The week in breach news Oct 28, 2026

Ransomware attacks on the U.S. educational sector show no signs of letting up, with two East Coast school districts hit in separate incidents within days of each other.

Richmond Public Schools in Virginia confirmed a ransomware attack on October 21 after teachers arrived to find ransom notes displayed across their laptops, with no access to Wi-Fi, cameras, phones, copying, Smartboards, Chromebooks or the PowerSchools learning platform. As of this writing, the district’s network access remains unavailable, and teachers and students are still operating without normal digital resources. Meanwhile, the Oneonta City School District in New York is recovering from a separate ransomware attack first discovered on October 22, which forced the district to close schools for two days.

No ransomware group has claimed responsibility for either attack. The incidents add to a growing wave of cyberattacks targeting U.S. schools and edtech providers, with the California Department of Education and edtech company Frontline Education both coming under attack in recent weeks.

U.S. medtech provider Quest Diagnostics reported a cyberattack on its patient test result system, raising concerns over the potential exposure of protected health information (PHI).

Quest is a major U.S. laboratory testing company whose services support health care professionals in diagnosing and monitoring medical conditions, from routine laboratory testing to specialized areas such as cancer, infectious diseases and neurology. In an SEC filing on October 22, the company disclosed unauthorized access to its Quanum LSM system, which is used by certain clients to place test orders, receive results and look up patient test information. Quest became aware of the breach on October 21 and believes the attacker accessed certain patient records, though the full number of affected individuals has not yet been disclosed.

The breach puts Quest in the company of a lengthening list of U.S. medtech providers grappling with cyberattacks this year. Medtronic, AdaptHealth and iRhythm have all reported significant patient data exposure in recent months, painting a concerning picture for the sector as a whole.

Police services across Canada have started suspending their use of the Crime Stoppers program after safety company Navigate360 acknowledged a widely publicized breach that exposed millions of confidential crime tips, seven months after it first occurred.

In March 2026, an attacker known as “Internet Yiff Machine” claimed to have broken into tip intelligence platform P3 Global Intel, an arm of Navigate360, and stolen 93 GB of data, including 8 million confidential tips. At the time, Navigate360 said it was investigating the claim and declined to comment further. Seven months later, the company has now publicly acknowledged that hackers broke into one of its systems and copied months’ worth of data.

According to reports, sensitive information from more than 1.5 million tips submitted to the Canadian Crime Stoppers program was exposed in the breach. The compromised data includes names, addresses, dates of birth, Social Security numbers and other sensitive information belonging to individuals who submitted tips to the program.

A hacker disclosed customer information belonging to Japanese internet service provider GMO Internet Group after the company refused to meet ransom demands.

On October 20, GMO discovered that an unauthorized program had been installed by a third party in the server environments of some of its customers. On October 26, the company confirmed that the attacker had threatened to disclose customer information and launch a ransomware attack unless GMO paid a $50 million cryptocurrency ransom. The company said it would not comply with the demand, stating that payment could not guarantee the deletion of the stolen information or prevent its misuse.

Several Japanese companies, including Goldenway Japan Co and Ava Trade Japan KK, have since reported that their customers were affected by the GMO cyberattack.

Russian state-linked hackers reportedly targeted defense contractors in two NATO allied countries in a recent espionage campaign.

Reports indicate that the attackers targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency across two NATO countries in Europe. Cybersecurity researchers have attributed the attacks to APT28, a hacking group linked to Russia’s military intelligence agency. The reports did not identify the specific countries or organizations targeted.

The hackers reportedly used a recently discovered backdoor known as Hookedge to gain access to victims’ systems, steal credentials and gather intelligence about their networks.