This week in cyber: 27 October to 2 November 2026

Binance: one of the largest crypto thefts on record

On 29 October the crypto exchange Binance said around $6.3 billion of digital assets had been moved out of its online wallets. Blockchain analysis firms said most of it left within about 20 minutes and linked the attack, with high confidence, to a North Korean hacking group known as TraderTraitor. Binance said customer deposits were unaffected, that it had frozen roughly $3 billion with partners, that withdrawals were paused for a short time and that it would cover all losses.

What it means for you: if you hold crypto on an exchange, expect scammers to pose as "Binance support" or "recovery services". Binance will not ask for your password, codes or recovery phrase. Our explainer The Binance hack explained covers this in more depth.

Sony-owned provider So-net: about 2.5 million records

Sony Network Communications, which runs the So-net and plala internet services in Japan, disclosed that attackers reached a customer database in mid-October. According to reports, about 2.58 million records were involved, including names, phone numbers, email addresses and dates of birth. Separately, around 54,000 email addresses from its mail services were exposed together with their passwords; the company reset those passwords.

What it means for you: if you are a customer, change any password you reused elsewhere and watch for convincing emails that use your real details.

University of Copenhagen and Japan Airlines

The University of Copenhagen in Denmark said hackers accessed a test environment that contained real personal data, affecting around 525,000 people. Names, national ID numbers, phone numbers and email addresses were involved, along with roughly 20,000 PIN codes for campus building access. It is a reminder that test systems need the same protection as live ones, or should use fake data.

Japan Airlines reported that a breach at Amadeus, a company that provides reservation systems to many airlines, exposed booking details for about 92,000 customers and more detailed information, including passport numbers, for about 2,000 more.

What it means for you: breaches often happen at a supplier you have never heard of. You cannot prevent that, but you can limit the damage: see How to check if your details were in a data breach.

PHP2Shell: website software flaws now under attack

The US Cybersecurity and Infrastructure Security Agency (CISA) added two flaws in PHP, nicknamed PHP2Shell, to its list of vulnerabilities known to be used in real attacks. PHP is the programming language behind a large share of websites, including many built on WordPress. Fixed versions were released on 21 October.

What it means for you: if you run a website or blog, ask your hosting company whether its servers have been updated. If you manage servers yourself, upgrade PHP and restart the services. Our note on patch management explains why speed matters.

Also this week

• Bank of America told customers not to give their banking username and password to AI assistants or agents that offer to act for them. See AI assistants that act for you.
• Attacks on Plex Media Server continued after CISA listed the Plex2Shell flaws. Home users should update. See our Plex article.
• Scammers posing as the US Federal Trade Commission threatened to cut off people's phone numbers. See this scam alert.

Your five-minute checklist this week

1. Install waiting updates on your phone, computer and router.
2. Change any password you have reused, starting with email.
3. Turn on 2-step verification for email and financial accounts.
4. Ignore unexpected calls or messages about crypto recovery, account problems or "security deposits".