Recent Cyberattacks and Data Breaches: Fall 2026 Tracker
This tracker follows recent cyberattacks and data breaches from August to October 2026 that were confirmed by the organization involved or by authorities. Each briefing is built from the organization’s own statements, regulatory filings and reputable reporting, links every fact to its source and separates confirmed facts from attacker claims. Each one ends with practical steps any organization can take. OC Security Audit is based in Irvine and serves organizations across Orange County, Los Angeles and Southern California on-site, and nationwide remotely.
How to read the status labels
- Confirmed by the organization The organization has publicly confirmed the incident (statement, filing or notice).
- Confirmed by authorities A government or law-enforcement body has made a public finding, such as attribution.
- Under investigation The organization confirmed an incident, but key details (such as ransomware or data theft) are still under investigation.
- Reported claim, not confirmed Only the attacker or an unverified source makes the claim. We do not publish claim-only incidents as briefings.
Latest briefings
| Date | Organization | What the sources confirm | Status |
|---|---|---|---|
| Oct 29, 2026 | Binance hack Worldwide · Financial services / crypto | Hot wallets compromised; about $6.3B in crypto moved out. FBI attributes the theft to North Korea. Read the briefing | Confirmed by authorities |
| Oct 21, 2026 | Quest Diagnostics United States · Healthcare | Unauthorized access to the Quanum LSM lab-ordering system; certain patient records accessed. Read the briefing | Confirmed by the organization |
| Oct 21, 2026 | Richmond Public Schools United States · Education | Districtwide outage after a cybersecurity incident; ransom notes reported on laptops. A New York district was also hit. Read the briefing | Under investigation |
| Oct 20, 2026 | GMO Desktop Cloud Japan · Cloud hosting | Unauthorized program found on customer servers; up to 26,739 servers may be affected; ¥8 billion extortion demand refused. Read the briefing | Confirmed by the organization |
| Sept 9, 2026 | Passkey-themed help-desk scams on Microsoft 365 Worldwide · All sectors | Microsoft reports fake IT help-desk calls about passkeys and MFA leading to Microsoft 365 account takeover and data theft. Read the briefing | Confirmed by the organization |
| Sept 3, 2026 | Mathspace Australia / New Zealand · Education technology | Self-hosted reporting software left unpatched after a critical advisory; data on 1,079,819 people accessed. Read the briefing | Confirmed by the organization |
| Aug 25, 2026 | Boston Scientific United States / UK · Medical devices / manufacturing | Global disruption to manufacturing, order processing and shipping; full restoration reported in September. Read the briefing | Confirmed by the organization |
| Aug 25, 2026 | McKesson United States · Healthcare distribution | Unauthorized access to certain third-party applications and data exfiltration confirmed; attacker claims unverified. Read the briefing | Confirmed by the organization |
Date shown is when the incident was discovered, confirmed or reported, as stated in each briefing.
Four patterns across these incidents
Attackers talk their way in
Fake help-desk calls about passkeys and MFA, reported by Microsoft, and the confirmed ReliaQuest and Cook Medical cases show that sign-in processes and help desks are now a main target. Passkey phishing briefing · McKesson briefing. Related service: Microsoft 365 security audit.
Your data lives in someone else’s system
Quest’s lab portal, McKesson’s third-party applications and GMO’s hosted servers all held data their customers depended on. Quest briefing · GMO briefing. Related service: Third-party vendor risk management.
Known flaws stay open too long
Mathspace says patches were available for weeks before data was taken from an internet-facing reporting tool. Mathspace briefing. Related service: Network vulnerability assessment.
Recovery decides the damage
Boston Scientific and Richmond Public Schools show how one incident can stop shipping, phones and classrooms for days. Boston Scientific briefing · Richmond briefing. Related service: Business continuity and disaster recovery.
Check your own exposure
Every briefing ends with general controls. If you want to know which of them are in place in your own environment, a read-only audit gives you the answer and a prioritized fix list. The Microsoft 365, Entra ID, Cisco Meraki, Active Directory and AI security audits are each $3,500 fixed.
- Security audits: Microsoft 365, Entra ID, firewall, vulnerability, Azure and more
- Compliance consulting: HIPAA, PCI DSS, SOC 2, NIST CSF, ISO 27001
- Virtual CISO services: incident response planning, vendor risk and board reporting
- Free cybersecurity assessment tools
An audit shows where your controls are weak and what to fix first. No audit or service can guarantee that an organization will not be attacked; the goal is to lower the likelihood and the impact.
How we choose and verify incidents
We include incidents that the organization itself, a regulator or law enforcement has confirmed. We rely on primary sources first (company statements, SEC filings, government notices), then reputable news and security research. Attacker statements are labeled as claims. Unknowns stay marked unknown. Every external link opens the original publisher’s page, and all credit for the reporting belongs to those publishers. Earlier briefings, including our October 2026 series, are in the Cyber Incident Briefs archive. Read our full editorial standards or return to the Cybersecurity Intelligence Center.
About this briefing. This page summarizes publicly available information from the sources linked above, as of the verification date shown. OC Security Audit was not involved in responding to any incident described here and has no inside knowledge of them. Organization names are used only to identify the subjects of the cited public reports. Statements made by attackers are labeled as claims and are not treated as fact; details that the sources do not confirm are marked as unknown. Facts may change as investigations continue.
This content is for general educational purposes. It is not legal advice, a forensic conclusion or a finding about any organization’s security practices. See our editorial standards. To report an error, contact support@OCsecurityAudit.com and we will review it and publish a dated correction where needed.