Security researchers have dubbed October 2026 "Black October," a month in which attackers exposed more than 100 million records, knocked hospitals and local governments offline, and surfaced critical flaws in software much of the internet relies on. The period ended with $6.3 billion stolen from Binance hot wallets — among the biggest cryptocurrency hacks on record.

According to a roundup posted on X by Bull Theory, most of the attacks relied on access that was already trusted — vendors, cloud logins, certificates, and legacy systems — rather than novel intrusion techniques. Three separate crypto thefts were reported in the last week of the month alone. The incidents ranged from university hospitals and fast-food chains to national identity registers and core internet software.

A Month of Mass Data Leaks and Software Flaws

The breaches began early and cut across sectors. Ransomware reached the University of Illinois Chicago College of Medicine. Japanese restaurant chain Yakiniku King leaked 10.79 million member records, and Denmark's CPR register — the country's national civil registration system — saw 8.8 million identity records accessed without authorization.

In a post on X on October 31, 2026, Bull Theory wrote:

October 2026 was one of the most terrifying months cyberspace has ever seen. Security researchers are already calling it "Black October." Tens of millions of people had their personal data exposed. Critical flaws were found in software that most of the internet runs on.… pic.twitter.com/kzS9tH6vAH

— Bull Theory (@BullTheoryio) October 31, 2026

Japan was hit particularly hard. A ransomware attack on IDCF Cloud disrupted services for 495 companies and local governments. Sourcenext, a Japanese software distributor, reported 22.52 million customer records potentially exposed. Burger King Japan and Capcom followed with 11.18 million and 11.77 million records, respectively. Leaked names, emails, and ID numbers are often reused in scam emails and fake login pages.

Software flaws compounded the exposure. On October 17, researchers found that private keys behind eight certificates issued by eMudhra, an India-based digital certificate provider, were weak enough to be reconstructed. The company's shares fell about 20%, and eMudhra is leaving the global SSL certificate business. The episode highlights why certificates sit at a sensitive layer of web infrastructure: they are the mechanism browsers and operating systems rely on to confirm that a website is what it claims to be.

PHP, the widely used server-side scripting language that runs on roughly 70% of web servers, issued emergency fixes on October 21 for two critical bugs that let attackers take over web servers without a password. The US government later confirmed active exploitation and ordered federal agencies to patch within three days.

AI Agents, Emergency Guidance, and Crypto Thefts

AI agents added another dimension of risk. On October 15, CERT-In, India's cyber emergency response team, warned that AI agents had accessed live systems at Indian organizations without authorization, reaching personal data and confidential business records. In the United States, JPMorgan, Morgan Stanley, and Charles Schwab have started blocking outside AI agents from customer accounts.

Governments are also preparing for potential system failures. On October 22, the UK launched its Be Ready campaign, advising people to keep at least three days of food and water at home. Germany advises up to 10 days, while Sweden, Norway, and Estonia suggest at least 7 days.

The final week brought further attacks. A cyberattack on University of New Mexico Health disrupted appointments and forced ambulance diversions. Florida's Department of Education reported up to 4.9 million people potentially affected. Both incidents affected institutions in the healthcare and education sectors.

Crypto platforms were also targeted. CryptoBilis reportedly lost up to $93 million through tampered hardware wallets. CoinDCX, one of India's largest crypto exchanges, lost nearly $16 million through compromised legacy wallet infrastructure — consistent with the trusted-systems pattern that ran through the month. Binance then lost $6.3 billion from compromised hot wallets, capping the month with one of the largest crypto thefts on record. Hot wallets are the internet-connected wallets exchanges keep online to process withdrawals and routine transfers, which concentrates large sums on systems reachable from the open internet. Beyond the headline losses, the month leaves several concrete items to track: eMudhra's withdrawal from the global SSL certificate business, the three-day federal patch deadline for the PHP flaws, and further moves by financial institutions to restrict AI-agent access to customer accounts.

Bull Theory noted that during Black October, a single compromised wallet can put billions of dollars at risk.

This article first appeared on Blockonomi.