Data Breaches & Exploited Vulnerabilities Dominate Cybersecurity News

Critical Vulnerabilities Under Active Exploitation:

• [UPDATE] China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks: CISA has added CVE-2026-102764, a BeyondTrust Remote Support authentication bypass, to its KEV catalog, mandating patching for federal agencies. The China-linked ARMORY CASTLE group has been actively exploiting this zero-day since August 2026 for initial access and privilege escalation.

Data Breaches and Exposed Information:

• [UPDATE] Burger King Japan App Breach Exposes 11.18 Million Member Records: User passwords were not compromised in the Burger King Japan app data breach. The exposed PII now explicitly includes 'Prefecture of residence', with potential attack techniques like SQL injection and exploitation of public-facing applications identified.
• [UPDATE] Millions of California Students' Data Exposed in Breach at Testing Provider: Class-action lawsuits have been filed against Educational Testing Service (ETS) following a data breach that exposed demographic information, program participation status, and statewide assessment results. The breach was detected on September 25, 2026.
• [NEW] OpenCode Breach Exposes OpenAI, Anthropic API Keys, Leads to Fraud: The open-source AI coding agent OpenCode experienced a breach exposing API keys for OpenAI, Anthropic, and Google. Attackers used these keys in a 'distillation attack' to incur fraudulent charges on user accounts.
• [NEW] Helix Ransomware Group Claims Attack on American Campus: The Helix ransomware group has claimed responsibility for a cyberattack on American Campus, a student housing provider. The group threatened to release exfiltrated data, employing a double extortion strategy.
• [NEW] Gîtes de France Breach Data Added to Have I Been Pwned: Data from a May 2026 breach at Gîtes de France, attributed to hacker 'ChimeraZ,' has been added to HIBP. The incident exposed personal and booking details of hundreds of thousands of customers, including email addresses, names, phone numbers, and physical addresses.

Industry Trends and Phishing Activity:

• [NEW] Microsoft Remains Top Impersonated Brand in Q3 2026 Phishing Attacks: A Check Point Research report indicates Microsoft was the most impersonated brand in Q3 2026 phishing attacks, accounting for 33% of attempts. The report also notes a rise in impersonations of AI and developer platforms.