Ransomware crews and data thieves are hitting organisations faster than many can say what was taken. In October 2026 alone, TSN has tracked a ransomware attack on a SoftBank cloud subsidiary that rippled out to hundreds of customers, a run of large data leaks at Japanese companies and attacks that halted services people rely on, from US bankruptcy court notices to supermarket fridges in France.
What ties these stories together is the way attackers get in. Many incidents start with a supplier or a piece of edge equipment rather than the victim itself. Palo Alto Networks’ Unit 42 says ransomware crews including Qilin and Inc are exploiting a firewall flaw that was patched in May. An attacker used a ConnectWise Cloud Backup credential to sign in to customers’ Microsoft 365 tenants, and Google says AOMEI’s update servers were tampered with for minutes at a time between April and July. In Wales, the UK data regulator found that a forgotten test account protected by “Password1” let ransomware in.
That matters for anyone whose details sit with a delivery firm, a fast-food app or an email provider they have never heard of. Yamato Transport says about 5.26 million pay-later customer records were taken, Burger King’s Japanese operator reports about 11.18 million app member records leaked, and Ymirlink estimates about 9 million records were extracted from systems behind its Cuenote email service.
Where things stand: many victims are still investigating, and several have not said whether data left their networks. Some of the biggest numbers are attackers’ claims rather than confirmed facts, such as ByteToBreach’s claim to hold more than 80 million Ampath patient records, which Ampath has not confirmed. Police are also moving: the FBI has arrested another suspected ShinyHunters member, and a former ransomware-negotiation executive has been charged with extortion conspiracy. TSN keeps confirmed facts, reported details and claims separate, and updates this page as the story moves.
Timeline
November 2026
- 6 Nov 2026: US Agencies Warn on Industrial Refrigeration Cyber ThreatsRefrigeration cyber: CISA, FBI, HHS, USDA and DoT urge hardening of industrial refrigeration and cold-chain monitors amid global malicious activity.
- 5 Nov 2026: Alpine OpenSSH Password Authentication Bypass FixedAlpine OpenSSH password authentication bypass: apk upgrade and restart sshd, or set PasswordAuthentication no on no-PAM builds.
- 5 Nov 2026: Solaseed and AIRDO Confirm Airline Email Leak via Mail VendorSolaseed Air (~490,000) and AIRDO (max 673,920) report an airline email leak from an external mail system. Press attributes it to Arara Message.
- 5 Nov 2026: Canada Flags Zyxel GS1900 Vulnerability as Possibly ExploitedZyxel patched GS1900 out-of-bounds write CVE-2026-107441. Canada's Cyber Centre cites open-source reporting of exploitation. Update affected switches.
- 5 Nov 2026: Rails Security Releases Fix Critical Active Storage FlawRails 8.0.5.2 and 8.1.4.1 fix a critical Active Storage ImageMagick flaw (CVSS 9.8) and 20 other issues. Upgrade; rotate secrets if Disk was exposed.
- 5 Nov 2026: Crédit Mutuel Arkéa Confirms Cyberattack on Its Own AccountsCrédit Mutuel Arkéa confirms a cyberattack moved funds from its own account via a service provider. Customer assets safe; exact loss figure unconfirmed.
- 4 Nov 2026: CISA Adds Apple’s 2024 WebKit Flaw CVE-2024-27834 to Its KEV ListCISA has added Apple KEV vulnerability CVE-2024-27834, a WebKit flaw fixed in May 2024, to its exploited list. Keep Apple devices and Safari updated.
- 4 Nov 2026: Prestige International Breach May Have Leaked 5.5m Roadside RecordsPrestige International says a hack leaked up to 5.5m roadside-assistance records, including names, vehicle details and partial bank account data.
- 3 Nov 2026: GitBook Users Told to Rotate API Tokens After AI-Agent AttackGitBook says an attack using AI agents may have exposed API tokens, Git Sync secrets and integration tokens. Here is what users need to…
- 3 Nov 2026: Supermarket Refrigeration Attacks Spread as Belgium Issues Fix AdviceBelgium's cyber centre has set out fixes as attacks on supermarket refrigeration controllers spread across Europe. Italy and the EU held talks.
- 3 Nov 2026: Barracuda Patches Two Vulnerabilities That Can Chain to RootBarracuda has patched two vulnerabilities in six security products that, chained, could give root access. Update firmware and restrict admin interfaces.
- 3 Nov 2026: Cloudflare Launches Zero Wire, a Free Feed for Critical FlawsCloudflare's Zero Wire is a free feed on Cloudflare Radar that explains critical internet-facing flaws, who should check them and what to do next.
Load more Showing 12 of 175
