A fortnightly roundup of breaches and enforcement that matter to banks, payments and regulated firms, with the lessons I would take into an audit or incident response plan. Items marked as claims have not been confirmed by the organisation named.
UAE, Gulf and India
- State Bank of India (disclosed 21 October). India's largest bank was alerted on 16 October by its threat intelligence provider, the Defence Cyber Agency and CERT-In. A review of about 375,000 records found on the dark web identified 3,897 containing customer data: names, mobile numbers, dates of birth, addresses, customer IDs and loan details. The root cause is not yet known, and SBI has hired a CERT-In-empanelled investigator. A group calling itself "Siriusim" has claimed the leak; SBI has not named anyone. SBI learned of the leak from outside agencies rather than its own monitoring, and told the stock exchanges five days after the alert.
- DIFC, Dubai (claim, reported 21 October). A group calling itself REZE Ransomware claims to have taken 200GB of data from the Dubai International Financial Centre. Neither DIFC nor any authority has verified the claim.
- Amity University Dubai (claim, 15 October). The BlackNevas ransomware group listed the university as a victim. Amity has not confirmed a breach.
- Saudi Arabia (claims). The HYFLOCK group claimed an attack on cloud accounting provider Nodhom on 13 October. Earlier in the month, the WallStreet group claimed to have stolen 17TB from a contractor building a 2034 World Cup stadium, including data on 150,000 employees. Neither claim is confirmed.
- Earlier context. Bank of Baroda confirmed in July that an employee email account was compromised, while saying core banking was secure; a hacker's claimed data haul has not been confirmed. In September, the UAE's cyber security head said a hacker had demanded more than $5 million from a private firm supporting a government sector.
Major global incidents
- Capcom (found 19 October). Attackers accessed the CAPCOM ID account service, exposing about 11.7 million email addresses and account details, and changed the passwords on 196 accounts, which Capcom has reset.
- Burger King Japan. Data on 11.18 million app members was accessed between 2 and 7 October, including contact details, birth dates and gender. The company found no sign that passwords or payment cards were taken.
- ASOS (6 October). An employee was tricked into giving up login credentials, which were used to reach third-party platforms. Names, contact details, addresses, dates of birth and search history were exposed; ASOS says payment cards and passwords were not.
- ConnectWise Cloud Backup. A stolen backup app credential was used to sign in to the Microsoft 365 environments of at least 173 organisations, with potential access to email and files, often via IT service providers.
- Quest Diagnostics (found 21 October). Quest told the SEC that someone accessed certain patient records through its Quanum lab-ordering system.
- LiteLLM (21 October). Attackers used stolen GitHub tokens, reportedly taken from logs on an internet-exposed internal deployment, to hijack the release process and publish a version containing malware. LiteLLM says the tokens have been revoked.
- Zeabur. Admin credentials stored in plain text were exposed, affecting 321,810 accounts.
- Also reported: Sourcenext (up to 22.5 million member records) and Nikkei (1.83 million records, its third disclosed incident in about a month).
Payment cards: no confirmed card-data breach this period. Burger King Japan and ASOS both ruled out card data.
Regulatory enforcement
- Norway: Xandr fined €8.6 million over Grindr user data shared through real-time ad bidding.
- UK: the ICO issued a reprimand and an enforcement notice to the Metropolitan Police for sharing personal data through an unapproved third-party platform.
- Ireland: the regulator reprimanded Children's Health Ireland over the confidentiality of paper records at CHI Tallaght and ordered it to comply. No fine was issued.
- Sweden (reported in September): IT provider Miljödata fined about €160,000 after a cyberattack exposed data on 2.2 million people.
- India DPDP Act: no penalties yet. Consent manager rules start on 13 November 2026, and breach notification and the other main duties apply from 13 May 2027. Until then, banks report breaches to CERT-In and the RBI rather than to customers, which is the gap the SBI case highlights.
- UAE PDPL: I found no public enforcement actions this period.
Lessons for audit and incident response
- Treat secrets as part of the attack surface. LiteLLM's attackers used tokens found in logs, and Zeabur kept admin credentials in plain text. Audit where secrets can leak, including logs, and confirm that every credential involved in an incident has been revoked.
- Treat third parties as your attack surface. ConnectWise and ASOS both ran through third-party platforms and app credentials. Include vendor app identities and service accounts in access reviews.
- Detect it before the dark web does. SBI learned of its leak from outside agencies. Test dark-web monitoring and data-loss alerts against your incident response plan.
- Plan customer notification now. Under DPDP, customer notification becomes a duty from May 2027. Build and rehearse the process before it is mandatory.
- Guard against people-led compromise. ASOS began with social engineering and Bank of Baroda with a compromised mailbox. Phishing-resistant MFA and data-loss prevention on staff email close the most common routes in.
Sources
- SBI data breach: 3,897 customers affected, Business Today
- SBI told investors its data breach doesn't matter, Internet Freedom Foundation
- REZE ransomware group claims DIFC breach, Brinztech
- Amity University data breach listing, Breachsense
- HYFLOCK targets Nodhom, DeXpose
- Hackers claim Saudi World Cup stadium contractor attack, The National
- Bank of Baroda confirms data breach, WION
- UAE cyber security chief reveals hacker demanded more than $5m, The National
- 11 million impacted by Capcom data breach, SecurityWeek
- Burger King Japan data breach, Security Affairs
- ASOS links data breach to social engineering, BleepingComputer
- ConnectWise backup credentials exposed Microsoft 365 tenants, CSO
- Quest Diagnostics Form 8-K, SEC
- LiteLLM 1.107.0 supply chain compromise, Rescana
- October 2026 security incident, Zeabur
- Sourcenext data breach, GameBusiness
- Nikkei discloses third data breach in a month, BleepingComputer
- Norway fines Xandr over Grindr data, Sonomos
- ICO reprimands Met over third-party platform, Infosecurity
- CHI Tallaght reprimanded over children's data, Irish Times
- DPDP Act implementation timeline