The Field Briefing — Issue #016 October 30, 2026 · From the Red Flag Cyber research desk

Next issue: The desk is watching for Amadeus to put a total figure on its shared airline breach — Cathay Pacific is the latest airline to disclose its share, and the total is still unknown — and for Muji's follow-up on whether the MUJI app data actually leaked.

DEEP DIVE Cathay Pacific breach: about 53,000 bookings affected in the Amadeus breach

The Short Version: Cathay Pacific said on October 30 that a breach at its reservation provider Amadeus affected about 53,000 of its bookings made between August 2023 and September 2026. Most records held the booking reference, passenger name and flight details; a smaller subset also included email addresses, phone numbers, travel document information and frequent flyer numbers. The airline says there is no evidence financial or payment information was accessed, and its own systems and flight operations were not affected. This is the same Amadeus incident Japan Airlines disclosed on October 28.

What to do now: - Treat any message about a Cathay Pacific booking as unverified until you check it yourself: open the airline's official website or app directly — never through a link in the message — and compare the booking reference and flight details there. - Do not pay change fees, "verification" charges or refund-processing fees requested by email, text or phone. - If your travel document information was included, watch for misuse of your name and passport details and report anything suspicious to the airline and your passport issuer. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/cathay-pacific-amadeus

RED FLAG OF THE WEEK Never move money on a verbal request alone — even when the voice sounds exactly like your boss. A cloned voice was used this week to press an employee to transfer about $3.3 million. Require a second person to approve new payees and changed account details, and call back on a number from your own directory. Source: https://red-flag-cyber-site.andrewdpeat.workers.dev/ai-threats

This issue covers items published October 29 – October 30, 2026.

NEWS

Muji breach: up to 27.26 million MUJI app records may have leaked Ryohin Keikaku said unauthorised access to the official MUJI App may have leaked up to about 27.26 million records — email addresses, dates of birth and gender, including former members. Names, addresses, phone numbers and card details were not included. If you have ever used the MUJI App, do not click links in Muji-branded email; open the official app or website directly. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/muji-app

Binance breach: about $6.3 billion stolen in the largest crypto theft on record Binance confirmed attackers drained about $6.3 billion from its wallets in about 20 minutes on October 29 after breaching its systems, including a DevOps engineer's laptop. Deposits and withdrawals were suspended, about $2.7 billion has been frozen, and the exchange says user funds are safe and all losses will be covered. Do not act on any message asking you to verify, unlock or move funds; check status only inside the official Binance app or website, typed in yourself. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance

Good Smile breach: full card details of about 2,800 shop customers may have leaked Malicious software on Good Smile's official online shop payment page may have leaked the full card details of about 2,800 customers who entered a card between October 21 and 23; partial details for 402,466 saved cards and order information for 7,673 customers may also have been exposed. If you entered a card in that window, contact your card issuer now, check your statements, and ask about reissuing the card. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/good-smile

Fake prediction-market sites use AI influencers and AI chat support to steal crypto deposits Recorded Future's Insikt Group tracked three fraud teams selling fake Polymarket and Kalshi lookalike platforms promoted by synthetic AI influencers and backed by AI chat support; operators rig results, block withdrawals and harvest identity documents. The real platforms were not breached. Reach prediction markets only through the official domain you type or bookmark yourself, and treat any fee or tax demanded before a withdrawal as fraud. https://red-flag-cyber-site.andrewdpeat.workers.dev/ai-threats

AI-cloned voice of Danish Industry chief used in a $3.3 million transfer attempt DR reported a scammer cloned DI chief Lars Sandahl Sørensen's voice to press an employee to transfer about $3.3 million; the employee grew suspicious and internal controls stopped the payment. Never move money on a verbal request alone. https://red-flag-cyber-site.andrewdpeat.workers.dev/ai-threats

Two Ivanti Connect Secure flaws added to CISA's exploited list on October 30 CVE-2026-118527 could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, and CVE-2026-111357 could allow a local authenticated attacker to escalate privileges; CISA notes they can be chained with CVE-2026-104935. If your organisation uses Ivanti Connect Secure, apply Ivanti's mitigations and follow CISA's guidance to patch or stop using the product if mitigations are unavailable. https://red-flag-cyber-site.andrewdpeat.workers.dev/

WHAT YOU LEARNED TODAY Check booking and breach messages only through the official app or site you open yourself, never a message link — and never move money on a voice request alone, however real it sounds.

Forward this to ONE person who needs it today 👍 Good / 😐 Just OK / 👎 Terrible

— Red Flag Cyber research desk Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.