SecureFact – November 2, 2026

Northflank security breach leads to abuse of customers’ AI API keys

Cloud application hosting platform Northflank disclosed a security breach on October 30, 2026, after receiving a threat alert from cloud security company Wiz, which identified unauthorized access to the platform’s systems. The company warned all customers to immediately rotate their environment variables and API keys, as the breach exposed decrypted credentials stored on the platform. Multiple customers reported unauthorized use of AI API keys that had been stored on Northflank, with attackers using stolen credentials to access expensive AI services and generate massive API charges. Environment variables commonly store sensitive information including database passwords, cloud service credentials, authentication tokens, and API keys that can be exploited to breach other customer services. Northflank quickly responded with network policy patches at 11:43 UTC, 12:50 UTC, and 13:05 UTC, and requested assistance from Wiz’s incident response team. The company enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis databases, and enabled audit logs for all customers including free account users to help investigate suspicious activity. Northflank advised customers to review their AI provider usage and billing logs for unexpected activity and report suspicious usage to both Northflank and their AI providers. The company has not disclosed how many customers were affected or whether attackers stole credentials beyond the reported AI API keys.

(Source: Read full report)

Japan Airlines suffers third-party data breach exposing passenger info

Japan Airlines announced a significant data breach affecting approximately 92,000 customers after unauthorized access to Amadeus’s Passenger Service System, which JAL uses to handle passenger reservations, ticketing, and check-in. Amadeus notified JAL on October 23, 2026, that unauthorized access to its systems occurred between August 10, 2023, and September 23, 2026, representing a breach window of over three years. For approximately 90,000 customers, attackers accessed reservation codes (PNRs), names, flight dates, routes, and travel classes. An additional 2,000 customers had their above data types exposed plus email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers. JAL confirmed that credit card numbers and passwords were not compromised and reported no evidence of customer information being misused as of the announcement date. Amadeus, a major IT supplier to global aviation used by over 400 airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels, has implemented necessary security measures. The breach impacted multiple airlines including All Nippon Airways (ANA), Asiana Airlines, and Korean Air. JAL reported the incident to Japan’s Personal Information Protection Commission and confirmed that flight operations were unaffected by the security incident.

(Source: Read full report)

Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications, a Sony Group Corporation subsidiary providing telecommunications and technology services as an internet service provider in Japan, confirmed a data breach on October 28, 2026, that compromised approximately 2.5 million customer records. The breach occurred on October 19, 2026, and was detected four days later when the company shut down the compromised servers and blocked external communication. The investigation confirmed that 2,585,481 customer records were exposed, including full names, phone numbers, email addresses, user IDs, dates of birth, gender, and Internet Connection IDs. An additional 54,401 email addresses from several email services were exposed along with account passwords, prompting the company to advise users to change their passwords immediately. The breach impacted 2,141,986 So-net entries and 443,495 plala (S Course) records, with the latter affecting NTT Docomo customers who contract Sony Network Communications for Docomo Hikari services. Sony confirmed that no banking, payment card, or other account details were exposed in the breach. The company reported the incident to Japan’s Personal Information Protection Commission and is investigating the cause and scope of the breach. As of October 27, neither Sony nor NTT Docomo had confirmed misuse of the exposed data in the wild, though NTT Docomo warned customers of phishing emails and fake websites impersonating its d POINT Club and Universal Studios Japan campaign.

(Source: Read full report)

UNM Health ransomware attack disrupts patient care, surgeries

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. UNM Health, a major statewide provider with more than 1 million patient visits annually and home to New Mexico’s only Level I trauma center, temporarily limited new patient admissions, diverted ambulances to nearby hospitals, and suspended outpatient surgeries and appointments. A new ransomware group called Byod claimed the attack, stating it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the entire Microsoft Entra tenant, and two Oracle databases. Byod claimed access to student and employee personal data including Social Security numbers (SSNs), HR and payroll records, Banner student records, internal emails, research data, hospital appointment data, patient information, and Cerner EHR rosters. The threat actor promised to provide free decryption keys for healthcare facilities and offered to pay up to $2,500 for every patient affected by the cyberattack. UNM Health reported that all critical electronic systems were back online and all hospitals were fully open within one day, with IT security teams working with external partners to secure the network. The company’s assessment determined that the event affected some end-user devices but did not penetrate core systems or servers. Patients, staff, and students were advised to remain vigilant for unsolicited communications and phishing attacks.

(Source: Read full report)

Warp discloses breach exposing AI agent logs, user telemetry data

Warp, a popular agentic development environment with approximately 800,000 users, disclosed a security breach on October 27, 2026, after attackers exploited a vulnerability in a third-party vendor in Warp’s infrastructure. Agent decision logs and telemetry data belonging to Warp users were exposed in the attack, with the company’s founder and CEO estimating that roughly 1% of Warp users may have been impacted. The company detected the operation within hours and was able to remediate and mitigate the impact. Although agent traces and telemetry were identified as potentially affected data, the company did not clarify whether the exposed information included source code, prompts, credentials, or other sensitive details. Analysis of the incident suggests that the attack was powered by an agent swarm that relied on a very sophisticated penetration and escalation technique. Warp contacted the third-party vendor about the vulnerability but no details have been shared. The platform notified users identified to be impacted and engaged cybersecurity firm CrowdStrike to assist with the investigation. Warp also informed law enforcement authorities about the incident. Warp users were advised to remain vigilant, monitor account activity, and treat unsolicited communications with increased caution. The incident follows similar breaches at other AI development platforms during October 2026.

(Source: Read full report)

University of Copenhagen data breach exposes data of 525,000 people

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people, with an additional 20,000 staff and students whose PIN codes were exposed. Founded in 1479, the University of Copenhagen is Denmark’s oldest university and one of its leading research institutions with approximately 36,800 students and 10,700 employees. The educational organization detected the breach last Tuesday and disclosed it on Friday, with the university still investigating to determine the full extent of the incident. The exposed information includes full names, national identity numbers (CPR), phone numbers, and email addresses, which increases the risk of phishing and social engineering attacks. Regarding the PIN access exposure, the University of Copenhagen restricted physical access to certain critical locations on its campus out of abundance of caution and is gradually reopening them as it distributes new access codes. The university contained the attack and blocked the attacker’s access, with no indication that hackers accessed systems supporting daily operations or disrupted university activities. The university reported the incident to the Danish Data Protection Agency and stated it falls within the scope of Europe’s General Data Protection Regulation (GDPR), taking appropriate steps with relevant regulators. Students and staff whose data may have been exposed should be cautious of unsolicited communications and independently verify requests.

(Source: Read full report)