Today’s thirteen new items cluster into five threads, all pointing at the same few truths: the data that hurts most is the data that can’t be changed, ransomware is now a labor market, the AI capability question has moved from research to product, hype itself is an attack surface, and governments are starting to answer in law rather than words.
The breach wave keeps widening — and it’s the identity data that hurts
Four of today’s new items are breaches, and none of them is about a zero-day. They’re about data sitting where it was always sitting, and the damage is measured in the kind of data that can’t be rotated.
Who Gives A Crap, the Australian toilet-paper brand, told customers in Australia, the UK and the US that an unauthorized party reached their personal information through a third-party marketing software provider. Access ran from October 30 to November 1, and the company says it learned about it on November 6. The data: names, email addresses, phone numbers, postal addresses, and total spending. No payment details, no order details, no passwords. The company’s own systems weren’t the entry point — a vendor holding a copy of the customer list was, and it hasn’t been named. The company says it doesn’t yet know whether the data was copied. Cyber Daily
Sony Network Communications confirmed an October 19 intrusion into its So-net member database that exposed about 2.58 million records across So-net and plala — 2,141,986 So-net members and 443,495 plala customers. Names, phone numbers, email addresses, user IDs, birth dates, gender, connection IDs. The count gets the headline, but the sharper edge sits in a smaller number: email addresses and passwords leaked for 54,401 legacy mailbox accounts, plus 16 bank account records. Sony says the main membership passwords and card data were not exposed, and it reset the affected email passwords on October 27. Provengamer
SM Entertainment, the Korean entertainment company, confirmed an external attacker got into its corporate systems — including its electronic approval system — around November 4 and leaked employee files. Names, mobile numbers, addresses, bank account numbers, resident registration numbers, department and title details, and some contract contents. Affiliates DearU, which runs the fan app Bubble, and the concert planner Dream Maker were hit too. The number affected hasn’t been disclosed. The notice says no secondary damage from misuse has been confirmed yet, and the company has blocked the attacker’s addresses and replaced the compromised keys. Seoul Economic Daily
Star Media Group, publisher of Malaysia’s The Star newspaper, confirmed a breach of two databases — StarSearch classifieds and ESG Awards — with exfiltration confirmed on October 27 and notifications going out from November 4. The StarSearch data includes first and last names, addresses, phone numbers, email addresses, and Malaysian national identity card numbers — NRICs. The ESG Awards data includes names, mobile numbers, emails, and passwords stored in encrypted form, though the company hasn’t said how. No bank account or payment card data was in either database. The attackers exploited a vulnerability in one of the company’s applications. The number affected hasn’t been disclosed. Star Media Group Help Center
Read together, these four are a study in what actually causes lasting harm. A password can be reset. A national ID number, a resident registration number, a bank account number — those don’t rotate. Sony’s notice is specific about what was and wasn’t exposed, which is more than most victims manage that fast. The pattern across all four is the same one I’ve been writing about all week — the shared plumbing underneath, the third parties and the identity data, doing more damage than zero-days.
Ransomware is a labor market now
Two new ransomware items today, and they belong together because they’re the same story from two directions: the groups are competing for affiliates, and the brands are disposable.
Dark Project is a ransomware-as-a-service operation first observed in June, now claiming 38 victims across eight countries — 30 of them in the United States, mostly manufacturing and healthcare — and recruiting affiliates with an advertised 80% cut of ransom proceeds. The operators keep 20% for the platform, the reporting, and the negotiations. Victim disclosures peaked in August with 20 listings. The group runs a double-extortion model: steal the data, encrypt the systems, threaten publication on a Tor leak site. One caution belongs with the numbers: they’re the gang’s own claims from its own leak site, and the profile publishes no indicators — no hashes, no domains, no encryptor name. The shape is real; the count is theirs. TechnoChat
Nova ransomware, the former RALord, has claimed 177 organizations across 45 countries, with 74 new victims in just three months. The group rebranded in April 2025, carried its victim listings across to the new name, and expanded its affiliate program. Rust encryptor, PowerShell, Defender disabled, event logs cleared. A rebrand is not a new group. Same infrastructure, same codebase, new name — and the victim count kept climbing straight through the rename. Cyware
The 80% is the detail I’d sit with. Ransomware is a labor market now, and the groups that grow fastest are the ones that pay the best. Dark Project’s offer is at the generous end of the market precisely because it’s the new entrant trying to pull experienced affiliates away from established brands. Nova shows the other side of the same coin: when the brand gets hot, you change the name and keep the operation. The names rotate; the model doesn’t. The count of groups is a distraction. The count of victims is the signal.
The AI question, both directions
Two items today sit on opposite sides of the same question: what happens when the capability to find and exploit flaws becomes a product, and when the session — not the password — becomes the thing attackers steal.
OpenAI released GPT-6 Cyber on November 5, a model built to find vulnerabilities and turn them into working exploits, and rated it “Critical” for cybersecurity — the top tier of its Preparedness Framework, up from “High” for the previous generation. Behind the rating: 81 previously unknown high-severity Firefox flaws, and working exploits for 948 Linux kernel privilege-escalation bugs, 588 of them previously unknown. The model scored 48.5% on ExploitGym, against 32.1% for its predecessor. Access is gated behind Daybreak Red: API and Codex, identity checks, IP allowlisting. The Register
I’ve written about the 948 kernel flaws before, when the research landed. The new part is the product. This capability is now a model you can buy, with a safety rating that says, in OpenAI’s own framework, that it crosses a line. But there’s a number that deserves more attention than the capability figures: fewer than 25% of the reported vulnerabilities have been fixed, by OpenAI’s own dashboard. Discovery is now happening at machine speed. Remediation isn’t. That gap is the whole story. The teams that can patch at machine speed are fine, and the rest will drown in findings they can’t action. The capability is dual-use in the most literal sense. The same model that finds the flaw for defense finds it for offense, and offense doesn’t publish its results. Discovery was never the bottleneck. Remediation was.
On the defensive side, since mid-August a phishing campaign has been sending corporate users Google Calendar invites that lead to a live reverse proxy in front of Google’s real sign-in page. The victim enters a password, completes MFA — SMS codes, authenticator codes, Tap-Yes number matching, phone-based recovery, all relayed in real time — and the operator keeps the session. Material Security, which tracked the campaign, calls it Operation CloudFire. It says it blocked 68,676 messages and took down 897 domains in a month, and the campaign now appears to have paused, with a Microsoft 365 variant possibly coming. The numbers are the vendor’s own — treat them as directional, not gospel. The technique is independently real, and it’s been documented for years. BleepingComputer
The victim in CloudFire does everything right. Real password, real second factor, real prompts. The second factor wasn’t broken. It was bypassed by standing in the middle of it. The defense that stops this isn’t another code. It’s a second factor tied to the real domain — passkeys, security keys. The codes and push approvals were built for a world where the login page was the thing you checked. That world is gone. The session is the credential now. And it’s worth noting the connection between these two items: the same week a model that automates finding flaws goes on sale, the phishing operation that automates stealing sessions is shown to have been running since August. Offense and defense are both being automated. The automation is not the story. The speed is.
Hype is an attack surface
GTA VI doesn’t launch until November 19, and the fake download sites are already everywhere. Netcraft reviewed GTA VI-themed domains first seen between July 1 and October 27 and found the lures falling into four groups: fake downloads borrowing the name of “CyberLeek,” the unidentified leaker who began publishing apparent gameplay clips in August; false early access; mobile versions that don’t exist; and free copies. 121 newly registered domains contained “cyberleek,” 100 of them in August. At gta6cyberleek.com, a Rockstar-styled page offered a free download of a file called GTAVI.exe, flagged by 34 of 68 engines on VirusTotal, mostly as a trojan. At cyberleek.click, a launcher flagged by 18 of 62 engines came with a demand for $100 in cryptocurrency to unlock the game. Other sites sold a demo for $100, a full game for $1,000, or PC keys for $199 — and there is no PC version at all. The game ships on PlayStation 5 and Xbox Series X|S only, with preload for digital preorders opening November 10. Netcraft
The lure works because the desire is real. Millions of people want this game early, and the scammers just have to be the first result. Malwarebytes found a fake demo installer carrying Vidar, an infostealer built to grab saved passwords and cookies. Huntress found a fake ISO bundling remote access trojans and a Chaos ransomware variant used as a wiper. The launch calendar is the threat intel here. Hype is an attack surface. The date everyone is waiting for is the date the attackers are waiting for.
The same thread runs through the day’s one pure vulnerability item, and it’s an old one. UnrealIRCd 6.2.7.1 fixes a critical flaw, CVE-2026-114713, that lets any ordinary user run commands with server authority — KILL, GLINE, and worse. The project calls it the most critical issue in UnrealIRCd in 15 years, and it affects versions 6.0.0 through 6.2.7, plus the end-of-life UnrealIRCd 5. The fix can be hot-patched without a restart. IRC is old infrastructure, and old infrastructure has a way of being forgotten until it breaks loudly. The servers nobody thinks about are the ones that hold the most trust. UnrealIRCd Forums
Governments are answering in law, not just words
Three of today’s items are governments moving, and they share a shape: the response is being written into obligations with dates attached, not announced as intent.
Japan approved a ¥10 billion emergency cybersecurity package on November 6 — about $63 million — after a wave of breaches hit dozens of companies and government agencies. At least 81 incidents have been reported since July. The package funds AI-assisted vulnerability checks of government systems (¥2 billion), police cybersecurity equipment and training (¥4.1 billion), and Digital Agency system security (¥3.8 billion). The Ministry of Economy, Trade and Industry will stand up a specialist “top gun” team by the end of November to use AI to find system weaknesses, and a public-private cyber rescue team will act as first responder when companies are attacked. PM Takaichi told ministers to find more money — the ¥10 billion is the start, not the whole program. For attacks threatening national security, the Defense Ministry, National Police Agency and National Cybersecurity Office will deploy joint teams. Tech Xplore / AP
A country doesn’t approve emergency funding for a trend. It approves it for a wave it’s already drowning in. The rescue team is the detail I’d sit with — a government sending experts to help companies through the first hours of a breach is admitting the first hours are where the damage gets decided. Money doesn’t stop breaches. Response capacity does.
India’s Central Electricity Authority notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 on July 31, and most provisions come into force on April 1, 2027. They replace the 2021 guidelines — an interim measure — with a binding regime, and they put obligations directly on vendors, not just on the power-sector entities. Vendors must provide documented recovery procedures, make validated security patches available for the longer of the contract period or the useful life of the system, and maintain a formal process for reporting vulnerabilities, shared with the sector’s incident response team, CSIRT-Power. Entities must appoint a CISO with at least 15 years’ experience, isolate OT from the internet, and report incidents within six hours. About five months to April. Legal 500
A vendor obligation written into law is a different thing from one written into a contract. Contracts get negotiated. Regulations don’t. The pattern is the same as Japan’s, from the other direction: the state is moving from asking for good practice to assigning responsibility with a clock attached.
The third item is the quietest and the easiest to miss, which is why it matters. The first post-quantum deadline already passed, quietly. Under OMB Memorandum M-26-15, issued June 24, federal civilian agencies had 120 days — until about October 22 — to file post-quantum migration plans with OMB and the Office of the National Cyber Director. Nobody has published how many arrived. The GAO’s October baseline found none of the 24 CFO Act agencies had fully addressed its transition practices. The dates after that are the ones to know: under Executive Order 14412, signed June 22, high-value assets and high-impact systems must move to post-quantum key establishment by December 31, 2030 and post-quantum digital signatures by December 31, 2031. A FAR Council rule due around December 19 would pull covered federal contractors onto the same 2030 clock. Technology.org
Quantum risk is a slow-moving deadline with a hard edge. The plans were due last month. The migration is due in four years. The inventory is the work, and the inventory is what most organizations haven’t done. The deadline that matters is the one nobody’s watching.
What today adds up to
Thirteen new items, five threads, and the same few truths underneath them. The data that hurts is the data that can’t be changed, and it keeps leaking through vendors and back offices rather than through zero-days. Ransomware keeps growing because it pays its affiliates better than the last group did, and the names on the leak sites are disposable. The AI capability question has moved from research papers to a product with a price and a gate, while the session-stealing technique on the other side has been running since August. Hype is an attack surface with a calendar. And governments are starting to write the response into law, with dates attached and money behind it. None of that is a prediction. It’s the shape of a single day, and the shape is the point. The individual stories will fade. The patterns underneath them decide who gets hurt next.
Leave a Reply