October 2026 Data Breaches and Lessons Learned

October 2026 was a rough month for breach notices. A blockchain analytics firm said an attacker used AI agents to get inside. A backup tool trusted by thousands of IT providers turned into a door into hundreds of Microsoft 365 tenants. And the count from a 2025 health tech breach finally came out. It’s nearly 20 million people.

This roundup covers six incidents at US-based companies that were disclosed or updated in October 2026, with later updates through November 6. Each one is backed by a company statement, an SEC filing or a state regulator filing. For each, you’ll see what happened, what was exposed and what your team can test so the same thing doesn’t happen to you. For the previous month, see our September 2026 data breach roundup.

Company	What was hit	Reported impact	Disclosed
Chainalysis	Internal systems and tools	All users’ names, usernames, password hashes and live tokens; some passwords	Oct 30, updated Nov 4
ConnectWise	Cloud Backup app credential	Sign-in activity in almost 1,000 Microsoft 365 tenants; 300+ successful sign-ins	Oct 17
Railway	Build infrastructure and stored secrets	Environment variables potentially exposed in up to about 100,000 workspaces	Oct 21
Revolve	E-commerce platform	Saved payment cards; at least 197,072 people notified	Oct 29
Oracle Health	Legacy Cerner servers	Nearly 20 million patients	Oct 2 (count)
Quest Diagnostics	Quanum LSM portal	Certain patient records; count not disclosed	Oct 22

Chainalysis says AI agents helped an attacker get inside

In October 2026, an attacker got into Chainalysis’s systems and internal tools. Chainalysis says the attacker used “offensive agentic techniques,” but it hasn’t explained exactly how. That’s an awkward spot for the New York-based firm, since crypto exchanges and investigators rely on it to trace stolen funds.

The story has grown since the first notice. On October 30, Chainalysis said a subset of users had their user IDs, names, email addresses and organization role labels exposed. Its November 4 update went much further. It said the names, usernames, password hashes and live tokens of all Chainalysis users were exposed, and that an on-path attack exposed some customer passwords. Every user now has to reset their password and rotate API keys where needed. Chainalysis says it still has no evidence that investigation data was accessed.

So what does “agentic” mean? In general, agentic attack tools use AI agents that find a weakness, exploit it and plan the next move with little human help. They don’t sleep, and they don’t wait for your next scheduled pentest. That’s the case for running agentic pentesting against your own apps on the same clock.

Why did a ConnectWise backup app become a way into Microsoft 365?

A single stolen credential let attackers sign in to customer Microsoft 365 tenants as ConnectWise’s own backup app. ConnectWise sells software to managed service providers (MSPs). Its Cloud Backup app (formerly SkyKick) holds wide permissions across Exchange Online, OneDrive, SharePoint and Teams so it can back them up.

Here’s how it played out.

1. October 15. The stolen Cloud Backup credential was used to sign in to customer tenants and get Microsoft Graph access tokens.

2. Inside the tenants. In about 50 tenants Huntress monitors, ConnectWise apps gave themselves directory roles, mostly Exchange Administrator. In two, an app made itself Global Administrator and planted new client secrets on other apps, a way back in for later.

3. October 16. Security firm Huntress went public and confirmed unauthorized sign-ins in 162 tenants.

4. October 17. ConnectWise disabled seven application identities and took Cloud Backup, SaaS Security and Cloud Management offline. By that evening, Huntress had seen sign-in activity across almost 1,000 tenants, with more than 300 successful sign-ins.

These were app-only sign-ins with no user involved, so user MFA didn’t apply. Microsoft later tied the attack to Storm-0940, a China state-aligned group it says used ARTEX, an open-source agentic AI pentesting framework, to try signing in to more than 2,250 tenants. Microsoft also points out that a successful sign-in doesn’t prove data was taken, and ConnectWise says it found no evidence that stored backups were accessed.

Turning off the ConnectWise app isn’t enough on its own, because an attacker may have planted secrets on other apps too. If your tenant trusts third-party apps like this, check these things now.

• Which apps hold admin-level permissions in Entra ID, and whether each one needs all of them

• Any directory role a ConnectWise or SkyKick app gave itself, especially Global Administrator

• Client secrets or certificates added to any enterprise app since October 13

• What an attacker could reach if one of your app secrets leaked

A build pipeline exposed Railway customers’ secrets

If you deploy on Railway, an attacker may have read some of your API keys and database passwords in October. Between October 20 and 22, 2026, someone got into the San Francisco-based cloud platform’s internal systems and decrypted part of the environment variables customers store there.

Railway caught an attempted privilege escalation in its build infrastructure on October 20 and declared an incident the same day. The next day it published a security disclosure and asked every user to rotate their secrets. Its preliminary report says at most 1.85% of workspaces, about 100,000, may have had some environment variables exposed.

The bigger worry is where those secrets lead. One key can open a cloud account, an AI provider, a GitHub repo or a Stripe account, and Railway controls none of those. Railway believes the attack was part of a wider campaign against platform companies, aimed at getting into AI inference providers.

Could an attacker in your environment jump from a low-privilege foothold into your build pipeline, then into production secrets? You want that answer before someone else finds it, and it’s what a cloud pentest is built to check.

Which customers lost card data in the Revolve breach?

Certain shoppers who saved a card on Revolve.com or FWRD.com are affected. An attacker got into Revolve’s online shopping platform on September 11, 2026, and may have used “automated means” to collect their payment details.

Revolve confirmed on September 29 that the data included card numbers. It disclosed the breach in an SEC 8-K on October 29 and started notifying customers that day. Here’s what its filing and notice letters say was taken.

Data	Possibly taken?
Name and address	Yes
Card number	Yes
Card expiration date	Yes
CVV code	Not mentioned in the 8-K

Revolve hasn’t published a total. State breach notices add up to at least 197,072 people, including 127,200 in Texas. If you got a letter, ask your card issuer for a new card number.

Revolve hasn’t disclosed the technical cause. If you run a similar shopping platform, check your APIs for broken object level authorization (BOLA) and for controls that stop bulk data pulls, like rate limits. Both risks are in the OWASP API Security Top 10. PCI DSS Requirement 11.4 already expects you to pentest, and this web application pentesting checklist is a good place to start.

Oracle Health’s legacy servers exposed nearly 20 million patients

Attackers broke into Oracle Health’s legacy Cerner servers in early 2025, but the full count of people affected only came out in October 2026. Filings in Oregon give January 22 through April 1, 2025, as the breach window and February 20, 2025, as the day Oracle found it.

The count surfaced through Texas. On October 2, 2026, the state attorney general’s breach portal listed 2,992,244 affected Texans, with a nationwide total of 19,929,149 reported alongside the filing. Oracle declined to comment on the figure. Depending on the patient, stolen data can include names, home addresses, Social Security numbers, diagnoses, medications and lab results.

How does a cloud company end up here? Oracle bought Cerner in 2022 for $28 billion and planned to move its systems to the cloud. The data on these servers hadn’t moved yet. Oracle says Oracle Cloud Infrastructure (OCI) wasn’t compromised, and it’s offering affected patients free credit monitoring.

Older systems waiting on a migration still hold real data, so they belong in your asset inventory and your testing scope until the day they’re shut down. We go further into this in exposure management in legacy environments.

Where did the Quest Diagnostics breach start?

It started in Quanum Lab Services Manager (Quanum LSM), the web platform Quest’s clients use to order lab tests and look up results. The Secaucus, New Jersey, company learned of the unauthorized access on October 21, 2026, and filed an SEC 8-K the next day.

Quest believes an unauthorized party accessed certain patient records. That’s close to everything we know. It hasn’t said how many patients were affected, what data was involved or how the attacker got in. It has notified federal law enforcement and says the incident hasn’t materially disrupted its operations. HIPAA generally requires affected people to be notified without unreasonable delay and within 60 days of discovering a breach, so more detail should come.

This isn’t Quest’s first time, either. In 2019, data on about 11.9 million of its patients was exposed through a breach at its billing collections vendor, AMCA.

A portal that outside clients log in to sits right on your external attack surface. Map every one you run, and test its authentication, session handling and access control on a regular schedule.

What should your security team do this week?

A yearly pentest checks one moment in time, and none of these attackers waited for that window. Start by reviewing the kinds of access and systems involved in these incidents. Each step below maps to at least one of the six.

1. List every third-party app with admin-level access in Microsoft 365 and Entra ID, and remove any access you can’t justify.

2. Rotate the secrets stored in your CI/CD and PaaS platforms, then check who and what can read them.

3. Add legacy and mid-migration systems to your asset inventory and your testing scope.

4. Test customer-facing portals and APIs for broken access control and missing rate limits.

5. Move from point-in-time testing to continuous testing, retest after every meaningful change and track each finding until it’s fixed.

That last step is the gap Strobes is built to close. Strobes runs agentic pentesting across web apps, APIs, networks, cloud and mobile, and reports only confirmed, evidence-backed findings. Your team approves before an agent takes any critical action. To see which attack paths in your environment are actually exploitable, start with exposure validation or claim free pentest AI credits.

Frequently asked questions

How do I know if my data was in one of these breaches?

Watch for a notice from the company. Chainalysis now requires every user to reset their password, Revolve’s letters name the affected card by its last four digits and Railway told every user to rotate their secrets. Oracle Health patients may hear from the hospital or clinic that used Oracle’s systems, and the timing can differ from state to state.

How many breaches and cyberattacks were disclosed worldwide in October 2026?

There’s no official count. One tracker, GRC Solutions, found 49 publicly disclosed data breaches and cyberattacks worldwide in October 2026, with at least 67.6 million records confirmed breached.

What should Railway and ConnectWise customers do now?

Railway customers should rotate every secret stored as an environment variable and check linked cloud, AI provider, GitHub and Stripe accounts for misuse. ConnectWise partners should review their own Microsoft 365 tenant and every customer tenant, including ones with dormant SkyKick connections, and look for unexpected directory roles and newly added app credentials.

Could pentesting have prevented these breaches?

Pentesting can find some of the weaknesses discussed here, like overprivileged third-party apps, privilege escalation paths and weak API controls. Public disclosures don’t show whether it would have prevented these specific incidents.

Sources

• Chainalysis incident notice

• Huntress on ConnectWise

• Microsoft on Storm-0940

• Railway incident report

• Revolve 8-K

• SecurityWeek on Oracle Health

• Quest Diagnostics 8-K

• GRC Solutions October 2026 tracker