30th October 2026 – (Hong Kong) A fast‑moving series of cyber incidents at the end of October triggered what security professionals have dubbed Black October, with multiple organisations disclosing breaches or service disruptions across two days. Reports said cryptocurrency exchange Binance paused trading on 29th October after intruders linked by some accounts to North Korea allegedly siphoned more than US$6 billion through unauthorised transactions routed across several blockchains; other coverage put the figure near US$6.3 billion. Prediction market Polymarket also halted activity for close to an hour the same day after a third‑party tool embedded on its site was hijacked, with more than 700 user accounts affected and about US$2.65 million reportedly stolen.
Amid the turmoil, several companies disclosed significant data exposures. Ryohin Keikaku, the parent of Muji, said the official Muji App experienced unauthorised access, placing up to about 27.26 million items of personal data at risk, including email addresses, dates of birth and gender, even for former members. Cathay Pacific reported that a third‑party provider, Amadeus, suffered unauthorised access affecting roughly 53,000 booking records between August 2023 and September 2026, mainly comprising reservation codes, passenger names and flight details. Hardware wallet maker Keystone confirmed that an intrusion at its online store exposed around 26,000 customer records and a key used to verify device authenticity, forcing approximately 19,000 devices to be written off. Good Smile Company said about 2,800 customers’ full credit‑card details may have been compromised. Sony’s So‑net and Plala units disclosed close to 2.6 million records stolen, while separate reports indicated data exposures at Hong Kong Airlines, Wilson Communications and Broadway Photo Supply affecting more than 1,600 people.
Security agencies and researchers said there is currently no evidence that the incidents share a single origin. Although the PHP Foundation recently disclosed two serious vulnerabilities collectively nicknamed PHP2Shell, and Hong Kong’s HKCERT later warned the flaws were being exploited, current reporting has not established a direct connection between those bugs and the late‑October disclosures. Timelines published by the affected parties also show some intrusions pre‑dating the Black October window.
Investigators said the Polymarket incident stemmed from a compromised performance‑monitoring script, while the Binance case was reportedly triggered by an employee laptop breach that preceded rapid, automated fund movements.