SecureFact – October 12, 2026

EY data breach puts spotlight on data security at Big Four as clients demand tighter controls

The recent EY data breach, which exposed potentially sensitive client information linked to firms such as Goldman Sachs and Man Group, has raised serious concerns about data security across the Big Four professional services firms. The breach occurred when an unauthorised third party accessed an IT platform and downloaded client-related documents, reportedly exploiting a vulnerability in Checkmarx software. The incident highlights broader risks associated with complex IT environments, legacy systems, inconsistent security controls across global offices, employee access, third-party software, email communications, and the growing use of AI tools. As a result, clients and technology leaders are demanding stronger controls, better monitoring, and more consistent protection of confidential data across interconnected systems and external providers.

(Source: Read full report)

Denmark population registry data breach affects 8.8 million people

Denmark’s Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals, including people who live in the country, individuals who have moved abroad, and deceased people. Threat actors misused a private Danish company’s legitimate access to the registry system to obtain names, addresses, CPR numbers, and other information relating to registered members. The attack involved brute-forcing to enumerate valid CPR numbers and then extract the related data from each entry. The CPR system currently holds data for 11 million registered citizens, so the incident impacted 80% of that. The security incident occurred in September 2026, but CPR administration became aware of the breach on October 2 and determined the size of the impact over the weekend. The private company’s access to the registry has been blocked and police have launched an investigation. Additional security measures have been implemented to prevent similar incidents on the CPR system. A dedicated cyber hotline has been set up for potentially affected individuals and help and guidance are available online at sikkerdigital dk.

(Source: Read full report)

South Korea probes bank breaches amid suspected AI-powered attacks

South Korea’s Financial Services Commission held an emergency meeting following a series of cyberattacks targeting financial institutions. Officials confirmed a data breach at Shinhan Bank and said other cybersecurity incidents affected other South Korean banks, including Kookmin Bank. Shinhan Bank and KB Kookmin Bank are large private South Korean commercial banks, each holding more than $400 billion in assets. Authorities launched on-site investigations after receiving incident reports and shared all actionable information with relevant agencies, including KISA. According to reports, Shinhan Bank leaked the details of 25,000 customers, while Kookmin Bank leaked credit card information of 119 clients. Hana Bank was also found to have suffered a limited-scope breach after its sales-support system was compromised. Financial companies in the country were instructed to inspect all externally accessible IT systems, reduce unnecessary information exposure, check for missing or inadequate authentication and access controls, and quickly share threat information. Authorities also pledged to oversee consumer protection and compensation.

(Source: Read full report)

ASOS links data breach to social engineering attack, credential theft

UK fashion retailer ASOS confirmed that a recent data breach was caused by a social engineering attack in which hackers stole an employee’s login credentials by impersonating a trusted contact. The stolen credentials were used to access information on certain third-party platforms used by ASOS. The threat actor, calling themselves “Xuanye Group,” claimed they had stolen customer data but not payment information. ASOS confirmed that the following details were exposed: full names, contact details, and certain non-personal account-related information. ASOS says hackers did not access payment card information or account passwords. The company locked down the affected platforms and launched an investigation with support from external experts, law enforcement, and regulatory authorities. ASOS has implemented additional security measures to prevent similar incidents in the future. The company advises customers to remain cautious of unexpected messages or calls claiming to be from ASOS and to never share passwords, security codes, or payment details in response to unsolicited communications.

(Source: Read full report)

Advantest confirms personal information stolen in ransomware attack

Advantest Corporation, a global manufacturer of automated test equipment for the semiconductor industry, is notifying affected individuals that a ransomware attack in February 2026 exposed their personally identifiable data. On February 15, a threat actor breached its network and gained access to some of its systems, deploying a ransomware payload. In a data breach notification dated October 6, 2026, Advantest confirms that data was stolen in the attack. The exposed data types include contact information, date of birth, social security numbers, national ID numbers, driver’s licenses, passport numbers, medical information, financial information, and other ID numbers. It is unclear whether the compromised data belongs to customers, employees, partners, or a combination of these groups. The company states that it has no information that the compromised data has been leaked or otherwise misused, although it recognizes the elevated risk of identity theft and fraud. Advantest provides instructions on how to enroll in free 18-month identity theft, credit, and web monitoring services from Kroll, with enrollment available until January 4, 2027.

(Source: Read full report)