Fright Night: The Spookiest Cyber Incidents of 2026

By Christie Rae • 29 October 2026 • 10 min read

Last year, we shared The Spine-Tingling Cyber Incidents Scaring Us This Halloween, a blog featuring commentary from IO’s executive team on some of the most hair-raising cyber incidents of 2025. From supply chain attacks to AI-powered deepfakes, the team discussed a range of incidents, and shared key steps organisations can take to defend themselves.

In this year’s Halloween special blog, the IO executive team are back to discuss the cyber incidents that gave them the creeps in 2026!

Telus Digital – Credential Theft

Our CEO, Chris Newton-Smith, says:

In March, Telus Digital, a business process outsourcing and technology company and subsidiary of Telus Corporation, confirmed a major data breach. Cybercrime group ShinyHunters claimed credit, sharing that it had exploited the company’s Google Cloud Platform credentials and OAuth obtained in a 2025 Salesloft Drift breach – an attack our CCO, Ross, flagged in last year’s Halloween blog. This enabled them to access Telus Digital’s systems over the course of several months.

The group claimed to have exfiltrated almost a petabyte of data, including source code. Customers’ personally identifiable information and call centre recordings, over the course of the attack. ShinyHunters reportedly demanded $65 million from Telus Digital in exchange for deleting the data, but the company refused to communicate with the group.

This layered attack leveraged data stolen during one breach to launch another, months after the original compromise. For organisations, robust credential hygiene, third-party risk management and stringent vendor security requirements such as the controls outlined in information security standard ISO 27001 are now vital. Businesses can embed controls to manage credential lifecycle management, strategically assess and treat vendor risk, and limit supplier access to sensitive data to minimise incident impact.

However, as attackers continue to target supply chains, it’s an organisation’s incident response, recovery efforts and communication with customers and regulators that will become increasingly important.

ASOS – Social Engineering

Our CMO, Dave Holloway, says:

Respondents to our State of Information Security Report rank social engineering among the biggest challenges they face in information security (35%), after the information security skills gap (42%), the rise of “as-a-service” cyber threats like phishing-as-a-service (39%), and securing emerging technologies such as AI, ML and blockchain (39%). One in five (21%) have experienced a social engineering incident in the last 12 months.

The recent social engineering attack on online fashion retailer ASOS demonstrates why the attack method is top of mind for security leaders. On 6^th October, customers received a push notification through the ASOS app that hackers had accessed company data, with actors threatening to leak stolen records – a high-pressure and extremely public extortion tactic. Attackers gained access by impersonating a trusted contact to obtain an ASOS employee’s login credentials.

Customers’ personal data, including names and contact information, were exposed, leading to fears of targeted phishing attempts. ASOS stated it “took immediate action to restrict access to the notification platforms and [was] working with internal and external specialist advisers, as well as all relevant authorities.” Despite this, shares in the business fell as much as 13.2% after threat actors sent the push notification to customers.

Employees are an organisation’s first line of defence, and those defences are increasingly being tested by unscrupulous threat actors. Organisations must ensure their employees have the knowledge needed to identify a potential attack and a clear process to report it. Encouragingly, our data shows that the majority (69%) of organisations plan to increase investment in employee cybersecurity awareness and training programs, and just under a third (31%) had seen tangible benefits from employee training on security awareness.

Police National Legal Database – Misconfiguration Exploit

Our CPO, Sam Peters, says:

An attack on the Police National Legal Database (PNLD), an online legal reference service, exposed the contact information of over 100,000 police officers, police staff and criminal justice professionals in July. The data included verified identities, employer information and contact information.

The type of information revealed in this breach put impacted parties at risk of harassment, downstream social engineering attacks, and could even have presented a credible threat to life for officers working on undercover assignments.

It’s thought that a misconfiguration in a Microsoft Power Pages portal was the source of this breach, rather than a software vulnerability. Experts theorise that attackers were able to take advantage of the web role of Anonymous Users being given overly broad access to Dataverse records through public Microsoft Power Pages portals, which allowed them to access data via its portal Web API.

Microsoft provides a control that blocks unauthenticated users from reading Dataverse data while allowing public form submissions; in this instance, it appears this was not configured.

Attackers continue to seek out and exploit these vulnerabilities; our latest State of Information Security Report revealed that 31% of organisations experienced one or more data breaches in the last 12 months. Incidents like the PNLD breach emphasise the need for foundational information security best practices as well as regular risk review and oversight.

The ISO 27001 standard provides a structured framework to support the implementation of these best practices. Organisations must assess and implement necessary security controls including configuration management, secure authentication, management of technical vulnerabilities and more.

Cisco – SD-WAN Zero-Day Vulnerabilities

Our CCO, Ross, says:

In 2026, the Cisco Catalyst Software Defined Wide Area Network (SD-WAN) architecture has experienced multiple vulnerabilities, the most recent being CVE-2026-76504 in September. CVE-2026-76504 is a vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager, which could allow an unauthenticated attacker to access an impacted system with admin privileges.

Cisco shared that the vulnerability is “due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint.” The business shared advice for customers to support them in identifying system compromise and released indicators of compromise, including a warning that threat actors are using “%6a” as the URI-encoded character “j” in malicious requests.

The vulnerability is actively being exploited and affects Cisco Catalyst SD-WAN Manager regardless of system configuration. With no known workaround, organisations must upgrade to a fixed software release.

Google Threat Intelligence Group recently shared that vulnerability exploitation is rising – the number of vulnerabilities exploited increased from an average of 10.5 per month in 2025 to an average of 18 per month from January-August 2026. Vulnerability management and patch management now play significant roles in an organisation’s overall security management, enabling businesses to strengthen security, reduce risk and ensure regulatory compliance.

Ernst & Young – Supply Chain Compromise

Our CFO, Jon Orpen, says:

Earlier this year, attackers compromised service management platform Checkmarx, used by accounting firm Ernst & Young (EY) to support tax-related work it performs on behalf of its clients. The unauthorised third party accessed the platform and downloaded documents relating to multiple firms using EY’s tax services, including Goldman Sachs’ wealth management business and Man Group. Individuals linked to these clients were later told their personal or financial information had been compromised.

Our State of Information Security Report reveals that over half (51%) of businesses have experienced a cybersecurity or information security incident caused by a third-party vendor or supply chain partner in the last 12 months. 22% have experienced more than one incident.

Repercussions of these incidents included data breaches (38%), financial loss or unplanned costs such as remediation, fines or legal fees (35%), delays or disruptions across the supply chain or service delivery (34%) and temporary system outage or operational disruption (33%).

For organisations, the challenge of building resilience now extends well beyond the perimeter of their own network and systems. A breach involving a supply chain partner can raise questions about your own data privacy practices. As such, businesses should ensure they implement diligent supplier management processes including supplier risk categorisation and preferring suppliers with demonstrable approaches to information security practices like ISO 27001.

Hugging Face – AI Agent Attack

Our CTO, Tyler Downs, says:

OpenAI made headlines worldwide in July when around 1,200 AI agents escaped a sandbox environment and coordinated an attack on AI and ML platform, Hugging Face. The agents were also discovered to have posted thousands of messages on message boards to coordinate a sandbox escape, exploiting a vulnerability in the JFrog Artifactory tool they were given.

Headlines at the time suggested the attack was a sign of things to come – AI sentience and even worldwide collapse. Evan Hubinger, a safety researcher at Anthropic, was widely quoted warning that there is a greater than 10% chance AI could “kill all humans” within the next decade.

The reality, however, is that the OpenAI agents were operating under reduced safeguards; security practitioners criticised OpenAI’s inadequate sandboxing as well as lack of log monitoring of the software activities. TrendAI described the attack: “OpenAI deliberately loosened the guardrails to gauge raw capability, and the models used that latitude to solve the problem in a way no one had intended—in a sense, gaming the test rather than failing it.”

For businesses, strengthening baseline security measures is the best way to defend against attacks of this type. The OpenAI agents made multiple server-side request forgery (SSRF) attempts against Hugging Face before one was successful. Kapersky recommends organisations establish rules within defensive alert telemetry to escalate event priority when volume spikes and conduct security team drills to ensure key personnel are equipped to respond quickly to key events.

Bonus: PHP – PHP2Shell Vulnerabilities

We couldn’t share the most spine-chilling cyber incidents of the year without discussing last week’s PHP2Shell vulnerabilities – CVE-2026-109618 and CVE-2026-109619. The vulnerabilities allow an attacker to execute code or expose sensitive process memory. PHP powers around 70% of the world’s websites, including platforms like WordPress, Drupal, and Joomla.

PHO released a patch on October 21^st at 14:00 UTC; businesses either rushed to update or, in many cases, took websites offline entirely until the patch could be applied. In the UK, 32 government services were forced offline, with another four partially unavailable. Tech minister Baroness Lloyd of Effra said this “resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied.”

The UK’s National Cyber Security Centre (NCSC) also sent 50,000 warnings to businesses and other organisations ahead of the public disclosure. Despite this, Cloudflare CEO Matthew Prince shared that the company had spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. The figure “jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Building Resilience, Reducing Risk

Organisations contend with increasingly sophisticated cyberattacks, from AI-powered threats to supply chain compromise. Implementing best practice standards like ISO 27001 for information security management, ISO 27701 for data privacy management and ISO 42001 for AI management supports organisations in building strong governance across all three disciplines – and the foundations for real resilience in the face of evolving cyber threats.

Ready to act? Our Cyber Hygiene Checklist provides ten best practices businesses can implement to bolster their cyber defences.

Download your Cyber Hygiene Checklist