Data Breach Watch: 27 October to 5 November 2026

Breaches and enforcement from 27 October to 5 November that matter to banks, payments and regulated firms. Items marked as claims have not been confirmed by the organisation named.

UAE, Gulf and India

Moody's Investors Service Middle East (fined 28 October). The DFSA fined the DIFC-based ratings unit $585,825 (after an early-settlement discount) over seven inadvertent disclosures of confidential data between December 2023 and May 2026. It cited a data security tool removed without a replacement and weak leak prevention and detection.
State Bank of India (update, 3 November). After its 21 October filing on 3,897 customer records found on the dark web, Chairman C.S. Setty said the root cause is still under investigation and the bank has reviewed its APIs. As Indian Banks' Association chair, he said banks are considering real-time sharing of cyber incident information. A group calling itself "Siriusim" claims responsibility for the leak; SBI has not named anyone.
Reserve Bank of India (reported 30 October). Reuters, citing unnamed sources, reported that the RBI has asked banks to prove compliance with cyber rules, show AI risk preparedness and probe API weaknesses. A police complaint seen by Reuters says two Mumbai non-bank lenders lost about $2 million in unauthorised transfers on 8–9 October after the API link carrying their disbursal instructions to ICICI Bank was compromised.
Indian Cybercrime Coordination Centre (4 November). I4C warned financial firms of attacks using AI agents to exploit unpatched or misconfigured systems and reach disbursement systems and payment APIs.

Major global incidents

Binance (29 October). The FBI attributed the theft of more than $6 billion in virtual assets to North Korean actors it tracks as TraderTraitor. Binance reported losses of $6.3 billion and says it will cover them from its own funds.
Crédit Mutuel Arkéa (confirmed 4 November). The French bank said attackers used a supplier's platform to make transfers from the bank's own account; customer accounts were not accessed. It said investigator ZachXBT's estimate of more than $133 million could "validate the order of magnitude".
Polymarket (29 October). Polymarket confirmed an incident at an unnamed third-party provider and paused trading. Hudson Rock identified the provider as DebugBear, which acknowledged a security incident. Researchers traced over $2.1 million in losses, which Polymarket will reimburse.
Revolve (8-K, 29 October). The US retailer told the SEC an unauthorised actor may have obtained names, contact details, card numbers and expiry dates of customers with saved payment details. State filings list 127,200 affected Texas residents.
Convertr (reported 27 October). Sansec reported that a compromised analytics script on the Brazilian e-commerce platform's checkout skimmed card numbers, expiry dates, CVVs and taxpayer IDs from 24 October. Sansec says Convertr has removed the skimmer.
Chainalysis (30 October). The analytics firm, used by banks, exchanges and law enforcement, said an actor using "offensive agentic techniques" accessed internal systems, exposing user IDs, names, emails and role labels. It found no evidence of access to investigation content or credentials.
Amadeus (late October). Japan Airlines said a breach at reservations provider Amadeus affected about 92,000 customers, including passport numbers for about 2,000, but no card numbers. Cathay Pacific reported about 53,000 bookings affected.

Payment cards: yes. Revolve confirmed card numbers and expiry dates may have been obtained, and Sansec reported CVV-level skimming on Convertr checkouts.

Regulatory enforcement

South Africa (27 October): the Information Regulator fined First National Bank R1 million under POPIA after an app flaw exposed data of 88 home loan applicants.
United States (2 November): 36 state attorneys general announced a $220 million settlement with General Motors over the alleged sale of drivers' location and behaviour data without consent.
India DPDP: consent manager rules (Rule 4) take effect on 13 November 2026; core data fiduciary duties, including breach notification, apply from 13 May 2027.
UAE PDPL: the federal law applies, but public sources indicate its executive regulations remain unissued; I found no public enforcement this period. DIFC and ADGM run separate, enforced regimes.

Lessons for audit and incident response

Your supplier's access is your attack surface. Arkéa, Polymarket and Convertr were reached through third parties. Map which suppliers can initiate payments or inject code, and monitor them as tightly as staff.
Lock down payment page scripts. Convertr's skimmer arrived through an analytics script. PCI DSS requirements 6.4.3 and 11.6.1 require a script inventory and tamper detection on payment pages; test that both operate.
Put business controls on payment APIs. The Mumbai losses and the I4C warning point to API abuse. Set per-transaction and daily limits, beneficiary name checks and velocity alerts, the same principle as SWIFT CSP control 2.9 on transaction business controls.
Verify releases, not just signatures. LiteLLM's incident page, updated 30 October, warns that the malicious v1.107.0 images carry a valid signature from its old key. Pin versions, check key fingerprints and rotate secrets on affected hosts.
Never remove a control without a replacement. The DFSA's Moody's findings began with a data security tool dropped without a substitute. Make retiring a control a risk-assessed change.

Data Breach Watch: 27 October to 5 November 2026

UAE, Gulf and India

Major global incidents

Regulatory enforcement

Lessons for audit and incident response

Sources

More insights

Data Breach Watch: 12–26 October 2026

Data Breach Watch: September 2026

NIST CSF 1.0 vs 1.1 vs 2.0: what actually changed