Ransomware crews and data thieves are hitting organisations faster than many can say what was taken. In October 2026 alone, TSN has tracked a ransomware attack on a SoftBank cloud subsidiary that rippled out to hundreds of customers, a run of large data leaks at Japanese companies and attacks that halted services people rely on, from US bankruptcy court notices to supermarket fridges in France.

What ties these stories together is the way attackers get in. Many incidents start with a supplier or a piece of edge equipment rather than the victim itself. Palo Alto Networks’ Unit 42 says ransomware crews including Qilin and Inc are exploiting a firewall flaw that was patched in May. An attacker used a ConnectWise Cloud Backup credential to sign in to customers’ Microsoft 365 tenants, and Google says AOMEI’s update servers were tampered with for minutes at a time between April and July. In Wales, the UK data regulator found that a forgotten test account protected by “Password1” let ransomware in.

That matters for anyone whose details sit with a delivery firm, a fast-food app or an email provider they have never heard of. Yamato Transport says about 5.26 million pay-later customer records were taken, Burger King’s Japanese operator reports about 11.18 million app member records leaked, and Ymirlink estimates about 9 million records were extracted from systems behind its Cuenote email service.

Where things stand: many victims are still investigating, and several have not said whether data left their networks. Some of the biggest numbers are attackers’ claims rather than confirmed facts, such as ByteToBreach’s claim to hold more than 80 million Ampath patient records, which Ampath has not confirmed. Police are also moving: the FBI has arrested another suspected ShinyHunters member, and a former ransomware-negotiation executive has been charged with extortion conspiracy. TSN keeps confirmed facts, reported details and claims separate, and updates this page as the story moves.

Timeline

• 20 Oct 2026: Unit 42 says ransomware crews including Qilin and Inc are exploiting a months-old Palo Alto GlobalProtect flaw. Read
• 20 Oct 2026: The ICO reprimands two Welsh bodies after a “Password1” test account let in ransomware that exposed 3,300 people’s data, mostly children’s. Read
• 20 Oct 2026: Symantec says Russia’s APT28 broke into defence and police targets in two NATO countries. Read
• 19 Oct 2026: Ymirlink says hackers took about 9 million records via its Cuenote email service. Read
• 19 Oct 2026: A cyberattack takes Bullhorn’s staffing software offline and forces password resets. Read
• 17 Oct 2026: An attacker uses a ConnectWise Cloud Backup credential to get into Microsoft 365 tenants; Huntress confirms 162 among those it monitors. Read
• 17 Oct 2026: Yamato Transport says about 5.26 million Kuroneko pay-later customer records were taken. Read
• 16 Oct 2026: Google says AOMEI’s update servers were tampered with between April and July to push malware. Read
• 16 Oct 2026: A cyber incident at BAE Systems halts notices from every US federal bankruptcy court. Read
• 15 Oct 2026: Burger King’s Japanese operator says about 11.18 million app member records leaked. Read
• 14 Oct 2026: Ampath confirms a cyber incident; a group calling itself ByteToBreach claims more than 80 million patient records. Read
• 12 Oct 2026: Ahold Delhaize’s Dutch chains confirm an incident it later says “resulted from the malicious actions of others”. Read
• 12 Oct 2026: A cyberattack disables refrigeration at French supermarkets; Paris prosecutors later estimate about 700 victims, The Record reports. Read
• 9 Oct 2026: JR East and Viewcard say about 6.09 million accounts may be exposed after the IDC Frontier ransomware attack. Read
• 8 Oct 2026: Ransomware hits SoftBank’s cloud subsidiary IDC Frontier on 7 October, and police say Qilin has hit 53 Japanese companies. Read