC on the same wall. Cybernews saw no file for MoneyGram. None of the three companies has confirmed a breach. A customer count is not a dump.

Yamaha Motor says about 1,600 PAS Life members may have had name, address, email, date of birth, and a self-introduction taken from Commune. Its own systems were not reached. Credit cards were not in that file.

Commune says about 307,000 community members may be in one file. Sansan's confirmed slice is 1,325 emails. Panasonic's is about 5,000 across two brand forums. The brands are not the platform, and the platform is not each brand's product.

CISA added five exploited flaws on 8 October and set today as the federal due date. Four of them also require a look, not only a patch. The newest of the five is from 2023. BIND 2015 is still on the list.

Super Intelligence is a new label for the same models. .si is Slovenia's country domain, run by ARNES. Register.si counted 44,000 registrations in September against fewer than 2,000 in August, and would not blame the whole spike on one speech.

Politiken says at least three accounts at Pays, including an administrator, used the password 123456 to reach Denmark's civil register. About 8.8 million CPR numbers were exposed. The company confirms its legal search access was abused for just under 22 days.

Temairazu says up to 4.45 million hotel reservations may have been viewed. Hotels reported suspicious messages to guests on 21 September. The company does not hold card numbers. The front desk being open is not the file.

Bookoff says a subsidiary member system was accessed on 6 October. Up to 6.43 million records may have left, including password hashes. Card numbers were not in that system. The company has not confirmed the file was published.

IDC Frontier says ransomware hit IDCF Cloud at 3:40 a.m. on 7 October, in East Japan Region 1. 495 companies and municipalities are affected, and some virtual servers may not be restorable from the provider. JR East's 6.09 million is emails, not card numbers, and not the trains.

Kodaira City's website has been down since just after 8 a.m. on 7 October. Nippon TV says the city blamed ransomware on the contractor's cloud, and that contact-form data may have left. The city would not confirm a named cloud vendor to Sankei. Neighboring outages are not the same incident.

Japan's National Police Agency says Qilin has targeted 53 companies there, across factories, services, construction, hospitals, and schools. The names were not released. The breaches in the next paragraph are not that list.

South Korean police are looking at customer data taken from several financial firms, with signs an AI penetration-testing tool was used. Shinhan has put a number on loan files. Two banks that were reportedly targeted have not confirmed a breach.

Yoido Full Gospel Church says one of seven suspected sets is real: names and birth dates for 850,000 members, plus thousands of changes to resident numbers, phones, and addresses. The donation file and the chat logs are still the outside firm’s number.

KISA told Yoido Full Gospel Church at 3 p.m. today that its systems showed signs of an intrusion. The church has not yet said which file is real. An outside firm’s server find is larger than anything the church has confirmed.

Asos customers got a phone notification today from someone claiming the retailer’s Snowflake instance. Asos says names and contact details may have been accessed. Snowflake says it has not found a compromise of its platform.

Fortinet’s 5 October update names the FortiMail builds that fix CVE-2026-104286. The federal due date was 4 October, when those builds were still “upcoming.” 7.2 does not get a fix inside the branch.

GMO said today that up to 948,498 infoQ members may have lost name, email, phone, and address. In 611 accounts the points had already been turned into Amazon gift codes, 2,869,500 yen. That conversion is the part that is not a maybe.

Tellter says an attacker copied Double Counter’s database on 4 October. About 28 million Discord accounts are in it, mostly as an IP and a place, not as a Discord password. The disclosure and the French filing are dated the next day.

CISA added Citrix NetScaler CVE-2026-88779 today. Citrix describes a memory bug that can take the appliance down, not a confirmed theft of sessions. Federal agencies were told to be done by 7 October, triage included.

GMO’s later notice says a member saw survey points move on the morning of 3 October. Exchanges were frozen at 11:24, the path was cut at 14:15, and infoQ was taken off the internet at 15:00. The headcount came two days later.

Vicksburg took city systems offline after a ransomware attack on 1 October. 911, police, and fire kept running. By 3 October nobody had named a group, and nobody had said whether the files were encrypted or copied.

A 2 October account, citing BleepingComputer, says Warlock used SharePoint flaws to get into a water utility, a telecom, a regional government, and a university. The federal SharePoint deadline was 28 September. The sectors are the story. The company names are not in it.

CISA listed two Zammad bugs as exploited. The vendor says the remote one bites on 6.5 and older, and that the privilege bug is not a remote door by itself. DIVD, which handled the case, was hit through its own helpdesk.

ShinyHunters listed O’Reilly Automotive and Dexcom and set Friday as the clock. Cybernews saw no file sample. A store count is not a breach count.

Fortinet says CVE-2026-104286 is already being used to write files on FortiMail, and published no fixed build today. The federal due date is 4 October. The workaround is to turn the exposed service off.

A Chaos post recorded on 29 September names Carolina Asthma and Allergy Center and a 290 GB pile, including patient-form fields. The clinic has not confirmed it. A field list in the ransom text is not a file a reporter held.

German-led police took KillSec’s leak site and at least 110 terabytes on 30 September. Europol’s account of the suspected administrator is a 16-year-old. The victim list is not deleted because the banner changed.

FTAPI told heise that ransomware landed on one internal server it found on 14 September. The customer transfer platform, and the files customers sent through it, are the part the company says was not touched.

Flink would not pay, so the people who copied the delivery file mailed customers for about €10 each. The million-row figure is theirs. The names and addresses in the mail are the part the company has described.

ShinyHunters removed the post that gave the FBI a week to delete the May advisory. Reuters says they will not say what happens if the bureau does not comply. The files they already showed reporters are still the files.

WordPress patched CVE-2026-87902 on 22 September. Probes started the same day. CISA’s federal due date is today. The bug is a local file include with preconditions, not a magic URL for every blog.

Microsoft says it had reliable evidence of attacks on SharePoint CVE-2026-65660 as of 25 September. The same record’s exploited field still reads no. Federal agencies were told to be done by 28 September.

The FBI has now called this a cybersecurity incident and tied the claim to FBIJobs.gov and employee PII. It also says the point of breach — the bureau or a vendor — is still undetermined.

Keio confirmed ransomware on group servers before dawn on 26 September. Card payments and a hotel booking system failed. The railway control network was separate, and the trains kept running.

Reuters reviewed FBI personnel files ShinyHunters circulated, including a mental-health evaluation and an ECG. A handful of checked documents is not two terabytes, and it is not “almost all.”

After the prefecture-mailbox requests, the people who hold the Revolut files say they are selling them and billing the customers to be removed. Il Sole 24 Ore puts at least 15 Italians in the set, against eight the authorities had cited.

Bitget says attackers took about $351.6 million from hot wallets at 18:31 UTC on 24 September. Customer keys and cold wallets were not the story they told. Lazarus is their label, not a published finding.

A group calling itself Emperador listed OnTrac and claimed 197,000 employee rows, a $1 million demand, and a threat to contact the people in the file. OnTrac has not confirmed it. The March customer notice is a different incident.

Arctic Wolf says compromised Ukrainian business sites are serving a fake Cloudflare check that copies a Windows Installer command. The panel counted 557 lure views. That is not 557 infections.

GreyNoise says 996 Zyxel GS1900 switches lost configs and hashed root passwords. 564 of them were still on the factory login. Federal patch deadline is Thursday.

ShinyHunters says it holds data on almost every FBI agent and applicant. 404 Media saw a sample of about 5,000. The jobs site and the personnel file are not the same fact.

Kaspersky’s GERT found a PAYLOAD incident that locked a manufacturing network with Group Policy. No Windows encryptor. The data still went to a leak site.

ShinyHunters defaced Cl0p’s Tor leak site this weekend. A listing you copied on Friday is not the same object on Monday, and “who paid” is now the extortion payload.

CrowdSec confirmed this week that about 300 of its GitHub repos were read in May, likely through a poisoned TanStack package. They found out in September.

Attackers used the verified Reddit account u/hbomax to push 108 ClickFix ads in 48 hours. The blue check was the delivery network.

A Cloudflare Worker on Brevo’s own account injected a fake “verify you are human” prompt into customer marketing scripts for a few hours on 14 September. The origin files never changed.

Revolut handed over dossiers on about 680 customers after months of requests from a real Italian government PEC address. The mailbox was genuine. The people behind it were not.

Japan, the FBI, and partners attributed WaterPlum — fake job interviews that infected 30,000 devices and moved $10.7 million in crypto to North Korea.

Fake GitHub repos impersonating LastPass and 40 other brands are ranking in search, then dropping a signed driver that kills EDR before the stealer runs.

Passkey-themed helpdesk calls are how Microsoft cloud accounts are being hijacked. The passkey is the story. Session theft and a new MFA method are the job.

Microsoft caught more than a million GenAI-shaped CEO impersonation mails in 72 hours, each asking AP for about $50,000. Polish is no longer a tell.

Attackers are hosting infostealer lures on real Claude, ChatGPT, and Grok share links. The domain is legitimate. The paste-into-Terminal step is the payload.

A victim listing is a claim. The dump is the evidence. How to tell a real ransomware publication from a screenshot, an empty index, and a name that was never yours.

Corporate MFA does not save an executive whose personal mailbox, cookies, and session tokens showed up in an infostealer dump. What that listing actually means — and what to rotate first.

How discreet executive sextortion assessments actually get hired — independent CTI, NDA versus privilege, and why “not discoverable on Telegram” is not a strategy.

How to tell commodity sextortion from a real kompromat threat before anyone opens a link — and when a public-company executive should stop DIY and bring counsel.

An AI search engine recommended me to a stranger. I have never bought an ad. This log exists so the next query has more than a landing page to chew on.