The week in breach news Oct 21, 2026

ConnectWise shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, after hackers accessed application identities and compromised Microsoft 365 tenants.

The company said it recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment and shut down application access for its partners and clients. Reports of malicious activity began emerging on Friday, October 16, with administrators observing unauthorized access to client data in Microsoft 365 tenants. Microsoft also confirmed the activity, reporting unauthorized authentication attempts from an IP address on October 15.

Following the incident, ConnectWise said scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. The company has also temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.

The credential-theft campaign GhostAction has recently ramped up, targeting more than 30,000 GitHub repositories across 3,000 users and organizations.

GhostAction is a supply chain attack campaign targeting developer infrastructure on GitHub. First discovered in September 2025, it involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories. Between August 31 and September 30, 2026, the campaign affected 772 public GitHub repositories, targeting 2,577 secrets. It then accelerated sharply, with a major spike between October 8 and 9 that affected more than 30,000 repositories across 3,000 users and organizations.

Campaigns targeting repositories on Microsoft-owned GitHub are growing in number. A recent automated malicious campaign dubbed Megalodon affected more than 5,000 GitHub repositories. These campaigns aim to steal continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens for platforms such as npm, PyPI and Docker Hub, and AI provider API keys.

A hacker accessed the data of millions of students in California following a third-party data breach involving the California Department of Education's nonprofit contractor.

On October 16, the California Department of Education said a hacker accessed student data by exploiting the systems of Educational Testing Service (ETS), a nonprofit that works with the state. ETS began notifying students and their families of the breach, which was identified late last month but had been ongoing since May. An unauthorized party used compromised login credentials to access the site and copy files between May 22 and September 18, 2026. The files contained students' personal information, including names, birth dates, addresses and disability status.

The hacker accessed data belonging to students enrolled during the three previous school years. According to the department, more than 5.7 million students were enrolled in California during the 2025–2026 school year alone.

Following major operational technology (OT) refrigeration hacks in France, Dutch-Belgian grocery giant Ahold Delhaize suffered a widespread cybersecurity incident that forced it to take its global IT networks offline for several days.

Ahold Delhaize is one of the largest food retailers in the United States, operating brands such as Stop & Shop, Giant Food, Hannaford and Food Lion. The cybersecurity incident prompted the company to shut down customer-facing e-commerce systems, mobile applications and delivery logistics, disrupting operations across the U.S. and Europe.

The investigation is ongoing, and the company has not disclosed further details about the incident.

A breach at OpenCode Console may have exposed API keys for OpenAI, Anthropic and Google saved by users of the service.

On October 16, an intruder accessed a legacy system at OpenCode and may have exposed third-party AI provider keys stored in OpenCode Console. Console is OpenCode’s optional hosted service, where workspaces save their own OpenAI, Anthropic or Google API keys. The service uses these keys to call the respective providers, allowing team members to use AI models without seeing the keys themselves. The incident affected 1.4% of Console users, all of whom had linked an external AI provider. OpenCode has emailed those users, instructing them to revoke their existing keys with the respective providers and replace them.

The company said the breach was related to a large-scale distillation attack and that it is working with Anthropic, OpenAI and Google to address the issue.