Cyber Attacks Today: The Biggest Hacks, Breaches and Flaws of Black October 2026, in Plain English

Business Today traced the label “Black October” to a viral X post listing incidents on October 22, 2026. This roundup checks those claims against company notices, government records and established reporting. The name describes the collection; it does not show that the incidents were coordinated.

This cyber attack today roundup covers reports through October 22 and shows whether a company's systems, your account or a student's data may be affected, plus what to do. We separate incident dates from later updates and label estimates.

The timeline below runs newest first.

What the viral Black October list got right and wrong

All 27 items had sources, but some claims misstated timing or scope.

• Claroc rechecked 40 shares on October 20; none opened, and it reported no known misuse.
• Railway told every customer to rotate stored secrets, although only a subset may have been affected.
• GMO advised Onamae trading-tool users to change passwords from another device and end active sessions.
• The joint SafePay advisory says attackers used network-device flaws and stolen or guessed passwords.

What company got hacked today: cyber attack incidents, newest first

Timeline lists reports from October 1 to 22; later updates are labeled.

• The CDE testing notice says the pause applied to records added or changed on or after September 25.
• SBI said its core business continued normally in the stock filing.
• Zeabur said incomplete access logs leave some of the impact scope unknown in its October 19 report.
• GMO's October 22 notice says some customers reported unauthorized trading-account operations.

California ETS student data breach: what was taken and what families should do

California's testing contractor, Educational Testing Service (ETS), says someone used a compromised login to copy student files at various times between May 22 and September 18, 2026.

ETS runs the state's school tests. It spotted the incident on September 25 and took the file site offline. The district family briefing summarizes the official ETS notice.

An SFTP site is a secure file-swap server. On October 2, the California Department of Education (CDE) told school leaders ETS had paused enrollment processing and some testing. GovTech reported the letter. An October 1 testing notice says the pause applied to new or changed records from September 25.

The district summary says the data may cover “all students enrolled in the three previous school years” and could go further. The state has given no single total, so we give none.

• Copied (varies by student): name, date of birth, home address, school, grade, student ID numbers, race, language and test results.
• Also copied: disability status, Section 504 status (related to disability accommodations at school), testing accommodations and the type of disability.
• Not included: Social Security numbers, driver's license or passport numbers, bank or card details and passwords. The notice says parents' details were not involved.
• Free help: ETS offers two years of Experian IdentityWorks. The district family briefing lists the March 19, 2027 enrollment deadline for minors.
• What to watch for: emails, texts or calls that mention a student's school or tests. Never share passwords or bank details in reply.

SBI data breach: 3,897 customer records, and what the filing did not list

State Bank of India told the stock exchanges on October 21, 2026 that it found 3,897 customer records with personal details.

The 3,897 were among about 375,000 records on the dark web (online places where stolen data is traded).

SBI's stock-exchange filing says the bank was alerted October 16 by its threat service, the Defence Cyber Agency and CERT-In, India's cyber safety agency. It calls this a loss of certain data but does not say how it got out.

SBI's safety advice says to report cyber incidents to report.phishing@sbi.co.in or the cybercrime helpline 1930.

• The filing says the records reportedly included names, mobile numbers, dates of birth, gender, email and home addresses. They also listed branch and customer ID numbers, lead IDs and loan or lead-record details.
• Not in the list: account numbers, balances, passwords, OTPs (one-time codes), cards, PAN or Aadhaar (India's tax and national ID numbers), as The Hacker News reports.
• What the bank did: it hired an outside cyber firm to investigate. It says its core business runs normally.
• What customers can do: the filing gives no customer steps. A caller could use your name and loan details to sound like the bank. Verify unexpected callers through official bank contacts. Never share a PIN or OTP.

The hacks that touch AI tools and AI keys

Five incidents hit AI tools or API keys (app access codes); two involved AI agents used by attackers.

For affected LiteLLM releases, stop and rebuild systems that ran them, then replace every password and key those systems could reach. Older versions and private enterprise releases were unaffected.

PingCAP says copied TiDB Cloud records included customer accounts, SQL-editor data (from its database editor), business records and encrypted API keys. It found no evidence customer databases were accessed, according to its security notice.

• LiteLLM and OpenCode: LiteLLM's October 21 version 1.107.0 contained password-stealing software, according to LiteLLM's report. PyPI (Python's package index) downloads were affected 11:39–13:23 UTC; Docker images (ready-made server software) 11:46–14:20 UTC. Read our LiteLLM guide. OpenCode said keys saved in its online console may have been exposed; see our OpenCode guide.
• Meta Muse: Claroc's analysis found 6,800+ share hostnames (web address names) in passive DNS (records of domain lookups); this was not 6,800 confirmed accessible chats. Claroc reported that Meta told Ars Technica on October 20 it would suspend sharing; none of 40 previously open shares opened in Claroc's recheck. Read our Meta Muse guide.
• Railway, October 21: the hosting company says an intruder may have read environment variables (stored settings that can hold secret keys). It asked all customers to replace secrets and registry passwords (codes for downloading private software) and review service logs. Read our guide.
• Zeabur: its October 20 status report says compromised login details reached shared clusters and some Google Cloud servers; the attacker read stored settings, account information and project data. The investigation continues. Zeabur urges customers to rotate passwords and keys, including API and zSend email access codes. A shutdown notice says shared clusters pause on December 1 and servers stop by December 31; some dedicated servers end sooner.
• Cairn and ConnectWise: one hacker's agents breached websites at 100+ companies and attempted access to 1,200+ sites, Reuters reported. See our AI agent attack guide for the company-by-company details. Deere said it had “no indication that sensitive information was accessed”. Microsoft says Storm-0940 used ARTEX, an AI agent, to attempt sign-ins to more than 2,250 Microsoft 365 organization accounts; that is not a count of confirmed compromises, according to Microsoft's report.

Software flaws to fix this week

This week's fixes cover PHP, self-run GitLab, NGINX and Signal.

October reporting also highlighted a Signal flaw fixed earlier, with a September 4 code change. A fix from the software maker is called a patch. PHP, self-run GitLab and NGINX fixes usually need your server administrator or web host. Signal updates apply to phones and computers.

• PHP2Shell: PHP fixed two critical flaws on October 21. The NSA posted on X that sites which cannot update should go offline. Our guide: PHP2Shell explained.
• GitLab: a flaw rated 10 out of 10 affects self-run GitLab versions going back to 2014. GitLab.com is already fixed.
• NGINX: F5 rates three NGINX flaws as critical (9.2 out of 10) and fixed them on October 14.
• Signal: the call bug only works for someone already on the call. Install available Signal updates. The fix is in RingRTC 2.72.0 and later, the software Signal uses for calls.

Company outages and ransomware warnings this month

This section covers the Bullhorn incident, Ahold Delhaize’s precautionary outage and the FBI’s SafePay ransomware warning (ransomware locks files and demands payment).

Bullhorn's staffing platform, used by 10,000+ firms, went offline on October 17 after a cyber incident. Its customer FAQ said it had not determined whether data was copied out; Bullhorn's status page carries restoration updates.

Tor users who accepted an unfamiliar SSH host key (a server identity check) and entered a password from October 1 to 5 should change it and check the server. Relay operators should audit, per the Tor report.

• Bullhorn: reset non-SSO passwords (passwords outside a shared company login) when prompted, and replace API passwords (app connection codes) as instructed.
• Ahold Delhaize: the owner of Food Lion and Stop & Shop took systems offline as a precaution. Stores stayed open.
• SafePay: the joint FBI and CISA advisory says the gang breaks in through network-device flaws and guessed passwords.
• Medi-Cal: The billing company found the break-in on October 13, 2025. Letters were dated September 14, 2026. The October 20 report put the scale above 970,000 members. Its breach notice advises reviewing statements and credit reports, and considering fraud alerts or credit freezes.

What to do this week if you were caught up in a breach

If you were affected, use the relevant steps below.

Replace credentials that the company identifies as exposed or advises rotating. Verify unexpected messages through official channels before sharing information.

Follow the steps that match your services, devices or personal data, including former students and Medi-Cal members.

• Onamae: change trading passwords from another device and end active sessions, as GMO advises.
• Check AI bills: look at your OpenAI, Anthropic and Google AI usage pages for spending you do not recognize.
• Turn on two-step login [a second code or approval after your password] for email, bank and work tools. Two-step login adds protection, but some attacks can bypass it.
• Treat breach messages with care: leaked names, schools and loan details can make scams sound real.
• Take the free ID protection offered in any breach letter you receive.

Why Elephas is a more private choice for work files

Most of this month's incidents hit data sitting on someone else's servers, and cloud AI tools are servers you cannot see too.

What ChatGPT, Gemini and Claude receive

ChatGPT, Gemini and Claude process your questions and uploads on their servers. Chats may be kept there and, depending on plan and settings, used for training, as OpenAI, Google and Anthropic explain.

Elephas hides detected personal details on your Mac first

On cloud routes, Elephas detects and hides names, emails and phone numbers on your Mac before selected text leaves. Detection can miss details, works best in English, and shows what it hid. Elephas AI does not store or train on those details; your own key follows its provider's terms. Elephas restores details in answers.

Local models make answers on your Mac

With the Elephas local model, the answer is made on your Mac. Your questions and documents are not sent anywhere.

Elephas Team gives your company one private place

Elephas Team gives a company one shared, private place for its files, with roles for managers, contributors and readers. Team costs $29 per person per month.

• Every answer shows which of your files it came from.
• Your documents stay stored on your computer.
• Works on Apple Silicon Macs with macOS 14 or later.
• Plans start at $19 a month. The individual plan has a 7-day free trial on one computer at elephas.app.

Conclusion

Black October's 27 list items describe very different events. Our source check found evidence for each topic, but several viral descriptions stretched timing, scope or who was affected. A disclosure date does not necessarily mark when an attack began, and possible exposure is not confirmed data theft.

Match each report to a service, account or letter that applies to you. Follow provider notices and check official contact details before replying; investigations can change what is known.

Onamae customers who stored trading credentials should change them from another device and end active sessions, as GMO advises.

• ETS has issued family notices; the billing company's letters were dated September 14, 2026, so read them before you reply to any message about the breach.
• Keys, secrets or chats in AI tools may have been exposed in the five highlighted incidents, so follow the relevant response steps and rotate exposed keys from a clean environment.
• Attackers used AI agents in at least two campaigns this month.
• For private AI on work files, Elephas detects and hides personal details on your Mac before a question goes to a cloud model; detection can miss details.

Written by

Selvam Sivakumar

Founder, Elephas.app

Selvam Sivakumar is the founder of Elephas and an expert in AI, Mac apps, and productivity tools. He writes about practical ways professionals can use AI to work smarter while keeping their data private.

LinkedInFollow