The Field Briefing #013 — October 27, 2026 From the Red Flag Cyber research desk

Next issue: The desk is watching for ENGIE's count of affected customers — the company has not disclosed one — and for Keystone's follow-up on destroying 18,835 unsold devices and suspending shipments.

Deep Dive — ENGIE breach: customer contact and energy contract details stolen from a partner marketing platform

The Short Version: ENGIE said on October 27, 2026 that attackers stole customer contact details and energy contract information from a marketing platform used by its business partners in France, and that no banking data was affected. The stolen details include first and last names, mailing address, email address, phone number, customer ID, contract number, and the Delivery Point (PDL) or Metering and Estimation Point (PCE) identifier for the customer's energy supply. ENGIE says its internal IT systems were not compromised, it has notified the relevant authorities, and it has individually informed each customer concerned.

What to do now: Treat any contact claiming to be from ENGIE with care, even when it quotes your real contract number or meter point, because those identifiers are part of what was stolen. Do not hand over banking details, card numbers or verification codes in response to a call, text or email about your energy contract; end the contact and reach ENGIE through the official website, app or phone number you open yourself. If you are asked to pay an energy bill to new bank details, verify the change through your existing ENGIE account before paying anything.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/engie

Red Flag of the Week: Never enter a hardware-wallet recovery phrase because an email told you to. Foundation says phishing emails from its official domains carried a fake urgent recall to steer Passport owners toward giving up their recovery phrases, and Keystone warns against fake recall or asset-migration messages. A recall, refund or replacement never requires your recovery phrase.

This issue covers items published October 26 – October 27, 2026.

News

Keystone update: breach exposed 25,964 buyer records and a device-authentication key — 18,835 unsold wallets to be destroyed. Keystone said the breach exposed 25,964 buyer records and the WebAuth device-authentication key, it will destroy 18,835 unsold devices and suspend shipments, and devices received after October 20 need extra verification. Full update: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/keystone-device-key-update

Foundation breach: phishing emails from official domains carried some customers' addresses and phone numbers. Foundation said attackers compromised its backend and sent phishing emails from its official domains; some messages included customers' mailing addresses or phone numbers, and attackers could access legacy records containing about 5,600 mailing addresses and 5,200 phone numbers. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/foundation-passport

Seoul police: AI pentesting tool helped a hacking crew breach about 90 organisations and steal 8.2 million records. Seoul police say an AI pentesting suite helped one operator breach about 90 South Korean organisations — hospitals, universities, academies and golf courses among them — and steal 8.2 million records, with 60 breaches coming in 44 days after he adopted AI tools. Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/ai-threats

CVE-2026-109618, PHP Group PHP (KEV). PHP contains a memory corruption vulnerability that allows for unauthenticated remote code execution; CISA added it to the exploited list on October 26, 2026. Details: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

CVE-2026-109619, PHP Group PHP (KEV). PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution; CISA added it to the exploited list on October 26, 2026. Details: https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

What you learned today: A message quoting your real contract number, address or order details no longer proves it is genuine — those details are exactly what these breaches took. Verify through a channel you open yourself, and never hand over a recovery phrase, banking details or a verification code on demand.

Forward this to ONE person who needs it today

How was this issue? 👍 Good / 😐 Just OK / 👎 Terrible

Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.

— Red Flag Cyber research desk