Cyber news on October 25, 2026

1. 0114:24 UTC

   RBI opens sovereign Tier-IV data centre and cyber training institute

   3 outlets · first: Business Standard Security

   Machine summary Key facts from the reports:

   1. PM Narendra Modi inaugurated the RBI data centre and cybersecurity training institute in Bhubaneswar on 25 October 2026, according to the reports.
   2. Governor Sanjay Malhotra told DD India the facility cost Rs 169 crore and holds Uptime Institute Tier-IV accreditation, the highest tier.
   3. UPI is run by NPCI but its final settlement passes through RBI data centres and applications, Malhotra said; the complex contains four independent data centres.
   4. Two-thirds of the site is allocated to the training institute and one-third to the data centre; the institute will teach AI, big-data analytics, quantum computing and blockchain, per the RBI press release and Malhotra's remarks.

   Reported by Business Standard, The Hindu - Business Line and economictimes.indiatimes.com.

   • Narendra Modi
   • UPI
   • Uptime Institute

2. 0206:46 UTC

   Korean Air and Asiana say reservation data leaked via Amadeus

   2 outlets · first: The Korea Times Data breach

   Machine summary Korean Air and Asiana Airlines said customer reservation information was exposed through Amadeus IT Group, which runs reservation and ticketing systems for airlines worldwide. Korean Air acknowledged that certain booking reference numbers had been leaked, whereas Asiana stated payment information remained unaffected since it operates on a separate transaction system.

   1. Korean Air and Asiana Airlines said customer reservation information was leaked through Amadeus IT Group, which operates reservation and ticketing systems for airlines worldwide, according to the carriers' announcements reported by The Korea Times.
   2. According to the airlines, the incident is thought to have occurred through unauthorized entry via login credentials belonging to an account within Amadeus' system.
   3. Korean Air confirmed that exposed information included booking reference numbers belonging to certain customers; how many customers were affected, as well as the full scope, remained under investigation.
   4. According to Asiana, data linked to reservations was compromised, while payment details remained unaffected since transactions run through a different system.
   5. According to the airlines, neither carrier found evidence that its internal systems or its databases had suffered a direct breach; Amadeus is preventing unauthorized access and keeping watch on the dark web.

   Reported by The Korea Times and koreatimes.co.kr.

   • Reservation and ticketing systems
   • Asiana Airlines
   • Amadeus IT Group
   • Login credentials
   • Korean Air

3. 0312:35 UTC

   CyberGuy Oct. 25 report: Social Security-branded email sent with no apparent federal link

   2 outlets · first: Democratic Accent Threat intelligence

   Machine summary The report says the SSA Office of the Inspector General warned in February 2026 of a significant increase in fraudulent emails using the same approach.

   1. The email displayed the sender name "Social Security Administrator" while originating from an address with no apparent connection to the federal government, the CyberGuy report states.
   2. The message used the subject line "Statement Support Was Posted to Your Account Details Report" and told recipients their 2025 Social Security statement was ready, according to the report.
   3. The email carried the Social Security Administration logo and a button labeled as a way to view a statement, the report describes.
   4. According to the report, in February 2026 the Inspector General's office at the Social Security Administration warned about a substantial rise in scam emails employing this identical technique.

   Reported by Democratic Accent and foxnews.com.

   • Social Security Administration

4. 0415:11 UTC

   Coverage recordbleepingcomputer.com: “Tailscale warns of SSH flaws allowing root privilege escalation”

   2 outlets · first: CyberSecurityNews Vulnerability

   Reports ran from 15:11 UTC on Oct 25 to 14:09 UTC on Oct 27.

   The outlets that reported this event are listed with links to their reports; no summary of ours passed our automated checks for it, which says nothing about the event (how they work).

   Reported by CyberSecurityNews and bleepingcomputer.com.

   • Tailscale

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.