Verified breaches and exploited vulnerabilities — in plain English, with the next step that matters.
No panic. No jargon for its own sake. Just the warning signs, the safer move, and what to do if the click already happened.
The latest incidents, newest disclosures first. Each headline opens the full report — what happened, who is affected, how serious it is, and what to do now.
Who Gives A Crap told customers on November 7, 2026 that some customers' personal information was accessed without authorisation in a security incident at one of its marketing-software providers, and that names, email addresses, phone numbers, postal addresses and total spending may have been viewed.
Iris Plaza said on November 5, 2026 that data on about 7.7 million people stored in an external cloud service may have been viewed or taken, including encrypted passwords.
Mirae Asset Securities confirmed on November 7, 2026 that external attacks on its mobile login service and internal groupware on November 4 and 5 leaked account numbers for about 3,800 customers and personal data on 35,255 current and former employees and contractors, including names and employee numbers and, for some, email addresses, mobile numbers and encrypted passwords.
Rohto Pharmaceutical confirmed on November 6, 2026 that unauthorised access to its mail-order telephone and customer management systems leaked the names, addresses and telephone numbers of 2,797,545 customers, and that call recordings for 9,715 customers contained payment card numbers and expiry dates.
Gnosis Pay detected unauthorised access to its legacy consumer card system on November 3, 2026, exposing customer information that its notifications to affected customers list as including full payment card numbers, expiration dates, CVV codes, names, home addresses and cryptocurrency wallet addresses linked to their accounts.
NTT Docomo confirmed on November 5, 2026 that unauthorised access to the Docomo Online Shop and My docomo leaked personal information on up to about 300,000 customers, including names, addresses, dates of birth and phone numbers.
SMBC Consumer Finance announced on November 5, 2026 that unauthorised access to its card-loan guarantee system sent data on up to 320,118 people outside the company, including names, dates of birth, addresses, phone numbers, driver’s licence numbers, employers, annual incomes and guaranteed loan amounts.
The developers of Goddess of Victory: NIKKE confirmed that a third party tampered with the game’s PC launcher scripts and issued a client fix on November 4; independent analysis reported the tampered scripts delivered a remote-access agent able to steal game credentials, browser data and files, with code that could target cryptocurrency wallet data.
Chainalysis said on November 4, 2026 that it had discovered names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 statement that it had found no evidence authentication credentials or session tokens were accessed; a separate on-path attack exposed a subset of customer passwords, and every user must reset their password and rotate API keys as services are restored — follow-up to our October 30 report.
MoneySmart said an unauthorised third party accessed its internal IT systems on October 29 and copied personal data of some customers in Singapore and Hong Kong — names, identification numbers, dates of birth, contact details, income ranges and financial profiles; no affected count has been given.
Binance said in a November 3 incident report that the October 29 theft began in September with a fake job interview that tricked a software engineer into running malicious code, spread to two more wallet-infrastructure employees, and reached its wallet signing service; about $2.85 billion is now frozen or intercepted — follow-up to our October 29 report.
Singapore Airlines said about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer numbers; its own systems were not breached — follow-up to our October 28 report.
Chainstack said an attacker who entered through a third-party component reached a customer account database containing organisation names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which the company is treating as exposed.
GitBook said a sophisticated, highly targeted attack using AI agents gave an attacker access to some of its infrastructure credentials on November 2; integration tokens, Git Sync secrets, API tokens and GitBook Assistant visitor questions may have been accessed, and all personal API tokens were revoked.
mSeven Software said an unauthorised actor acquired an encrypted copy of a database holding information on current and former mSecure users who synced through mSecure Cloud, and told customers to change passwords, reset two-factor authentication and remove passkeys.
Northflank said the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations — follow-up to our October 30 report.
Nojima said unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site, detected on November 1, leaked about 7 million member records: names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses; no card data was held, and affected passwords were force-reset on November 3.
DreamHost said an unauthorised third party exploited a vulnerability in its web-based File Manager and accessed the FTP/SFTP usernames and passwords of users who logged in between about August and October 23, 2026, plus webmail credentials for a limited number of users; formal breach notices were filed from November 2.
Malaysia Airlines said customer information processed through Amadeus between August 2023 and September 2026 may have been affected in the Amadeus breach; it gave no affected count and no list of data types, said its own IT systems were not breached, and said there is no evidence financial information was accessed.
Binance said it has covered about 95% of the roughly $6.3 billion stolen on October 29 and is resuming withdrawals in phases from November 1 across 15 networks, and the FBI attributed the theft to North Korea’s TraderTraitor unit.
Club Tourism said unauthorized access to part of its servers may have leaked personal information of about 4.32 million online members — names, addresses, phone numbers, email addresses and emergency contacts; passwords, passport, credit card and bank account details were not included.
Cathay Pacific said the unauthorised access at Amadeus affected about 53,000 of its bookings from August 2023 to September 2026, covering booking references, passenger names and flight details, with contact details, travel document information and frequent flyer numbers in a smaller subset.
Ryohin Keikaku said unauthorised access to the official MUJI App may have leaked up to about 27.26 million records — email addresses, dates of birth and gender, including former members — while names, addresses, phone numbers and card details were not included.
All Nippon Airways said unauthorised access at Amadeus may have exposed reservation data for about 37,800 customers — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included.
A password for an internal Applebee’s customer database was hidden inside its Android app, giving anyone who extracted it access to names, email addresses, dates of birth, phone numbers and ZIP codes; the flaw is fixed and the company says it has found no evidence of unauthorised access.
Northflank disclosed a security incident on October 30 and told all customers to assume their environment variables had been decrypted and rotate every stored secret immediately, after users reported unauthorised use of AI API keys stored on the platform; no root cause or affected count has been given.
Chainalysis said an external actor using what it calls ‘offensive agentic techniques’ gained unauthorised access to its systems and internal tools in October, and accessed user IDs, full names, email addresses and organisation role labels for platform users; it says investigation content, clear-text passwords, MFA secrets and session tokens were not accessed.
Binance confirmed attackers breached its systems, including a DevOps engineer’s laptop, and drained about $6.3 billion from its wallets in about 20 minutes on October 29; deposits and withdrawals were suspended, about $2.7 billion has been frozen, and the exchange says user funds are safe and all losses will be covered.
A compromised third-party monitoring script hijacked logged-in traders’ sessions on Polymarket.com, liquidated positions and drained crypto assets; Polymarket halted trading for about an hour and promises full reimbursement to affected traders.
Good Smile Company said malicious software on its official online shop’s payment page may have leaked the full card details of about 2,800 customers who entered a card between October 21 and 23, and that partial details for 402,466 saved cards and order information for 7,673 customers may also have been exposed.
The Florida Department of Education said unauthorised criminal access to its Florida Student Financial Aid website may have impacted about 4.9 million people; its FAQ says the compromised information includes Social Security numbers.
Revolve said an unauthorized actor may have obtained, through automated means, the names, contact information, payment card numbers and expiration dates of customers who saved payment information in their online shopping accounts; state notices put the number notified at at least 179,259 people.
Fore Coffee said an unauthorised party accessed its customer-data platform, exposing data from up to 5.7 million customer accounts, including names, contact details, dates of birth, addresses, hashed PINs and purchase history; payment data was not involved.
Japan Airlines and Japan Transocean Air said unauthorised access to Amadeus’s passenger service system left traces suggesting reservation data for about 92,000 customers may have been viewed, including contact details and passport numbers for about 2,000 customers.
Coinbase said a security incident at its analytics vendor Amplitude impacted a small subset of its customers' contact data; a spokesperson said contact and limited transaction data were impacted, with no evidence Coinbase's own systems were accessed and customer funds not impacted.
Daishin Securities said personal and credit information on 38,490 customers was leaked in a hack of a server linked to account openings, including names, email addresses and mobile phone numbers.
TFG London’s October 28 customer email confirmed some personal data was accessed in the October 11 attack on Phase Eight, Hobbs and Whistles — contact and delivery details, order information and, in some cases, the last four digits of a payment card.
Sony Network Communications said unauthorised access to its So-net member database exposed 2,585,481 So-net and plala member records, and that email addresses and passwords for 54,401 email accounts also leaked; it reset those email passwords on October 27.
ENGIE said attackers stole customer data after breaching a marketing platform used by its business partners in France; its internal systems were not compromised and no banking data was affected.
Keystone said its website breach exposed 25,964 buyer records and the WebAuth key used to verify its devices, so it will destroy 18,835 unsold devices, suspend shipments, and direct customers who received a device after October 20 to seek extra verification.
Foundation said attackers compromised its backend and sent phishing emails from its official domains; some messages included customers' mailing addresses or phone numbers, and attackers could access legacy records containing about 5,600 mailing addresses and 5,200 phone numbers.
Mirae Asset Life said a breach of its customer insurance application system and parts of its website leaked customer personal and credit information; how many customers are affected is still under investigation.
Alliance Healthcare Group said a third party gained unauthorised access to Alliance Medinet's membership-database system and compromised personal data of about 110,000 members, including names, personal identification numbers and contact information.
Keystone said a third party obtained customer names, contact details, shipping addresses and order details from its official website store; payment details, recovery phrases and private keys were not involved.
GMO Internet confirmed on October 24 that customer information was taken from its Onamae.com Desktop Cloud service in Japan, after malware was planted on customer servers and saved trading-account logins were misused for unauthorised trades; up to 26,739 servers are in scope and payment data was not stored on the servers.
The University of Copenhagen said hackers gained access to one of its test environments holding a database with information on approximately 525,000 individuals, including full names, national identity (CPR) numbers, work and home telephone numbers and personal email addresses.
Navigate360 said an unauthorized third party accessed one of its systems and obtained copies of data between November 21, 2025 and March 5, 2026; Washoe County School District, summarising the investigation, says the incident involved approximately 8.3 million data records across the United States and Canada.
Capcom said a third party accessed its CAPCOM ID membership service and reached 11,774,247 records worldwide, including email addresses and last-login IP addresses, and changed passwords without authorization on 196 accounts.
Marathon Health said an unauthorised individual posing as an IT worker tricked an employee into disclosing credentials on August 24 and exported information from a cloud application, including names, contact information, dates of birth and Social Security numbers, with medical and health insurance information also reported compromised; notification letters began October 20.
Zeabur said an attacker using leaked internal credentials broke into its shared clusters, dedicated servers and internal systems on October 14-15, 2026 and read its platform database, including 3,218,965 environment-variable records and account data tied to 321,810 accounts.
TeamUpdraft said unauthorised access to teamupdraft.com over October 17-18 led it to believe its customer database was accessed, including connection keys for UpdraftCentral that attackers have since used to install backdoor plugins on connected WordPress sites.
Hollys said unauthorised access to a cloud service holding its membership information leaked about 2.76 million customer records — cumulative member data from 2009 to February 11, 2020, including duplicate members — with member IDs and passwords among the leaked items.
Napoleon Perdis said an unauthorised party had access to customer records held by its third-party provider Retail Express between November 2025 and June 2026, and that about 339,055 customer records were accessed.
The California Department of Education said an unauthorised party used a compromised login credential to copy student files from Educational Testing Service’s file-transfer site between May 22 and September 18, 2026, covering all students enrolled in the three previous school years.
Yamato Transport said about 5.31 million personal information records of users of its Kuroneko deferred payment service had been leaked following unauthorised access to the service’s system.
Nikkei said stolen authentication credentials were used to access a cloud service in the early hours of October 7, 2026, leaking about 1.83 million personal data records.
More Rewards found unauthorised activity on one of its servers on October 13, 2026, and confirmed on October 16 that members’ names and, where provided, addresses, phone numbers, email addresses and dates of birth were accessed.
SourceNext said a third party used an API for retrieving member information to reach its member information management system between October 9 and 13, 2026, potentially exposing up to 22,519,960 member records.
BK Japan said an outside party accessed the system that manages member information for its official app between October 2 and 7, 2026 and took data on about 11.18 million members.
Malware on a contractor’s computer put records for about 8,631,000 customers and 93,000 employees at risk; Daiichi Kosho’s own systems were not breached and no data theft or leak has been confirmed.
ASOS said an unauthorised party impersonated a trusted contact to obtain an employee’s login credentials, then used them to reach customer information held on third-party platforms the retailer uses.
Denmark’s Ministry of Digital Affairs said unauthorised parties misused a legally authorised company’s access to the CPR register, the national population registry; police opened an investigation.
An unauthorised party accessed DriveWealth’s network on September 4–5, 2026 and exfiltrated personal information of people for whom it had opened brokerage accounts.
Bromcom identified an incident involving legacy single sign-on registration functions; it says there is no evidence its school MIS database was accessed and no successful account takeover was identified.
An unauthorised actor downloaded certain files from United Underwriters’ systems on May 1, 2026; after a forensic investigation, notification letters were mailed starting September 21, 2026.
An unauthorised party obtained credentials from a third-party vendor and used them through a limited application interface to download copies of patient personal data for a small number of Veradigm’s customers.
Static snapshot · feed checked November 8, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) tracks flaws attackers are actively using. A CVE number is simply a catalog ID for a known security flaw.
SonicWall SonicOS SSLVPN is the remote sign-in gateway many organisations use to let staff reach work systems. This single-factor authentication flaw may allow a user who already has valid credentials for an alternate sign-in method to bypass SAML authentication controls, and successful exploitation may also bypass the multi-factor authentication (MFA) that SAML was enforcing. CISA added it to the exploited list on November 6.
Apple’s iOS, iPadOS, macOS, Safari, tvOS and watchOS software contains an improper-authentication flaw that could allow an attacker who already has the ability to read and write data on the device to bypass pointer authentication, a protection that helps stop code tampering. CISA added it to the exploited list on November 4.
WordPress Core is the software behind a large share of the world’s websites and blogs. This race-condition flaw in its upgrade process could allow an attacker who is not signed in to execute code on the server during the window while a full-package core upgrade is running, because the upgrade uses predictable, web-accessible staging paths. CISA added it to the exploited list on November 3.
Ivanti Connect Secure is the gateway many organisations use to let staff sign in to work systems remotely. This flaw in how it generates numbers or identifiers could allow an attacker who is already signed in to upload files with attacker-controlled content to a known location on disk, and CISA notes it can be chained with CVE-2026-104935 and CVE-2026-111357. CISA added it to the exploited list on October 30.
Ivanti Connect Secure is the gateway many organisations use to let staff sign in to work systems remotely. This missing-authentication flaw could allow an attacker who is already signed in locally to escalate their privileges, and CISA notes it can be chained with CVE-2026-104935 and CVE-2026-118527. CISA added it to the exploited list on October 30.
See the full vulnerability dashboard →
Source: CRAwatch KEV Atom feed, verified live November 8, 2026 · Canonical catalog: CISA KEV JSON. Confirm the latest status at the source; this page is a dated snapshot.
A preview of the guide library: twenty-three practical defenses, plus the console special report — full library on the Guides page.
In plain English: step-by-step guides that show you exactly how to protect your accounts, your devices, and your inbox — written for people, not engineers.
New to the library? These two defenses never go out of date.
New 60-second briefings every week.
Subscribe on YouTubeEvery major breach and exploited flaw, in plain English, the day it lands. Free — no spam, no selling your data, unsubscribe anytime. Join and take the free Spot the Phish checklist with you.
Select one file — or drop it onto the checker. Your browser calculates its SHA-256 fingerprint here, in small pieces so even a large file won't freeze the tab, then checks only that fingerprint against MalwareBazaar’s database of known malware. Already have a hash? Paste it below instead.
Your file is never uploaded. Only its SHA-256 hash is sent to MalwareBazaar.
Hashing… 0%
Important: a 'not found' result does NOT prove a file is safe. MalwareBazaar only contains known malware samples — new, rare, or modified malware will not appear. Treat any unexpected file as suspicious, even if it is not listed.
Already have the hash? Paste it instead:
This checks one file against known malware. It is not a full computer scan — no website can scan your whole machine.
Choose the kind of information named in your notice. The guide turns a vague warning into an ordered response plan.
Related briefings: account recovery · unique passwords · stronger MFA
Read the situation, make the call, then see the signal that matters. No email address or score is collected.
Speed matters, but panic creates a second mistake. Work the problem in order.
The five red flags to check before you trust an email — free one-page PDF from our first briefing.
Want the warnings before the next one lands in your inbox? Get the Field Briefing — free, plain-English breach alerts the day they land.
Short video briefings, practical reminders in your feed, and one clear roundup in your inbox.
Every major breach and exploited flaw, in plain English, the day it lands. Free — no spam, no selling your data, unsubscribe anytime.
Speed matters. Primary sources, careful labels, and visible corrections matter more.
Named incidents require primary-source support. Unverified reports stay labeled—or stay unpublished.
Read our methodology →Corrections say what changed and when. Older coverage is not silently rewritten to look prescient.
Read the corrections policy →Company notices, regulator filings, CISA entries, and vendor advisories come first. Future password-manager or VPN affiliate links are labeled next to the link and never influence coverage.
Read our sourcing standards →How we verify — our method and sources.
We read everything.