Week 46, 2026 security incident reportIn progress

LNbits urges server shutdowns after unauthorised wallet withdrawals

Impact: Unauthorised withdrawal of 2,285,545 satoshis from one operator’s wallet; total losses undisclosed

LNbits suffered a series of attacks that drained wallet funds. One operator reported an unauthorised withdrawal of 2,285,545 satoshis through a new account, while the total losses and the precise attack method were not disclosed. LNbits asked all operators to shut down their servers immediately and closed its own hosted service, later recommending an emergency security update.

Amadeus reservation system breach exposes passenger data at multiple airlines

Impact: Passenger booking data exposed at multiple airlines

Unauthorised access to the reservation system of Spanish travel technology company Amadeus exposed passenger booking data at multiple airlines. Alongside names and itinerary details, some passport numbers and contact details were exposed, with Japan Airlines, ANA and Cathay Pacific among the affected airlines. Further reports followed from Korean Air, Asiana Airlines and others, while Thailand's aviation authorities confirmed that Thai Airways and Bangkok Airways were affected among seven major airlines.

SMBC Consumer Finance data breach affects up to 320,118 customers

320.1kImpact: Personal information of up to 320,118 customers

A third party breached Japan's SMBC Consumer Finance loan guarantee operations system and transferred data containing the personal information of up to 320,118 people outside the company. The compromised information included names, addresses, dates of birth, telephone numbers, email addresses, driving licence numbers, workplaces, annual incomes and guarantee contract details. The company detected the intrusion on 2 November, blocked access and temporarily shut down the system, while some partner financial institutions also suspended loan applications.

Arara email service cyber-attack exposes 81.33 million email addresses

81.3mImpact: 81,329,467 email addresses and some customers' member information

Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also misused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and suspended its email delivery service entirely.

Fireworks AI breached again, exposing customer data and model weights

Impact: Some customers’ account information, billing information, secrets, datasets and unfinished model weights

Fireworks AI experienced further unauthorised access to its development systems on 24 October through a breach at an external cloud provider, 18 days after confirming the initial breach. The investigation confirmed that customer account and billing information, as well as some customers’ secrets, datasets and unfinished model weights, were affected. The company revoked credentials, isolated systems and notified all affected customers.

DOUZONE BIZON server breach raises wider concerns over client data exposure

Impact: As of 5 November, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed

Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of 5 November, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totalling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the extent of any leak remain under investigation.

CYBERBIZ database breach raises fears of client order data leaks

Impact: Four client companies disclosed possible compromise of order data and personal information

Unauthorised access to part of the database of Taiwanese e-commerce service provider CYBERBIZ prompted four client companies to disclose that order data and personal information may have been compromised. Acer Gadget and Acerpure suspended their online shops. Some clients have been informed of the extent of the impact, but Taiyen and Far East Bio-Tec are still verifying the precise scope of the damage, while the overall extent also remains under investigation.

Electronic ticketing service teket exposes all members’ names and email addresses

Impact: Names and email addresses of all members and additional personal information of some members exposed; all services suspended

Unauthorised access to Japanese electronic ticketing service teket’s member information management system exposed all members’ names and email addresses. Additional information exposed for some members included dates of birth, addresses, telephone numbers and ticket issuance codes. All services have been suspended since 5 November 2026, disrupting ticket sales, ticket display and event admission processing, while the number of people affected, the extent of the impact and when services will resume remain under investigation.

Intrusion into Japanese security firm's development environment raises customer data concerns

Impact: Possible exposure of some customers' company names, names, email addresses and service communications information

A Japanese security services provider detected suspected third-party access to its development administration environment after an employee's GitHub credentials were compromised. It is investigating whether some customers' company names, names, email addresses and service communications information may have been viewed or obtained. The company said it would respond across the organisation to prevent a recurrence and restore trust.

Unauthorised network access and system encryption at Canadian child welfare agency

Unauthorised access and system encryption occurred on the network of Canada’s Highland Shores Children’s Aid Society. The agency was providing IT services to The Children’s Foundation. The foundation announced that personal information belonging to people associated with it may have been affected.

Bookeasy breach may expose Australian national park booking customers' data

Impact: Potential exposure of names, addresses, contact details and booking information of customers across several Australian states and territories

Unauthorised access to Australian booking platform Bookeasy was confirmed to have potentially allowed the names, addresses, contact details and booking information of its partners' customers to be viewed or exposed. National park booking customers across several states and territories were affected, and WhatsApp scam messages using actual booking information to demand additional payments were also reported. Parks Victoria temporarily suspended new campsite bookings, and no evidence of access to credit card information was found.

Unauthorised access to ReserVision bookings leads to customer phishing

Impact: Personal information and booking details of restaurant and hotel guests

Unauthorised access through customer accounts on reservation service ReserVision exposed the personal information and booking details of restaurant and hotel guests. The stolen information was used in phishing emails requesting payments or card details, and some businesses' actual email sending accounts were also misused.

Dentsu Digital TONARIWA breach leaks personal data from two client companies

Impact: Personal data from two client companies leaked; number of affected records under investigation

Unauthorised access and privilege escalation using leaked administrator account credentials were confirmed on Dentsu Digital's marketing platform TONARIWA. A follow-up announcement on 12 November confirmed logs showing that personal data from two client companies had been exfiltrated, with names, dates of birth, contact details and LINE integration access tokens among the information identified as leaked. All servers were shut down and isolated, and the number of affected records is under investigation.

AllUnited cyber-attack exposes Dutch sports club members' data

Impact: More than 350 sports clubs reported the breach; members' personal information and bank account details were exposed

An attacker exploited a software flaw in AllUnited, a Dutch sports club membership management platform, to copy its membership database. The exposed information included names, addresses, dates of birth, passwords and bank account details. The company began resetting all passwords, and more than 350 sports clubs reported the breach to the data protection regulator.

Malware on Quantum Systems servers prompts German military to halt drone operations

Impact: Temporary suspension of the German armed forces’ operations of the manufacturer’s drones

German drone manufacturer Quantum Systems detected a cyber-attack on its internal servers in late October 2026. Update files containing malware had been planted on the servers, reportedly in an attempt to affect drone operations through updates. The company began a joint investigation with the authorities, and the German armed forces temporarily suspended operations of the manufacturer’s drones as a precaution.

Taiwan netiCRM provider’s management server breached, client data stolen

Impact: Theft of non-profit clients’ contact details, contract and billing documents, and customer support records

An internal management server at Taiwan’s netiCRM provider was compromised, and non-profit clients’ contact details, contract and billing documents, and customer support records were stolen. More than 30 non-profit organisations warned donors about scams. The provider included servers belonging to around 500 clients in its inspection and rebuilding programme, and as of 12 November, no evidence of donor information theft had been found.

Fireworks AI breach exposes client information

In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driving licence information were exposed.

OPENLOGI breach exposes seven months of delivery data

Impact: Some dispatch data covering approximately seven months leaked; the total number of records remains under investigation.

Japanese logistics company OPENLOGI experienced unauthorised access on 8–9 November, and some delivery data received from 8 April to 8 November was exfiltrated. The data included recipients’ names, addresses, telephone numbers, email addresses and product information. By 12 November, 13 client companies and services had announced impacts, while the full extent of the breach remained under investigation.

Amicus Lex hack exposes personal data of 20,028 users

20kImpact: Personal information of 20,028 LawForm users

A hack at Amicus Lex at 5:38 am on 11 November exposed the names, phone numbers and email addresses of 20,028 LawForm users. An SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.

Nissan Financial Services faces possible leak of up to 236,000 customer records

236kImpact: Possible leak of up to approximately 236,000 customer records

A breach of the business systems of a roadside assistance contractor for Japan’s Nissan Financial Services raised concerns that up to approximately 236,000 customer records may have been leaked. The information concerned may include names, addresses, contact details, email addresses, vehicle information and records of accident and breakdown reports. Other companies using the same contractor were also reported to be affected.

MetaM customer service systems hacked, exposing phone numbers and conversations

Impact: Phone numbers and customer service conversations in some customer service systems

An external attack on some of MetaM’s customer service systems revealed indications that phone numbers and customer service conversations had been accessed without authorisation or exfiltrated. MetaM became aware of the incident following a customer service outage at 6:03 am on 12 November 2026. During its investigation, the company found that abnormal access to some services had occurred before it became aware of the incident, and it is investigating the extent of any further data exposure and the intrusion vector.