Week 46, 2026 security incident reportIn progress

LNbits urges server shutdowns after unauthorized wallet withdrawals

Impact: Unauthorized withdrawal of 2,285,545 satoshis from one operator’s wallet; total losses undisclosed

LNbits was hit by a series of attacks that drained wallet funds. One operator reported an unauthorized withdrawal of 2,285,545 satoshis through a new account, while the total losses and the specific attack method were not disclosed. LNbits asked all operators to shut down their servers immediately and shut down its own hosted service, later recommending an emergency security update.

Amadeus reservation system breach exposes passenger data at multiple airlines

Impact: Passenger booking data exposed at multiple airlines

Unauthorized access to the reservation system of Spanish travel technology company Amadeus exposed passenger booking data at multiple airlines. In addition to names and itinerary details, some passport numbers and contact details were exposed, with Japan Airlines, ANA and Cathay Pacific among the affected airlines. Further reports followed from Korean Air, Asiana Airlines and others, while Thailand's aviation authorities confirmed that Thai Airways and Bangkok Airways were affected among seven major airlines.

SMBC Consumer Finance data breach affects up to 320,118 customers

320.1KImpact: Personal information of up to 320,118 customers

A third party breached Japan's SMBC Consumer Finance loan guarantee operations system and transmitted data containing the personal information of up to 320,118 people outside the company. The compromised information included names, addresses, dates of birth, phone numbers, email addresses, driver's license numbers, workplaces, annual incomes, and guarantee contract details. The company detected the intrusion on November 2, blocked access, and temporarily shut down the system, while some partner financial institutions also suspended loan applications.

Arara email service hack exposes 81.33 million email addresses

81.3MImpact: 81,329,467 email addresses and some customers' member information

Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also abused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and completely suspended its email delivery service.

Fireworks AI breached again, exposing customer data and model weights

Impact: Some customers’ account information, billing information, secrets, datasets, and unfinished model weights

Fireworks AI suffered renewed unauthorized access to its development systems on October 24 through a breach at an external cloud provider, 18 days after confirming the first breach. The investigation confirmed that customer account and billing information, along with some customers’ secrets, datasets, and unfinished model weights, were affected. The company revoked credentials, isolated systems, and notified all affected customers.

DOUZONE BIZON server breach raises wider concerns over client data exposure

Impact: As of November 5, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed

Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of November 5, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totaling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the scope of any leak remain under investigation.

CYBERBIZ database breach raises fears of client order data leaks

Impact: Four client companies disclosed possible compromise of order data and personal information

Unauthorized access to part of the database of Taiwanese e-commerce service provider CYBERBIZ prompted four client companies to disclose that order data and personal information may have been compromised. Acer Gadget and Acerpure suspended their online stores. Some clients have been informed of the extent of the impact, but Taiyen and Far East Bio-Tec are still verifying the precise scope of the damage, while the overall extent also remains under investigation.

Electronic ticketing service teket leaks all members’ names and email addresses

Impact: Names and email addresses of all members and additional personal information of some members exposed; all services suspended

Unauthorized access to Japanese electronic ticketing service teket’s member information management system exposed all members’ names and email addresses. Additional information exposed for some members included dates of birth, addresses, phone numbers, and ticket issuance codes. All services have been suspended since November 5, 2026, disrupting ticket sales, ticket display, and event admission processing, while the number of people affected, the scope of the impact, and when services will resume remain under investigation.

Intrusion into Japanese security firm's development environment raises customer data concerns

Impact: Possible exposure of some customers' company names, names, email addresses, and service communications information

A Japanese security services provider detected suspected third-party access to its development administration environment after an employee's GitHub credentials were compromised. It is investigating whether some customers' company names, names, email addresses, and service communications information may have been viewed or obtained. The company said it would respond across the organization to prevent recurrence and restore trust.

Unauthorized network access and system encryption at Canadian child welfare agency

Unauthorized access and system encryption occurred on the network of Canada’s Highland Shores Children’s Aid Society. The agency was providing IT services to The Children’s Foundation. The foundation announced that personal information belonging to people associated with it may have been affected.

Bookeasy breach may expose Australian national park booking customers' data

Impact: Potential exposure of names, addresses, contact details and booking information of customers across several Australian states and territories

Unauthorized access to Australian booking platform Bookeasy was confirmed to have potentially allowed the names, addresses, contact details and booking information of its partners' customers to be viewed or exposed. National park booking customers across several states and territories were affected, and WhatsApp scam messages using actual booking information to demand additional payments were also reported. Parks Victoria temporarily suspended new campsite bookings, and no evidence of access to credit card information was found.

Unauthorized access to ReserVision bookings leads to customer phishing

Impact: Personal information and booking details of restaurant and hotel guests

Unauthorized access through customer accounts on reservation service ReserVision exposed the personal information and booking details of restaurant and hotel guests. The stolen information was used in phishing emails requesting payments or card details, and some businesses' actual email sending accounts were also misused.

Dentsu Digital TONARIWA breach leaks personal data from two client companies

Impact: Personal data from two client companies leaked; number of affected records under investigation

Unauthorized access and privilege escalation using leaked administrator account credentials were confirmed on Dentsu Digital's marketing platform TONARIWA. A follow-up announcement on November 12 confirmed logs showing that personal data from two client companies had been exfiltrated, with names, dates of birth, contact details, and LINE integration access tokens among the information identified as leaked. All servers were shut down and isolated, and the number of affected records is under investigation.

AllUnited hack exposes Dutch sports club members' data

Impact: More than 350 sports clubs reported the breach; members' personal information and bank account details were exposed

An attacker exploited a software flaw in AllUnited, a Dutch sports club membership management platform, to copy its membership database. The exposed information included names, addresses, dates of birth, passwords, and bank account details. The company initiated a reset of all passwords, and more than 350 sports clubs reported the breach to the data protection regulator.

Malware on Quantum Systems servers prompts German military to halt drone operations

Impact: Temporary suspension of the German armed forces’ operations of the manufacturer’s drones

German drone manufacturer Quantum Systems detected a cyberattack on its internal servers in late October 2026. Update files containing malware had been planted on the servers, reportedly in an attempt to affect drone operations through updates. The company launched a joint investigation with the authorities, and the German armed forces temporarily suspended operations of the manufacturer’s drones as a precaution.

Taiwan netiCRM provider’s management server breached, client data stolen

Impact: Theft of nonprofit clients’ contact details, contract and billing documents, and customer support records

An internal management server at Taiwan’s netiCRM provider was compromised, and nonprofit clients’ contact details, contract and billing documents, and customer support records were stolen. More than 30 nonprofit organizations warned donors about scams. The provider included servers belonging to around 500 clients in the scope of its inspections and rebuilding efforts, and as of November 12, no evidence of donor information theft had been found.

Fireworks AI breach exposes client information

In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driver’s license information were exposed.

OPENLOGI breach exposes seven months of shipping data

Impact: Some shipment data covering approximately seven months leaked; the total number of records remains under investigation.

Japanese logistics company OPENLOGI suffered unauthorized access on November 8–9, and some shipping data received from April 8 through November 8 was exfiltrated. The data included recipients’ names, addresses, phone numbers, email addresses, and product information. By November 12, 13 client companies and services had announced impacts, while the full extent of the breach remained under investigation.

Amicus Lex hack exposes personal data of 20,028 users

20KImpact: Personal information of 20,028 LawForm users

A hack at Amicus Lex at 5:38 a.m. on November 11 exposed the names, phone numbers, and email addresses of 20,028 LawForm users. A SQL injection attack targeting the administrator page and a vulnerable API were identified, and the vulnerable API code was deleted. The Ministry of SMEs and Startups disclosed the incident approximately 60 hours after becoming aware of it.

Nissan Financial Services: possible leak of up to 236,000 customer records

236KImpact: Possible leak of up to approximately 236,000 customer records

A breach of the business systems of a roadside assistance contractor for Japan’s Nissan Financial Services raised the possibility that up to approximately 236,000 customer records had been leaked. The affected information may include names, addresses, contact details, email addresses, vehicle information and records of accident and breakdown reports. Other companies using the same contractor were also reported to be affected.

MetaM customer service systems hacked, exposing phone numbers and conversations

Impact: Phone numbers and customer service conversations in some customer service systems

An external attack on some of MetaM’s customer service systems revealed indications that phone numbers and customer service conversations had been accessed without authorization or exfiltrated. MetaM became aware of the incident following a customer service outage at 6:03 a.m. on November 12, 2026. During its investigation, the company found that abnormal access to some services had occurred before it became aware of the incident, and it is investigating the extent of any further data exposure and the intrusion vector.