Cyber news on October 29, 2026

1. 0117:32 UTC

   Florida says financial aid site breach may have exposed 4.9M people

   5 outlets · first: cbs12.com Data breach

   Machine summary The Florida Department of Education reported that an unauthorized criminal intrusion into its student financial aid site possibly revealed personal data, including Social Security numbers, affecting about 4.9 million individuals. Staff detected the activity on Oct. 19, and the department said its response ended the access and re-secured the systems, with the Florida Department of Law Enforcement and Florida Digital Service assisting.

   Reported by cbs12.com, WPEC, WPLG Local 10, WCTV and GovTech.

   • Florida Department of Education
   • Florida Digital Service
   • Florida Department of Law Enforcement

   Full coverage: every report, when each was published, and who was named (5 outlets)

2. 0222:27 UTC

   Loss estimates for Binance incident range from $2 billion to $5.8 billion

   4 outlets · first: techcrunch.com Security

   Machine summary BleepingComputer reported the suspected breach involves up to $5.8 billion in digital assets, while TechCrunch cited crypto watchers saying at least $2 billion was drained from Binance's hot wallets, with some estimates above $5.7 billion. Both reports state the figures are unconfirmed, and TechCrunch reported it is possible the theft is ongoing. Binance has not confirmed a theft or a loss total.

   1. Binance told BleepingComputer and TechCrunch it is investigating reports of a potential security issue and stated that "user funds are completely safe"
   2. BleepingComputer reported the potential breach involves up to $5.8 billion in digital assets; TechCrunch cited estimates of at least $2 billion drained from Binance hot wallets and some estimates above $5.7 billion, unconfirmed
   3. Tether CEO Paolo Ardoino said on X that Tether froze more than $1.567 billion in USDT linked to the incident
   4. On X, Jeremy Allaire, Circle's CEO, stated that the company had frozen over $800 million in USDC connected to the incident and was working with law enforcement.
   5. BleepingComputer reported the frozen total exceeds $2.3 billion; a confirmed loss would exceed the $1.5 billion stolen from Bybit in February 2025, described there as the largest confirmed crypto heist on record

   Reported by techcrunch.com, bleepingcomputer.com, cointelegraph.com and www2.stockmarketwatch.com.

   • Binance
   • Tether
   • Circle
   • Bybit

3. 0319:23 UTC

   Polymarket halted trading after crypto-draining script found

   2 outlets · first: cointelegraph.com Threat intelligence

   Machine summary Polymarket suspended trading on Thursday after, the company said, a third-party provider was compromised and cryptocurrency-draining JavaScript reached users on Polymarket.com. Hudson Rock researchers found a suspected attacker-controlled wallet embedded in the malicious script, and BleepingComputer's blockchain review traced about 28.6 million POL, roughly $2.57 million, to three additional wallets. The company said the issue was fixed the same afternoon, trading came back around 3:05 p.m. ET, and affected traders will be reimbursed; it has not disclosed the user count or the amount stolen.

   1. Polymarket temporarily halted trading on Thursday after, the company said, one of its third-party providers was compromised and cryptocurrency-draining JavaScript was distributed to users (BleepingComputer).
   2. A wallet believed to be under attacker control, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, was flagged by Hudson Rock researchers as having been embedded in malicious JavaScript.
   3. BleepingComputer's review of the wallet's blockchain activity found approximately 28.6 million POL, valued at roughly $2.57 million, transferred to three additional wallets.
   4. At 2:05 p.m. ET, Polymarket switched its exchange to cancel-only mode; at 2:37 p.m. ET it reported the problem had been fixed; and at 3:05 p.m. ET it declared the incident resolved, with trading back online.
   5. The number of users affected, the amount of cryptocurrency taken, and the way its reimbursement process will function have not been disclosed by Polymarket; the company stated that anyone affected will be made whole and that it had referred the matter to law enforcement.

   Reported by cointelegraph.com and bleepingcomputer.com.

   • Polymarket
   • Hudson Rock
   • cryptocurrency-draining JavaScript
   • Polymarket.com
   • POL

4. 0423:37 UTC

   Michigan order cites FTC Safeguards Rule disposal gaps at servicer

   2 outlets · first: The National Law Review Regulation

   Machine summary The servicer is required to deploy servicing software, submit the designated servicing records to DIFS, and have independent compliance audits performed twice yearly for a period of two years.

   1. Per the National Law Review, a consent order was entered by Michigan DIFS on October 19, 2026, with a licensed mortgage servicer.
   2. DIFS alleged failures involving annual escrow account statements and secure disposal of customer information, the report states
   3. The order requires a $15,000 fine, implementation of servicing software, and delivery of specified servicing records to DIFS
   4. Independent compliance audits are required every six months for two years, with audit records retained for five years

   Reported by The National Law Review and National Law Review.

   • FTC
   • National Law Review
   • Licensed mortgage servicer (unnamed in reports)

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.