Cybersecurity Roundup

Several of October’s attacks started with access that someone had already granted. In Denmark, a private company’s legitimate access to the national population register exposed data on 8.8 million people. In Japan, a contractor’s stolen account was used to attack NEC’s customers, and a login flaw let ransomware into a cloud provider. This Cybersecurity Roundup for October 2026 covers the key incidents and exploited vulnerabilities, with what each means for businesses.

Cyberattacks in the October 2026 Cybersecurity Roundup

Denmark’s Central Population Register (CPR)

Denmark’s Ministry of Research, Education and Digitalisation disclosed on October 5 that irregular activity had been observed in the national population register during September and that unauthorized parties had gained access to data. The CPR administration learned of the irregular activity on the evening of October 2 and, according to Help Net Security, notified the Danish Data Protection Agency on October 4. According to the ministry, information on about 8.8 million registered people was accessed, including residents, deceased people and citizens who have moved abroad: names, addresses and CPR numbers. Help Net Security describes the CPR number as the 10-digit identifier that Danish citizens use for taxes, healthcare and banking. The register holds about 11 million records. The ministry said the access did not include names and addresses of people with name and address protection.

The route in was not a break-in at the register itself. The ministry said the intruders misused the legitimate access of a private Danish company to search the register, and stayed within the kind of information that private companies are allowed to retrieve. The company’s access has been cut off and the police are investigating. The ministry has not named a suspect. The full scope is still being mapped, and the reporting on the incident does not say how many of the accessible records were copied. The ministry advises people never to give out passwords or confidential information by phone or email, even if the caller knows their name, address and CPR number; Help Net Security notes that fraud attempts are a risk.

What this means: A legitimate, narrowly scoped account was enough to search most of a national register. Access granted to outside companies needs monitoring for unusual volume, not only strong authentication.

Fehmarnbelt Tunnel Contractor FLC

Sund & Bælt, the Danish company behind the Fehmarnbelt tunnel between Denmark and Germany, said on October 13 that Femern Link Contractors (FLC), one of the project’s main contractors, had suffered a cyber incident. According to Sund & Bælt, the attack hit FLC’s IT systems in the night to Monday, October 12. Danish reporting says employees were told to stay off their computers, several vessels were idle and the project was at a standstill. By October 16, Sund & Bælt said work had gradually resumed in several areas, with earthworks continuing unhindered, and that the National Unit for Special Crime is investigating.

On November 2, a hacker group publicly claimed the attack. It says it had access for about a month, holds 2.44 terabytes of confidential data and is offering it for sale. As of writing, these claims have not been verified, and the extent of any data loss and the effect on the construction schedule have not been established and may change.

What this means: A contractor’s office IT can stop work on the ground. Continuity planning has to include suppliers’ systems, not only the owner’s.

Japan: IDCF Cloud and Osaka Metropolitan University

Two Japanese incidents show what a compromised provider can do to its customers. On October 7, ransomware hit IDCF Cloud, the cloud service of IDC Frontier, and affected 495 companies and local governments. According to IDCF’s seventh report of October 27, which says its investigation is complete, the attackers broke into the authentication system of the customer portal through a flaw in open-source software, gained administrator rights over the virtualization platform and encrypted virtual servers. IDCF found no sign that data on customers’ virtual servers was taken, but confirmed that registration information in the customer portal was queried without authorization for up to 71 customers. IDCF said that restoring the affected zones in their original environment was expected to be difficult, offered migration to a substitute environment and backup retrieval, and reports that backup data could be retrieved for 206 of the 495 customers.

Osaka Metropolitan University was hit earlier, on October 2. Ransomware reached its virtualization platform; according to media reports of the university’s October 5 press conference, about 500 servers stopped and most backups were encrypted. The university’s notices list email, the student portal and academic-affairs systems among those affected, and in-person classes resumed on October 9 on temporary systems. On October 5, the university said that about 130,000 records of academic-affairs data on that platform might have leaked; it is still investigating whether they did. On October 21, it said that its operator NEC had told it how the attackers got in: a company working for NEC was hacked in late September, and its legitimate account was used to reach the university’s systems. NEC reported that several customers were affected and that files in its cloud storage, including personal and system-related information, had leaked. The university relayed NEC’s report that the leaked files included information related to the university; details and numbers are still being confirmed with NEC.

Osaka University was caught up in the same NEC incident. It reported that files with the data of 77,851 students, graduates and staff had been downloaded on September 26 from cloud storage that NEC used to share files with a partner company the university had not been told about.

What this means: In these cases the outcome depended on the provider’s access paths, file sharing and backup design, not on the customers’ own defences. Customers cannot fix that, but they can ask providers how access is secured, which partners handle their data, and keep a backup outside the provider’s environment.

UNM Health Sciences Center, New Mexico

The University of New Mexico Health Sciences Center reported a cybersecurity event on October 26. According to its own updates, its security teams began containment efforts around 11 a.m. UNM Health diverted ambulance traffic between 12:30 and 2:30 p.m., suspended outpatient surgeries and appointments for the rest of the day, and brought systems back in phases from 2:30 p.m. Classes at the health sciences schools were cancelled on October 26 and 27, and by October 28 clinical operations were fully functional again.

UNM said the event affected some end-user devices but did not penetrate core systems or servers, that it did not make concessions to any group behind the incident, and that it had notified state and federal law enforcement. The incident remains under criminal investigation, and UNM has not said whether data was taken. UNM also warned patients, students and staff not to engage with anyone claiming responsibility, because follow-up scams are common.

What this means: Healthcare cannot simply switch systems off, so the useful comparison is recovery speed: ambulance diversion lasted two hours and clinical operations were fully functional again within two days. Phased restoration and a rehearsed response are what make that possible.

Sony Network Communications, Japan

Sony Network Communications, the Sony subsidiary behind the So-net and plala internet services, disclosed on October 27 that a third party had accessed its member database. According to the company, the access took place on October 19 and was confirmed on October 23. Sony reported 2,141,986 So-net records and 443,495 plala records, 2,585,481 in total. These are records, not necessarily distinct people, and they include former members. The data includes names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs, and Sony says membership passwords were not part of it. Separately, email addresses and passwords for 54,401 accounts on four So-net mail services were exposed (the passwords were reset on October 27), as were bank account details in 16 records. Sony says no credit card data was affected, and it has reported the incident to Japan’s Personal Information Protection Commission. Sony describes the cause only as unauthorized access by a third party. The investigation is ongoing.

What this means: Contact details and dates of birth look low-risk, but together with names they give attackers what they need for convincing phishing, and exposed mailbox passwords raise the risk further. Affected members should change passwords that were reused elsewhere and treat unexpected messages with extra care.

Key CVEs in the October 2026 Cybersecurity Roundup

Four sets of flaws were exploited in the wild in October, all of them listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Three sit in widely deployed infrastructure: the Windows shell, a VPN appliance and a firewall management interface. The fourth is in collaboration and development tools that many teams run in-house.

• Microsoft Windows Shell (CVE-2026-96951): a security feature bypass that Microsoft fixed in its October 13 Patch Tuesday and that was already being exploited as a zero-day. It affects Windows 10, Windows 11 and Windows Server 2012 R2 through 2025, and CISA added it to the KEV catalog on October 13.

  It was the only confirmed exploited flaw in a release of 1,407 CVEs, 78 of them rated Critical. Ivanti puts the release at roughly 44% above September’s record and notes that Windows Shell has been a zero-day target several times this year.

  What to do: With a release this large, ranking the work matters most, and the exploited flaw comes first. Teams that cannot patch everything at once should then turn to the Critical remote code execution flaws on network-facing services, which Ivanti lists as including DHCP Server, Message Queuing, Remote Desktop Services and QUIC.

• Ivanti Connect Secure (CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527): a chain of three flaws. CVE-2026-104935 (CVSS 8.6) is an authentication bypass that Ivanti disclosed on October 13, saying it was aware of limited exploitation; CISA listed it the same day.

  Ivanti also noted that a fix for a related privilege escalation flaw used in the same chain was still to come. On October 30, CISA added CVE-2026-111357 and CVE-2026-118527, the remaining parts of the chain, after Ivanti published fixes for both on October 29. Volexity, which discovered the attacks, described the chain as giving an unauthenticated attacker root access on the VPN appliance.

  What to do: Patching on October 13 was not the end of the job. Administrators should confirm that every appliance is on a build that includes the October 29 fixes. Ivanti recommends running its Integrity Checker Tool regularly, but Volexity reports that this chain evades it, so a clean result does not rule out compromise and forensic investigation is needed. Ivanti also recommends moving to the 25.x line, because the 22.x line reaches end of life on January 31, 2027.

• Palo Alto Networks PAN-OS (CVE-2026-0322, CVSS v4.0 8.6): a code injection flaw in the management interface that lets an authenticated attacker with network access run code as root on the firewall. It affects PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not affected.

  Palo Alto Networks observed very limited exploitation when it published the advisory on October 14, and CISA listed the flaw the same day. There is no workaround. The company says the risk is highest when the management interface is reachable from the internet.

  What to do: In addition to upgrading, restrict the management interface to trusted internal addresses or a single jump host.

• Atlassian self-hosted products (CVE-2026-21589, CVSS 9.3): an arbitrary file access flaw that lets an unauthenticated attacker read specific files in the web application root of self-hosted instances of eight Atlassian products, among them Jira, Confluence, Bitbucket and Crowd. The attacker has to know the exact file name and path. Atlassian disclosed the flaw on October 5 and said it cannot tell whether individual customer instances have been compromised.

  After watchTowr published a technical analysis on October 6, security firm Previdian observed exploitation attempts within about two hours, and CISA added the flaw to the KEV catalog on October 15. watchTowr showed that in some Crowd-integrated deployments, a file read can expose application credentials and lead to administrator access.

  What to do: Update to the fixed versions in Atlassian’s bulletin. Where patching has to wait, apply Atlassian’s mitigations, such as blocking the traversal patterns at a web application firewall or proxy. Atlassian says to remove affected instances from the internet until they are patched or mitigated; restricting access to known IP addresses is a further option.

When Legitimate Access Becomes the Way In

Several of October’s incidents come down to access that already existed, not to exotic malware. Denmark’s register was searched through a company’s legitimate access. Osaka Metropolitan University was entered with a contractor’s legitimate account, and Osaka University’s data sat in cloud storage shared with a partner it did not know about. IDCF’s customers were hit through the provider’s own login system and its control over the virtualization layer. In most of these cases, the weak point was access that existed for a good reason and was not limited, monitored or revoked tightly enough.

That makes an access inventory a practical first step: which partners, contractors and providers can reach your systems or your data, with which accounts, from which devices, and for how long. The CVEs point the same way. VPNs, firewall management interfaces and remote-access tools are the doors that attackers test first, so they should not be reachable from the internet unless they have to be, and they need patching that does not wait for the next maintenance window. Backups belong outside the environment they protect, since both Japanese incidents show that backups reachable from the same platform can be encrypted along with it.

The patterns above map to work DIESEC does every day. Penetration testing and red teaming test the access paths attackers used this month, such as partner accounts, VPN gateways, management interfaces and self-hosted tools, the way an attacker would. Managed Detection & Response with NovaMDR™ and our SOC as a Service help you see the misuse of legitimate accounts and unusual query volumes, which is what the Danish and Osaka cases came down to. Governance, Risk and Compliance support helps define who owns supplier and partner access, including under NIS2.

If October’s incidents raise questions about your own exposure, such as who has access to what or how far a compromised partner account could reach, we are happy to talk them through via our contact page.

This post may contain AI-generated images, graphics and/or photos.