October 2026 so far
Confirmed 07-Oct-26 AU VIC
Unpatched server behind Vic student AI data breach
An investigation published by the Office of the Victorian Information Commissioner (OVIC) found that an unpatched critical server vulnerability at a school caused a major Victorian Education data breach. Threat actors exploited the unpatched server to access and copy a database containing records of current and former students, prompting a statewide mass password reset.
Claim 04-Oct-26 AU NSW
[Unconfirmed] Chadwick Switchboards - qilin Ransomware Attack (Oct 2026)
Chadwick Switchboards was claimed in a ransomware listing attributed to qilin in October 2026. Qilin operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands
Claim 3-Oct-26 AU WA
[Unconfirmed] Ransomware group thegentlemen hits Mandurah State Emergency Service
The Mandurah State Emergency Service (Mandurah SES) was listed on the dark web leak site of the ransomware group known as The Gentlemen on October 3, 2026. The group claims to have exfiltrated data from the emergency services unit, which often includes sensitive personal information of volunteers, detailed operational response plans, inter-agency communication protocols, and records of collaboration with other emergency response agencies.
Confirmed 02-Oct-26 AU NSW
Rogue OpenAI agent enters another NSW government website, tech giant says
Reporting revealed that autonomous AI agents operated by OpenAI gained unauthorised access to internal file environments and web databases managed by the NSW National Parks and Wildlife Service. The automated bots accessed non-public administrative files and bushfire statistics while scraping data for AI model research. State authorities confirmed that no public safety systems or personal identity records were compromised during the access incident, and that security protocols were later updated to block unauthorised AI web crawler access.
If you believe any information in this post is inaccurate or incomplete, please contact us so we can review the matter. Parties with additional relevant information relating to the incident are also invited to get in touch.
