Three organisations disclosed cyber incidents around 8 October 2026: a US biotech company, a large Turkish university and a small-town American clinic. They show three different kinds of harm: data taken from forgotten cloud systems, ransomware on a university’s servers, and a medical practice forced back to basics. As always, TSN separates what has been confirmed from what is not known yet. No attack methods are described here.
Ginkgo Bioworks: data from “legacy cloud environments”
Confirmed (company statement). Ginkgo Bioworks, a Boston-based biotechnology company, said it “recently discovered an unauthorized third party accessed data” from “cloud environments primarily associated with the Company’s former biosecurity business” [1]. It believes the data came “primarily from legacy cloud environments” [1].
Ginkgo says it cut off the intruder’s access, rotated credentials and found “no evidence” that the intruder still has access or reached other environments [1]. Some legacy systems were taken offline as a precaution, but “there has been no interruption to our core systems, including our financial systems” [1]. It is explicit about what this was not: “This was not a ransomware or encryption event” [1]. The company has informed the FBI, believes it has notified all customers whose data was involved, and is assessing what regulatory notices it must make [1].
Not disclosed: how many people or customers are affected, what kind of data was taken, and when the access happened [1].
Yıldız Technical University: ransomware on servers
Confirmed regulator notice, as quoted by T24. Turkey’s Personal Data Protection Board (KVKK) has published a breach notice for Yıldız Technical University, under its decision 2026/2203 dated 7 October 2026 [2]. According to the university’s notification, as quoted, the breach began on 1 October 2026 and was detected the same day; the university’s virtualisation infrastructure and the servers running on it were hit by ransomware [2].
The people who “may be” affected are students, staff and visitors. Based on current records, that is approximately 140,000 students and 4,500 staff; the number of visitors affected “has not yet been determined” [2]. The investigation continues [2]. The notice as quoted does not name an attacker or say whether data has been published.
Green Clinic, Ruston, Louisiana: back to rebuilding
Confirmed (clinic statement). Green Clinic said it identified a cybersecurity incident at about 6:30 a.m. on Friday 2 October and immediately halted computer and network operations [3]. It later determined it was “the victim of a ransomware attack associated with a threat actor identifying itself as ‘Wall Street,’ or an affiliate thereof” [3]. The attack encrypted files and systems across its network, leaving staff without access to many electronic systems, “including patients’ electronic medical records” [3]. The clinic has notified the FBI and CISA [3].
Rather than wait, it is bringing in a new clinical system and plans to resume broader patient care on Wednesday 14 October [3]. It warns that this does not immediately restore historical records or appointment lists, so providers may not have a patient’s earlier records at first. Patients with appointments on or after 14 October should arrive as scheduled unless told otherwise, and should bring ID, insurance cards and medication lists [3]. The clinic says it will not speculate on whether data was taken while its investigation continues [3].
What this does not prove
- How many people Ginkgo’s incident affects, or what data was taken. Ginkgo has not said [1].
- That Yıldız data has been leaked. The figures are people who “may be” affected; the visitor count is not yet known [2].
- That patient data was stolen from Green Clinic. The clinic says its assessment of what was accessed is ongoing [3].
- That these incidents are connected. Nothing in the sources links them.
The Bottom Line
Ginkgo’s case is data taken from old cloud systems tied to a former business, explicitly not ransomware. Yıldız Technical University’s is ransomware on core servers, with up to about 140,000 students and 4,500 staff possibly affected. Green Clinic’s shows the human cost of ransomware in healthcare: nearly two weeks of very limited care and a restart without past records. In all three, the key question of exactly what data left the building is still unanswered.
Sources
- Ginkgo Bioworks Holdings, Inc., “Ginkgo Bioworks Cybersecurity and Incident Response”, press release, 8 October 2026 (company statement, distributed via Public Technologies; contains forward-looking statements). https://pubt.io/view/8AA94BDB5045FD6ED37F813E06B90D3D96DB254D
- T24, “Yıldız Teknik Üniversitesi’ne fidye yazılımı saldırısı: 140 bin öğrenci ve 4 bin 500 personelin verisi çalınmış olabilir!”, 8 October 2026 (in Turkish; quotes the KVKK breach notice under decision 2026/2203 of 7 October 2026; TSN’s translation). https://t24.com.tr/gundem/yildiz-teknik-universitesine-fidye-yazilimi-saldirisi-140-bin-ogrenci-ve-4-bin-500-personelin-verisi-calinmis-olabilir,1352052
- Green Clinic, “Green Clinic provides update on cybersecurity issue”, press release published by the Ruston Daily Leader, 8 October 2026 (clinic statement). http://www.rustonleader.com/breaking-news-news/green-clinic-provides-update-cybersecurity-issue
