October 2026: Binance Heist, ConnectWise Breach, and More

The major cyber attacks of October 2026 were some of the year’s most consequential, and many of them started with access their victims already trusted. A cryptocurrency exchange lost billions through compromised engineer workstations in the Binance hot wallet heist, a backup provider’s cloud credential reached hundreds of Microsoft 365 tenants in the ConnectWise breach, and a supplier’s lookup account exposed records on 8.8 million people in Denmark’s CPR register breach. Other attacks disrupted day-to-day operations, from ransomware hitting Japan’s IDCF Cloud platform to Iran-linked remote sabotage of refrigeration systems in French supermarkets.

Binance Loses About $6.3 Billion in Hot Wallet Theft

Attackers began draining Binance hot wallets across several blockchains at 20:05 UTC on October 29, 2026, and moved most of the funds within about 20 minutes, according to blockchain analysts. Binance puts the loss at about $6.3 billion, the largest cryptocurrency theft publicly reported to date. The exchange’s incident report traces the intrusion to a months-long campaign against its engineers, including a tampered Homebrew installer in June and a fake job interview that planted a malicious code repository in September. Abuse of an internal AI tool on October 20 then led the attackers to the wallet signing service used in the theft.

The Federal Bureau of Investigation (FBI) publicly attributed the theft to North Korea on October 31, 2026, and, with the US Secret Service and Internal Revenue Service Criminal Investigation (IRS-CI), tied the laundering to the TraderTraitor cluster. SOCRadar assesses the attribution with high confidence based on that public government statement. Binance says about $3 billion has been frozen on-chain and that it is covering the remaining losses from its own funds. Withdrawals began reopening in phases on November 1, 2026.

FBI Warns FortiBleed Campaign Is Still Locking Organizations Out

On October 6, 2026, the FBI and the US Secret Service issued a joint advisory warning that FortiBleed, a global credential-compromise campaign against internet-facing Fortinet FortiGate firewalls and Secure Sockets Layer (SSL) VPN gateways, remains active. The operators log in with credentials from earlier Fortinet leaks and infostealer logs, then crack captured legacy SHA-256 password hashes offline. SOCRadar first exposed the campaign in June 2026 and verified 86,644 working device credentials across 194 countries.

The advisory warns that organizations are being locked out of their own firewalls when attackers delete legitimate accounts or change their passwords. It also describes attackers creating admin accounts for persistence, stealing password hashes and API keys, and passing access to ransomware affiliates, including INC/Lynx and Payload. No government agency has named the operators, and the advisory says recovery takes more than standard patching and password resets.

Capcom Confirms Breach of 11.7 Million CAPCOM ID Records

Capcom disclosed on October 22, 2026, that unauthorized access to its CAPCOM ID membership service, which it confirmed on October 19, 2026, exposed 11,774,247 records, mainly email addresses and account metadata such as login history. The attacker also changed the passwords of 196 accounts, and an October 23, 2026, follow-up said e-CAPCOM store account details were exposed for 19 of them. No payment card data was involved, and no threat actor has been named.

ConnectWise Cloud Backup Credential Abused Against Microsoft 365 Tenants

ConnectWise disclosed on October 16, 2026, that an attacker abused the Microsoft 365 application credential behind its Cloud Backup service, formerly SkyKick, which held standing consent to read the tenants of managed service providers (MSPs) and their customers. The attacker began using that credential to authenticate to customer tenants on October 15, 2026, and in at least two tenants a related ConnectWise app assigned itself the Global Administrator role. Incident responders saw sign-in attempts in almost 1,000 Microsoft Entra ID tenants, with successful sign-ins in more than 300 of them.

Microsoft assessed that Storm-0940, a China state-aligned group, was responsible, citing infrastructure shared with a password-spraying campaign that preceded the compromise. The group used the ARTEX agentic artificial intelligence (AI) penetration-testing framework. SOCRadar assesses the link with moderate confidence based on that private-sector infrastructure analysis; no government body has publicly attributed the compromise. ConnectWise reset all credentials on October 19, 2026, and as of November 4, 2026, its advisory said backups and restores were available again for Microsoft 365 tenants re-authorized through a new app, while billing, the platform backup dashboard and some notifications were still being restored.

PHP2Shell Leads October’s Wave of 2Shell RCE Flaws

On October 21, 2026, the PHP project fixed CVE-2026-109618 and CVE-2026-109619, two memory-handling flaws in PHP core known together as PHP2Shell. The project rates each 9.2 CVSS v4.0. Its CVE-2026-109618 advisory confirms unauthenticated RCE over HTTP against mod_php with default limits and assesses PHP-FPM as susceptible, while CVE-2026-109619 exploitation was validated against both mod_php and PHP-FPM. Any internet-facing PHP application running an affected version is exposed.

Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The European Union’s Computer Emergency Response Team (CERT-EU) also lists PHP 8.1 and older as affected, though PHP published only minimal source backports for 7.4, 8.0 and 8.1. Amazon reported exploitation attempts as early as October 17, 2026, four days before the fixes, and the Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026. SOCRadar researchers later found one-click exploit tooling on an exposed attacker server, along with scripts that had checked about 20 public websites for vulnerable setups, but saw no evidence of successful access.

• Node2Shell: CVE-2026-111497, an out-of-bounds write in the Brotli decompression library rated 9.2 CVSS v4.0, was fixed in Node.js on October 21, 2026, and also affects Python Brotli packages and PHP for Windows builds. CISA added it to the KEV catalog on October 27, 2026
• Plex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 can be chained into RCE on Plex Media Server. Plex fixed them in version 1.43.3.10861 in August 2026, but reports of in-the-wild exploitation emerged on October 17, 2026, and CISA added all four to the KEV catalog on October 20, 2026

Ransomware Encrypts Virtual Servers at Japan’s IDCF Cloud

IDC Frontier, a SoftBank group cloud provider, confirmed that ransomware hit its IDCF Cloud service on October 7, 2026, disrupting 495 companies and local governments in parts of its East Japan Region 1. The company’s investigation update says the attacker exploited a vulnerability in open-source software behind the cloud portal’s authentication, gained administrator rights over the virtualization platform and encrypted customer virtual machines.

IDC Frontier found no exfiltration from customer virtual machines, did not pay a ransom and has not named a group. Downstream, JR East said an email delivery provider hosted on the platform was affected, though a later check found no leak. The latest update, dated October 27, 2026, said backups were retrievable for 206 customers and the cloud portal remained suspended.

Ex-Pentester Accused of Stealing 8.2 Million Records With ARTEX

A former penetration tester allegedly led a group that breached more than 90 South Korean organizations, including private academies, hospitals, golf courses, universities, funeral-service firms and insurance sales firms. The group stole about 8.2 million personal data records along with internal documents between September 2025 and October 2026. The suspect, who worked in penetration testing at a security company from 2019 to 2022, was arrested on October 15, 2026, and referred to prosecutors in custody on October 23, 2026.

Police said that from late August 2026 he paired a coding agent with an autonomous AI penetration testing system, reported as ARTEX, to breach about 60 of the victims between August 31, 2026, and October 13, 2026. The group demanded a combined 360 million won from 38 victims, and only one paid, sending 300,000 won.

France Links Supermarket Refrigeration Sabotage to Iran

Overnight on October 11 to 12, 2026, attackers forced remote refrigeration controllers at French supermarkets into defrost cycles. The French national Computer Emergency Response Team (CERT-FR) issued alert CERTFR-2026-ALE-012 on October 12, 2026, and expanded it the next day. The alert now covers Danfoss AK-SC and AK-SM controllers and Copeland and Dixell XWEB supervisors, warns that internet-exposed end-of-life devices face a particularly high risk of compromise and assesses that the campaigns are probably ongoing.

In a November 9, 2026, report published by CERT-FR, French authorities counted about 700 affected retail sites and at least 15 fires, and attributed the attack to Shahid Kaveh, a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC). SOCRadar assesses the attribution with high confidence based on that public government statement. The report names Coopérative U, Carrefour, Intermarché and Metro among the affected chains, and French authorities put food losses in the tens of millions of euros.

Denmark’s CPR Register Breach Exposes 8.8 Million People

Denmark’s Ministry of Research, Education and Digitalisation disclosed on October 5, 2026, that someone misused a private company’s lawful lookup access to the Central Person Register (CPR), the national register behind every Danish personal identification number. During September 2026, the intruder ran a very large number of automated lookups and retrieved records on about 8.8 million people, including living, emigrated and deceased persons. Exposed data includes names, addresses and CPR numbers, though people with address protection were excluded.

The government has not said who is behind the access. The company confirmed that its access had been abused, and an anonymous individual claimed to have logged in with a former employee’s leaked password, a claim authorities have not confirmed. Access was cut on October 2, 2026, and the National Special Crime Unit (NSK) is investigating. Officials warned organizations not to rely on CPR data alone for identity checks, and the government ordered a thorough security review of the CPR system.

Florida Student Aid Breach May Affect 4.9 Million People

The Florida Department of Education (FLDOE) disclosed on October 29, 2026, that unauthorized access to the Florida Student Financial Aid website may have affected approximately 4.9 million people, potentially including anyone who has applied for state financial aid. Exposed data includes Social Security numbers, names, dates of birth, home addresses, phone numbers, email addresses and gender.

FLDOE staff became aware of the breach on October 19, 2026, and the department has not disclosed how the attackers got in or when access began. It is working with the Florida Digital Service and the Florida Department of Law Enforcement on an ongoing criminal investigation. No threat actor has claimed the attack, and the department’s notice advises affected people to monitor their credit reports and financial accounts.

How Can SOCRadar Help?

October’s incidents showed how much of an organization’s exposure now sits with the vendors, platforms and devices it trusts. SOCRadar offers several modules that help security teams monitor that exposure from the outside:

• Supply Chain Intelligence: Monitors vendors such as backup, hosting and data providers for breaches and exposure that could reach your environment

• Exposure Management: Discovers internet-facing assets, including outdated PHP servers, exposed admin panels and building or refrigeration controllers, before attackers find them
• Vulnerability Intelligence: Prioritizes flaws such as PHP2Shell based on exploitation activity, so patching follows real risk
• Dark Web Monitoring: Tracks leaked credentials, stolen datasets and threat actor claims that mention your organization or its suppliers
• Cyber Threat Intelligence: Follows state-aligned and financially motivated groups such as TraderTraitor and Storm-0940, with context on their latest campaigns and infrastructure

Together, these modules help teams spot external and third-party risk earlier and decide which exposures need attention first.