Between October 29 and 30, 2026, a series of significant cybersecurity incidents affecting at least nine global organizations were disclosed, leading industry observers to label the period “Black October.” The cryptocurrency exchange Binance suspended trading on October 29 following a major security breach. Reports, including one from Axios, suggest that hackers—allegedly linked to North Korea—stole over $6 billion in what may be the largest cryptocurrency theft in history. The incident reportedly originated from a compromised employee laptop, leading to unauthorized transactions across multiple blockchains. Binance has suspended withdrawals but stated that user funds remain secure, with founder Changpeng Zhao pledging to cover losses. On the same day, the prediction market platform Polymarket suspended operations for nearly an hour after a third-party vendor was compromised. Researchers identified that the platform’s embedded performance monitoring tool, DebugBear, had been hijacked to access user accounts, liquidate positions, and transfer funds. Approximately 700 accounts were affected, with the perpetrator’s wallet reportedly holding $2.65 million. Polymarket has referred the matter to authorities in the United Kingdom. Other organizations also reported data breaches during this period: Ryohin Keikaku (MUJI): The parent company of MUJI announced on October 30 that its official mobile application had been subject to unauthorized access. Up to 27.26 million personal records, including email addresses, dates of birth, and gender information, may have been exposed. The breach includes data belonging to former members. It remains unclear if Hong Kong users are affected. Cathay Pacific: The airline disclosed that a third-party service provider, Amadeus, experienced unauthorized system access between August 2023 and September 2026. Approximately 53,000 booking records related to Cathay Pacific were involved, containing booking references, passenger names, and flight details. Keystone: The Hong Kong-based hardware wallet manufacturer reported that its online store was compromised in late October, resulting in the leak of approximately 26,000 customer records. Additionally, the breach exposed keys used for device authentication, rendering approximately 19,000 hardware units unusable. While these incidents occurred in close succession, reports from outlets such as Business Insider indicate no evidence linking the Binance and Polymarket attacks. Furthermore, while these disclosures coincide with global concerns regarding the “PHP2Shell” vulnerabilities—two critical flaws in the PHP programming language announced by the PHP Foundation on October 21—there is currently no confirmation that these specific breaches are related to those vulnerabilities. The Hong Kong Computer Emergency Response Team (HKCERT) issued an alert on October 23 confirming that the PHP2Shell vulnerabilities were being actively exploited.
Article source: Sing Tao Electronic Daily | Image credit: Sing Tao Electronic Daily