Good morning. Four items today, and they split cleanly between confirmed damage and pressure tactics.
11 million records, one app server
Burger King Japan confirmed attackers accessed its mobile app customer database between October 2 and 7. Eleven million records: names, birth dates, phone numbers. That is the full account-takeover starter kit for every affected customer, and it came from one compromised app server, not the restaurant network. No payment cards reported so far.
What to do: segment your data stores away from the app tier, tighten retention, and watch for phishing that knows a customer's name, birthday, and phone number.
A state space company in the crosshairs
Switzerland's state-owned space company Beyond Gravity reported a targeted cyberattack by what it called a highly professional actor, with Chinese involvement suspected internally. No vector or scope disclosed.
What to do: when a state space company gets targeted, every supplier in that chain should be segmenting engineering networks and forcing phishing-resistant MFA on privileged accounts.
38 ships on a ransom list (unverified)
The n0n ransomware group listed 38 maritime firms across 18 countries on its leak site, demanding $2.4M to $14M in Bitcoin each with a deadline of October 19. No victims have confirmed. Treat leak-site lists as extortion pressure, not confirmed incidents.
What to do: run the drill anyway. Backups isolated and tested, OT segmented from IT.
Healthcare ransomware keeps climbing
Ransomware attacks against US healthcare rose 64% in Q3 2026, with 618,149 records exposed in confirmed attacks alone (Comparitech). Healthcare stays the top target because care cannot wait out an encryption event.
Hunt with on-disk artifacts
On the hunting side, the IoC Library now carries the concrete ARMORY CASTLE file and URI indicators: the mangoapi.php web shell marker, the /usr/bin/dbus-authd SUID shell, the zz-root-persist boot script, the /uidchanarge HAProxy path, and the sudoers.template changes from the BeyondTrust zero-day campaign. Hunt with on-disk artifacts, not logs; that actor deletes them.
Full entries with huntable indicators: kevinthecyberguy.com/vuln-watch and kevinthecyberguy.com/ioc-library
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com