The Field Briefing #015 — October 29, 2026 From the Red Flag Cyber research desk.

Coming next: The desk is watching for Polymarket's official reimbursement process — and for fake "claim your refund" messages trying to steal wallets in its name.

DEEP DIVE — Polymarket breach: compromised third-party script drained traders' assets, full reimbursement promised

The Short Version: A compromised third-party monitoring script hijacked logged-in traders' sessions on Polymarket.com, liquidated positions and drained crypto assets. Polymarket halted trading for about an hour on October 29 and says affected traders will be fully reimbursed.

What to do now: - Wait for Polymarket's official reimbursement process, and reach it only through the company's official website or app — never through a link in an email, text, direct message or social-media reply. - A reimbursement never requires your wallet recovery phrase (seed phrase) or private key; anyone asking for one is stealing, not refunding. - Do not sign wallet transactions or approve token allowances offered by "support" accounts or refund pages. - Check your Polymarket account history for trades or transfers you did not make on October 29, and keep your own records of balances and positions.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/polymarket

RED FLAG OF THE WEEK A real refund never asks for your seed phrase or private key. If a "refund" or "support" message asks you to connect a wallet, sign a transaction, or reveal a recovery phrase, it is a theft attempt — close it and go to the official site yourself.

This issue covers items published October 28 – October 29, 2026.

NEWS

Fore Coffee breach: up to 5.7 million customer accounts exposed, hashed PINs included Fore Coffee said an unauthorised party accessed its customer-data platform, exposing data from up to 5.7 million accounts — names, contact details, dates of birth, addresses, hashed PINs and purchase history. Payment data was not involved. Change your Fore app PIN, and change it anywhere else you reused it. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/fore-coffee

Japan Airlines: reservation data for about 92,000 customers may have been viewed at Amadeus Unauthorised access to Amadeus's passenger service system left traces suggesting reservation data for about 92,000 Japan Airlines and Japan Transocean Air customers may have been viewed, including passport numbers for about 2,000. Credit card numbers and passwords were not compromised. Verify any message about your trip through the airline's official channels, never a link in the message. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/japan-airlines-amadeus

TFG London breach: personal data accessed at Phase Eight, Hobbs and Whistles TFG London confirmed some personal data was accessed in the October 11 attack — contact and delivery details, order information and, in some cases, the last four digits of a payment card. Passwords were not found to have been accessed. Watch for fake order or refund messages that get your real order details right. https://red-flag-cyber-site.andrewdpeat.workers.dev/news/tfg-london

GitLab flaw added to CISA's exploited list — CVE-2026-97229 CISA added GitLab Community Edition and Enterprise Edition to its Known Exploited Vulnerabilities catalog on October 29: an unauthenticated attacker could execute arbitrary code on a GitLab server via a specially crafted regular expression in a CI/CD configuration. If you run GitLab, apply CISA's required action. https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

Cisco Secure Firewall flaw added to CISA's exploited list — CVE-2026-76418 CISA added the Cisco Secure Firewall ASA and Secure FTD flaw on October 29: an unauthenticated remote attacker could force an affected device to reload unexpectedly, resulting in a denial of service. If you manage these firewalls, apply CISA's required action. https://red-flag-cyber-site.andrewdpeat.workers.dev/vulnerabilities

WHAT YOU LEARNED TODAY Never chase a crypto reimbursement through a message link, and never give a seed phrase to anyone. Change a reused PIN when a breach exposes it, and verify breach messages through the official app or site yourself.

Forward this to ONE person who needs it today

Was this useful? 👍 Good / 😐 Just OK / 👎 Terrible

— Red Flag Cyber research desk Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.