Cyber insurance: the events of the week from 24 to 31 October 2026

Six cyber events from the week of 24 to 31 October 2026, from the 6.3 billion dollar theft at Binance to Amadeus, GMO Internet, PHP2Shell, UNM Health and Sony Network Communications, linked by dependence on shared suppliers and platforms. With the insurance impact and the questions to bring to renewals.

Week of 24 to 31 October 2026

Updated on 1 November 2026: the FBI attributed the Binance theft to TraderTraitor and Binance began reopening withdrawals.

The week of 24 to 31 October 2026 has a clear common thread: dependence on a supplier or a shared platform. Four of the six selected events start from a single upstream access point (a reservation system, a cloud desktop service, a widely used web software) that spreads to many customers. The largest, the 6.3 billion dollar theft at Binance, shows what happens when the management of the systems that sign transactions gives way. Another, the ransomware attack on a large health system, shows how much more an operational outage weighs than data theft. For underwriters, the question is not only who the insured is, but which suppliers it shares with other insureds.

In brief

Binance: on 29 October the exchange suspends withdrawals after a theft estimated at about 6.3 billion dollars, the largest in the history of cryptocurrencies; about 3 billion frozen.
Amadeus: unauthorised access, lasting from 10 August 2023 to 23 September 2026, to the reservation system used by many airlines. JAL, ANA and Cathay Pacific have reported tens of thousands of affected customers.
GMO Internet: the Onamae.com cloud desktop service is shut down after an attack with a 50 million dollar extortion demand, which was refused. Up to 26,739 servers potentially involved.
PHP2Shell: the two PHP vulnerabilities enter the CISA catalogue of exploited vulnerabilities on 26 October, with exploitation observed on a global scale.
UNM Health: a ransomware attack forces a New Mexico hospital system to divert ambulances and suspend procedures.
Sony Network Communications: 2,585,481 customer records of the So-net and plala internet providers exposed.

The attacks of the week

1. Binance: the largest theft in the history of cryptocurrencies

On 29 October 2026 Binance suspended deposits and withdrawals after a security incident that, according to the exchange, affected about 6.3 billion dollars in assets. Binance says about 3 billion has been frozen on the blockchains with the help of industry partners. Third-party estimates vary: Chainalysis puts the figure at about 5.9 billion at the time of the theft, Elliptic at 6.43 billion (The Hacker News). The previous record was the theft of about 1.5 billion dollars from Bybit in 2025 (Cybersecurity Dive).

According to TRM Labs, the transfers took place across ten blockchains, for about 6.36 billion, mostly within about 20 minutes; the first unauthorised movements date back to 20:05 UTC on 29 October. The attackers had been preparing for at least 36 hours (CoinCentral).

The cause has not been published. Binance's initial investigation pointed to the compromised laptop of a DevOps engineer, which allegedly gave access to a service container from which unauthorised withdrawal transactions were sent. Co-CEO Richard Teng later said the attack was more complex and Binance found other points of breach; there is no evidence of a leak of wallet private keys (The Hacker News). Binance states that the cold wallets, which hold most customer funds, were not touched (Boston Globe).

TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, a unit linked to North Korea and already named for the Bybit theft; Elliptic urges caution because of differences in timing and laundering methods. Binance only says it is working with law enforcement. On 1 November 2026 the FBI officially attributed the theft to TraderTraitor and, with the Secret Service and IRS Criminal Investigation, published the wallet addresses used to move the funds, converted mainly into Ethereum (The Hacker News). Binance has set aside more than 6.34 billion dollars of its own funds to cover user losses. On 1 November it began the first phase of reopening withdrawals and plans to complete it gradually as it finishes its security checks (same source).

2. Amadeus: three years of access to a reservation system

Japan Airlines reported that the data of about 92,000 customers was exposed through unauthorised access to the Amadeus passenger service system, used for reservations, ticketing and check-in. For about 90,000 people, the booking reference, name, flight date, route and class are involved. For about 2,000, email, phone number, passport number, nationality, frequent flyer number and ticket and seat numbers are also involved (BleepingComputer).

The unauthorised access covers the period from 10 August 2023 to 23 September 2026. Amadeus informed JAL on 23 October 2026. On 1 October 2026 Amadeus had published an advisory about a vulnerability in the booking display environment; BleepingComputer notes that the flaw appears to have been exploited afterwards. Neither the article nor Amadeus names a perpetrator.

All Nippon Airways reported about 37,800 affected customers, with passport and nationality for 1,700 of them. Asiana Airlines and Korean Air confirmed they are affected (ID Tech). JAL rules out the exposure of credit cards and passwords and says it has no evidence of misuse.

On 31 October 2026 Cathay Pacific reported about 53,000 affected bookings, created between August 2023 and September 2026. Amadeus informed it on 28 October and explained that an unauthorised party used the credentials of a system account to access booking data; Amadeus reset the password and strengthened monitoring (Aviation A2Z).

3. GMO Internet: a cloud desktop service shut down

GMO Internet, a major Japanese provider, discovered on 20 October 2026 that third parties had installed malicious programs on the servers of some customers of the Onamae.com Desktop Cloud service, used in particular for currency trading. On 21 October a 50 million dollar extortion email arrived and server shutdowns began. GMO refused to pay. On 24 October it confirmed that customer information had been stolen, and on 27 October that the attackers had published data that appears to concern customers, warning that it may contain false information (Webhosting Today).

Up to 26,739 servers are potentially involved; this is an estimate of servers that may have been affected, not of confirmed intrusions. Some customers reported trading operations they did not recognise. GMO will not restart the platform in its current form. It will offer a free alternative environment for six months, compensation of 5,000 yen to each customer and reimbursement of confirmed losses, after any refunds from the trading firms. It has also opened a bounty of up to 1 million dollars for information useful to investigators (same article).

According to The Register, CEO Masatoshi Kumagai admitted that the response to earlier internal reports was not deep or fast enough, and linked an attack on about 20 Japanese companies to the use of ARTEX, an autonomous AI-based penetration testing tool (The Register). This is a statement by the executive, not an independent verification.

4. PHP2Shell: from vulnerability to confirmed exploitation

The two flaws in the PHP engine (CVE-2026-109618 and CVE-2026-109619), already covered last week, have gone a step further. On 26 October 2026 CISA added them to its catalogue of known exploited vulnerabilities, with a deadline of 29 October for US federal civilian agencies. PHP had released the fixes on 21 October, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (The Next Web).

On 24 October a researcher recorded in three honeypots 35 shell commands launched from the Apache server, from two IP addresses, consistent with the first CVE. The Delft University of Technology lab counted, since 21 October, 68,499 exploitation requests from 652 IP addresses in 73 countries, 174 of them carrying code or a dropper. The same source reports that Sophos corrected an account of successful attacks against its own customers and that Palo Alto Networks' Unit 42 withdrew an assessment of an attack on a European government body: attributions should therefore be treated with caution.

5. UNM Health: the operational outage of a university hospital

On 26 October 2026 University of New Mexico Health suffered an IT systems outage. UNM Health limited new admissions, diverted ambulances to other hospitals and suspended outpatient procedures and appointments; classes in the four health sciences schools were cancelled (BleepingComputer).

The university has not stated the type of attack. The Byod group, new and with six victims on its site, claimed the attack, saying it has access to about 36,000 systems and to data of patients, students and employees. These are the group's claims and are not verified. UNM Health states that the event did not penetrate the main systems and servers but affected some user devices. As of the article date, 27 October, critical systems were back online, the hospitals were fully open and the clinics had resumed activity.

6. Sony Network Communications: the mass data breach

Sony Network Communications, a Sony Group subsidiary that operates as an internet provider in Japan, reported that the So-net member database was accessed by an unauthorised party. The affected records number 2,585,481: 2,141,986 from So-net and 443,495 from the plala service, which concerns Docomo Hikari customers of NTT Docomo. In addition, 54,401 email addresses from various services were exposed, together with account passwords (BleepingComputer).

The data includes name, phone number, email, user ID, date of birth, gender and connection identifiers; no bank or card data appears to be involved. The breach took place on 19 October and was detected about four days later; Sony announced it on 27 October and reported it to Japan's Personal Information Protection Commission. The article does not name a perpetrator or the method, and as of 27 October no misuse had been confirmed.

Other events worth noting

University of Copenhagen (education): access to a test environment, with data of about 525,000 people (name, CPR national identity number, phone, email) and, in an update, the physical access codes of about 20,000 staff and students. Reported to the Danish data protection authority.
ENGIE (energy): a marketing platform used by commercial partners was compromised; contact and contract data of customers in France exposed, number not disclosed. ENGIE says its internal systems were not affected.
Quest Diagnostics (healthcare): unauthorised access to Quanum, a platform for test orders and billing, with patient data stolen. Volume and perpetrator are unknown; the company filed a disclosure with the SEC (Beinsure).

Insurance impact

The common picture is concentration: the loss does not originate with the insured, but with a shared infrastructure. For each event, the possible impact on policies can be read as follows.

Binance. Covers potentially triggered: theft of digital assets, extortion and business interruption, where provided. Accumulation potential: medium-high, for counterparties and services linked to the exchange (stablecoin freezes, decentralised finance protocols that suspended deposits and lending). Contractual issue: many cyber policies limit or exclude digital assets and cryptocurrency theft; the definition of insured property, custody and the sublimit matter. State attribution, now made by the FBI, brings war and state operation exclusions into play.
Amadeus. Covers potentially triggered: data breach liability, notification and incident response costs, fines where insurable. Accumulation potential: high, because the same system serves several airlines in several countries. Contractual issue: the length of the access (since 2023) and the discovery date compared with the retroactive date and the extended reporting period.
GMO Internet. Covers potentially triggered: extortion, business interruption, system restoration, liability towards customers. Accumulation potential: high among the service's customers. Contractual issue: financial losses from unauthorised trading, which many policies exclude or limit, and the distinction between loss to the customer and loss to the supplier.
PHP2Shell. Covers potentially triggered: all those of a cyber incident, from restoration to liability. Accumulation potential: very high, because the software is extremely widespread and the same flaw hits different insureds. Contractual issue: delays in applying fixes and vulnerability management conditions.
UNM Health. Covers potentially triggered: business interruption, restoration, extortion, healthcare data liability. Accumulation potential: low as an isolated event, but high in severity. Contractual issue: business interruption sublimits and waiting periods, and the cost of healthcare services not delivered.
Sony Network Communications. Covers potentially triggered: data breach liability, notifications, credit monitoring. Accumulation potential: medium. Contractual issue: the presence of passwords among the exposed data, which can extend the damage to customers' other services.

The supplier is the accumulation point. Amadeus (now also with Cathay Pacific), GMO and PHP2Shell show that the risk lies in shared dependencies more than in the individual insured. Portfolio dependency maps are needed, not only per-customer questionnaires.

The length of the intrusion changes how the loss is read. Access lasting years, like the one described for Amadeus, makes retroactive, discovery and notification dates central. The same caution applies to claims by criminal groups, which are often unverifiable: what counts for the assessment is the fact established by the insured and the supplier.

State attribution weighs on policy wordings. For Binance, the attribution to North Korea, first made by analysts, was confirmed by the FBI on 1 November 2026, three days after the theft. War and state operation clauses depend on how the wording defines attribution and on who can establish it.

Interruption weighs more than data theft. For a hospital, the main loss is the inability to operate. Business interruption conditions, including from suppliers, deserve more attention than those on data breach alone.

What to bring to renewals

Are digital assets and cryptocurrencies covered, with what sublimit, and how are custody and wallets defined?
Which critical suppliers (reservations, cloud desktop, hosting, MSPs) support the insured's business, and does the policy cover interruption caused by a supplier?
Are there sublimits for supplier business interruption, and how long are the waiting periods?
How are financial losses caused by unauthorised use of credentials or trading accounts treated?
What are the retroactive date and the extended reporting period, in the case of unauthorised access discovered years later?
Is there a documented process for applying fixes to exploited vulnerabilities (for example those in the CISA catalogue), and within what timeframe?
How are notification and incident response costs covered when the exposed data concerns people in several countries?

On the portfolio side, it is worth mapping exposures to a few recurring platforms (reservation systems, hosting and cloud desktop, very widespread languages and software) and simulating a scenario in which a single supplier involves many insureds in the same period.