Global cyber incidents: the impact behind the headlines
From Binance to SBI and public services in Moldova and Argentina: what was reported, what remains uncertain and what security teams can do.
An estimated $6.3 billion impact at a cryptocurrency exchange. Millions of account records exposed. A government data extraction affecting hundreds of thousands of identity numbers. The past two weeks have brought sharply different kinds of cyber risk into view.
We selected this briefing for documented financial impact, significant scale, public-service consequences or the importance of the organisation affected. The dates below are disclosure or major-update dates; some intrusions began earlier. Numbers are not comparable: dollars, records, customer accounts and potentially affected servers measure different things. Estimates and allegations are labelled.
Global: Binance reports an estimated $6.3 billion impact
29–30 October. Binance estimated the impact of a security incident at approximately $6.3 billion. Associated Press reported that approximately $3 billion had been frozen on-chain at the time of the company's initial update; the amount frozen is not the same as the final net loss. Binance subsequently said its investigation had identified additional breach points beyond an initially suspected laptop compromise. Reuters reported a theft of digital assets. The final attack chain and recovery status remain under investigation. Binance update; Associated Press; Reuters.
What to do: For high-value transaction systems, test withdrawal limits, independent approval, key and session isolation, and emergency suspension. Rehearse the decision to halt activity and the process for coordinating with external counterparties.
South Korea: police allege 8.2 million pieces of personal data stolen
26 October. Seoul police said seven suspects allegedly stole 8.2 million pieces of personal data and other internal records from more than 90 entities, including hospitals and businesses. The alleged activity extended from September 2025 into 2026. Police said the group demanded a combined 360 million won from 38 affected entities; that is a reported demand, not a verified loss or payment. Yonhap.
What to do: Assess external attack paths across all subsidiaries and suppliers, not just flagship systems. Correlate authentication failures, scanning and unusual exports, and test incident escalation when several organisations face a common campaign.
Japan: Capcom account records exposed
22 October. Capcom reported 11,774,247 records containing email addresses and account-related metadata. It said passwords were changed without authorisation for 196 accounts, a subset of the larger population. It reported no leakage of credit-card information or users' existing passwords. Capcom (Japanese); BleepingComputer.
What to do: Monitor account recovery and password-change activity; protect high-risk changes with strong authentication. Explain to customers that exposed account metadata can support more convincing phishing.
Japan: So-net reports 2.14 million membership records leaked
27 October. Sony Network Communications' So-net reported 2,141,986 current and former membership records leaked. Its notice separately describes exposures involving other services, including some email-address passwords; those categories should not be added without checking overlap. So-net notice (Japanese).
What to do: Separate identity data from credential stores, reduce retained data, and practice targeted credential resets. Notify people using channels that cannot be confused with a phishing link.
Europe: Moldova estimates data tied to 750,000 identity numbers extracted
28 October update. Moldova's Cybersecurity Agency estimated that data associated with approximately 750,000 national identity numbers was extracted after unauthorised queries against public digital services. This was a preliminary estimate; not every affected person had every listed data type exposed. The agency said it examined 82 services and temporarily disconnected exposed services and other systems. Moldova Cybersecurity Agency.
What to do: Inventory unauthenticated endpoints and limit what each can return. Test for repeated data harvesting, ensure that authorisation is enforced per request, and retain useful audit trails.
Japan: JAL reports 92,000 customers in supplier-system exposure
30 October statement. Japan Airlines and Japan Transocean Air reported traces of access to reservation data for approximately 92,000 customers via the Amadeus passenger-service system. About 2,000 were in a group whose data included passport numbers and other additional details. The identified access period ran from August 2023 to September 2026; card numbers and passwords were not compromised, the airlines said. Japan Airlines.
What to do: Map sensitive information held by transaction providers, define notification timelines and required evidence, and test whether customers can independently verify communications about bookings.
Japan: GMO identifies 26,739 potentially affected servers
21 October disclosure; later updates. GMO said unauthorised access to Onamae.com Desktop Cloud installed malicious programs in some customer environments. It identified 26,739 servers as potentially affected, not as a confirmed count of compromised servers. GMO later reported unfamiliar transactions involving some customers. GMO; Associated Press.
What to do: Map credentials and downstream accounts reachable from managed desktops. After a provider incident, inspect sessions and endpoints, coordinate credential resets and verify recovery with each dependent business service.
India: SBI reports 3,897 customer records identified
21–23 October. State Bank of India disclosed that it had identified 3,897 customer records containing personal information in a larger dataset found online, and subsequently said it contacted affected customers. The bank was investigating the source and extent; this is not a confirmed count of compromised accounts or financial losses. The Statesman; SBI disclosure summary.
What to do: Reconcile data exposure with the affected customer population, notify individuals through established channels and monitor for impersonation using leaked personal details.
China: Hong Kong examinations authority reports 16,900 applicants affected
30–31 October. Hong Kong's Examinations and Assessment Authority reported that personal data of 16,900 mainland residents applying for two international examinations had leaked. The information included names, dates of birth and email addresses. It said there was no evidence that the separate DSE or other examinations were affected. RTHK.
What to do: Segregate examination platforms, minimise applicant data in externally accessible systems, and test both access controls and incident-notification workflows.
Argentina: municipal systems interrupted across five provinces
23 October. Roldán's municipality said an attack on provider PGM left its municipal system unavailable. Local reporting counted interruptions affecting at least 17 municipalities in five provinces; some were identified through inaccessible websites, which does not establish that every internal system was down. Roldán municipality; source-based incident review.
What to do: Exercise a manual fallback for essential payments and services, then reconcile transactions after recovery. Ask shared providers how their recovery plan handles simultaneous outages across customers.
How to read this selection
The financial figure for Binance, the Korean police's allegations and the other organisations' record or server counts are different measures. The briefing does not imply that every affected record represents a unique person or a financial loss. It does not claim to list every global incident. We did not include a case from every region merely to fill a geographic slot when a qualifying impact could not be verified to the same standard.
What connects these incidents?
A dependency can multiply the blast radius. JAL's report concerns reservation data handled by a technology provider; municipalities relied on a common platform; GMO's desktop environment connected customers to other services. For each critical supplier, map which business processes and data depend on it, identify the customer-side owner, and test what happens if the provider's service or credentials cannot be trusted.
Exposure is a starting point, not the whole outcome. An email address, booking reference or other context can support persuasive impersonation even where payment data was not exposed. Brief help desks and customers on the exact information at risk, verify unusual requests through an independently sourced channel, and watch for account-recovery abuse.
A number needs a unit and a timestamp. Affected records can overlap, a potentially affected server is not a confirmed compromised server, and an attacker demand or frozen sum is not an established net loss. Keep the source date alongside every figure and update decisions as investigations progress.
A practical 48-hour review for security leaders
- Identify exposure: Name the owner of each external provider and internet-facing service that handles customer information or can execute sensitive transactions. Capture the service, data, privileged access and business dependency.
- Check identity and recovery: Review administrative access and recent changes; test session revocation, credential rotation and an independent recovery route. Ensure the response does not assume that the affected provider is available.
- Exercise continuity: Pick one critical workflow—such as payments, customer support or fulfilment—and run a short tabletop covering supplier outage, manual approval and later reconciliation.
- Brief the people receiving requests: Give help-desk and finance teams concrete examples of impersonation and a known callback channel. Record who decides whether customer notification or escalation is needed.
- Track evidence and decisions: Record what is confirmed, what remains unknown, who owns each follow-up, and when to reassess. Adjust the plan to the facts and obligations of your organisation.