https://red-flag-cyber-site.andrewdpeat.workers.dev/ Plain-language cybersecurity briefings and verified breach reports from the Red Flag Cyber research desk. en-us Sun, 08 Nov 2026 00:00:00 GMT https://red-flag-cyber-site.andrewdpeat.workers.dev/news/who-gives-a-crap https://red-flag-cyber-site.andrewdpeat.workers.dev/news/who-gives-a-crap Sat, 07 Nov 2026 00:00:00 GMT Who Gives A Crap told customers on November 7, 2026 that some customers' personal information was accessed without authorisation in a security incident at one of its marketing-software providers, and that names, email addresses, phone numbers, postal addresses and total spending may have been viewed. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/mirae-asset-securities https://red-flag-cyber-site.andrewdpeat.workers.dev/news/mirae-asset-securities Sat, 07 Nov 2026 00:00:00 GMT Mirae Asset Securities confirmed on November 7, 2026 that external attacks on its mobile login service and internal groupware on November 4 and 5 leaked account numbers for about 3,800 customers and personal data on 35,255 current and former employees and contractors, including names and employee numbers and, for some, email addresses, mobile numbers and encrypted passwords. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/rohto https://red-flag-cyber-site.andrewdpeat.workers.dev/news/rohto Fri, 06 Nov 2026 00:00:00 GMT Rohto Pharmaceutical confirmed on November 6, 2026 that unauthorised access to its mail-order telephone and customer management systems leaked the names, addresses and telephone numbers of 2,797,545 customers, and that call recordings for 9,715 customers contained payment card numbers and expiry dates. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/gnosis-pay https://red-flag-cyber-site.andrewdpeat.workers.dev/news/gnosis-pay Fri, 06 Nov 2026 00:00:00 GMT Gnosis Pay detected unauthorised access to its legacy consumer card system on November 3, 2026, exposing customer information that its notifications to affected customers list as including full payment card numbers, expiration dates, CVV codes, names, home addresses and cryptocurrency wallet addresses linked to their accounts. https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/backup-codes https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/backup-codes Fri, 06 Nov 2026 00:00:00 GMT Lost your phone? Backup codes are one-time codes for the second sign-in step. Print a copy, store it somewhere safe offline, and never share it. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/ntt-docomo https://red-flag-cyber-site.andrewdpeat.workers.dev/news/ntt-docomo Thu, 05 Nov 2026 00:00:00 GMT NTT Docomo confirmed on November 5, 2026 that unauthorised access to the Docomo Online Shop and My docomo leaked personal information on up to about 300,000 customers, including names, addresses, dates of birth and phone numbers; whether payment card details were also leaked is still under investigation. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/smbc-consumer-finance https://red-flag-cyber-site.andrewdpeat.workers.dev/news/smbc-consumer-finance Thu, 05 Nov 2026 00:00:00 GMT SMBC Consumer Finance announced on November 5, 2026 that unauthorised access to its card-loan guarantee system sent data on up to 320,118 people outside the company, including names, dates of birth, addresses, phone numbers, driver's licence numbers, employers, annual incomes and guaranteed loan amounts. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/iris-plaza https://red-flag-cyber-site.andrewdpeat.workers.dev/news/iris-plaza Thu, 05 Nov 2026 00:00:00 GMT Iris Plaza, Iris Ohyama's online store, said on November 5, 2026 that personal information on about 7.7 million people — about 5.8 million members and former members and about 1.9 million non-members — may have been viewed or taken from an external cloud service it uses, including names, addresses, phone numbers, email addresses, dates of birth and encrypted passwords; credit card information was not stored in that service. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/nikke-launcher https://red-flag-cyber-site.andrewdpeat.workers.dev/news/nikke-launcher Wed, 04 Nov 2026 00:00:00 GMT The developers of Goddess of Victory: NIKKE confirmed on November 4, 2026 that a third party tampered with the game's PC launcher scripts, and issued a client fix at about 02:30 (UTC+9) that day; independent analysis reported by BleepingComputer says the tampered scripts delivered a remote-access agent able to steal game credentials, browser data and files, with code that could target cryptocurrency wallet data — the scope of impact is still under investigation. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/chainalysis-credentials-update https://red-flag-cyber-site.andrewdpeat.workers.dev/news/chainalysis-credentials-update Wed, 04 Nov 2026 00:00:00 GMT Chainalysis said on November 4, 2026 that it had discovered names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 statement that it had found no evidence authentication credentials or session tokens were accessed; a separate on-path attack exposed a subset of customer passwords, and every user must reset their password and rotate API keys as services are restored. https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/voice-clone-family-emergency https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/voice-clone-family-emergency Wed, 04 Nov 2026 00:00:00 GMT A call that sounds exactly like family may be an AI voice clone. Hang up, call back on a number you know, and verify before you pay anything. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/singapore-airlines-amadeus https://red-flag-cyber-site.andrewdpeat.workers.dev/news/singapore-airlines-amadeus Tue, 03 Nov 2026 00:00:00 GMT Singapore Airlines said on November 3, 2026 that about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer membership numbers; its own IT systems were not breached, and Amadeus confirmed bank and card information was not leaked and no bookings were modified. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/chainstack https://red-flag-cyber-site.andrewdpeat.workers.dev/news/chainstack Tue, 03 Nov 2026 00:00:00 GMT Chainstack said on November 3, 2026 that an attacker who entered through a third-party component reached a customer account database containing organisation names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which the company is treating as exposed; it says the incident was part of a broader AI-powered attack campaign reported in late October. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/gitbook https://red-flag-cyber-site.andrewdpeat.workers.dev/news/gitbook Tue, 03 Nov 2026 00:00:00 GMT GitBook said on November 3, 2026 that a sophisticated, highly targeted attack using AI agents gave an attacker access to some of its infrastructure credentials on November 2; integration tokens, Git Sync secrets, API tokens and questions visitors sent to GitBook Assistant may have been accessed, the company found no evidence hosted content was modified, and it revoked all personal API tokens and told customers to rotate their credentials. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/msecure https://red-flag-cyber-site.andrewdpeat.workers.dev/news/msecure Tue, 03 Nov 2026 00:00:00 GMT mSeven Software warned current and former mSecure customers on November 3, 2026 that an unauthorised actor had acquired an encrypted copy of a database of mSecure Cloud users; the company reports no evidence the encrypted contents were accessed and has given no affected count. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance-interview-update https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance-interview-update Tue, 03 Nov 2026 00:00:00 GMT Binance said in an incident report published November 3, 2026 that the October 29 theft began with a fake job interview that tricked a software engineer into running malicious code, that the attackers then compromised two more wallet-infrastructure employees and reached its wallet signing service, and that about $2.85 billion of the stolen assets had been frozen or intercepted as of November 3, with 98% of impacted token assets replenished as of October 31. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/moneysmart https://red-flag-cyber-site.andrewdpeat.workers.dev/news/moneysmart Tue, 03 Nov 2026 00:00:00 GMT MoneySmart said on November 3, 2026 that an unauthorised third party accessed its internal IT systems on October 29 and copied personal data of some customers in Singapore and Hong Kong, including names, identification numbers, dates of birth, contact details and financial profiles; no affected count has been given. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/nojima https://red-flag-cyber-site.andrewdpeat.workers.dev/news/nojima Mon, 02 Nov 2026 00:00:00 GMT Nojima said in a notice dated November 2, 2026 that unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site leaked about 7 million member records: names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses; no credit card data was held on either site, and on November 3 the company forced a password reset for customers it suspects are affected. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/dreamhost https://red-flag-cyber-site.andrewdpeat.workers.dev/news/dreamhost Mon, 02 Nov 2026 00:00:00 GMT DreamHost said an unauthorised third party exploited a vulnerability in its web-based File Manager and accessed the FTP/SFTP usernames and passwords of users who logged in between about August 2026 and October 23, 2026, plus the webmail credentials of a limited number of users; formal breach notices filed with the California Attorney General were listed on November 2, 2026, and the company says the incident affected well under about 10% of its hosted email and FTP/SFTP accounts. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/northflank-update https://red-flag-cyber-site.andrewdpeat.workers.dev/news/northflank-update Mon, 02 Nov 2026 00:00:00 GMT Northflank said in a November 2, 2026 update that the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained in its systems or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations; the root cause is still to come. https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/payroll-email-quiz https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/payroll-email-quiz Mon, 02 Nov 2026 00:00:00 GMT A direct-deposit update you never asked for can be a phish. Count the four flags, skip the button, and contact payroll through a channel you know is real. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/malaysia-airlines-amadeus https://red-flag-cyber-site.andrewdpeat.workers.dev/news/malaysia-airlines-amadeus Sun, 01 Nov 2026 00:00:00 GMT Malaysia Airlines said on November 1, 2026 that customer information processed through its reservation provider Amadeus between August 2023 and September 2026 may have been affected by the Amadeus cybersecurity incident; the airline gave no affected count and no list of data types, said its own IT systems were not breached, and said there is no evidence financial information was accessed. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance-withdrawals-update https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance-withdrawals-update Sun, 01 Nov 2026 00:00:00 GMT Binance said on November 1, 2026 that it has covered about 95% of the roughly $6.3 billion stolen on October 29, that phase-one withdrawals resume on November 1 across 15 networks, and that the FBI has attributed the theft to North Korea's TraderTraitor unit. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/club-tourism https://red-flag-cyber-site.andrewdpeat.workers.dev/news/club-tourism Sat, 31 Oct 2026 00:00:00 GMT Club Tourism announced on October 31, 2026 that unauthorized access to part of its servers may have leaked personal information of about 4.32 million online members — names, nationality, gender, date of birth and age, addresses, phone numbers, email addresses, member IDs and emergency contacts; login passwords, passport, credit card and bank account details were not included, the company said. https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/router-default-password https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/router-default-password Sat, 31 Oct 2026 00:00:00 GMT Your router's default admin password is public. Change it, update the firmware, use WPA3 or WPA2, and turn off remote management. https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/password-reset-quiz https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/password-reset-quiz Sat, 31 Oct 2026 00:00:00 GMT A password reset email you never asked for can be a phish. Check the sender, spot the urgency and generic greeting, and go to the service yourself. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/chainalysis https://red-flag-cyber-site.andrewdpeat.workers.dev/news/chainalysis Fri, 30 Oct 2026 00:00:00 GMT Chainalysis said on October 30, 2026 that an external actor using what it calls 'offensive agentic techniques' gained unauthorised access to its systems and internal tools, and accessed user IDs, full names, email addresses and organisation role labels for users of its platform; the company says it has found no evidence that investigation content, clear-text passwords, MFA secrets or session tokens were accessed, and it has given no count of affected customers. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/cathay-pacific-amadeus https://red-flag-cyber-site.andrewdpeat.workers.dev/news/cathay-pacific-amadeus Fri, 30 Oct 2026 00:00:00 GMT Cathay Pacific said on October 30, 2026 that the breach at its third-party provider Amadeus affected about 53,000 bookings: booking references, passenger names and flight details in most cases, with email addresses, phone numbers, travel document information and frequent flyer numbers in a smaller subset; the airline says there is no evidence financial or payment information was accessed. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/muji-app https://red-flag-cyber-site.andrewdpeat.workers.dev/news/muji-app Fri, 30 Oct 2026 00:00:00 GMT Ryohin Keikaku announced on October 30, 2026 that unauthorised access to the official MUJI App may have leaked up to about 27.26 million records — email addresses, dates of birth and gender, including former members — and warned customers to watch for spoofing emails; names, addresses, phone numbers and card details were not included. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/ana-amadeus https://red-flag-cyber-site.andrewdpeat.workers.dev/news/ana-amadeus Fri, 30 Oct 2026 00:00:00 GMT All Nippon Airways said in an updated notice on October 30, 2026 that unauthorised access at Amadeus may have exposed reservation data for about 37,800 customers — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/applebees-app https://red-flag-cyber-site.andrewdpeat.workers.dev/news/applebees-app Fri, 30 Oct 2026 00:00:00 GMT TechCrunch reported on October 30, 2026 that a password for an internal Applebee's customer database was hidden inside its Android app, giving anyone who extracted it access to names, email addresses, dates of birth, phone numbers and ZIP codes; the flaw is fixed and the company says it has found no evidence of unauthorised access. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/northflank https://red-flag-cyber-site.andrewdpeat.workers.dev/news/northflank Fri, 30 Oct 2026 00:00:00 GMT Northflank disclosed a security incident on October 30, 2026 and told every customer to assume their environment variables had been decrypted and rotate all stored secrets immediately, after users reported unauthorised use of AI API keys stored on the platform; the company has given no root cause and no affected count. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance Thu, 29 Oct 2026 00:00:00 GMT Binance confirmed on October 29, 2026 that attackers drained about $6.3 billion in cryptocurrency from its wallets in about 20 minutes after breaching its systems, including a DevOps engineer’s laptop; the exchange suspended deposits and withdrawals, says user funds are safe and that it will cover all losses, and about $2.7 billion of the stolen assets have been frozen. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/polymarket https://red-flag-cyber-site.andrewdpeat.workers.dev/news/polymarket Thu, 29 Oct 2026 00:00:00 GMT Polymarket confirmed on October 29, 2026 that a compromised third-party provider’s script drained cryptocurrency and prediction-market holdings from logged-in users of its international platform; trading was halted for about an hour, the company says affected traders will be fully reimbursed, and researchers traced about $2.5 million to a suspected attacker wallet. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/good-smile https://red-flag-cyber-site.andrewdpeat.workers.dev/news/good-smile Thu, 29 Oct 2026 00:00:00 GMT Good Smile Company said in its October 29, 2026 third update that malicious software on its online shop’s payment page may have leaked the full card details — name, 16-digit number, expiry date and security code — of about 2,800 customers, that last-four digits and expiry dates for 402,466 saved cards may also have been exposed, and that order details for 7,673 customers are treated as potentially affected. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/florida-student-aid https://red-flag-cyber-site.andrewdpeat.workers.dev/news/florida-student-aid Thu, 29 Oct 2026 00:00:00 GMT The Florida Department of Education announced on October 29, 2026 that unauthorised criminal access to its Florida Student Financial Aid website may have impacted about 4.9 million people; its FAQ says the compromised information includes Social Security numbers, and it urges users to monitor accounts and consider a fraud alert or credit freeze. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/revolve https://red-flag-cyber-site.andrewdpeat.workers.dev/news/revolve Thu, 29 Oct 2026 00:00:00 GMT Revolve disclosed in an SEC filing dated October 29, 2026 that an unauthorized actor may have obtained, through automated means, the names, contact information, payment card numbers and expiration dates of customers who saved payment information in their online shopping accounts; state attorney-general notices put the number notified at at least 179,259 people, SecurityWeek reported on November 2, 2026. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/fore-coffee https://red-flag-cyber-site.andrewdpeat.workers.dev/news/fore-coffee Wed, 28 Oct 2026 00:00:00 GMT Fore Coffee disclosed on October 28, 2026 that an unauthorised party accessed its customer-data platform, exposing data from up to 5.7 million customer accounts, including names, contact details, dates of birth, addresses, hashed PINs and purchase history; payment data was not involved, and the company asks customers to change their app PIN. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/japan-airlines-amadeus https://red-flag-cyber-site.andrewdpeat.workers.dev/news/japan-airlines-amadeus Wed, 28 Oct 2026 00:00:00 GMT Japan Airlines and Japan Transocean Air said on October 28, 2026 that unauthorised access to Amadeus’s passenger service system left traces suggesting reservation data for about 92,000 customers may have been viewed, including contact details and passport numbers for about 2,000; credit card numbers and passwords were not compromised and flight operations were not affected. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/coinbase-amplitude https://red-flag-cyber-site.andrewdpeat.workers.dev/news/coinbase-amplitude Wed, 28 Oct 2026 00:00:00 GMT Coinbase said on October 28, 2026 that a security incident at its analytics vendor Amplitude exposed contact and limited transaction data for a small subset of its customers; it found no evidence its own systems were accessed, said customer funds were not impacted, and is notifying affected customers.