Cyber news on October 22, 2026

1. 0109:55 UTC

   Capcom says breach exposed data on 11.7 million Capcom ID accounts

   6 outlets · first: Notebookcheck Data breach

   Machine summary The company said 43 records additionally contained date of birth, gender, country or region and nickname, and that unauthorised password changes were made on 196 accounts. The incident was reported by Capcom to the Osaka Prefectural Police as well as Japan’s Personal Information Protection Commission, and the company issued a warning regarding fraudulent messages.

   Reported by Notebookcheck, IGN Southeast Asia, GamingBolt, gamereactor.eu, hothardware.com and shacknews.com.

   • Personal Information Protection Commission
   • Capcom ID
   • Capcom
   • Osaka Prefectural Police

   Full coverage: every report, when each was published, and who was named (6 outlets)

2. 0207:30 UTC

   Interpol-led Africa operation dismantles 10,909 malicious networks

   2 outlets · first: interpol.int Threat intelligence

   Machine summary Interpol says Operation Serengeti III, conducted with law enforcement from 21 countries between 29 June and 31 August 2026, led to 1,462 arrests and the disruption of 10,909 malicious networks. Investigators identified 65,929 victims and linked the activity to losses exceeding USD 385 million, recovering more than USD 105 million. Private partners including Team Cymru, Kaspersky, Group-IB and Fortinet supplied intelligence on suspicious domains, IP addresses and command-and-control infrastructure.

   1. Operation Serengeti III ran from 29 June to 31 August 2026 with law enforcement agencies from 21 countries under Interpol coordination (Interpol).
   2. Authorities arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than USD 105 million in illicit funds, according to Interpol.
   3. Investigators identified 65,929 victims, and financial investigations linked the criminal activity to losses exceeding USD 385 million (Interpol).
   4. In Uganda, 365 individuals were arrested over alleged links to two transnational online investment and pension fraud rings.
   5. BleepingComputer reported that in Angola nine suspects were arrested at cryptocurrency mining centers alleged to be illegal and more than 2,000 mining devices were seized.

   Reported by interpol.int and bleepingcomputer.com.

   • INTERPOL
   • Fortinet
   • Kaspersky
   • Group-IB
   • Operation Serengeti III
   • Team Cymru

3. 0313:03 UTC

   Marines file class-action suit over Pentagon data center breach

   2 outlets · first: Defense News Data breach

   Machine summary The lawsuit alleges the files were exposed for about nine months and that some affected people were notified two or three months after discovery.

   1. According to the DMDC, a flaw was found on July 16 within a file-sharing platform and announced in September; it let people without authorization reach unencrypted files holding full names, Social Security numbers, dates of birth, and military occupations.
   2. According to the complaint, a security flaw left millions of records belonging to service members and military-affiliated individuals exposed for about nine months prior to being found.
   3. The complaint alleges some affected individuals were notified two or three months after the vulnerability was found, according to the report.
   4. Both plaintiffs say they experienced fraudulent charges on financial accounts and an increase in spam messages, the report states.
   5. The complaint references several reports from the Defense Department Office of Inspector General that outline shortcomings in the department's and the DMDC's adoption of sufficient cybersecurity controls, according to the report.

   Reported by Defense News and Military Times.

   • Defense Manpower Data Center (DMDC)
   • Defense Department Office of Inspector General

4. 0415:24 UTC

   Coverage recordIndia Today: “Top US banks restrict AI agents over unauthorised customer account access risks”

   2 outlets · first: Decrypt Threat intelligence

   Reports ran between 15:24 and 17:10 UTC on Oct 22.

   The outlets that reported this event are listed with links to their reports; no summary of ours passed our automated checks for it, which says nothing about the event (how they work).

   Reported by Decrypt and India Today.

5. 0514:32 UTC

   Quad9 to end free DNS cyberprotection for users in France on November 24

   1 outlet · first: quad9.net Security

   Machine summary Quad9 announced that its free cyberprotection service will no longer be available to users located in France as of November 24, 2026, following a French court ruling that requires it to block recursive DNS resolution for certain domain names. The organization states that it will not alter or withhold DNS responses and describes compliance as technically unfeasible. Quad9's post says French users will be left without what it considers an adequate protective alternative that also complies with European privacy law.

   1. According to Quad9's announcement, the court cut the financial penalty from €580,000 down to €1,000 for each day.
   2. beIN, described in the post as a Qatari company with offices in France, sought the blocking over domain names it asserts infringe its audiovisual rights to sports event broadcasts; Quad9 states it has no association with those domain names or their operators.
   3. Quad9 states it considers recursive DNS resolution a neutral and passive service and says it refuses to alter or misrepresent DNS responses to users.
   4. Quad9 states that compliance is technically unfeasible and that the ruling, in its view, misapprehends the role of the domain name system.

   Reported by quad9.net.

   • beIN
   • Quad9
   • DNS
   • recursive DNS resolution

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.