DHS breach exposes 41,000 staff; CISA orders Node2Shell patches

Hacker leaks records of 41,000 DHS employees via Okta access

A hacker using the handle Department of Peace stole personal data on more than 41,000 Department of Homeland Security employees, including names, job titles, phone numbers, email addresses and office locations. Access came through Okta, the identity and access management service used by DHS. About 21,000 records pertain to Customs and Border Protection employees and nearly 7,000 to Immigration and Customs Enforcement staff. The data also covers the Cybersecurity and Infrastructure Security Agency, US Citizenship and Immigration Services and Homeland Security Investigations, and links agencies to specific surveillance tools. The hacker said: They have our information, so it is only fair that we have theirs. The data was reportedly given to researcher maia arson crimew, who shared it with Distributed Denial of Secrets, which hosts the leaked Icepick dataset. The breach follows hackers stealing FBI employee data weeks earlier.

A hacker stole more than 40,000 DHS employee records →

Topics: Government agency data breaches

GMO tells Onamae VPS customers to disconnect and shut down PCs after breach

GMO Internet Group told customers of its Onamae Desktop Cloud VPS service to scan for viruses, back up data, disconnect devices from the internet and shut them down, unplugging any connected cords. The warning followed a cyberattack in which threat actors installed malware on customer environments, with up to 26,739 servers at risk. The company said unauthorized access occurred against Onamae.com Desktop Cloud and unauthorized programs were installed in some customer server environments. Attackers took sensitive customer data and demanded roughly $50 million in ransom, threatening dark web release; Onamae refused to pay and the data eventually leaked. Attackers also threatened ransomware on customer devices, setting an October 27 deadline, though no ransomware was found. Onamae will compensate each customer $30 and offer replacement computers. Login credentials for MetaTrader 4 and 5 users were also compromised.

Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat →

Topics: Ransomware gangs and leaked data

CrowdStrike: Chatty Spider hired a man to walk into a US law firm

CrowdStrike’s legal-sector report, covering September 2025 to August 2026, names CHATTY SPIDER as the dominant threat to US law firms, with activity up 129% in the first eight months of 2026 versus all of 2024 and law firms making up nearly 90% of victims. In November 2025 the group hired a Russian national to enter a US law firm; posing as internal IT, he reached an onsite workstation, helped install remote access tools and tried to move data to cloud storage. Law enforcement detained him on a second visit the next day. The FBI’s May advisory on the Silent Ransom Group, another name for the gang, says it has targeted US law firms since spring 2023 and sends people to plug storage devices into computers when remote access fails. Ransomware and extortion groups named 455 legal entities on leak sites, up 39% from 327 a year earlier.

Hackers hired a man to walk into a US law firm, CrowdStrike says →

Topics: Ransomware

CISA confirms active Node2Shell exploitation, sets November 10 patch deadline

The US Cybersecurity and Infrastructure Security Agency confirmed hackers are exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell and HTTP2Shell, tracked as CVE-2026-111497. The flaw is an out-of-bounds write in the Brotli decoder used to expand data compressed with Google’s Brotli algorithm. Unprivileged attackers can use a crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries. The issue was first identified in Node.js but also affects HTTP servers and clients using vulnerable Brotli implementations. Microsoft pushed an emergency .NET update warning of privilege escalation. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch by November 10 under Binding Operational Directive 26-04, urging all defenders to prioritize patching.

CISA warns of hackers now exploiting critical Node2Shell flaw →

Topics: Zero-day vulnerabilitiesPatch Tuesday & security updates