North America
Gmail
A massive email breach has been uncovered, reportedly compromising more than 183 million email accounts, including millions of Gmail users.
Data breach notification service Have I Been Pwned revealed that the stolen emails and passwords were collected through infostealer malware. The breach, which occurred in April, saw cybercriminals quietly gather login details over time. The discovery has raised serious concerns across the tech industry about personal data security and the growing threat of infostealers that harvest sensitive information undetected for sale on the dark web.
SourceHow it could affect your business
Exposed credentials can lead to phishing attempts, account takeovers and even large-scale identity theft or fraud. Beyond individual precautions, organizations should adopt proactive monitoring and enable two-factor authentication to protect users. Leveraging dark web monitoring tools can help detect compromised account information early and prevent attackers from exploiting stolen data.
North America
Nethereum (Open-source .NET integration library for Ethereum)
A sophisticated supply chain attack has been discovered, targeting cryptocurrency developers through malicious NuGet packages designed to resemble the popular Nethereum project.
Cybersecurity researchers found counterfeit packages impersonating Nethereum, a trusted .NET library used for Ethereum blockchain interactions with tens of millions of downloads. The fake packages, named Netherеum.All and NethereumNet, used advanced obfuscation techniques to steal private keys, mnemonics, keystore JSON files and signed transaction data.
Attackers used a homoglyph typosquatting trick — swapping the Latin letter “e” with a nearly identical Cyrillic character (U+0435) — to make the malicious version appear legitimate to unsuspecting developers. To boost their credibility, the threat actors also inflated the fake package’s download count, making it appear as though it had been downloaded 11.7 million times.
SourceHow it could affect your business
This attack shows how cybercriminals are using advanced supply chain tactics — like homoglyph typosquatting — to disguise malware or steal sensitive data. Organizations should educate developers and employees to verify package sources, check publisher authenticity and stay alert to small visual differences that can hide serious threats.
North America
Toys “R” Us Canada
In yet another cyberattack targeting the retail sector, Toys “R” Us Canada has alerted customers to a data breach that exposed personal information from its databases.
The Canadian toy retailer said the incident dates back to July, when threat actors accessed and later leaked customer data online. Notifications sent to affected customers revealed that the compromised information includes names, email addresses, physical addresses and phone numbers. While no financial details or passwords were exposed, the stolen data still poses serious risks for phishing and identity theft.
The breach came to light after Toys “R” Us discovered leaked data circulating online. A subsequent investigation confirmed that an unauthorized third party had illegally copied the information from the company’s internal systems.
SourceHow it could affect your business
Retail companies remain prime targets for cybercriminals because of the vast amount of customer data they store. A single breach can cause major financial losses and long-term damage to brand reputation. Securing customer information through strong access controls, encryption and continuous monitoring is essential to prevent such costly consequences.
Latin America & the Caribbean
FictorPay
The Brazilian financial sector was caught off guard after a cyberattack on fintech FictorPay led to the theft of roughly R$26 million.
According to reports, the Central Bank of Brazil detected unusual transactions through FictorPay on Sunday and promptly alerted Celcoin, the company providing Banking-as-a-Service (BaaS) infrastructure to FictorPay. Celcoin is directly connected to Pix, the Central Bank’s instant payment platform. The attack, which lasted only a few hours, allowed threat actors to exploit a system flaw and carry out at least 280 fraudulent Pix transactions.
In a statement, FictorPay said it was alerted to irregular activity within the environment of a third-party service provider that supports multiple companies, including theirs. The fintech noted that an investigation is underway with the provider and cybersecurity experts and that, so far, there’s no indication of a direct impact on FictorPay’s internal systems.
SourceHow it could affect your business
Third-party service providers are often the weakest link in an organization’s security chain. Businesses should vet vendor security practices carefully, enforce strong access controls and require timely incident reporting. Regular audits and continuous risk assessments can help identify and patch vulnerabilities before attackers exploit them.
Australia
Western Sydney University
Western Sydney University has confirmed a major cyberattack that stole sensitive student data, including tax file numbers, passport details and private health and disability information.
On October 23, the university revealed that the breach occurred through its student management system, which is hosted by a third-party provider on a cloud-based platform. Its investigation found that a daisy chain of suppliers had been exploited during the breach, starting at an additional external system, which itself was linked to the third-party cloud platform. The breach of the third- and fourth-party systems allowed hackers to access and exfiltrate data from the student management system.
The stolen information includes names, dates of birth, ethnicity, employment and payroll details, bank account numbers, tax file and driver’s license numbers, passport and visa information, and even complaint, health, disability and legal records — making it one of the most severe education-sector breaches in recent months.
SourceHow it could affect your business
Cyberattacks on educational institutions are increasing as schools and universities store vast amounts of personal data. Protecting sensitive student and faculty information requires strong access controls, immutable backups and regular security assessments to ensure critical systems and data remain secure.
North America
Visual Studio Code (VS Code)
A newly discovered malware strain called GlassWorm is spreading rapidly, marking one of the most advanced supply chain attacks ever seen in developer ecosystems. It is the first self-propagating worm to target Visual Studio Code (VS Code) extensions.
The attack was first detected on October 17, 2025, when seven malicious extensions appeared on OpenVSX, followed by one infected extension on Microsoft Marketplace. In total, the infected extensions were downloaded more than 35,000 times. Experts report that GlassWorm hides its code using invisible Unicode variation selectors, allowing it to slip past static analysis tools and manual reviews.
Once installed, the malware steals credentials, deploys hidden remote-access tools and uses compromised developer accounts to publish more infected extensions, turning the VS Code ecosystem into a self-propagating network of infections.
SourceHow it could affect your business
Developer tools like VS Code have privileged access to source code, credentials and CI/CD systems, making them prime entry points for wide-scale compromise. GlassWorm shows a paradigm shift from single-package attacks to autonomous, self-spreading threats that exploit the trust baked into open-source and enterprise developer workflows. Strengthen code integrity checks, restrict extension installs and monitor developer accounts to reduce such risks.
