Trending
Incidents with the most news coverage recently, including older incidents that are still drawing follow-up reports.
Unauthorised access raises concerns over personal data on Noran Woosan website
On 11 November, unauthorised external access and indications that a third party may have viewed some customers’ personal information were detected on the Noran Woosan website, operated by the Korea Federation of SMEs (KBIZ). Names, the first seven digits of resident registration numbers, contact details and addresses may have been viewed, while investigators are still establishing whether a leak occurred and the extent of any impact. KBIZ blocked the attacking IP addresses, reported the incident to the Korea Internet & Security Agency (KISA) and notified customers of the possible leak.
Related reports: 14 →KOMSCO Chak platform exposes personal data of 3,083 users
3.1kImpact: Personal information of 3,083 users
An unauthorised external party accessed Chak, KOMSCO’s mobile platform for local gift certificates, and viewed the personal information of 3,083 users. The exposed information varied by individual and included some of the following: names, dates of birth, mobile phone numbers, bank account numbers, connecting information (CI), email addresses and encrypted card numbers. KOMSCO blocked access from the attacker’s IP address and overseas IP addresses and is investigating the intrusion route and any additional harm.
Related reports: 14 · last report →Keisei reservation system breach may expose 3.37 million customer records
3.4mImpact: Possible exposure of up to approximately 3.37 million customer records
Unauthorised access to Keisei Electric Railway’s Skyliner seat reservation system on 11 November 2026 raised concerns that up to approximately 3.37 million customer records may have been exposed. The information includes user IDs, encrypted passwords, names, phone numbers and email addresses. The company has suspended online reservations and is investigating the scope of the breach, with no timetable for resuming the service as of 14 November.
Related reports: 15 →Attack on Inje University server exposes 24,011 personal information records
24kImpact: 24,011 personal information records belonging to students and staff
An external attack on a server associated with Inje University’s Flipped Learning Class system for course delivery exposed 24,011 personal information records belonging to students and staff. The university learnt of the incident through a notification from the Ministry of Education on 12 November, and the exposed data included student IDs, employee IDs, names, email addresses and mobile phone numbers. Passwords and resident registration numbers were not included, and the university blocked network access to the affected server and decided to shut down the system.
Related reports: 7 · last report →MetaM customer service systems hacked, exposing phone numbers and conversations
Impact: Phone numbers and customer service conversations in some customer service systems
An external attack on some of MetaM’s customer service systems revealed indications that phone numbers and customer service conversations had been accessed without authorisation or exfiltrated. MetaM became aware of the incident following a customer service outage at 6:03 am on 12 November 2026. During its investigation, the company found that abnormal access to some services had occurred before it became aware of the incident, and it is investigating the extent of any further data exposure and the intrusion vector.
Related reports: 2 · last report →Fireworks AI breach exposes client information
In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driving licence information were exposed.
Related reports: 4 · last report →Cyber-attack on France’s Maileva exposes 22 million people’s data
22mImpact: Personal information of 22 million people
France’s Maileva suffered a cyber-attack in which the personal information of 22 million people was stolen. The precise timing of the attack, the types of information exposed and the response measures have not been confirmed.
Related reports: 3 →Cyber-attack on Osaka Metropolitan University exposes personal information of 170,000 people
170kImpact: Personal information of 170,000 students and staff, including bank account numbers, passport images and other data for approximately 1,400 of them
A cyber-attack on Osaka Metropolitan University in October caused system disruptions and class cancellations, and an investigation confirmed that the personal information of 170,000 students and staff had been exposed. The exposed data included names and dates of birth, while records for approximately 1,400 people also included bank account numbers and passport images. It emerged that NEC, which managed the system, and its subcontractor had failed to delete the data after the system migration.
Related reports: 10 · last report →World Triathlon breach exposes athletes’ medical information
Impact: Athletes’ medical and personal information
A security breach at World Triathlon exposed athletes’ medical and personal information. World Triathlon confirmed the breach. When it occurred, the scale of the impact and the specific response measures have not been confirmed.
Related reports: 3 · last report →Unauthorised access at Yamada Denki may affect 3.5 million customer records
3.5mImpact: Up to 3.5 million customer records potentially affected
Unauthorised access was confirmed in Japanese retailer Yamada Denki’s renovation management system, raising the possibility that up to 3.5 million customer records may have been affected. The information includes names, addresses, telephone numbers, renovation histories and quotation records. The company has blocked external access and is investigating whether data was actually leaked externally and what caused the incident.
Related reports: 6 · last report →Ransomware attack disrupts India's TG-iPASS industrial approval services
Impact: TG-iPASS portal outage and disruption to industrial approval operations
The TG-iPASS portal in India's Telangana state suffered service disruption from 22 October after a ransomware attack encrypted its database. Industrial approval operations were affected, and the recovery of the data was subsequently reported. Telangana's cybercrime investigation agency is investigating the cyber-attack.
Related reports: 9 · last report →Around 46,000 TSMC employee records leaked and offered on black market
46kImpact: Around 46,000 records containing employees’ personal information
Around 46,000 records containing TSMC employees’ personal information were leaked, and a hacker attempted to sell them on the black market for 3 bitcoins. TSMC confirmed the leak and said its investigation found that the information matched data held by a cloud service provider. No evidence of a breach of TSMC’s systems was found, and neither production nor customer information was involved.
Related reports: 43 · last report →Around 17,000 ticket QR codes stolen from Hong Kong Disneyland
Impact: Around 17,000 admission ticket QR codes stolen; online ticket sales and hotel bookings suspended
Around 17,000 admission ticket QR codes were stolen from Hong Kong Disneyland's computer systems. The resort suspended ticket sales and hotel bookings on its official website and reported the incident to the police. The police are investigating the incident as a case of unauthorised computer access.
Related reports: 2 →Fullerton Health server breach exposes around 140,000 migrant worker records
140kImpact: Around 140,000 work permit holder records
Unauthorised access to a server supporting Singapore-based Fullerton Health's Primary Care Plan for migrant workers exposed around 140,000 work permit holder records. Names, foreign identification numbers, dates of birth, contact details and addresses were affected, but medical and financial information was not included. The company discovered the incident on 31 October, took response measures, reported it to the police and the Personal Data Protection Commission (PDPC), and began notifying those affected. It said there was no evidence that the breach had spread to other healthcare systems.
Related reports: 13 · last report →Bookeasy breach may expose Australian national park booking customers' data
Impact: Potential exposure of names, addresses, contact details and booking information of customers across several Australian states and territories
Unauthorised access to Australian booking platform Bookeasy was confirmed to have potentially allowed the names, addresses, contact details and booking information of its partners' customers to be viewed or exposed. National park booking customers across several states and territories were affected, and WhatsApp scam messages using actual booking information to demand additional payments were also reported. Parks Victoria temporarily suspended new campsite bookings, and no evidence of access to credit card information was found.
Related reports: 7 · last report →Kochi City recruitment video interview breach exposes 1,464 applicants’ data
1.5kImpact: Personal information of 1,464 applicants for staff recruitment examinations
Unauthorised access to an outsourced video interview system used for Kochi City’s staff recruitment examinations in Japan exposed the personal information of 1,464 applicants. Kochi City disclosed the breach approximately two months after receiving a report from the contracted system provider. The city explained that it had been awaiting the final report.
Related reports: 9 · last report →Amicus Lex hack exposes personal data of 20,028 users
20kImpact: Personal information of 20,028 LawForm users
A hack at Amicus Lex at 5:38 am on 11 November exposed the names, phone numbers and email addresses of 20,028 LawForm users. An SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.
Read on 헤럴드경제 ↗KIPA’s IDEARO platform hacked, exposing 62 MB of data
Impact: Approximately 62 MB of data exfiltrated
On 6 November 2026, attackers exploited a vulnerability in the file upload feature of IDEARO, a platform operated by the Korea Invention Promotion Association (KIPA), to gain access and install and run malware. KIPA detected and blocked the intrusion on 11 November and confirmed that 62 MB of data had been transferred outside the organisation from some servers. The attackers could also access attachment storage, but it has not been confirmed whether any attachments were actually viewed or exfiltrated. No signs of intrusion were found on the separate server holding encrypted member information.
Read on 데일리시큐 ↗Modoo Jobs website defaced, replacing service information
Impact: Website homepage defaced
According to a report published on 15 November 2026, the website of professional talent matching service Modoo Jobs was defaced in a hacking incident. The reported damage was the alteration of the website’s display; the information supplied in the article does not establish whether personal information was leaked or the scale of any leak.
Read on 데일리시큐 ↗Maersk data breach linked to legacy IT systems inherited through acquisition
Impact: Data breach confirmed; attackers claim about 100 GB stolen
Maersk confirmed that attackers gained unauthorised access to legacy IT systems inherited from a company it had previously acquired and extracted data. WhiteArmor claimed to have stolen about 100 GB and demanded $5 million. While investigating the incident, Maersk denied claims that plaintext passwords had been stolen and said the codes obtained by the attackers were expired one-time codes.
Related reports: 28 · last report →Mirae Asset breach exposes data on 331 users and 2,281 staff
2.3kImpact: Information on 331 users and 2,281 executives and employees, daily fund returns and other data
An attacker stole information on 331 users, daily fund returns and other data from Mirae Asset’s pension fund investment pool website by changing member numbers individually to retrieve records. Personal information on 2,281 executives and employees was also leaked from an internal business system. An internal security inspection two weeks before the incident reported no issues across all items checked, but a subsequent inspection into the hacking identified some violations.
Related reports: 3 · last report →India's Unocoin loses $200,000 in crypto following server breach
Impact: $200,000 in cryptocurrency losses and a customer data leak
Indian cryptocurrency exchange Unocoin confirmed a breach of its server infrastructure and suspended services including logins, trading and withdrawals from 9 November. The company began rebuilding its infrastructure and investigated unauthorised withdrawal transactions detected at an Ethereum address in its BitGo wallet. It subsequently acknowledged $200,000 in cryptocurrency losses and warned of a customer data leak.
Related reports: 7 · last report →BrickLink cyber breach exposes member data and disrupts service
Impact: Exposure of some members’ usernames and IP addresses and a small number of email addresses; service disruption lasting around a week
Lego-owned marketplace BrickLink was restored after a cyber breach left it offline for around a week. Unauthorised access to some members’ usernames and IP addresses and a small number of email addresses was confirmed, while passwords and payment information were unaffected. Users also reported misuse of additional information, but the extent was not independently verified.
Related reports: 7 · last report →Malicious Claude Code extensions distributed through Cursor marketplace
5kImpact: Up to 5,000 developers potentially exposed to malware
Tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were distributed through Cursor's extension marketplace for around 11 hours, potentially exposing up to 5,000 developers to malware. The malicious extensions transmitted host information and installed attacker SSH keys and persistence components or attempted to establish reverse SSH tunnels. Cursor removed the packages and temporarily suspended and rebuilt the marketplace. Cursor later confirmed that the malicious extensions had been distributed through a breach using credentials stolen from AI infrastructure provider Fireworks.
Related reports: 5 · last report →Philippine interior department investigates possible resident data leak
Impact: Possible exposure of resident records; scale unconfirmed
The Philippines' Department of the Interior and Local Government is investigating a possible data leak from a system supporting local governments and managing resident information. Resident records containing names, addresses, contact details, marital status, occupations and classifications such as persons with disabilities, overseas workers and single parents may have been affected. Philippine authorities have identified some hackers' real identities in connection with data leaks targeting 23 organisations, including government agencies, and are gathering evidence with the National Bureau of Investigation.
Related reports: 2 · last report →Binance hack sees $6.3 billion in cryptoassets stolen
Impact: $6.3 billion in cryptoassets stolen
Around 29 October 2026, $6.3 billion in cryptoassets was stolen from Binance. A subsequent investigation revealed how North Korean attackers deceived an employee through a fake recruitment interview into installing malware and compromised wallet infrastructure. Binance resumed withdrawals and completed full reimbursement of affected customer assets, while the US government pursued freezing and seizure proceedings for some of the stolen assets.
Related reports: 303 · last report →Cyber-attacks disrupt Rosstat websites and statistics releases
Impact: Defacement and access disruptions affecting central and regional websites; delayed releases of key economic statistics
Russia’s Federal State Statistics Service suffered cyber-attacks from 29 October to 1 November 2026, resulting in defacement and access disruptions affecting its central and regional websites. Cyber Partisans and Silent Crow claimed access to approximately 25,000 computers and the theft of 23 TB of data, but the agency denied that its databases had been compromised or protected information leaked and investigated the source of the attacks. Records of combatant deaths identified through analysis of the stolen records were subsequently made public, while system recovery and the provision of key statistics remained disrupted through 15 November.
Related reports: 20 · last report →Unauthorised access to file-sharing platform at facility under Malaysia’s Ministry of Health
Malaysia’s Ministry of Health detected unauthorised access to a secondary file storage and sharing platform at one of its facilities on 12 November 2026 and blocked external access. It said an initial investigation found that the main databases had not been encrypted, and that core operational systems and medical and patient care services were operating normally without disruption.
Read on The Star ↗Kempinski data leak followed by fraudulent payment requests
Impact: Hotel customers' contact details and booking information exposed
The misuse of a technology partner's access credentials exposed Kempinski hotel customers' contact details and booking information. Fraudulent payment requests citing actual booking details followed. Kempinski confirmed the customer data leak and could not rule out the possible exposure of passport and visa numbers.
Related reports: 3 →Fireworks AI breached again, exposing customer data and model weights
Impact: Some customers’ account information, billing information, secrets, datasets and unfinished model weights
Fireworks AI experienced further unauthorised access to its development systems on 24 October through a breach at an external cloud provider, 18 days after confirming the initial breach. The investigation confirmed that customer account and billing information, as well as some customers’ secrets, datasets and unfinished model weights, were affected. The company revoked credentials, isolated systems and notified all affected customers.
Related reports: 15 · last report →