> InfoSec News Nuggets – 10/19/2026

Stolen ConnectWise ‘SkyKick’ credential exposed Microsoft 365 tenants ConnectWise has switched off its Cloud Backup service (formerly SkyKick) worldwide after attackers stole an application credential that let them sign into customers’ Microsoft 365 environments. Huntress confirmed unauthorized sign-ins in 162 tenants and later found nearly 1,000 tenants with activity from the attacker’s address, noting the credential works against every tenant where the app is consented. In at least one tenant, a second ConnectWise app granted itself global administrator rights and planted new secrets on two other apps valid until 2028, giving the attacker a way back in even after the original credential was revoked. ConnectWise says it has cancelled the credential and has no indication stored backups were accessed, but backups and restores are unavailable while the service is offline. Administrators are advised to disable (not delete) the ConnectWise apps in their tenants and review every app for credentials added since October 13.   OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys AI coding tool maker OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed the third-party OpenAI, Anthropic, and Google API keys that customers saved in OpenCode Console, its optional hosted service. About 1.4% of Console users are affected and have been emailed instructions to revoke and replace those keys with each provider, while keys stored locally by the OpenCode CLI and desktop apps are not involved. Because provider keys are bearer credentials, deleting them from Console does not stop abuse, and some users report hundreds to thousands of dollars in usage they did not run. OpenCode called the incident ongoing, linked it to a large-scale distillation attack, and said it is working with the three AI providers; affected users should revoke keys at the provider, review billing back to at least October 16, and set spend limits.   Millions of California students’ data exposed after hackers lurk in third-party testing system for months The California Department of Education has disclosed a breach at Educational Testing Service (ETS), the nonprofit that administers the state’s standardized assessments, after an attacker used a compromised login to access an ETS SFTP site and copy student files between May 22 and September 18, 2026. The exposed records cover all students enrolled in California public schools over the past three years, more than 5.7 million in the 2025-26 school year alone, plus some former students dating back to 2006. Stolen data includes names, birth dates, addresses, student IDs, demographics, assessment results, English learner status, and disability and Section 504 information, though ETS says Social Security numbers, financial data, passwords, and parent information were not accessed. ETS detected the intrusion on September 25, rebuilt the SFTP site, began notifying families on October 16, and is offering two years of identity protection.   BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts Federal bankruptcy courts across the United States have been unable to send notices for more than a week after a security incident hit the BAE Systems infrastructure that runs the judiciary’s Bankruptcy Noticing Center. The Administrative Office of the US Courts said all access to the center’s systems and websites is unavailable, including the National Creditor Registration Service, so paper and electronic notices issued since October 9 have not been delivered. BAE says the incident is isolated to the noticing system and is working to restore it, but neither BAE nor the judiciary has said what caused it, whether it was a cyberattack, or whether any data was compromised. Courts are still accepting filings and opening new cases, and there is no estimated date for restoration.   Burger King Japan data breach exposes 11 million customer records Burger King Japan has disclosed a data breach after attackers accessed the server that manages member information for its official smartphone app, exposing 11.18 million customer records. The company says unauthorized access took place between October 2 and October 7, 2026, and was confirmed on October 13, with leaked data including names, birth dates, gender, email addresses, phone numbers, and order history. Credit card numbers were not stored on the affected server and there is no evidence user credentials were accessed. The incident has been reported to Japan’s Personal Information Protection Commission, external experts are investigating how the attackers got in, and customers are being warned to watch for phishing emails, texts, and calls impersonating the brand. The post InfoSec News Nuggets – 10/19/2026 appeared first on AboutDFIR - The Definitive Compendium Project.