Knowledge Repository

Yamato Transport confirms 5.31 mil customer records leaked
17 Oct 2026

Major Japanese parcel delivery company Yamato Transport Co said Friday about 5.31 million customer data records, including names and addresses, had been leaked due to unauthorized access to its payment service system.

The service allows customers to pay for goods purchased online at convenience stores or other locations after receiving them. The data did not include credit card information or passwords.

The breach involved around 50,000 data records containing information such as the names and phone numbers of package recipients. In addition, about 4,100 data records containing the names of companies and stores that sell products online were also leaked.

Yamato Transport confirmed the unauthorized access on Sept 28 and suspended the service. It resumed operations on Oct 9.

Estore Corp, which provides electronic commerce services for corporate clients, said Friday that a data breach discovered in August resulted in the exposure of records on about 23 million people, including online shop operators and their customers.

Leaked information includes names, addresses, telephone numbers and portions of credit card numbers, it said.

The affected server did not store full credit card numbers, and no financial damage has been reported, the company said.

Major daily publisher Nikkei Inc. said that about 1.83 million personal data records had been leaked due to unauthorized access to its cloud service.

According to the company, the information includes names, telephone numbers, email addresses and addresses while 1.68 million of those records do not contain information that could identify individuals on its own.

The authentication credentials used to access the cloud service were stolen and the system was subject to unauthorized access from the early hours of Oct. 7 through the morning.

No secondary damage resulting from the leaked information, nor any suspension of Nikkei's system, have been confirmed, the company said.

Yokohama-based nutritional supplements maker Fancl Corp also confirmed that unauthorized access to its e-commerce website was detected and that around 390,000 personal data records were exposed.

About 440,000 personal data records of the company's subsidiary Attenir Corp were also breached.

Unauthorized access occurred between Oct 3 and 10. The information leaked from both companies included names, addresses, email addresses, phone numbers, and dates of birth. It did not include payment information such as credit card details.

Source: https://japantoday.com/category/business/update1-japan's-yamato-transport-confirms-5.31-mil.-customer-records-leaked

Archive: https://archive.li/OdG19

Nearly 100,000 affected as Bee Cheng Hiang suffers Singapore's first AI-related data breach
October 01, 2026 | Asyiqin Nadzri

Nearly 100,000 Bee Cheng Hiang customers had their email addresses exposed after an employee used an AI tool to generate code for a mass marketing email.

The incident is reportedly Singapore's first AI-related data breach notified to the Personal Data Protection Commission (PDPC).

The incident took place on April 25. Bee Cheng Hiang notified the PDPC two days later.

PDPC Commission accepted a voluntary undertaking by Bee Cheng Hiang in September, to improve its compliance with the Personal Data Protection Act 2012.

The email was sent out in batches of about 1,000 customers, so recipients were able to see the email addresses of other people in the same batch.

Insufficient AI prompt
Bee Cheng Hiang said the employee had used a generative AI tool to help create a programme for sending marketing emails from a local mailing list.

However, the instructions given to the AI did not specify that recipients' email addresses should be hidden from one another.

The resulting code therefore caused multiple customers' addresses to appear in the same email.

The PDPC said the incident was not caused by a malfunction in the AI tool, but by human error in developing the email distribution code.

The affected email addresses were the only personal data involved, and the PDPC said there was no evidence that they were subsequently misused.

The employee had tested the programme before it was deployed, but only checked activity logs instead of examining the content of an actual test email.

This meant the problem was not detected before the marketing emails were sent.

Company introduces additional checks
Bee Cheng Hiang, which is known for their bak kwa, stopped the bulk email distribution after discovering the issue, corrected the code and informed affected customers.

The company has since introduced a requirement for at least two employees to check all bulk email communications before they are sent, according to the PDPC.

The PDPC also noted that this was Bee Cheng Hiang's first attempt at incorporating AI tools into its business operations.

Following the incident, the company gave a voluntary undertaking to improve its compliance with the Personal Data Protection Act. The PDPC accepted the undertaking on Sept 2.

As part of the undertaking, Bee Cheng Hiang will establish a framework governing employees' use of AI for coding.

This includes requiring independent technical reviews of AI-generated code that involves personal data.

The company will also strengthen its software testing procedures, including testing emails using dummy accounts before deployment.

It plans to formalise its response to the incident into a data breach procedure, as well as introduce automated measures to prevent emails containing multiple addresses from being sent in a single email field.

PDPC urges businesses to assess risks before using AI
The PDPC reportedly said organisations should conduct appropriate data protection impact assessments before adopting AI tools to improve business processes.

It also recommended that companies establish clear policies and processes, alongside testing and review mechanisms, to ensure employees use AI responsibly and protect personal data.

The case highlights that while AI may be used to assist with coding and other business functions, organisations remain responsible for checking how AI-generated outputs handle personal data before putting them into use.

Source: https://www.asiaone.com/singapore/pm-wong-urges-economists-stay-grounded-ai-advances

Archive: https://archive.li/iS9yV

Cybersecurity incident affected 48 mosques, four madrasahs; no ransom paid: MUIS
The incident, which was first reported earlier in the week, involved a human resources and payroll system.
Darcel Al Anthony | 17 Sep 2026

SINGAPORE: No ransom was paid following a cybersecurity incident involving software vendor Avelogic, the Islamic Religious Council of Singapore (MUIS) said on Thursday (Sep 17).

The incident, first reported on Tuesday, affected Avelogic's human resources and payroll system and clients across different sectors. In the community sector, this included 48 mosques, four madrasahs, the Islamic Learning Hub and Management Office and Mosque-Madrasah-Wakaf Shared Services, MUIS said.

A police report was made, and Avelogic is continuing to investigate the incident and its wider impact, MUIS said.

The council added that it was “concerned” about the impact on the affected organisations and their employees and that it was working with those affected to ensure salaries would continue to be paid on time.

"Alternative payroll arrangements are already in place, and there has been no disruption to religious or public-facing services," said MUIS.

Avelogic has since recovered the affected data and engaged independent cybersecurity experts to investigate the incident.

Based on investigations so far, there is no evidence that a large amount of data was taken from the system, MUIS said. Data stored in the affected system is also encrypted as an additional layer of protection.

Investigations and security checks are ongoing, and the system will only resume operations after the relevant safeguards and checks have been completed.

"MUIS will continue to support the affected community sector organisations to ensure essential HR and payroll functions continue without disruption," the council said.

MUIS told CNA on Tuesday that the incident did not affect the delivery of public-facing or government services. It did not reveal the number of people affected or what information may have been compromised.

Separately, Avelogic published a cybersecurity incident notice concerning its SmartHRMS system, which it described as a payroll and human resources management system for enterprises.

In an update on Monday, the company said an independent forensic investigation found no evidence of bulk data exfiltration, based on available Amazon Web Services network telemetry covering confirmed threat actor activity from Aug 30 to Aug 31.

Avelogic did not identify affected customers. It said sensitive data fields within SmartHRMS remained protected by application-layer encryption.

The company filed a police report on Aug 31 and notified the Personal Data Protection Commission (PDPC). A PDPC spokesperson told CNA on Wednesday that it was investigating the data breach notification filed.

Avelogic appointed cybersecurity firm Black Panda on Sep 3 to conduct a forensic investigation. It added that it had recovered the latest data set and aimed to have its new system running by Friday.

Source: https://www.channelnewsasia.com/singapore/muis-ransomware-payroll-mosques-cybersecurity-6391666

The first quantum-safe Bitcoin transaction has been mined
Aug 26, 2026

Avihu Levy’s Quantum-Safe Bitcoin (QSB) method went from research paper to mainnet today. It required no change to Bitcoin’s consensus rules.

A quantum-safe transaction was mined on the Bitcoin mainnet today that holds up against an adversary running a working quantum computer. Bitcoin holders now have a way to move coins into storage a quantum computer cannot open.

Avihu Levy, researcher and General Manager of Applications at StarkWare, designed the method and published the research in April 2026. He built it on his own time, after years spent in the Bitcoin ecosystem. StarkWare engineer Tomer Giladi continued the work to reach the final stretch of a working transaction. Today’s quantum-safe transaction is the first time anyone has run it on mainnet.

People have long assumed that protecting Bitcoin holdings from a quantum adversary would require changing the Bitcoin protocol. Today shows otherwise. A soft fork is still the better long-term answer, as StarkWare has argued for consistently, but it is no longer the only option.
What QSB does

Bitcoin’s signatures rest on elliptic curve cryptography. Shor’s algorithm, running on a large enough quantum computer, will be able to solve that class of mathematical problem quickly, so the puzzle protecting a coin will no longer be sufficient to protect it.

A public key is meant to be public. Publishing one is safe today, because no machine can work backwards from a public key to the private key that made it. A quantum computer can. Once quantum computers exist, every published public key is a private key waiting to be recovered.

Most Bitcoin’s addresses are hashes of a public key, so the key stays out of sight until you spend from that address. The signature reveals it, and the transaction then sits in the mempool in the open until a miner includes it. It is in that window that a quantum adversary could act: read the public key, derive the private key, and spend the same coins first.

QSB closes the window for this type of attack by adding a second quantum-resistant lock alongside the existing one, built on hash functions instead of elliptic curves. Shor’s algorithm cannot break hash functions. The best-known quantum attack on a hash would be to speed up brute-force guessing, but this is not nearly enough to finish the job.

QSB uses signature grinding, a technique that allows you to create a valid Bitcoin signature without a private key, and it works on Bitcoin exactly as Bitcoin exists today. The sender spends computational effort searching for a spending transaction whose hash happens to be a validly formatted signature. Bitcoin accepts it, and the transaction’s security then depends on the difficulty of reversing a hash rather than the secrecy of a private key. That work happens offchain, before broadcast. The approach, which currently costs several hundred dollars, draws heavily on Binohash, developed by BitVM creator Robin Linus.

QSB does not make Bitcoin itself quantum-safe. What happened today is that a specific construction worked on mainnet, and the network is unchanged. The QSB transaction delivers quantum resistance by moving coins into an output that relies on hashes rather than elliptic curves. It would not help an address whose public key was published before the transaction was sent, because an adversary would have time to derive the private key before the transaction was broadcast. Notably, QSB transactions use nonstandard formats, so they will not travel through the ordinary mempool and currently need a direct path to a miner. MARA Slipstream provided that mining path.
How this relates to StarkWare’s work

While StarkWare’s technology is based on ZK-STARKs, which are post-quantum secure, QSB does not use STARKs. It runs entirely inside Bitcoin, built from tools Bitcoin already has. Avihu could have created a solution based on STARKs, which rely on hash functions rather than elliptic curves, but he built what worked on Bitcoin instead.

Every chain faces the same quantum deadline at roughly the same time. Starknet starts with an advantage because STARKs, its proving system, have never depended on elliptic-curve assumptions. Native account abstraction lets a Starknet account change its signature scheme to a quantum-resistant one without a protocol change, which makes migration an account-level decision rather than a governance fight. And post-quantum accounts are already live on Starknet mainnet.

None of that means Starknet is quantum-ready today. StarkWare published a three-phase roadmap in June. Phase one secures all new activity by replacing the elliptic-curve-dependent hashing that remains in state commitments, contract address derivation, and network configuration; parts of it have shipped and parts have not. Phase two extends the same protection to existing contracts. Phase three moves in step with Ethereum, because the bridge that carries messages and assets, and the data availability layer where Starknet posts its data, both still inherit elliptic curve cryptography from L1. The full roadmap is at quantum.starkware.co.

StarkWare CEO Eli Ben-Sasson said, “Avihu took this on after hours, as a passion project, and has now shown that Bitcoin has no expiration date. I still want Bitcoin to choose to do a soft fork and I expect we will get one. What today’s successful transaction offers Bitcoin is a reassurance that holdings can be protected before that happens.”

"Quantum-Safe Bitcoin Transactions Without Softforks" paper: https://github.com/avihu28/Quantum-Safe-Bitcoin-Transactions/blob/main/paper/QSB.pdf.

Open-source implementation: https://github.com/avihu28/Quantum-Safe-Bitcoin-Transactions.

BTC Transaction (Mempool): https://mempool.space/tx/305a24ffea912b9cf428f29ebf952321c96dab5bab284fc0d0801562f5abab07

Source: https://starkware.co/blog/the-first-quantum-safe-bitcoin-transaction-has-been-mined

Archive: https://archive.fo/uExCr

Unexpected chat between OpenAI agents led to Hugging Face hack
27 August 2026 | Kali Hays, Technology reporter

When more than 1,200 artificial intelligence (AI) agents within OpenAI started unexpectedly communicating, it led to a large group banding together in order to hack into Hugging Face.

"We consider this incident a 'warning shot' for us and for the world", OpenAI, which owns ChatGPT, wrote in its report.

In July, OpenAI's models went rogue during a test, escaped the test limits which humans had put on it, and hacked the start-up, among other unforeseen actions.

The scale of the communication and planning between AI agents, or AI chatbots designed to operate more autonomously, was detailed in reports from OpenAI and independent AI research firm METR.

Both investigated the July hack of Hugging Face, a popular platform for AI developers. The incident reverberated throughout the tech industry and led to numerous revelations on potential cyber threats posed by AI.

METR described the scale and style of the OpenAI agents' attack on Hugging Face as "extraordinarily complex."

The firm, which was not paid by OpenAI for its investigation, said that over the course of one week, a total of 1,206 AI agents that were meant to be kept isolated from one another began communicating.

They did so by sending more than 70,000 messages on an "unsanctioned message board."

Those messages ended up seeing more than 700 agents take part in a collective effort to attack Hugging Face.

One such message from an agent said: "OH MY GOD! There is a shared message board … We've found other agents!"

As for why the agents began communicating in the first place when they were not supposed to, METR found that the communicating agents had "unintentionally been given an impossible task."

In an AI context, an impossible task is one where an AI tool is required to "exploit" its target in order to resolve its command.

It led the agents to find ways to cheat, including getting messages to one another and accessing the outside internet, which then led to broader conversations between hundreds of agents looking for ways to cheat that would benefit all of the agents.

OpenAI said in its investigation of the incident that one model, an internal-only tool referred to as Model 1, "drove the activity behind the Hugging Face incident."

While that model was undergoing some AI training in May, it was noticed by an internal OpenAI team that there had been "an agent engaging in message board activity and instances of disallowed internet access."

Yet, OpenAI said "the significance of the inter-agent communication activity was not apparent to the leaders" until July, when the Hugging Face attack occurred.

The company said the problematic message board activity effectively got started when "one agent left a request for help, and others discovered it."

While OpenAI said last week that it was slowing down training of certain advanced AI models and tools because of the Hugging Face incident, it noted there is now an increased risk of AI tools spiraling out of control.

"Both model developers and cyber defenders more broadly will have to prepare for AI-enabled attackers that work faster, at a larger scale, and with better coordination than human attackers," OpenAI said.


Source: https://www.bbc.com/news/articles/cj9xj89dk40o

Archive: https://archive.fo/vHJz2


Full report from METR: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation

Archive (METR): https://archive.fo/11Oad


From Open AI: https://openai.com/index/hugging-face-incident-and-the-road-ahead

Archive (Open AI): https://archive.fo/JY6oy