News & Threat Intelligence

LATEST INCIDENT

October 28, 2026

South Korea Finance

Government Breach Spotlight · Deep Dive

FLHSMV learned on September 4, 2026 that an international cybercriminal organization had accessed DAVID, its driver and vehicle lookup database (22 million driver records), through a Plant City Police Department employee's credentials improperly stored on a personal device. The department says access was contained and credentials reset; FDLE and the Florida Digital Service are investigating. Potentially affected: driver license and motor vehicle data, including document images. No misuse has been found so far; no confirmed count and no exposure window have been published.

ShinyHunters listed the department on its leak site on September 7, claiming more than 200,000 records. Its proof, a screenshot of Jeffrey Epstein's DAVID record, is unverified; the department has confirmed none of the group's counts, methods, or data, so all group figures are attacker claims. The state did not pay by the September 11 deadline. On September 16 the group published hundreds of thousands of files (500,000 claimed in total), which TechCrunch reviewed. On October 16, lacking current addresses for some impacted people, the department issued a public substitute notice; letters to current holders follow the week of October 19 (one year of Sontiq monitoring, $1 million identity theft insurance).

Lessons learned: (1) Privileged credentials never live on personal devices; enforce and verify the rule. The vector was a stored credential, not a software flaw. (2) Shared query systems need privileged access management: least privilege, per-user accountability, session controls, anomaly detection on unusual lookups. (3) Assume publication; notification readiness is what shortens a six week gap.

Why it matters to Florida residents, and what to do: DAVID records are not opt-in accounts; every licensed driver and titled vehicle owner must have one, former holders included. License and vehicle data with document images enables identity theft, fraudulent titles, and synthetic identities, and the data is already published. Watch this week's mail; enroll when the letter arrives. Place a free credit freeze with Equifax (1-800-525-6285), Experian (1-888-397-3742), and TransUnion (1-800-680-7289); pull free reports at AnnualCreditReport.com. The department notifies by mail, so distrust emailed or texted enrollment links. Former holders who receive no letter should email CustomerInquiry@flhsmv.gov.

What FLHSMV should do now: Publish the itemized data elements and a confirmed count, undisclosed six weeks on; finish notifying former holders rather than relying on substitute notice; audit DAVID query logs for the full exposure window and publish it; enforce the personal device credential ban across every agency with DAVID access, with sanctions; add anomaly detection and step-up authentication; state whether the claimed password reset flaw was investigated and closed.

Where SecurTek fits: A privileged access failure, not a perimeter failure. SecurTek's advisory work covers privileged access management for shared query systems, credential governance across partner agencies, and notification readiness; Professor Fehr's doctoral research covers the same control family for privileged actors and AI agents. The human failures are trainable, and SecurePath Academy's security awareness and compliance training drills them. (Sources: FLHSMV · Tallahassee Democrat · TechCrunch and BleepingComputer reporting.)

Healthcare Breach Spotlight · Deep Dive

Central Ohio Primary Care (COPC), one of the largest physician-owned primary care groups in the United States, serving more than 500,000 patients across Ohio, is not yet listed on the HHS Office for Civil Rights breach portal. This deep dive rests on COPC’s October 15, 2026 statement and the reporting cited below, and it will be updated when the registry listing appears.

COPC discovered the incident on August 25, 2026: a vishing attack, voice phishing carried out for extortion, in which a criminal threat actor gained unauthorized access to files containing protected health information. The practice publicly acknowledged the breach on October 15, about six weeks later. Its investigation found that around 1.4 million current and former patients and employees were affected. The information potentially exposed includes names, addresses, Social Security numbers, patient ID numbers, financial information, and limited health-related data. COPC says its MyChart patient portal was not impacted, that it has seen no misuse of the information for identity theft or fraud, and that affected individuals are being notified in writing and offered complimentary credit and dark web monitoring. The Chaos ransomware group has reportedly claimed responsibility for the attack; that claim, reported by law firms citing dark-web monitoring, has not been confirmed by COPC or by authorities.

Lessons learned: (1) Voice is an attack surface. This intrusion began with a phone call, not malware. Verification discipline, refusing to act on a voice request alone and calling back on a known number, is a control, and it can be drilled. (2) The clock is part of the incident. Six weeks passed between discovery and public acknowledgment; notification readiness, with counsel, call centers, and monitoring arrangements in place before they are needed, is what compresses that gap. (3) Extortion changes the playbook. The attacker wanted money, not just records; segmented access to files containing protected health information limits what one compromised identity can reach. That is the gap SecurePath Academy’s HIPAA and security awareness training and SecurTek’s advisory work exist to close: vishing verification and incident readiness are trainable, testable, and auditable before they become a breach headline. (Sources: The Columbus Dispatch · COPC incident response site.)

Illustrative scale (not data): 1 5 10

Breaches by state

October 28, 2026 · South Korea · Finance

Records: 38,490 (Daishin Securities only; Bithumb count not disclosed, not counted)

October 27, 2026 · Japan · Technology

Records: 2,585,481

October 26, 2026 · South Korea · Finance

Records: count not yet published (under investigation; not counted in the records exposed total)

October 26, 2026 · Japan · Travel

Records: up to 2.6 million potentially affected (company stated maximum total; not counted in the records exposed total)

October 24, 2026 · Singapore · Healthcare

Records: about 110,000

October 23, 2026 · Denmark · Academics

Records: about 525,000

October 23, 2026 · Canada · Retail

Records: about 2,000,000

October 22, 2026 · Japan · Gaming

Records: 11,774,247