October 2026 cyberattack timeline MetaMask - Security incident reported, full impact unclear - Oct 1, reported. TensorLake npm - Malicious package targeted developer credentials - Oct 7-8. South Korean banks - AI-assisted attacks reportedly compromised customer information - Reported Oct 8. IDCF Cloud - Ransomware attack affected cloud infrastructure - Oct 7-8. ASOS - Data-security incident involving claims of stolen customer information - Reported Oct 6. FBI recruitment system - Personal information linked to employees reportedly exposed - Reported Oct 6. PwnEscape - Linux KVM vulnerability potentially enabled virtual-machine escape - Oct 14, reported. Nikkei - Data breach reportedly exposed personal-information records - Disclosed Oct 16. Intermarché - Hackers reportedly manipulated supermarket refrigeration controls - Reported Oct 12. UpdraftCentral - Attackers reportedly abused access to connected WordPress sites - Oct 17-19, reported. PHP2Shell - Critical PHP vulnerabilities enabled potential unauthenticated remote code execution - Oct 17-21, reported. eMudhra - Weak certificate-authority keys threatened digital certificate security - Oct 17-22, reported. OVHcloud CLI - Compromised software distribution reportedly spread credential-stealing malware - Reported Oct 19. Rank Math PRO - Compromised plugin download reportedly introduced a backdoor risk - Reported Oct 19-20. AOMEI Backupper - Compromised update mechanism reportedly distributed a backdoor - Disclosed Oct 19; attack occurred earlier. AI-assisted corporate attacks - Deere, SharkNinja and Cummins appeared in reporting about a hacking campaign - Reported Oct 19-21. Onamae(dot)com Desktop Cloud - Unauthorized access and malicious programs reportedly affected customer servers - Disclosed Oct 20. Zeabur - Breach reportedly exposed account information and environment-variable records - Reported Oct 20-22. SBI - Customer information associated with 3,897 records reportedly exposed - Reported Oct 21. Railway - Unauthorized access potentially exposed environment variables, API keys, database credentials and other secrets - Disclosed Oct 21; response ongoing. LiteLLM - Compromised software release reportedly distributed credential-stealing malware - Reported Oct 21. ConnectWise Cloud Backup - Storm-0940 intrusions raised concerns about unauthorized access to cloud environments - Reported Oct 21. OpenRouter - Possible exposure was discussed in connection with a broader campaign; a separate confirmed breach was not established - Reported Oct 21-22. Citizens Bank - Third-party security incident reportedly exposed customer records - October, exact date not confirmed. World Acceptance - Reported data breach potentially exposed personal information of approximately 232,000 people - October, exact date not confirmed. Indian NBFCs and payment providers - Attackers stole payment API credentials and attempted unauthorized fund transfers - Oct 9, CERT-In advisory. Indian Railways - Alleged customer-data exposure; a specific confirmed breach and incident date could not be verified - Excluded from confirmed timeline. Renfe - Reported unauthorized access potentially exposed ticketing-related personal data - Incident reportedly began Sept 24; October disclosure date not independently confirmed. BeyondTrust Remote Support - Attackers exploited an authentication-bypass vulnerability to perform unauthorized file operations - Oct 9-16, based on patch and public advisories. Cisco Secure Email Gateway - Attackers actively exploited a vulnerability allowing arbitrary file writes - Publicly disclosed Oct 14. Citrix NetScaler - Attackers exploited vulnerabilities that could enable remote code execution on affected appliances - Reported Sept 28-Oct 5; exploitation began before October. FortiMail - Critical path-traversal vulnerability potentially enabled unauthorized file writes and code execution - Advisory issued Oct 2; confirmed exploitation not established. Ivanti Connect Secure - Attackers actively exploited an authentication-bypass flaw to execute commands remotely - Reported Oct 13-20. AhsayCBS - Unauthorized-access incidents affected backup-server environments through security vulnerabilities - Oct 9-13, confirmed by the vendor's incident timeline. Microsoft Windows Shell - Alleged exploitation of a Mark of the Web security vulnerability; a reliable October incident date could not be confirmed - Excluded from confirmed timeline. Siemens Software Center - Attackers used malicious DLL files alongside legitimate software to execute code on affected systems - Active exploitation confirmed Oct 19. Note: Items marked as unconfirmed should not be treated as verified hacks. Vulnerability advisories also do not necessarily mean a particular organization was compromised.