Yellow Hat Reports Breach in Web Work Reservation System, Possible Leak of 1.8 Million Member Records
Yellow Hat, a major Japanese retailer of car parts and accessories, has confirmed a security breach affecting its online Web Work Reservation System.
The system, used by customers to book maintenance services such as oil changes, battery replacements, and vehicle inspections, was found compromised on August 18, 2026. Subsequent investigation revealed that personal information stored on the company's member server may have been accessed and leaked externally.
Up to 1,801,499 members could be impacted. The exposed data includes names, telephone numbers, email addresses, and member numbers.
Yellow Hat has reported the incident to police and the Personal Information Protection Commission. Affected members are being notified via email, SMS, telephone, or postal mail, with warnings to watch for any suspicious unsolicited contacts.
Related articles
Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks
Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.
k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials
Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.
OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach
OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.
Moscow Court Places Dodo Pizza Cyberattack Suspect Denis Fridman Under House Arrest Until 2026
The Tverskoy District Court of Moscow has ordered Denis Fridman to remain under house arrest until December 8, 2026, in connection with a cyberattack on Dodo Pizza that occurred in late September. Fridman faces charges under paragraphs a and v of part 3 of Article 272.1 of the Russian Criminal Code, which covers the illegal circulation of computer information containing personal data. Investigators detained three of the four suspects after Fridman failed to mask his real IP address while accessing the stolen dataset. The breach lasted two days, but Dodo Pizza quickly blocked access and confirmed that payment details were not compromised because the company does not store them. Authorities notified Roskomnadzor of the incident and implemented measures to forcibly terminate active user sessions where necessary. House arrest remains a preventive measure, and Fridman’s guilt has not yet been established by the court.