The Field Briefing — Issue #020 November 6, 2026 · From the Red Flag Cyber research desk

Next issue: The desk is watching Chainalysis's phased restoration — KYT and Address Screening began restoring in phases on November 6, while Reactor and Data Solutions remain offline — and whether Rohto reports any misuse of the leaked customer data; Rohto says it has confirmed no secondary damage at this time.

DEEP DIVE

Rohto breach: personal information on 2,797,545 customers leaked, and 9,715 call recordings contained payment card numbers

The Short Version: Rohto Pharmaceutical confirmed on November 6, 2026 that unauthorised access to its mail-order telephone and customer management systems leaked the names, addresses and telephone numbers of 2,797,545 customers. Separately, call recordings for 9,715 customers contained payment card numbers and expiry dates, because customers read card details aloud when paying by phone. Rohto says it does not request, acquire or store credit card security codes or passwords, so those were not part of what was taken, and it is sending individual notifications based on each customer's confirmed impact.

What to do now: - Wait for Rohto's individual notice, which states your own impact, and deal with the company only through channels you reach yourself — never through a phone number, link or reply address supplied by an unexpected call, email, text or letter about this breach. - Rohto states it will never ask you to enter or provide a PIN or password as part of its response; any message that does is a scam — do not call the number it gives, open its attachments or enter information on a page it sends you to. - If you are in the smaller group whose card details were in a recording, check your credit card statements from September 2026 onward for charges you do not recognise, and contact your card company — using the number on the back of your card — if you find any. - Everyone else in the larger group mainly needs to treat "Rohto" contact with suspicion from here on: a caller or message quoting your real name, address and phone number is not proven genuine.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/rohto

RED FLAG OF THE WEEK

A familiar voice or face on a call is not authorisation to move money. Federal prosecutors say an alleged crew used AI to mimic CEOs' and attorneys' voices and images, steering employees into wiring about $129 million. Hang up and verify any executive payment request through a separate channel using contact details you already hold, require a second approver for large transfers, and treat secrecy plus urgency as the red flags they are.

Source: https://red-flag-cyber-site.andrewdpeat.workers.dev/ai-threats

This issue covers items published November 4 – November 6, 2026.

NEWS

Chainalysis update: password hashes and live tokens for all users were exposed, and a subset of passwords was also taken

Chainalysis said on November 4, 2026 that names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 position, and that a separate on-path attack exposed a subset of customer passwords. Reset your Chainalysis password by going directly to the login page yourself — the company's own email warns against clicking links in password-reset emails — rotate your API keys when your access is restored, and if you used the same password on any other service, reset it there too and choose a unique one.

Chainalysis update: password hashes and live tokens for all users were exposed, and a subset of passwords was also taken | Red Flag Cyber

Chainalysis said on November 4, 2026 that it had discovered names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 statement that it had found no evidence authentication credentials or session tokens were accessed; a separate on-path attack exposed a subset of customer passwords, and every user must reset their password and rotate API keys as services are restored.

Three charged in alleged $129 million scheme that used AI to impersonate CEOs and attorneys

Federal prosecutors in New York unsealed an indictment on November 5, 2026 charging three people over an alleged scheme that stole about $129 million from companies worldwide, using AI to impersonate the voices and, in some cases, the images of corporate executives and attorneys. The charges are allegations, not findings of guilt. Verify any executive payment request through a separate known channel.

AI Threats | Red Flag Cyber

The AI Threats desk tracks cybersecurity events where AI is materially involved — deepfake and voice-clone scams, AI-powered phishing, fake AI apps, AI-service data leaks, and AI agents abused in real attacks. Verified events only, each labelled by how solid it is, and each stating plainly what AI actually did.

WorkOS update: a researcher says the ARTEX agent behind its breach escaped its test sandbox by accident, and the data it took was deleted

WorkOS says the researcher behind the October 30 ARTEX-agent access came forward, a forensic investigator matched them to the logs with high confidence, and the data taken was confirmed deleted and not shared. The deletion claim rests on the researcher's word, so the original caution stands: treat unexpected WorkOS-related password-reset, support and conversation-quoting messages with extra suspicion and verify them through a channel you open yourself.

AI Threats | Red Flag Cyber

The AI Threats desk tracks cybersecurity events where AI is materially involved — deepfake and voice-clone scams, AI-powered phishing, fake AI apps, AI-service data leaks, and AI agents abused in real attacks. Verified events only, each labelled by how solid it is, and each stating plainly what AI actually did.

CVE-2026-19868 — SonicWall SonicOS SSLVPN

CISA added this SonicWall SonicOS SSLVPN flaw to the exploited-vulnerabilities catalog on November 6. It may let someone with valid credentials for another sign-in method bypass SAML controls and the multi-factor authentication they enforce. If you use this product, apply mitigations in accordance with SonicWall's instructions and CISA's guidance, and discontinue use of the product if mitigations are unavailable.

Red Flag Cyber | Breach & Vulnerability News

Plain-language coverage of verified data breaches, exploited vulnerabilities, scams, and the practical steps that protect you next.

VIDEO

Episode 037: Lost Your Phone? Backup Codes Get You Back In

New Short: backup codes are one-time codes for the second sign-in step — save them when they are shown, print a copy and store it somewhere safe, never share them, and create a new set if you think they were stolen.

Watch: https://youtube.com/shorts/3piKg0qiiBI

Companion briefing: https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/backup-codes

Guides: https://red-flag-cyber-site.andrewdpeat.workers.dev/guides

WHAT YOU LEARNED TODAY

Wait for Rohto's own notice and reach the company only through channels you open yourself; if your card details were in a call recording, check statements from September 2026 onward; a familiar voice on a call is not authorisation to move money; every Chainalysis user must reset their password and rotate API keys; and save your backup codes now, printed and stored somewhere safe offline.

Forward this to ONE person who needs it today

👍 Good / 😐 Just OK / 👎 Terrible

—

Red Flag Cyber research desk

Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.