Cybersecurity

Hack attempt knocks FEC filings offline in campaign cash crunch

The shutdown blocks mandatory spending disclosures a week before Election Day as super PACs and dark money groups pour record sums into congressional races.

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

The full Metacurity archive: Every newsletter, searchable and browsable.
Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

Upgrade my subscription

The US Federal Election Commission's website was targeted by a hacker or hackers, according to an email seen by Reuters, disrupting the agency's electronic filing system a week before the November 3 elections.

The hack comes as so-called super PACs and dark money groups spend ‌record sums in the final days of the races. The elections will determine whether Donald Trump's Republicans maintain their majorities in Congress for the next two years.

In a statement, the FEC said, "At this time, the FEC's electronic filing system is currently offline and our IT staff are actively working to restore service." The FEC, which tracks the spending of candidates and political committees, said users could still search the website for past reports. A status message posted by the FEC said its filing system had been down since around 10 p.m. ET on Monday (0200 GMT ⁠Tuesday).

Around 8 p.m. ET on Tuesday (0000 GMT Wednesday), a new status message said the issue "has been identified and a fix is being implemented."

The FEC does not play a role in administering US elections, and the outage should have no effect on voters' ability to cast ballots.

The outage does prevent organizations from filing the FEC's 24-hour and 48-hour spending reports, which show how much political groups and others are spending on specific races."I've never seen this in 26 years," said Steven Mele, president and CEO at political finance compliance firm MBA Consulting Group.

The FEC posted the notice to its website after campaign finance officers could not file mandatory reports late on Monday."We have a bad actor attempting to breach FEC systems. As a result, we’ve had to temporarily shut down our ‌web ⁠facing services," an FEC electronic filings officer said in the email to several campaign compliance firms that night. (Dawn Kopecki and Raphael Satter / Reuters)

Experts at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, recently found that an Israeli ad tech company, which sources now say is Discover-Tech, was heavily targeting users of Starlink's satellite internet service in a likely effort to spy on them.

The researchers concluded Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.

The researchers, who drew on digital advertising data in TrendAI's telemetry for their conclusions, found that Discover-Tech had become one of the world’s leading bidders for ads aimed at Starlink users and that it was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink itself was banned or restricted. Bidding refers to the complex auction system by which advertisers secure space inside people's browsers and apps.

TrendAI released a report on October 15 about ⁠the targeting of Starlink users but did not name Discover-Tech, instead saying the party responsible was “an ad tech entity” which it called “Shadow-Earth-79.” However, six sources said Shadow-Earth-79 is TrendAI’s codename for Discover-Tech.

TrendAI did not directly address questions about why its report did not identify Shadow-Earth-79 by name, saying in a statement that its approach to attribution was aimed at reducing the risk of mistakes and avoiding "hype-driven labels" or "unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions."

The same day that TrendAI published its report on Shadow-Earth-79, Canadian cyber watchdog Citizen Lab and New York advertising technology firm Confiant outed Discover-Tech by name.

Both groups said the Israeli company abused the ad ‌bidding process, which ⁠can leak data about internet users back to the bidder.

Over time, bidders can collect that leaked data, collate it and merge it with other information to de-anonymize users, follow them around the web and, in some cases, set them up for targeting with surveillance software.

Citizen Lab and Confiant said the ads had been shown inside dozens of sensitive networks, opens new tab belonging to media organizations, governments and tech firms, opens new tab.

In response to the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms.

TrendAI's report cited suspicious bidding ⁠patterns that suggested Shadow-Earth-79 was running "targeting and tracking infrastructure rather than a commercial advertising operation."

In addition to noting the "obvious skew" towards buying ads aimed at Starlink users, the report said that Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan and was the No. 2 ad buyer in Afghanistan , even though "the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero." It said the entity won "an implausibly dominant share" of bids in several countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela.

TrendAI ⁠researchers were convinced Discover-Tech was behind the suspicious bidding activity and discussed naming the company in TrendAI's report, according to the six people familiar with the matter. But they eventually dropped the idea of publicly attributing the activity to a named company after TrendAI executives raised legal concerns, five of the sources said. (Raphael Satter / Reuters)

Cyberattacks have hit more South Korean financial firms, with brokerage Daishin Securities reporting a data breach affecting more than 38,000 customers, while cryptocurrency exchange Bithumb and asset manager Mirae Asset Global Investments also confirmed security intrusions.

The incidents extend a weeks-long wave of cyberattacks across the financial industry, raising concerns over security vulnerabilities and prompting the country's financial watchdog to call for stronger defenses.

Daishin Securities said Wednesday that personal and financial information belonging to 38,490 customers was exposed after hackers gained unauthorized access to a server linked to its online account-opening service.

The brokerage said it detected suspicious activity on Oct. 17 and subsequently examined more than 60,000 requests disguised as legitimate service traffic over a 10-day period.

The leaked information included customer names, email addresses, physical addresses, bank names and account numbers, as well as encrypted phone numbers and account details.

Daishin said it had found no evidence of unauthorized access to its core trading systems or further harm to customers so far. The company plans to notify affected customers individually and compensate those who suffer losses under applicable laws.

Bithumb also reported a data breach after detecting unauthorized access Tuesday to its internal mobile groupware system, operated through third-party platform Daou Office.

The exchange said customer assets were unaffected because the compromised system is not used by customers and is physically separated from its trading network. It reported the breach to the Korea Internet and Security Agency and the Personal Information Protection Commission and is investigating whether any customer data was exposed.

Mirae Asset Global Investments separately confirmed unauthorized access to some of its web systems. The asset manager said it blocked the access routes and launched an emergency response after discovering that information from internal business systems had been exposed.

The Korean presidential office was set to hold an emergency meeting Wednesday to discuss responses after hacking attacks on multiple financial firms led to customer data breaches.

Song Ki-ho, vice chief of Cheong Wa Dae's National Security Office, will preside over the meeting, which will be attended by officials from the Financial Services Commission, the presidential office said. (Choi Ji-won / The Korea Herald and Park Boram / Yonhap News Agency)

Sony Network Communications has confirmed a breach exposing 2,585,481 customer records linked to its So-net and plala (S Course) internet services.

The company disclosed the incident on October 27, 2026, after finding unauthorized access to its member database. The exposed information includes contact details, account identifiers, and passwords for selected email services.

According to the official So-net notice, the breach affected 2,141,986 So-net records and 443,495 plala records. These figures reflect customer records, not a verified count of unique individuals. Former subscribers are also affected, widening the impact beyond people still using the services.

The leaked member information includes names, telephone numbers, email addresses, user IDs, dates of birth, gender, and internet connection IDs.

Sony said the breach did not expose passwords associated with the main membership accounts. The compromised data did not include credit card information. (Abinaya / Cyber Security News)

The Ohio Auditor of State's Office's web server was targeted in an overseas cyberattack, Ohio Auditor of State Keith Faber said.

Faber said the attack was carried out by overseas cybercriminals and potentially "foreign state actors."

The cyberthreat was detected and isolated by the state office's monitoring service. The web server and online accounts were taken offline while experts assessed the threat. Faber said state and federal law enforcement have been notified, and his office will work with them to identify those involved in the cyberattack.

Faber provided a list of what officials know so far about the attack. He said it was not a ransomware attack, there is no evidence the attack put Ohioans' personal financial information at risk, and there is no reason to believe the financial information of government entities audited by the office was put at risk either.

Faber noted that payments to the Auditor of State's Office go through a separate portal and that this data is not on the impacted web server.

Additionally, a grace period will be offered to audit clients who may be experiencing issues with online payments as a result of this incident. The state office doesn't work directly with individual Ohioans, so Faber said his office doesn't expect them to take protective measures because of the incident. (News 5 Cleveland)

Related: Cleveland.com, Dysruption Hub

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.

Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.

The PHP security team patched the two flaws on Wednesday, October 21, one day after urging security teams to install the security updates as soon as they became available.

Although details on the PHP2Shell security flaws (including the CVE IDs and mitigation measures shared with critical infrastructure providers) leaked and some proof-of-concept (PoC) exploits were published online before patches went live, the PHP security team said that none were functional.

Multiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them as unsuccessful.

Amazon Threat Intelligence security researchers also said that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released.

CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Thursday, as mandated by Binding Operational Directive 26-04. (Sergiu Gatlan / Bleeping Computer)

Warhorse Studios, the developer behind Kingdom Come: Deliverance and an upcoming RPG set in JRR Tolkien's Middle-earth, has announced it's been targeted in a cyberattack, the results and details of which are yet to come out.

In a post on X, the studio told followers that "We're sorry to share that a cyberattack has hit Warhorse Studios. We're working with cybersecurity specialists to secure our systems and understand the full extent of what happened. Thank you for standing with us."

In a statement to Czech media, studio CEO Martin Frývaldský said (the following is machine-translated)

"This is a serious incident for Warhorse Studios and for everyone affected. Our immediate priority is to secure the systems, determine the full extent of the breach, and take all necessary steps to protect our employees, partners, and our community. We are deploying all necessary capabilities and resources to address this situation."

He did not reveal any more details as to what the purpose of the attack was or what its impact has been.

The most obvious target for hackers would be details on Warhorse's two currently announced upcoming games: a Lord of the Rings RPG and a new Kingdom Come adventure. (Joshua Wolens / PC Gamer)

The US Justice Department said it disrupted a Madagascar-based scam operation that allegedly stole hundreds of thousands from Americans through fictitious NFT investment schemes.

Prosecutors announced indictments of Malaysian national Chui Kok Wa and five others for their role in stealing more than $516,695 from 74 cryptocurrency wallets associated with victims in Maryland, Oregon, Nevada, Minnesota and other states.

The indictment said Wa worked with accomplices in China in coordinating and funding the scheme, which allegedly moved to Madagascar last year after law enforcement takedowns in Cambodia.

An FBI unit went to Madagascar in August and gained access to more than 3,000 devices, prosecutors said. The sting revealed the detailed inner workings of the operation and provided concrete links between incident reports filed by victims in the US and scammers conducting the scheme from compounds in the country’s capital, Antananarivo.

The Justice Department noted that during the trip, its officers went to 13 scam compounds with the Madagascar National Police (MNP) but were “stymied” when they tried to interview suspects.

“Madagascar repatriated to China numerous suspects before the investigation was complete,” the Justice Department said. The US has “called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar.”

The indictment adds that Madagascar law enforcement agencies arrested 400 people, including 40 Chinese leaders of the operation. But the FBI was not allowed to interview the leaders before they were repatriated to China or released. (Jonathan Greig / The Record)

The ransomware group SETTRA was behind the cyberattack on Colmobil, Israel’s largest vehicle importer, Calcalist can now reveal, exactly two weeks after the attack was first reported.

Two weeks ago, Calcalist reported that Colmobil had notified its business partners of a security incident. The notice stated: “A few hours ago, a cybersecurity incident was identified by the company’s technology team. The company had prepared for such an event; it is currently investigating the source of the incident with the help of dedicated teams and has notified the relevant regulatory authorities. The situation is being managed, and the company is working to resolve it as quickly as possible.”

Sources familiar with the Colmobil incident said SETTRA threatened to publish the importer’s customers’ personal details online unless a ransom was paid. Colmobil declined to comment on whether it had paid the ransom. (Tomer Hadar / CTech)

Related: CTech

Researchers at Sansec report that a credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.

The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms.

Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales.

Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr.

Sansec suspects the attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access. However, this hasn’t been confirmed.

After gaining access, the attackers injected malicious code into a legitimate Plausible analytics tracker hosted on Convertr’s infrastructure, which loads on the checkout pages of all merchants using the platform. (Bill Toulas / Bleeping Computer)

Related: Sansec

The Magecart attack chain. Source: Sansec

Japanese internet service provider GMO Internet Group Inc said it will offer a reward of up to $1 million for information leading to the identification of hackers involved in unauthorized access to its foreign exchange trading service.

The company said it will accept information in Japanese, English or Chinese under its "GMO Cybercrime Bounty" program from noon Wednesday until the perpetrators are arrested.

GMO also said it will pay up to 3 million yen to victims whose personal information is confirmed to have been exposed in the hack.

A hacker believed to be behind the unauthorized intrusion disclosed some customer information earlier Tuesday after threatening to do so, cybersecurity sources said.

A statement from the hacker claimed information linked to one GMO customer had been posted online after the company failed to respond to a $1 million ransom request, the sources said.

The information included the name, address, and other personal information, though its authenticity was unclear.

The statement also warned that personal data of customers would be released daily. GMO has urged people not to view the information, saying that hackers could obtain access records and other data in the process.

GMO said late Monday that the hacker had threatened to disclose customer information and conduct a ransomware attack at noon. Prior to noon, GMO had called on users to back up data and unplug their computers. (Kyodo News)

Related: Finance Magnates, NHK, Japan Wire

Almost 2,000 customers of Hong Kong Airlines and two electronic appliance retailers received fraudulent calls after their personal information was leaked by the companies, the city’s privacy watchdog has found.

The Office of the Privacy Commissioner for Personal Data (PCPD) said on Monday that it had received more than 40 inquiries and complaints linked to the suspected data leaks involving Hong Kong Airlines and the electronic appliance retailers Yoho and Broadway Lifestyle.

The office said it was first notified by Hong Kong Airlines of the data breach on October 2. Preliminary findings showed 815 passengers departing between September 29 and October 22 received suspected scam calls, with leaked data including passenger names, phone numbers, flight dates, flight numbers and travel routes.

Yoho submitted a separate notification earlier this month.

Initial inquiries revealed that 790 customers who placed orders with Yoho between September 29 and October 12 had received fraudulent calls, with compromised details potentially including names, contact numbers, delivery addresses, order IDs and purchase records, the watchdog said. (Vivian Au / South China Morning Post)

Defense Minister Shinjiro Koizumi and US Defense Secretary Pete Hegseth on Wednesday agreed to boost cooperation to help prevent cyberattacks, as Japan continues to reel from a spate of almost daily incidents.

Koizumi met Hegseth on the sidelines of an Association of Southeast Asian Nations (ASEAN) defense chiefs’ summit shortly after arriving at the venue on the Philippine island of Cebu. (Jesse Johnson / Japan Times)

Related: Japan Wire

South Carolina Governor Henry McMaster joined Sean Cairncross, the White House National Cyber Director, to announce Project Lifeline 250, a pilot program designed to strengthen cybersecurity at rural hospitals across South Carolina.

The announcement comes as healthcare systems continue to face growing cyber threats. State leaders pointed to recent incidents, including the cyberattack on AnMed and last week’s data breach involving Quest Diagnostics, as examples of the risks facing healthcare providers.

“A rural hospital should be able to serve a small community without having to face a global cyberattack alone,” said Chris Klomp, chief counsel for the US Department of Health and Human Services.

Healthcare facilities increasingly depend on technology to manage everything from patient records to critical care equipment, making cybersecurity an essential part of day-to-day operations.

“Together we are unleashing meaningful solutions to protect the networks and systems that are vital to delivering care to Americans in rural communities,” Cairncross said.

South Carolina is the first state selected to launch Project Lifeline 250, a White House-backed initiative that will connect participating rural hospitals with cybersecurity experts and technology companies at no cost. The program is designed to identify vulnerabilities, strengthen hospital networks, and improve their ability to respond to cyber threats. (Stephen Biddix / WISTV)

The National Institute of Standards and Technology (NIST) has issued its final technical transition roadmap, NIST IR 8547: “Transition to Post-Quantum Cryptography Standards."

Authored by the Computer Security Division‘s leadership team—Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson, and David Cooper—the milestone document provides federal agencies, commercial enterprises, and global standard-setting bodies with the official blueprint and deprecation timeline for phasing out classical public-key cryptography.

The report operationalizes the requirements of White House Executive Order 14412 and OMB Memorandum M-26-15. Under this policy framework, federal High Value Assets (HVAs) and high-impact systems face accelerated, binding deadlines: complete transition to post-quantum cryptography (PQC) for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. Across the broader IT ecosystem, NIST officially confirms that classical, quantum-vulnerable public-key algorithms will be deprecated after 2030 and completely disallowed after 2035. (Quantum Computing Report)

Upwind Security, a San Francisco-based startup offering cybersecurity for artificial intelligence and cloud applications, has secured $400 million in a Series C round that values the company at $3.8 billion.

Bessemer Venture Partners led the investment, with participation from existing backers including Greylock Partners and Craft Ventures, Upwind told Bloomberg News. (Marissa Newman / Bloomberg)

Related: Upwind, Quartz

Infisical, a San Francisco, CA-based provider of a security infrastructure platform for developers, machines, and AI agents, raised $40m in Series B funding at a $600m valuation.

The round was led by Elad Gil, with participation from Gradient and Y Combinator. (FinSMEs)

Overwatch Data, an AI-native threat intelligence and risk operations firm, has closed a $15m Series A to help cyber, fraud, and risk teams respond to the growing volume of AI-driven attacks.

Mouro Capital led the investment. Visa Ventures and Capital One Ventures joined as strategic backers, and PruVen Capital and New Era Capital Partners returned with follow-on investments. (FinTech Global)

Related: InfoTechLead, Alleywatch

Best Thing of the Day: Nailing Down the Doomsday Scenarios

Senator Elizabeth Warren (D-MA) said in a letter to Anthropic Chief Executive Dario Amodei that the risks posed by his company’s AI technology “demand greater scrutiny before they become intertwined with the public capital markets, which could further escalate both public safety and systemic financial risks.”

Worst Thing of the Day: The Worst Government Agency in the World Is Spying on Us

Attorneys for 15 Minnesota residents facing federal conspiracy charges have obtained evidence of a sweeping, possibly unconstitutional spying operation carried out by Immigration and Customs Enforcement against left-wing social movements in Minnesota and beyond

Hack attempt knocks FEC filings offline in campaign cash crunch

The US Federal Election Commission's website was targeted by a hacker or hackers, according to an email seen by Reuters, disrupting the agency's electronic filing system a week before the November 3 elections.

Experts at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, recently found that an Israeli ad tech company, which sources now say is Discover-Tech, was heavily targeting users of Starlink's satellite internet service in a likely effort to spy on them.

Cyberattacks have hit more South Korean financial firms, with brokerage Daishin Securities reporting a data breach affecting more than 38,000 customers, while cryptocurrency exchange Bithumb and asset manager Mirae Asset Global Investments also confirmed security intrusions.

Sony Network Communications has confirmed a breach exposing 2,585,481 customer records linked to its So-net and plala (S Course) internet services.

The Ohio Auditor of State's Office's web server was targeted in an overseas cyberattack, Ohio Auditor of State Keith Faber said.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.

Warhorse Studios, the developer behind Kingdom Come: Deliverance and an upcoming RPG set in JRR Tolkien's Middle-earth, has announced it's been targeted in a cyberattack, the results and details of which are yet to come out.

The US Justice Department said it disrupted a Madagascar-based scam operation that allegedly stole hundreds of thousands from Americans through fictitious NFT investment schemes.

The ransomware group SETTRA was behind the cyberattack on Colmobil, Israel’s largest vehicle importer, Calcalist can now reveal, exactly two weeks after the attack was first reported.

Researchers at Sansec report that a credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.

Japanese internet service provider GMO Internet Group Inc said it will offer a reward of up to $1 million for information leading to the identification of hackers involved in unauthorized access to its foreign exchange trading service.

Almost 2,000 customers of Hong Kong Airlines and two electronic appliance retailers received fraudulent calls after their personal information was leaked by the companies, the city’s privacy watchdog has found.

Defense Minister Shinjiro Koizumi and US Defense Secretary Pete Hegseth on Wednesday agreed to boost cooperation to help prevent cyberattacks, as Japan continues to reel from a spate of almost daily incidents.

South Carolina Governor Henry McMaster joined Sean Cairncross, the White House National Cyber Director, to announce Project Lifeline 250, a pilot program designed to strengthen cybersecurity at rural hospitals across South Carolina.

The National Institute of Standards and Technology (NIST) has issued its final technical transition roadmap, NIST IR 8547: “Transition to Post-Quantum Cryptography Standards."

Upwind Security, a San Francisco-based startup offering cybersecurity for artificial intelligence and cloud applications, has secured $400 million in a Series C round that values the company at $3.8 billion.

Infisical, a San Francisco, CA-based provider of a security infrastructure platform for developers, machines, and AI agents, raised $40m in Series B funding at a $600m valuation.

Overwatch Data, an AI-native threat intelligence and risk operations firm, has closed a $15m Series A to help cyber, fraud, and risk teams respond to the growing volume of AI-driven attacks.

Best Thing of the Day: Nailing Down the Doomsday Scenarios

Worst Thing of the Day: The Worst Government Agency in the World Is Spying on Us

Closing Thought

Read more

Anthropic’s IPO filing reveals security failures alongside warnings of runaway AI

OpenAI cuts off internet access for top models' training following containment failures

AI surveillance, security lapses, dark web sleuthing, and foreign influence: Best infosec long reads 10/24/26

Banks scramble to keep uncontrolled AI agents out of customer accounts

The US Federal Election Commission's website was targeted by a hacker or hackers, according to an email seen by Reuters, disrupting the agency's electronic filing system a week before the November 3 elections.

Experts at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, recently found that an Israeli ad tech company, which sources now say is Discover-Tech, was heavily targeting users of ​Starlink's satellite internet service in a likely effort to spy on them.

Cyberattacks have hit more South Korean financial firms, with brokerage Daishin Securities reporting a data breach affecting more than 38,000 customers, while cryptocurrency exchange Bithumb and asset manager Mirae Asset Global Investments also confirmed security intrusions.

Sony Network Communications has confirmed a breach exposing 2,585,481 customer records linked to its So-net and plala (S Course) internet services.

The Ohio Auditor of State's Office's web server was targeted in an overseas cyberattack, Ohio Auditor of State Keith Faber said.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.

Warhorse Studios, the developer behind Kingdom Come: Deliverance and an upcoming RPG set in JRR Tolkien's Middle-earth, has announced it's been targeted in a cyberattack, the results and details of which are yet to come out.

The US Justice Department said it disrupted a Madagascar-based scam operation that allegedly stole hundreds of thousands from Americans through fictitious NFT investment schemes.

The ransomware group SETTRA was behind the cyberattack on Colmobil, Israel’s largest vehicle importer, Calcalist can now reveal, exactly two weeks after the attack was first reported.

Researchers at Sansec report that a credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout.

Japanese internet service provider GMO Internet Group Inc said it will offer a reward of up to $1 million for information leading to the identification of hackers involved in unauthorized access to its foreign exchange trading service.

Almost 2,000 customers of Hong Kong Airlines and two electronic appliance retailers received fraudulent calls after their personal information was leaked by the companies, the city’s privacy watchdog has found.

Defense Minister Shinjiro Koizumi and US Defense Secretary Pete Hegseth on Wednesday agreed to boost cooperation to help prevent cyberattacks, as Japan continues to reel from a spate of almost daily incidents.

South Carolina Governor Henry McMaster joined Sean Cairncross, the White House National Cyber Director, to announce Project Lifeline 250, a pilot program designed to strengthen cybersecurity at rural hospitals across South Carolina.

The National Institute of Standards and Technology (NIST) has issued its final technical transition roadmap, NIST IR 8547: “Transition to Post-Quantum Cryptography Standards."

Upwind Security, a San Francisco-based startup offering cybersecurity for artificial intelligence and cloud applications, has secured $400 million in a Series C round that values the company at $3.8 billion.

Infisical, a San Francisco, CA-based provider of a security infrastructure platform for developers, machines, and AI agents, raised $40m in Series B funding at a $600m valuation.

Overwatch Data, an AI-native threat intelligence and risk operations firm, has closed a $15m Series A to help cyber, fraud, and risk teams respond to the growing volume of AI-driven attacks.

Best Thing of the Day: Nailing Down the Doomsday Scenarios

Worst Thing of the Day: The Worst Government Agency in the World Is Spying on Us

Closing Thought

Read more

Anthropic’s IPO filing reveals security failures alongside warnings of runaway AI

OpenAI cuts off internet access for top models' training following containment failures

AI surveillance, security lapses, dark web sleuthing, and foreign influence: Best infosec long reads 10/24/26

Banks scramble to keep uncontrolled AI agents out of customer accounts

Experts at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, recently found that an Israeli ad tech company, which sources now say is Discover-Tech, was heavily targeting users of Starlink's satellite internet service in a likely effort to spy on them.