Daily Cyber Threat Brief — October 27, 2026: University of Copenhagen breach exposes data of 525,000 people

The detail that elevates this breach above a routine university incident is the data mix: CPR numbers — Denmark's national identity numbers — alongside names, phone numbers and email addresses. Test environments are a recurring weak point in breach reporting because they often hold production-grade data under weaker controls, and this case fits that pattern: the environment held real personal data for more than half a million people.

The second-order exposure is physical. The later addition of 20,000 staff and students whose building PIN codes were exposed forced the university to restrict access to some critical locations while replacement codes go out — a reminder that a data breach in a university's systems can translate directly into a physical-security response. What remains undisclosed is the access vector, whether data was copied out, and how long the intruders were present before detection last week. Until those findings land, affected individuals should treat the exposure as live: CPR numbers cannot be reissued the way a password can.

French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. In notification letters to affected customers, the company listed the stolen data as first and last names, mailing addresses, email addresses, phone numbers, Delivery Point (PDL) or Metering and Estimation Point (PCE) identifiers, customer IDs and contract numbers.

Two scoping facts matter. First, ENGIE says the incident is limited to its customers in France, and its investigation found no evidence that banking information was involved. Second, no ransomware operation or extortion gang has claimed the breach, and ENGIE has not attributed it to a specific threat group. The risk that remains is phishing precision: with a customer's name, address, meter point and contract number, a fraudulent message can be made to look convincingly like it came from ENGIE itself. The company has individually informed affected customers and reminded them of precautions against fraud and phishing. Note the separate, older thread: a year ago, the Scattered LAPSUS$ Hunters group leaked records it claimed to have taken from a Salesforce instance of ENGIE's North American retail subsidiary — a different incident, not evidence about this one.

Seoul Metropolitan Police announced the arrests of seven suspects in what they describe as South Korea's first large-scale AI-assisted hacking operation: about 90 organizations breached and 8.2 million records stolen over roughly 13 months, from September 2025 to this October. Targets included hospitals, universities, private cram schools, golf courses and subsidiaries of large conglomerates. One funeral services provider lost 1.22 million records, and reports say data from the academies included information on minors.

The acceleration is the story. The alleged ringleader, a 32-year-old former penetration-testing company employee (2019–2022) who says he taught himself hacking through YouTube and blogs, started with conventional website vulnerability scanners. After adding an AI coding agent and the ARTEX autonomous penetration-testing framework in late August 2026, police say he breached 60 companies in 44 days, from August 31 to October 13. Ransom emails went to 38 victims demanding a combined 360 million won (about $270,000), promising not to leak the data; only one payment of 300,000 won (about $210) is confirmed. The ringleader was arrested October 15, formally detained two days later and referred to prosecutors on October 23; the other six suspects remain under investigation without detention. Police opened the case in June after a victim complaint and traced the suspects through server logs. The same ARTEX framework was previously linked to attacks on South Korean banks attributed to a Chinese-speaking threat actor — that earlier activity is not established as connected to these suspects.

CISA has added the PHP2Shell vulnerabilities — CVE-2026-109618 (memory corruption on out-of-memory handling) and CVE-2026-109619 (stale request state), both unauthenticated remote code execution — to its Known Exploited Vulnerabilities catalog, with a remediation deadline of October 29 for federal agencies. This follows yesterday's confirmed in-the-wild exploitation evidence and converts the patching race into a formal exploited-vulnerability incident.

The patch targets are unchanged: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released October 21; PHP 8.1 and earlier have no fixed build and, per CISA, should be taken offline until upgraded. The exposure surface is vast — a Censys estimate cited by The Hacker News puts more than 32 million PHP services still on an affected build — and PHP is often bundled inside appliances and hosted apps, so an inventory of servers where PHP was deliberately installed will miss some. Palo Alto Networks notes PAN-OS and Panorama management interfaces are also affected, with remaining hotfixes due between October 27 and October 30. Separately, PHP's October 23 mitigation for a new code-execution flaw — setting session.upload_progress.enabled=0 — still stands until a fix ships.

DreamHost, a hosting provider serving more than 400,000 customers, has forced password resets for email and FTP/SFTP users after an incident that began with File Manager connectivity problems on October 23 and expanded to other services. Account owners have been sent recovery instructions and advised to remove any unrecognised email forwarding rules — a standard indicator check after mailbox compromise.

What is not yet known is the part that matters most: DreamHost has not said how many accounts were affected, or whether files or messages were exposed, and BleepingComputer reports it has not received answers to those questions. The provider also cannot contact individual mailbox or FTP users directly, so it is urging account owners to notify affected users by phone, text or other means, since users whose passwords were reset may be locked out of their email. Users should also change any reused passwords elsewhere. Until DreamHost characterises the incident, this should be read as an ongoing, undisclosed-scope incident — not as a confirmed data breach.