The Field Briefing — Issue #017 November 3, 2026 · From the Red Flag Cyber research desk

Next issue: The desk is watching for Northflank's root-cause analysis, which is still to come — and for the affected-customer counts that MoneySmart and Amadeus still have not given.

DEEP DIVE

MoneySmart breach: personal data of some Singapore and Hong Kong customers copied, identification numbers and financial profiles included

The Short Version: MoneySmart confirmed on November 3 that an unauthorised third party accessed its internal IT systems on October 29 and copied personal data of some customers in Singapore and Hong Kong — names, identification numbers, dates of birth, contact details, income ranges and financial profiles. Affected customers were emailed on November 2 and 3. The company has not given an affected count, and no payment card or bank account data has been named among the data involved.

What to do now: - Treat any message that references your real financial products, income band or insurance details with suspicion, even when it looks informed — that is exactly what the copied data enables. - Contact your bank or insurer only through its official app or the number on its own website, never through a link or number in a message. - Never share a password, one-time password or banking detail by phone or email, whoever claims to ask — MoneySmart says it will never ask for them that way. - Check your bank, card and insurance accounts for unfamiliar activity, and follow the steps in MoneySmart's own email if you received one — it sets out which of your data was involved.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/moneysmart

RED FLAG OF THE WEEK

Never run code from a job-interview assignment on a device that holds wallet keys, exchange sessions or work credentials. Binance says its $6.3 billion theft began with a fake job interview that tricked a software engineer into running malicious code — verify the recruiter and the company through official channels you find yourself.

Source: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/binance-interview-update

This issue covers items published October 20 – November 3, 2026.

NEWS

Nojima breach: about 7 million member records leaked from its online shop and phone buy-back site, encrypted passwords included

Nojima said in a November 2 notice that unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site leaked about 7 million member records: names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses; no card data was held, and on November 3 the company forced a password reset for customers it suspects are affected. Start the reset on Nojima's official site yourself, change every account where the password was reused, and treat surprise Nojima delivery, repair, refund or buy-back messages as suspect.

Nojima breach: about 7 million member records leaked from its online shop and phone buy-back site, encrypted passwords included | Red Flag Cyber

Nojima said in a notice dated November 2, 2026 that unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site leaked about 7 million member records: names, addresses, dates of birth, phone numbers, login IDs, encrypted passwords and email addresses; no credit card data was held on either site, and on November 3 the company forced a password reset for customers it suspects are affected.

Binance update: a fake job interview planted the malware behind the $6.3 billion theft, and $2.85 billion is now frozen or intercepted

Binance said in a November 3 incident report that the October 29 theft began with a fake job interview that tricked a software engineer into running malicious code, spread to two more wallet-infrastructure employees, and reached its wallet signing service; about $2.85 billion of the stolen assets had been frozen or intercepted as of November 3, with 98% of impacted token assets replenished as of October 31. Binance customers need take no new step — check balances and withdrawal status only inside the official Binance app or website, which you open yourself.

Binance update: a fake job interview planted the malware behind the $6.3 billion theft, and $2.85 billion is now frozen or intercepted | Red Flag Cyber

Binance said in an incident report published November 3, 2026 that the October 29 theft began with a fake job interview that tricked a software engineer into running malicious code, that the attackers then compromised two more wallet-infrastructure employees and reached its wallet signing service, and that about $2.85 billion of the stolen assets had been frozen or intercepted as of November 3, with 98% of impacted token assets replenished as of October 31.

Northflank update: attack contained within an hour and no sign workloads were accessed, tokens and sessions revoked

Northflank said the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations. The rotation advice is unchanged: finish rotating every stored secret, starting with AI provider keys.

Northflank update: attack contained within an hour and no sign workloads were accessed, tokens and sessions revoked | Red Flag Cyber

Northflank said in a November 2, 2026 update that the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained in its systems or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations; the root cause is still to come.

DreamHost breach: FTP/SFTP and webmail passwords accessed through its File Manager, mailbox contents may have been viewed in a small number of cases

DreamHost said an unauthorised third party exploited a vulnerability in its web-based File Manager and accessed the FTP/SFTP usernames and passwords of users who logged in between about August and October 23, 2026, plus webmail credentials for a limited number of users; the company says the incident affected well under about 10% of its hosted email and FTP/SFTP accounts. DreamHost has already reset the affected passwords — set new ones from inside its control panel, which you open yourself, and change every other account where you reused one.

DreamHost breach: FTP/SFTP and webmail passwords accessed through its File Manager, mailbox contents may have been viewed in a small number of cases | Red Flag Cyber

DreamHost said an unauthorised third party exploited a vulnerability in its web-based File Manager and accessed the FTP/SFTP usernames and passwords of users who logged in between about August 2026 and October 23, 2026, plus the webmail credentials of a limited number of users; formal breach notices filed with the California Attorney General were listed on November 2, 2026, and the company says the incident affected well under about 10% of its hosted email and FTP/SFTP accounts.

Marathon Health breach: names, Social Security numbers and health information exported after an impostor tricked an employee

Marathon Health said an impostor posing as an IT worker tricked an employee into disclosing credentials on August 24 and exported names, contact information, dates of birth and Social Security numbers, with medical and health insurance information also reported compromised; notification letters began October 20. If you receive a letter, enroll in the credit monitoring it offers, consider a free credit freeze, and watch your health insurance explanations of benefits for care you did not receive.

Marathon Health breach: names, Social Security numbers and health information exported after an impostor tricked an employee | Red Flag Cyber

Marathon Health said an unauthorised individual posing as an IT worker tricked an employee into disclosing credentials on August 24, 2026 and exported information from a cloud application, including names, contact information, dates of birth and Social Security numbers, with medical and health insurance information also reported compromised; notification letters began on October 20, 2026.

Club Tourism breach: personal information of about 4.32 million online members may have leaked

Club Tourism announced October 31 that unauthorized access to part of its servers may have leaked personal information of about 4.32 million online members — names, nationality, gender, date of birth and age, addresses, phone numbers, email addresses, member IDs and emergency contacts; passwords, passport, credit card and bank account details were not included, per the company. If you listed an emergency contact, tell that person yourself — the company's notices go to members.

Club Tourism breach: personal information of about 4.32 million online members may have leaked | Red Flag Cyber

Club Tourism announced on October 31, 2026 that unauthorized access to part of its servers may have leaked personal information of about 4.32 million online members — names, nationality, gender, date of birth and age, addresses, phone numbers, email addresses, member IDs and emergency contacts; login passwords, passport, credit card and bank account details were not included, the company said.

Revolve breach: saved payment card numbers and expiry dates may have been taken, at least 179,259 people notified

Revolve disclosed in an SEC filing dated October 29 that an unauthorized actor may have obtained, through automated means, the names, contact information, payment card numbers and expiration dates of customers who saved payment information in their online shopping accounts; state attorney-general notices put the number notified at at least 179,259 people. If you saved a card in a Revolve or FWRD account, review that card's statements back to September 2026 and ask the issuer whether it will replace the card.

Revolve breach: saved payment card numbers and expiry dates may have been taken, at least 179,259 people notified | Red Flag Cyber

Revolve disclosed in an SEC filing dated October 29, 2026 that an unauthorized actor may have obtained, through automated means, the names, contact information, payment card numbers and expiration dates of customers who saved payment information in their online shopping accounts; state attorney-general notices put the number notified at at least 179,259 people, SecurityWeek reported on November 2, 2026.

Malaysia Airlines: customer information may have been affected in the Amadeus breach

Malaysia Airlines confirmed on November 1 that customer information processed through Amadeus between August 2023 and September 2026 may have been affected — the latest airline in the Amadeus incident first flagged October 28; no count or data types given yet, its own IT systems were not breached, and there is no evidence financial information was accessed. Check any booking question inside the airline's official website or app, which you open yourself — never through a link in a message.

Malaysia Airlines: customer information may have been affected in the Amadeus breach | Red Flag Cyber

Malaysia Airlines said on November 1, 2026 that customer information processed through its reservation provider Amadeus between August 2023 and September 2026 may have been affected by the Amadeus cybersecurity incident; the airline gave no affected count and no list of data types, said its own IT systems were not breached, and said there is no evidence financial information was accessed.

Chainalysis breach: attacker using 'offensive agentic techniques' accessed customer names, emails and role labels

Chainalysis said an external actor using what it calls 'offensive agentic techniques' accessed its systems and internal tools in October, taking user IDs, full names, email addresses and organisation role labels for platform users; investigation content, passwords, MFA secrets and session tokens were not accessed, and no affected count has been given. The same incident is covered on our AI Threats desk, because the company itself describes the access method as agentic: https://red-flag-cyber-site.andrewdpeat.workers.dev/ai-threats — treat any unexpected password-reset request or authentication prompt as suspicious and verify through your organisation's own channels.

Chainalysis breach: attacker using ‘offensive agentic techniques’ accessed customer names, emails and role labels | Red Flag Cyber

Chainalysis said on October 30, 2026 that an external actor using what it calls ‘offensive agentic techniques’ gained unauthorised access to its systems and internal tools, and accessed user IDs, full names, email addresses and organisation role labels for users of its platform; the company says it has found no evidence that investigation content, clear-text passwords, MFA secrets or session tokens were accessed, and it has given no count of affected customers.

Binance update: 95% of stolen assets covered and withdrawals resume in phases, FBI blames North Korea's TraderTraitor unit

Binance has covered about 95% of the roughly $6.3 billion stolen on October 29 and is resuming withdrawals in phases from November 1 across 15 networks, and the FBI has attributed the theft to North Korea's TraderTraitor unit — follow-up to our October 29 Binance report. Check whether your asset and network are actually open inside the official Binance app or website, which you open yourself.

Binance update: 95% of stolen assets covered and withdrawals resume in phases, FBI blames North Korea’s TraderTraitor unit | Red Flag Cyber

Binance said on November 1, 2026 that it has covered about 95% of the roughly $6.3 billion stolen on October 29, that phase-one withdrawals resume on November 1 across 15 networks, and that the FBI has attributed the theft to North Korea’s TraderTraitor unit.

Northflank breach: customers told to assume all stored secrets were decrypted and rotate them, AI API keys reported used

Northflank told all customers to assume their environment variables had been decrypted and rotate every stored secret immediately, after users reported unauthorised use of AI API keys stored on the platform; no root cause or affected count has been given. Revoke existing credentials with the providers that issued them first, then generate replacements.

Northflank breach: customers told to assume all stored secrets were decrypted and rotate them, AI API keys reported used | Red Flag Cyber

Northflank disclosed a security incident on October 30, 2026 and told every customer to assume their environment variables had been decrypted and rotate all stored secrets immediately, after users reported unauthorised use of AI API keys stored on the platform; the company has given no root cause and no affected count.

ANA: reservation data for about 37,800 customers may have been viewed at Amadeus, passport numbers for about 1,700 included

All Nippon Airways' updated notice puts about 37,800 customers in the Amadeus breach — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included.

ANA: reservation data for about 37,800 customers may have been viewed at Amadeus, passport numbers for about 1,700 included | Red Flag Cyber

All Nippon Airways said in an updated notice on October 30, 2026 that unauthorised access at Amadeus may have exposed reservation data for about 37,800 customers — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included.

Applebee's exposure: a password hidden in its Android app gave access to a customer database with names, birth dates and phone numbers

A password for an internal Applebee's customer database was hidden inside its Android app, giving anyone who extracted it access to names, email addresses, dates of birth, phone numbers and ZIP codes; the flaw is fixed and the company says it has found no evidence of unauthorised access.

Applebee's exposure: a password hidden in its Android app gave access to a customer database with names, birth dates and phone numbers | Red Flag Cyber

TechCrunch reported on October 30, 2026 that a password for an internal Applebee's customer database was hidden inside its Android app, giving anyone who extracted it access to names, email addresses, dates of birth, phone numbers and ZIP codes; the flaw is fixed and the company says it has found no evidence of unauthorised access.

Florida student aid breach: up to about 4.9 million people may be affected, Social Security numbers included

The Florida Department of Education says unauthorised criminal access to its Florida Student Financial Aid website may have impacted about 4.9 million people; its FAQ says the compromised information includes Social Security numbers, and it urges users to monitor accounts and consider a fraud alert or credit freeze.

Florida student aid breach: up to about 4.9 million people may be affected, Social Security numbers included | Red Flag Cyber

The Florida Department of Education announced on October 29, 2026 that unauthorised criminal access to its Florida Student Financial Aid website may have impacted about 4.9 million people; its FAQ says the compromised information includes Social Security numbers, and it urges users to monitor accounts and consider a fraud alert or credit freeze.

AI threat — More than 400 fake AI apps hid deepfake 'nudify' tools behind pet, fitness and language apps

A WIRED investigation built on AI Forensics research found 400+ apps and domains that passed App Store and Google Play review as pet, fitness and language utilities, then served a hidden interface for generating non-consensual deepfakes; Apple removed 19 apps, Google had removed most, and Meta acted against 11,600 advertising accounts. Be wary of little-known "AI photo" or utility apps reached through a social-media ad, and delete such apps and cancel their credits or subscriptions if you installed one.

AI Threats | Red Flag Cyber

The AI Threats desk tracks cybersecurity events where AI is materially involved — deepfake and voice-clone scams, AI-powered phishing, fake AI apps, AI-service data leaks, and AI agents abused in real attacks. Verified events only, each labelled by how solid it is, and each stating plainly what AI actually did.

AI threat — ARTEX AI agents attacked more than 200 organisations in 14 countries, and hit WorkOS's sales tool

CrowdStrike reported a China-nexus actor used the ARTEX multi-agent AI framework against 200+ organisations in 14 countries, compromising at least nine, and WorkOS confirmed an AI-assisted framework attack accessed its internal sales application, exposing CRM contact details and excerpts of sales calls, support discussions and customer Slack conversations. If you work at an organisation that uses WorkOS, treat unexpected password-reset requests and support messages quoting real past conversations with extra suspicion.

AI Threats | Red Flag Cyber

The AI Threats desk tracks cybersecurity events where AI is materially involved — deepfake and voice-clone scams, AI-powered phishing, fake AI apps, AI-service data leaks, and AI agents abused in real attacks. Verified events only, each labelled by how solid it is, and each stating plainly what AI actually did.

Vulnerability — CVE-2026-119977, WordPress Core

CISA added CVE-2026-119977, a race-condition flaw in WordPress Core's upgrade process that could let an unauthenticated attacker execute code on the server during a full-package core upgrade, to its Known Exploited Vulnerabilities catalog on November 3; it enters our vulnerabilities hub's top five.

Red Flag Cyber | Breach & Vulnerability News

Plain-language coverage of verified data breaches, exploited vulnerabilities, scams, and the practical steps that protect you next.

NEW BRIEFINGS

Briefing 21: How to Spot a Fake Payroll Email

A direct-deposit update you never asked for can be a phish. Count the four flags — unexpected arrival, mismatched sender, payroll-closes-today urgency, and a button to a fake sign-in — and contact payroll yourself through a channel you know is real.

Spot a Fake Payroll Email | Red Flag Cyber

A direct-deposit update you never asked for can be a phish. Count the four flags, skip the button, and contact payroll through a channel you know is real.

Briefing 20: Your Router Still Uses Its Default Password?

Your home router ships with a default administrator password — and that default is public. Four fixes from NSA, CISA and FTC guidance: change the admin password, keep firmware updated, use WPA3/WPA2 with a strong Wi-Fi password, and turn off remote management.

Change Your Router's Default Password | Red Flag Cyber

Your router's default admin password is public. Change it, update the firmware, use WPA3 or WPA2, and turn off remote management.

Briefing 19: How to Spot a Fake Password Reset Email

A password reset email you never asked for is the bait. The briefing walks the four red flags — unexpected arrival, mismatched sender, lock threat, generic greeting — with the quiz episode.

Spot a Fake Password Reset Email | Red Flag Cyber

A password reset email you never asked for can be a phish. Check the sender, spot the urgency and generic greeting, and go to the service yourself.

VIDEO

Episode 035: Is the Nojima breach real? What to do

Nojima confirmed in its November 2 notice that unauthorised access to the member system behind Nojima Online and its used-smartphone buy-back site leaked about 7 million member records — names, birth dates, addresses, phone numbers, login IDs, encrypted passwords and email addresses; neither site held credit card data, and on November 3 the company forced a password reset for customers it suspects are affected. The episode walks what happened and the three steps: start the reset on Nojima's official site yourself, change every account where the password was reused, and treat surprise Nojima delivery, repair, refund or buy-back messages as suspect.

Watch: https://www.youtube.com/shorts/9v6RmBWkKNY

Also new — Episode 033: Is the Arara breach real? What to do. Arara Message, a Japanese email delivery platform, disclosed that about 77 million email addresses were taken or may have been taken from 97 client servers covering up to roughly 380 companies, and that about 7.13 million card-impersonation phishing emails were sent from its [email protected] address October 28–30; the service has been suspended since October 31.

Watch: https://youtube.com/shorts/Puolv5pUGA0

Also new — Episode 032: Can you spot the phish? Payroll Email Quiz — the quiz in this issue, below.

Watch: https://youtube.com/shorts/iwaZlTLgjsI

Also new — Episode 031: Is the Club Tourism breach real? What to do. The episode walks what happened in the Club Tourism report above and what to do, including: if you listed an emergency contact, tell them yourself — the company will not notify them.

Watch: https://www.youtube.com/shorts/RveUCVbHOsk

QUIZ

Spot the Phish: a payroll email lands in your inbox. It claims to be from Northlight Works, a made-up employer created for this quiz, and says your direct deposit needs updating — but you never asked to change it. It says payroll closes today and your pay will be delayed if you do not update now, and its button leads to a sign-in page. How many red flags can you count in that message before you touch its button?

Watch the quiz: https://youtube.com/shorts/iwaZlTLgjsI

WHAT YOU LEARNED TODAY

Reach every bank, insurer, airline, exchange and employer only through the official app or site you open yourself, never a message link — and never hand over a password, one-time code or recovery phrase, or run an interview assignment, to "unlock" or "verify" anything.

WITHHELD ANSWER REVEALED

Four red flags: (1) the unexpected arrival — you never asked to change your direct deposit; (2) the sender address is on an outside domain, not the employer's own; (3) the "payroll closes today" urgency, pressure meant to stop you thinking; and (4) the button leading to a fake sign-in asking for bank and login details. One flag is enough to stop: skip the message's button and contact payroll yourself through a channel you know is real.

Full quiz briefing: https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/payroll-email-quiz

Forward this to ONE person who needs it today

👍 Good / 😐 Just OK / 👎 Terrible

—

Red Flag Cyber research desk

Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.