Halloween Cybersecurity Digest: Danish Registry Breach via Weak Passwords, AI-Driven Card Theft, and Leaky Keurig Coffee Maker

A roundup of October cybersecurity incidents highlights a massive breach of Denmark's Central Population Register through compromised accounts at Pays ApS using the password 123456, exposing data of 8.8 million residents. An AI-powered attacker automated vulnerability discovery to steal over 600,000 payment card details and deploy web skimmers on 119 sites. Other cases include a Danfoss refrigeration system compromise in French supermarkets causing tens of millions in losses, a ShinyHunters breach of FBI agent data, and an accidental exposure of nearly 400,000 patient records by Washington D.C. health officials. Additional incidents involved social engineering at Astrana Health, a Burger King Japan app breach affecting 11 million users, and a Pentagon personnel data leak discovered after six months. The digest also covers failed insider threat lawsuits and a smart coffee maker that transmitted over 1 TB of data due to a firmware fault.

HabrOctober 31, 2026Translated from Russian

Read at source

SearchInform presents its Halloween Edition cybersecurity digest covering major October incidents involving large-scale data leaks, weak authentication failures, and AI-assisted attacks.

Nightmare on Strøget: Danish Population Register Breach

Hackers compromised systems at Pays ApS, a private company with legitimate access to Denmark’s Central Population Register. At least three accounts, including an administrator account, were protected only by the password 123456. Attackers used one account to run automated queries, sending approximately 14 million requests between September 10 and 20 and obtaining names, addresses, and identification numbers for 8.8 million residents. Monitoring systems ignored the activity; the breach was discovered only on October 2 after an unusually large bill was noticed. The incident potentially affected 80 percent of records in a register covering 11 million entries, including deceased and emigrated individuals, despite Denmark’s current population being around 6 million.

AI-Powered Maximum Acceleration Attack

An unknown attacker deployed AI agents to automate attacks, setting objectives that allowed the agents to independently find vulnerabilities. The campaign resulted in the theft of data from more than 600,000 active payment cards and the installation of web skimmers on at least 119 websites, including a major U.S. airline and a Fortune 500 hotel chain. Many victims experienced data loss and operational disruptions.

Danfoss Refrigeration Systems Compromised in France

French hackers breached Danfoss refrigeration control software in at least 330 stores belonging to chains including Intermarché, Netto, Carrefour, and U. Attackers exploited unpatched internet-exposed web interfaces, raised temperatures to 50°C, and manipulated SIEM systems to display false readings while spoiling fresh and frozen goods. Losses are estimated in the tens of millions of euros. Paris prosecutors and cybercrime units have opened an investigation.

ShinyHunters Targets FBI Infrastructure

The group ShinyHunters breached FBI systems and stole personal data of 5,000 current and former agents. The attackers exploited a vulnerability in infrastructure managed by a third-party contractor. The group described the operation as a “marketing campaign against disinformation” and demanded corrections to an earlier FBI statement. Following the incident, the group’s darknet site went offline and several key members were arrested by authorities in the U.S., Jordan, and the Netherlands.

Additional Incidents

Astrana Health fell victim to vishing when attackers spoofed company phone numbers to obtain server access. Burger King Japan reported the theft of 11.18 million customer records from its mobile app over six days. Washington D.C. health finance officials discovered that a 2023 public report had accidentally exposed personal data of 399,086 patients in hidden fields for three years. A Pentagon personnel data center breach exposed records of 2.76 million living and 294,000 deceased individuals, detected only after six months. A Keurig K-Supreme Smart coffee maker transmitted over 1 TB of data in ten days due to a network stack or firmware fault before being isolated by its owner.

ShinyHunters Keurig K-Supreme Smart Danfoss Pays ApS Burger King Japan Astrana Health

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Data Breaches & Leaks

Data Breaches & Leaks

Have I Been Pwned: How to Check If Your Passwords Have Leaked Online

The article explains how users can independently verify whether their email addresses or passwords have appeared in known data breaches. It distinguishes between three main scenarios: actual database leaks from websites, credential stuffing due to password reuse, and local theft by infostealers on compromised devices. The guide recommends starting with the Have I Been Pwned service to check email exposure across published breach datasets and using its separate Pwned Passwords tool to test whether a password itself has been seen in leaks. It stresses that absence from these databases does not guarantee safety and outlines practical next steps when exposure is confirmed, including changing reused passwords, enabling multi-factor authentication, and terminating old sessions. Additional advice covers device hygiene and safe habits such as using a password manager.

HabrOct 30, 2026Translated from Russian

Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks

Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.

AntiMalwareOct 28, 2026Translated from Russian

Data Breaches & Leaks

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

BoletimSecOct 26, 2026Translated from Portuguese