experimental website; AI used to find and compile articles
Hardware-wallet maker Keystone said an intruder accessed its website and obtained customer names, contact information, shipping addresses and order details, including purchased products and prices. The company detected the access on October 20 and confirmed the exposure on October 23 after reviewing API activity with Shopify. It has not disclosed how many customers were affected.
Keystone said payment-card and bank details, recovery phrases, private keys and wallet passwords were not compromised. It blocked the access, patched the vulnerability and began notifying affected customers. The company warned that scammers could use the exposed order data to offer fraudulent refunds or replacement devices, and said customers should never disclose a recovery phrase or enter one into a device they did not order.
experimental website; AI used to find and compile articles
Kaspersky researchers said a cyberespionage campaign used a newly identified UEFI bootkit called BlackX against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. After gaining administrator privileges, the attackers exploited the older Baton Drop vulnerability, CVE-2022-21894, to install custom keys and load malicious code before Windows started.
The affected computers were fully patched, but Microsoft’s additional certificate revocation for the flaw had not been manually activated. BlackX then loaded a kernel driver that attempted to obstruct security monitoring and delivered espionage payloads using cloud-storage services for command and control. Kaspersky attributed the campaign to the China-linked APT41 group with medium confidence.
experimental website; AI used to find and compile articles
GMO Internet Group said on October 24 that an intruder accessed its Onamae.com Desktop Cloud service, took customer information outside the environment and was linked to transactions that some customers said they did not authorize. An earlier company update said up to 26,739 servers may have been affected and that trading credentials stored on them may have been exposed.
The company said a person believed to be the attacker demanded money and threatened further unauthorized orders through accounts at more than 70 securities and foreign-exchange firms, data disclosure and a ransomware attack. GMO said it would not comply, would compensate verified realized losses from unauthorized trades, and had asked Japanese authorities to trace, block and neutralize the attacker’s infrastructure under the country’s active cyber defense framework.
