Cybersecurity Briefing – Thursday, Nov 5, 2026

Breachsense lists a claim by a group it calls SCARLETTGROUP against the operator of Medina Regional Hospital and clinics in Hondo, Devine and Castroville. The tracker warns that such claims come from the threat actor and are unverified. It gives no data types or leak size. The health system's home page showed no incident notice when checked; subpages were not reviewed. Attack type and patient impact are unknown.

Breachsense →

Breachsense lists a Chaos claim of a 325 GB leak and places the company in Texas. No data categories are listed, Darr has not confirmed anything I could find, and its website would not open during this run, so the Texas location rests on the tracker.

Breachsense →

Included because it was not in earlier briefings. The Indianapolis employer-clinic provider says someone posing as its IT staff got an employee's credentials, then exported data from a cloud-hosted application over a few hours on Aug 24. Exposed data includes names, contact details, birth dates and Social Security numbers; the Texas and Vermont filings also list medical and insurance information. The Texas AG site lists 234,534 Texans, while law firm Emery Reddy says the Texas AG was told 5,684,735 people overall. HIPAA Journal flags those figures as inconsistent, and the federal HHS portal had no listing. No group has claimed it. Letters began Oct 20. Indiana University is a named client; Texas employer clients are not named.

Action: Texas employers using Marathon clinics should ask whether their workforce data was included.

HIPAA Journal →

The employee benefits enrollment firm appears on the Texas AG portal with an Aug 31 incident date. Names and Social Security numbers are listed. Cause, discovery date and the national total are not disclosed. This comes from a law firm's solicitation page summarizing the portal; I could not open the portal listing itself.

Strauss Borrelli →

Yesterday's briefing said the incident was unresolved Tuesday morning. Abrigo's status feed later marked it resolved, with the platform available except borrower-facing capabilities. The feed says nothing about whether customer data was accessed, and I found no newer disclosure.

Abrigo status →

The web host says an intruder exploited a vulnerability in third-party software behind its web File Manager, found Oct 23. FTP/SFTP credentials of users who logged in during the period were taken, along with webmail logins for a limited number of users, and some mailboxes may have been viewed. DreamHost says well under 10% of email and FTP/SFTP accounts were affected and control panel logins and billing details show no sign of access. TechCrunch reports session tokens were obtained and customer files were stolen. The California AG record gives Aug 15 as the breach date. The vulnerability, attacker and customer count are undisclosed; Texas customers are not identified.

Action: DreamHost customers should rotate FTP/SFTP and mail passwords and check mailbox forwarding rules and filters.

DreamHost →    TechCrunch →

Stars and Stripes reports that two months after late-August freezer outages at at least six bases or stores, officials still will not say whether anything malicious happened or how much was lost. A Daily Caller report carried by WND names Fort Huachuca (AZ), Fort Irwin (CA), F.E. Warren AFB (WY), Naval Station Newport (RI), Columbus AFB (MS) and Travis AFB (CA). No Texas installation is named. Defense One reported Nov 2, from two unnamed sources, that officials suspect Iran-linked hackers; that is not an official attribution. A researcher separately counted 2,843 internet-exposed refrigeration controllers in the US, though he says the scan may include other device types.

Action: Texas grocers, hospitals and blood centers should take refrigeration controllers off the public internet and replace default credentials.

Stars and Stripes →

SecurityWeek counts at least a dozen breaches in about a month, aimed at stored customer secrets and AI access tokens for resale. Others named are Andromeda, NVIDIA's Brev, CommandCode, Fireworks AI, Lightning AI, OpenCode, Railway, Warp and Zeabur. WorkOS says an internal sales application was compromised Oct 30, exposing contact details, customer communications and product-use information. Entry methods vary and the attacks do not appear related. The Artex AI pentest framework was used against WorkOS and Chainstack, but neither is tied directly to China-linked Storm-0940.

Action: Customers of these platforms should rotate API keys and any secrets stored there.

SecurityWeek →

New since yesterday: customers shared support replies saying a hacker took an encrypted database from mSecure Cloud, with no evidence its contents were accessed. That comes from those replies, not a public company statement. The number of users and the method are undisclosed, and mSeven had not answered BleepingComputer at publication.

Action: mSecure users should change stored passwords, re-enroll 2FA and remove passkeys as the company advised.

BleepingComputer →

Included because it was not in earlier briefings. After a network and communications incident Nov 2, Turning Stone Resort Casino, Point Place Casino, YBR Casino, The Lake House at Sylvan Beach, Maple Leaf Markets and SavOn stores went cash-only. ATMs, TS Rewards, bingo and sports betting were unavailable. The company says it is not aware of confidential data being accessed. Attack type and actor are undisclosed, and I found no restoration update.

DysruptionHub →

Canada extradited Roach, 35, to Rochester, NY; co-defendant Mathiew James Stubbings, 41, is still in Canada. Prosecutors allege the pair hacked educational institutions with supercomputers to steal credentials and mine cryptocurrency. Institutions are not named in the coverage I read, only states: New York, Tennessee, North Carolina and Massachusetts. Texas is not listed. All conduct is alleged.

The Record →

The bank confirmed a sophisticated attack through a service provider's platform. Money moved from the bank's own account to other banks and was then converted to crypto. Investigator ZachXBT estimated more than $133 million; the bank would not confirm the figure but said it could validate the order of magnitude. It says customer accounts were not accessed, its solvency is not at risk and some assets are frozen. The supplier and attacker are unnamed, and the bank disputes reports that entry came through its Fortuneo subsidiary.

The Record →

ENISA says incidents began Oct 11 across several member states, with a new wave Nov 1–2. Named in the second wave are Delhaize, Carrefour and Spar in Belgium and Coop and ICA in Sweden; Colruyt and Intermarché reported technical problems without calling them cyberattacks. At Etablissement Français du Sang, whose three blood bank sites are unnamed, Reuters-based reporting says the situation was under control Wednesday, remote access was disabled and blood supplies were unaffected. No actor is identified. Lupovis saw probing with default credentials against Danfoss AK-SM controllers from Oct 20–30, from networks it links to Russian adversaries; that is one vendor's observation. Country counts differ between reports.

ENISA →    Help Net Security →

Hackers reached the outlet's content management system and newsletter service and sent readers false emails, including a claim that Zelensky launched a nuclear warhead at Kyiv. Staff removed posts from the site quickly. The outlet says payment data sits with third-party processors. It calls the attack suspected Russian, based on message content; there is no formal attribution, and how access was gained is not stated. The Record says no connection is confirmed to last week's fake alerts in Ukraine's air-raid app.

The Kyiv Independent →    The Record →

CISA's pages would not open during this run, so KEV details below come from secondary reporting. A third-party KEV mirror showed Nov 4 as its newest addition.

This 2024 Pointer Authentication bypass (CVSS 5.5) is part of iPhone exploit chains Sekoia attributes to APT29 with moderate to high confidence. The campaign stole browser cookies through compromised sites, lookalike domains and the Plerdy analytics tracker from Aug 27 to Sept 3. Lookalikes impersonated America250 and a London hotel, Raffles London at The OWO. A major US chemical-industry trade association was among compromised sites, but Sekoia does not name it. Other victims are also unnamed, the number of infected devices is not disclosed, and no Texas link was found.

Action: Update Apple devices. Sekoia lists older Android Chrome versions (139–145) in the campaign too, so update those.

Sekoia →    The Hacker News →

An out-of-bounds write in the CGI program gives unauthenticated command execution as root on ten GS1900 models. Binarly found the exploit in an archive tied to the Red Heron actor and says the attacks blamed on CVE-2026-7273 used this zero-day. GreyNoise tied the Kapibala attacker to 996 switches in 48 countries from about Aug 17; victims are unnamed. Zyxel's advisory does not mention exploitation, and The Hacker News notes neither firm confirmed the attacked switches had the earlier fix. Binarly scores it 9.8; NVD shows 8.8. No workaround is listed, and models outside the support period get no patch.

Action: Install firmware 2.90 Patch 3 and keep management interfaces off untrusted networks.

Zyxel →    BleepingComputer →    The Hacker News →

Reminder from Wednesday's briefing. BleepingComputer cites Wordfence blocking 13,095 attacks in 24 hours; those are attempts, and CISA gave no attacker details. No victims are named. WordPress's advisory still shows no CVE and a Low rating, unlike the CVE record reported as 8.1.

Action: Update to 7.1.4 or your branch's patched release, back to 4.7.39.

WordPress advisory →    BleepingComputer →

Synology points to advisory SA-24:20, including CVE-2024-10441 (CVSS 9.8), but has not said which flaw attackers use. No victims are named.

Action: Move to DSM 7.2.2-72806-1 or the fixed build for your branch, and keep NAS devices off the public internet.

Security Affairs →

1. Breachsense – Medina Healthcare System
2. Medina Healthcare System – home page
3. Breachsense – Darr Equipment
4. HIPAA Journal – Marathon Health
5. Strauss Borrelli – Fidelity Enrollment Services
6. Abrigo – status history
7. DreamHost – October security incident
8. TechCrunch – DreamHost
9. California AG – DreamHost record
10. Stars and Stripes – commissary outages
11. WND / Daily Caller – named installations
12. Defense One – Iran suspicion
13. Straight Arrow News – exposed controllers
14. SecurityWeek – AI developer platforms
15. BleepingComputer – mSecure
16. DysruptionHub – Turning Stone
17. The Record – Roach extradition
18. The Record – Crédit Mutuel Arkéa
19. ENISA – joint statement
20. Help Net Security – French blood banks
21. Help Net Security – second wave
22. Security Affairs – blood banks
23. The Kyiv Independent – statement
24. The Record – Kyiv Independent
25. Sekoia – Poisoned Source
26. The Hacker News – Apple KEV
27. Zyxel – GS1900 advisory
28. BleepingComputer – Zyxel
29. The Hacker News – Zyxel
30. WordPress – GHSA-4w3m-c66w-69mg
31. BleepingComputer – WordPress KEV
32. Security Affairs – Synology