Cyber Watch

Confirmed. NACSA says it is aware of incidents and NC4 is monitoring. Institutions and incident type not disclosed. MKN on 7 November called them cybersecurity incidents and system disruptions, with BNM leading sector preparedness.

Confirmed. A malicious cyber incident leaked user personal data. Police report filed; PDPC is investigating. It learned of the breach on 29 October, engaged Ensign InfoSecurity and says clinical records were not affected.

Confirmed. BIR is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group.

Claimed. Posts online allege BIR data was leaked; extent not stated.

Confirmed. Tajani said pro-Russian hackers exposed his private information on the dark web over Italy's support for Ukraine.

Confirmed. Websites defaced; the bank blames a third-party-managed site and says deposits, data and banking services were unaffected. On 7 November Fahmi Fadzil said the bank blocked the affected server and no data theft had been found so far.

Claimed. The actor claims internal access and a data sample, and no sample has been published. Screenshots shared on the night of 6 November show the same MARLANWG message and Session contact ID on both bankrakyat.com.my and the i-Rakyat online banking site, irakyat.com.my.

Confirmed. A breach found on 30 Oct exposed customer names, NRIC/FIN numbers, birth dates, mobile numbers, emails and addresses. Contained; payment data not affected. PDPC said on 6 November it is investigating; M1 has not said how many customers were affected.

Confirmed. Fore reported unauthorised access to customer data to Komdigi on 28 Oct; Komdigi puts it at about 5.7 million customer accounts.

Confirmed. About 46,000 booking records held by reservation provider Amadeus were accessed, about 620 with contact, travel document or KrisFlyer details. SIA's own systems were not breached.

Confirmed. Editor-in-chief Olga Rudenko confirmed attackers took over the website management and newsletter systems to send fake messages; the outlet suspects Russia.

Confirmed. RIA said personal data and booking records of about 9,000 customers leaked in October 2026.

Confirmed. Arkéa disclosed a sophisticated outside attack that sent about 100 million euros from its own account to other banks and said customer assets were unaffected.

Confirmed. President Yoshiaki Maeda said unauthorized access breached up to about 300,000 sets of personal information, including names, addresses, ID document numbers and bank account numbers, and the My docomo service was suspended.

Confirmed. An unauthorised party accessed internal systems on 29 Oct and copied personal data of some Singapore and Hong Kong customers. PDPC informed.

Confirmed. Natthaphong Ruengpanyawut posted an Apple spyware threat notification; Abhisit Vejjajiva also got one but his phone was not compromised. The government calls claims of state involvement baseless.

Confirmed. ACN said it received a NIS incident notification from a Tuscan catering firm hit in the cold-chain attacks.

Confirmed. The bank confirmed that hackers abused a security setting flaw at its new online banking system's foreign vendor to make unauthorised transfers from over 400 accounts. All funds were returned on 3 November.

Confirmed. Selver and refrigeration contractor Kitman Coldtech confirmed hackers raised a store freezer to 50 C through an older Danfoss control system; staff reacted within ten minutes.

Confirmed. The Association of Independent Meat Suppliers said fridges at two members defrosted and a third saw cold-unit temperatures rise during the Europe-wide refrigeration attack wave.

Confirmed. Officials and company representatives confirmed four German supermarket outlets were hit in the 2 November refrigeration attack wave.

Confirmed. EFS said attackers raised temperature and defrost thresholds at three plasma cold-storage sites through its refrigeration supplier, and no blood products were lost.

Confirmed. Danfoss confirmed to NOS that refrigeration systems at 17 Dutch businesses, mainly butchers and small grocers, were attacked.

Confirmed. Coop said four of its 300 Sicilian stores were hit in the refrigeration attack wave, and the government called the impact highly limited.

Confirmed. Musgrave said a cyber incident hit refrigeration in 13 SuperValu stores, its monitoring flagged it, and the issue was fully resolved the same day.

Confirmed. Coop confirmed a cyber incident hit cooling at seven stores in Gävle and Sundsvall, which were on older 4G connections.

Confirmed. Ica Kvantum Sjöbo said a cyberattack caused its cooling failure, and ICA Group said the affected stores were those using Danfoss systems.

Confirmed. Brazil's largest crypto exchange confirmed a cybersecurity incident and suspended deposits and withdrawals.

Claimed. Blockchain security firms said more than $46 million left the platform.

Confirmed. Qantas confirmed its booking data was among the Amadeus exposure, said its own systems remain secure, and notified Australian cyber authorities.

Confirmed. Outsiders accessed the system on 30 Oct; contained, users must reset passwords.

Claimed. A headline suggests over 7 million accounts were hacked; HOCMAI has not confirmed a figure.

Confirmed. The app's developers said unauthorised individuals interfered with it, and Ukraine's Air Force said it was likely compromised by the enemy after fake nuclear and chemical alerts went out.

Claimed. A group calling itself Hitcore Corp claimed responsibility.

Confirmed. Beget said on Telegram that attackers wiped data across its cloud infrastructure, disrupting hundreds of websites.

Confirmed. Customer data processed through Amadeus from August 2023 to September 2026 may be exposed. The airline's own systems were not breached.

Confirmed. A cybersecurity attempt took trading offline for over a week; app trading returned on 4 November. No evidence of data loss, per the CEO. Web trading stays suspended for all markets; orders go only through the iSPEED.my app.

Confirmed. St. Luke's said on 30 October that someone gained unauthorized access to a third-party managed platform behind its mobile app, and the NPC confirmed it received the breach notification the same day.

Confirmed. Cathay said about 53,000 bookings were affected by unauthorized access to reservation data held by Amadeus between August 2023 and September 2026.

Confirmed. Responding to a PCPD report, the Hospital Authority said patient data was stolen in April 2026 through a contractor's access during maintenance, and police arrested a contractor staff member.

Confirmed. Eight public LED screens were hijacked to show obscene video and switched off. Police are investigating.

Claimed. A Telegram group claimed it, according to foreign outlets.

Confirmed. The privacy commission is investigating with the DMW.

Claimed. Researchers say 27 database backups (about 68.8 GiB) tied to DMW portals were copied on 6 Sep; contents unverified.

Confirmed. Explicit footage ran on a highway billboard in Giza. The Interior Ministry said the website of the international firm that distributed the screen's ad content was hacked, and legal action began.

Confirmed. ANA said unauthorized access at its reservation contractor Amadeus may have exposed customer personal information.

Confirmed. Asiana said booking-related customer information was exposed through Amadeus and that payment data, held on a separate system, was not affected.

Confirmed. The banking software company told the exchanges that an employee email account at its Canadian subsidiary was compromised and used to send fake payment instructions to a customer. It reported no impact on its products or operations.

Confirmed. A ransomware attack detected on 18 October hit all nine servers at the Chhatrapati Sambhajinagar hospital, forcing staff onto manual processes. Police registered a case.

Claimed. A ransom note attributed to Crypto24 Group said hospital files were encrypted.

Confirmed. JAL said unauthorized access to the Amadeus passenger service system exposed reservation data of about 92,000 JAL and Japan Transocean Air customers, about 2,000 of them with passport numbers.

Confirmed. Bitonic said an attacker exploited a vulnerability, changed login data and took bitcoin from three customer accounts, which it reimbursed.

Confirmed. NTT Docomo said unauthorised access to a member database server at contractor Sony Network Communications (So-net) exposed 443,495 records of current and former plala (S course) customers: names, phone numbers, birth dates, gender, So-net email addresses and login IDs. Passwords, cards and bank details were not included.

Confirmed. The Information Regulator said FNB filed a security compromise notification after customer account numbers were exposed through its digital home loan application platform, and fined the bank R1 million for weak safeguards.

Confirmed. Alliance Healthcare Group told SGX that a third party gained unauthorised access to subsidiary Alliance Medinet's membership database, exposing names, ID numbers and contact details of about 110,000 members, and that it reported the incident to the PDPC on 21 October.

Confirmed. CTU said it stopped a cyberattack that forced some systems offline and linked it to a global wave of attacks on PHP-based sites.

Confirmed. The Government Office took its website offline because of newly disclosed critical PHP vulnerabilities.

Confirmed. Korean Air said Amadeus notified it on 20 October that customer data including reservation numbers may have leaked, with no intrusion into its own systems.

Confirmed. dbp.gov.my subdomains were hijacked to serve gambling pages. NACSA says it is aware of the campaign.

Confirmed. The e-commerce platform disclosed that a Commerce Cloud order database was accessed through an unpatched Appsmith tool, with traces of the ARTEX attack tool. Names, phones and addresses of shoppers at up to 1,329 brands may be affected, including MUJI Taiwan.

Confirmed. Fastwork said an attacker extracted national ID numbers, names, phone numbers and emails of some users on 13 October 2026, and that it notified the PDPC on 15 October.

Confirmed. The Ombudsman said a third-party IT security incident hit its case management system, was contained and was reported to the ICO.

Confirmed. Intermarché said a cyberattack on a service provider put display units out of service and Coopérative U's president confirmed the attack; the Paris prosecutor opened an investigation.

Confirmed. Ahold Delhaize called the outage of Albert Heijn, Etos and Gall & Gall websites, apps and deliveries a cybersecurity incident; deliveries restarted nearly two weeks later.

Confirmed. Services suspended for four days after suspicious activity. Police, NACSA and the data protection department notified; savings and data said to be safe.

Confirmed. The SoftBank cloud subsidiary said a third-party ransomware attack hit its East Japan Region 1, affecting 495 companies and local governments that use the service.

Confirmed. ATB, Ukraine's largest grocery chain, confirmed a cyberattack and denied that customer data was compromised.

Claimed. DataSuckers claimed data on 7.9 million customers and demanded 400,000 dollars.

Confirmed. Police and prosecutors said patient data from more than 300 healthcare providers was downloaded and a 45-year-old Estonian with past ties to the company was arrested.

Confirmed. Officials confirmed a data breach at Shinhan Bank, one of several bank incidents that led the Financial Services Commission to hold an emergency meeting and order on-site checks.

Confirmed. The minister's personal data circulated online; Komdigi and BSSN say it came from old leaks and opened a probe into illegal data trading with police.

Confirmed. DICT acknowledged unauthorised access and defacement of a website staging environment.

Claimed. 4HMDOS4 claimed the defacement.

Confirmed. Fakturownia, an invoicing platform used by over 600,000 businesses, confirmed unauthorised server access, and the Finance Ministry said the national e-invoicing system KSeF was not breached.

Claimed. Fingerprint claimed to have stolen 6 TB of invoices.

Confirmed. The PDPC said an employee's AI-generated mailing script exposed the email addresses of 95,364 members to other recipients, its first notified AI-related breach, and accepted a voluntary undertaking from the company.

Confirmed. Dodo Pizza confirmed attackers accessed customer personal data and said it notified Roskomnadzor.

Claimed. DataSuckers claimed records on 68 million customers and offered them for about 100,000 dollars.

Confirmed. Names, ID numbers, birth dates, mobile numbers and emails of 23,549 customers were breached. PDPC is investigating.

Confirmed. Keio confirmed a ransomware attack on its group servers that disrupted business systems, mainly in its hotel business, and reported it to police.

Confirmed. Flink confirmed unauthorised access to an internal system holding customer contact data and reported it to the German data protection authority and police.

Claimed. LPG Group claimed data on one million customers and 13,000 workers and sent ransom notes to individuals.

Confirmed. CTOS told Bursa it detected unauthorised access to an environment supporting its consumer business and that files with a limited subset of processed consumer information were accessed.

Confirmed. The LTFRB confirmed a data breach in a public advisory and took its LTFRB Electronic Support System offline.

Claimed. A user called core849 claimed 7.7 GB of personnel, vehicle registration and franchise records.

Confirmed. The council said national teams detected and contained advanced, organised attacks on the aviation, energy and education sectors in August 2026 before they disrupted vital systems.

Confirmed. An operation led by the National Intelligence Organization (MIT) with the Cybersecurity Directorate found leaked identity datasets could be queried through the firm's union software, and five suspects were arrested.

Confirmed. Duopharma told Bursa that data files allegedly including personal data were extracted after an unauthorised access attempt and that it will notify the Personal Data Protection Commissioner.

Confirmed. Library director Jaanika Anderson said an external attacker accessed the online store and most likely downloaded customer data.

Confirmed. RIA said a DDoS attack sent over 86 million queries to the national authentication service, more than 100 times normal volume.

Confirmed. The Digital Agency said a third party used a VPN flaw to access its staff system, possibly exposing about 246,000 records on government employees and related contacts.

Confirmed. A cyber incident halted terminal operations overnight; systems were isolated and restored.

Claimed. Direwolf listed the port on its leak site and claims ransomware and data theft.

Confirmed. Wildberries said a DDoS attack triggered security measures that delayed seller payouts.

Claimed. Ukraine's HUR intelligence agency claimed it ran a wider cyber operation against Wildberries with the group Cyber Corps.

Confirmed. Medyc confirmed theft of patient identity data after an SQL injection, Minister Gawkowski said the cybercrime bureau is investigating, and the data protection authority ordered an audit.

Claimed. An actor called Fingerprint claimed records on 5 million patients and 8 million photos.

Confirmed. DICT said a DOLE web host was modified without authorization, the node was isolated, and no sensitive databases or personal data were compromised.

Confirmed. MIP linked the Hollard material to its June breach. Hollard refused to pay and says its own systems were not compromised.

Claimed. The Gentlemen listed Hollard and published funeral policyholders' details.

Confirmed. Rand Water told debt holders it was responding to an incident affecting some IT systems. It said water treatment and supply were unaffected and treasury ran from a disaster recovery environment.

Confirmed. Mathspace said attackers exploited its self-hosted Metabase system and stole data on 1,079,819 students, parents and staff in Australia and New Zealand.

Confirmed. Mathspace said stolen data covered students, parents and staff in Australia and New Zealand, 1,079,819 people in total.

Confirmed. McKesson disclosed in SEC filings that attackers used a third-party application to take data on oncology and surgical customers.

Claimed. ShinyHunters claimed the attack and threatened to leak the data.

Confirmed. The cloud deployment platform said an internal service credential was misused and customer environment variables, including AI service API keys, were exposed. It told users to rotate keys.

Confirmed. SickKids said a flaw in third-party software exposed data on staff and job applicants, with clinical systems unaffected.

Confirmed. The council said an incident found on 21 August may have exposed health, child and family service, HR and financial records.

Claimed. The Gentlemen ransomware group listed the council as a victim.

Confirmed. MyDr, a software supplier to clinics, confirmed external criminal access to historical data, and Minister Gawkowski said P1 connection certificates were being replaced as a precaution.

Claimed. People claiming responsibility sent alleged samples of patient data to Zaufana Trzecia Strona; the claims are unverified.

Confirmed. The Ministry of the Economy said an attacker accessed DGFiP systems and tax data on 678,000 people and professionals, and notified CNIL and ANSSI.

Claimed. ZeroBytes listed a cadastral database for sale on PwnForums, claiming data on over 2 million people.

Confirmed. Berlin confirmed extortion attempts after data theft, disconnected affected Senate departments on 14 August, and the mayor said the city will not pay.

Claimed. Rhysida claimed 5.79 TB of administrative files, including HR, financial and water-supply security documents.

Confirmed. The Ministry of Digital Affairs said overseas hackers used AI agents such as OpenClaw against government agencies in July, with alerts issued from 20 July. Affected agencies completed their response.

Claimed. Researchers at Dream, cited by the Financial Times, said the tool compromised at least 85 government accounts and took over 2,500 personnel records, then moved to the nuclear safety agency and seven energy firms.

Confirmed. Quang Ninh police and the A05 department dismantled a ring that bought personal data, posed as bank staff, took over VND 110 billion from thousands of victims and laundered 1.24 million USDT.

Confirmed. Diskominfo Badung e-government head I Gusti Agung Angga Mulyanta confirmed on 9 August that two subdomain sites showed abortion drug and online gambling ads and were taken down.

Confirmed. Deputy Transport Minister Siripong Angkasakulkiat said vehicle registration data, including records on the prime minister and ministers, was pulled through the DLT API using credentials of connected agencies, and the DLT cut access for three agencies and filed Computer Crime Act complaints.

Claimed. Search access to the data was sold through Discord bots at 350 baht a day or 2,500 baht a month.

Confirmed. Cyber police said attackers used compromised staff accounts with access rights to pull citizen data from government systems and sold it on the dark web, Telegram and Discord; the Digital Economy Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints, and the cabinet ordered password resets across 300 departments.

Claimed. Domecloud CEO Thanarat Kuawattanaphan said data on more than 500,000 people across about 20 agencies was exposed, mostly through staff passwords stolen by infostealer malware.

Confirmed. Zenith Bank told customers that hackers accessed a limited set of customer data, including email addresses and phone numbers, as part of a wider global attack. It said core systems were not affected.

Claimed. Exfilsquad listed Zenith Bank on its leak site on 26 July.

Confirmed. Zabka confirmed unauthorised access to technical systems through a third-party provider's account, and Digital Affairs Minister Krzysztof Gawkowski said customer and payment data were not affected.

Claimed. Unidentified sellers offered allegedly stolen internal data, including source code and credentials, for 5,000 euros on a cybercrime forum.

Confirmed. A ports spokesperson said the IT system was hacked by an outside actor and the Wilmington, Morehead City and Charlotte sites moved to manual processing.

Confirmed. The pipeline operator said an attack hit its administrative systems while oil transport continued.

Claimed. Leak-site trackers attribute the claim to a ransomware group, with sources differing on which one.

Confirmed. Amgen told the SEC that attackers took proprietary information and patient health data from cloud environments run by outside providers.

Confirmed. The institute said hackers targeted its externally hosted website, which was taken offline for forensic analysis, and that no sensitive data was compromised.

Confirmed. Polda Jatim cyber director Kombes Bimo Ariyanto said police arrested a Demak man, AAK, who hacked 80 school, 20 university, 13 government and 147 private Indonesian sites since 2023 and sold access to promote online gambling.

Confirmed. The state-owned bank said a business email compromise gave unauthorised access to certain data through an employee's email account. It said core banking systems were not accessed and ordered a forensic probe.

Claimed. A threat actor claimed to have published about 1 TB of the bank's data on the dark web.

Confirmed. PNLD confirmed names, organisations and emails of police officers, staff and Ask the Police users were taken and published, and is working with the National Crime Agency.

Claimed. ExfilSquad claimed about 135,000 records, including 114,000 PNLD subscriber records.

Confirmed. TSD said a flaw on its Investor Portal profile page let a logged-in user pull personal and account data of about 200,000 of more than 5 million accounts on 25 and 26 July 2026, and it reported the case to cyber police; the PDPC asked TSD for evidence of PDPA compliance.

Confirmed. Thialf confirmed to RTL Nieuws that it was hit by a cyberattack and was in talks with the criminals.

Claimed. RTL Nieuws attributed the attack to The Gentlemen, which claims internal documents and staff data.

Confirmed. Maxis said a customer's billing and account data was exposed through unauthorised actions by an identified person, and JPDP opened an investigation under Section 130 of the PDPA.

Confirmed. The ministry disclosed that a breach of the academy's online education server, found in February, exposed IDs, names and emails of at least 6,000 people including diplomats abroad.

Confirmed. Origin confirmed an unknown actor exposed customer names, addresses, birth dates and partial payment details, and reported it to the AFP, ACSC and OAIC.

Claimed. An actor calling themselves John Doe claimed data on 2 million customers and threatened to leak it.

Confirmed. Ecopetrol said unauthorized access to its cloud file storage exposed data tied to about 3,300 user accounts and production was not disrupted.

Claimed. The Gentlemen claimed the attack and up to 1 TB of data.

Confirmed. The CCIB arrested a 26-year-old in Phuket on 18 July 2026 who police say manipulated a top-up platform's payment system in June and tried and failed to break into Royal Thai Police systems to erase his arrest warrants.

Confirmed. ICT Cabinet Secretary William Kabogo confirmed the attack and said access to the presidential website was restricted for containment and forensics. He said there was no evidence of sensitive data being accessed or stolen.

Claimed. The defaced homepage showed a bitcoin wallet and demanded 5 BTC, threatening to publish information about President Ruto.

Confirmed. ANCPI called it the most serious technical incident in its history, and DNSC director Dan Cimpean said the attack was financially motivated with limited data exfiltrated.

Claimed. ByteToBreach claimed the attack and advertised the data for sale.

Confirmed. Japan's largest taxi operator said its internal systems suffered unauthorized external access through a malware infection, taking dispatch and booking systems offline.

Claimed. The AiLock group claimed the attack and threatened to leak stolen data.

Confirmed. The college said a ransomware actor accessed files with personal information and disrupted email, online classes and financial aid systems.

Confirmed. SLA said IBM told it of unauthorised access to an IBM-managed development and testing cloud environment that held names, NRIC numbers and property addresses of about 70,000 people; live systems were not affected and SLA notified the PDPC and police.

Confirmed. The council said it thwarted sophisticated cyberattacks on several financial sector entities and kept financial services running.

Confirmed. PKCERT Director General Haider Abbas said a government entity was hit by ransomware the week before. Its data was encrypted and restored from backups.

Confirmed. The Selangor government confirmed a cyberattack on the Flexi Parking system and told councils to suspend summonses, and LITS said an intruder reached a legacy server and caused a 61-hour outage.

Claimed. The attacker claimed access to data on seven million users, which LITS disputes.

Confirmed. The Health Ministry said early findings tied the portal outage to a suspected cyberattack and urged the public to use its verified channels while the site was offline.

Claimed. A group calling itself Mushr00w left a message on the defaced page.

Confirmed. NACSA said several government websites including SKM were hacked through a flaw in a Joomla content editor extension.

Confirmed. NACSA named the Handicraft Development Corporation among government websites hacked through the Joomla content editor flaw.

Confirmed. NACSA named the Women's Development Department among government websites hacked through the Joomla content editor flaw.

Confirmed. Insurance software supplier MIP confirmed attackers used reused staff credentials to reach a support platform and took about 400,000 records tied to some 45 insurers. MIP paid a ransom, and data was published anyway.

Confirmed. AYA Bank said non-financial data from an old application portal was exposed. It said core banking, AYA Pay and cards were not affected.

Claimed. Lapsus$ claimed on 23 June to hold over 120 GB of bank data and demanded a ransom.

Confirmed. Ukrposhta said an enemy cyberattack on its IT systems temporarily disrupted its mobile app.

Claimed. IT Army of Russia claimed on Telegram that it had exfiltrated a user database weeks earlier.

Confirmed. Bajaj Auto told the stock exchanges that ransomware hit IT systems at its subsidiary Bajaj Auto Technology Limited and that it notified CERT-In.

Confirmed. BSSN notified the province of a leak indication found on 22 June and judged the posted sample valid after matching names and phone numbers; the provincial DKISP confirmed the notice and ordered password changes.

Claimed. An actor called B4d0kAhay posted a sample of civil servant names, NIP numbers and positions on a darknet forum, reportedly using infostealer-harvested credentials.

Confirmed. Tata Electronics said it detected a cybersecurity incident on some systems and that its operations were unaffected.

Claimed. World Leaks posted files it said included Apple and Tesla component designs, over 630 GB in total.