The Field Briefing — Red Flag Cyber's roundup of verified breaches, exploited vulnerabilities, and what to do about them. This issue catches up on everything since October 9.

Lead story: the California student data breach is real

California's Department of Education confirmed on Friday that a hacker accessed data on millions of students through ETS, the nonprofit behind the state's testing. Names, birth dates, addresses, and student IDs were taken — but NOT Social Security numbers, passwords, or bank and card details. Notification letters keep going out through early November; if yours arrives, keep it and enroll in the free two-year Experian identity protection inside.

Watch the 60-second briefing: https://youtube.com/shorts/RiZHfHKw1m4

New breach reports

Yamato Transport: 5.31 million pay-later records confirmed leaked — personal information of Kuroneko deferred-payment users, collected since October 2018. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/yamato-transport

Nikkei: about 1.83 million records leaked from a cloud service — stolen credentials were used to get in. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/nikkei-cloud

SourceNext: up to 22.5 million records potentially exposed, passwords included — affected members are being required to reset their passwords. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/sourcenext

Burger King Japan: about 11.18 million app member records taken — an outside party accessed the app's member system over five days. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/burger-king-japan

Patch these: actively exploited now

BeyondTrust Remote Support (CVE-2026-102764) — an authentication-bypass flaw CISA added to its exploited-vulnerabilities catalog on October 16. If your organization uses it, apply BeyondTrust's mitigations now.

Fortinet multiple products (CVE-2025-61624) — a path-traversal flaw across FortiOS, FortiProxy, and siblings, also added October 16. Apply Fortinet's fixes.

The full vulnerability dashboard: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

New briefings on the channel

• Consent Phishing: No Password Needed — no password was stolen; an app permission did it. https://youtube.com/shorts/d4nWXRzzrY8
• Can You Spot the Phish? QR Code Quiz — four red flags hiding in one QR code. https://www.youtube.com/shorts/zuew7MZMhiU
• Is the Windows zero-day real? — CVE-2026-96951 was already exploited when Microsoft patched it; install the October Windows updates now. https://www.youtube.com/shorts/nC0rIxBynz4

Free one-page checklist — Spot the Phish, the five checks to run before you trust an email: https://red-flag-cyber-site.andrewdpeat.workers.dev

— The Red Flag Cyber research desk