--- title: "FortiBleed Firewall Attacks, AI Bank Cyberattacks, ASOS Data Breach | DMARC Report" description: "Explore cybersecurity news from October 6–12, 2026, covering firewall attacks, AI-powered threats, ransomware, data breaches, and critical vulnerabilities." image: "https://dmarcreport.com/og/blog/fortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach.png" canonical: "https://dmarcreport.com/blog/fortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach/" --- Quick Answer Cybersecurity threats from October 6–12, 2026, included firewall attacks, AI-driven bank attacks, data breaches, ransomware, and critical vulnerabilities. These incidents highlight the importance of security updates, strong access controls, reliable backups, and SPF, DKIM, and DMARC. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=FortiBleed%20Firewall%20Attacks%2C%20AI%20Bank%20Cyberattacks%2C%20ASOS%20Data%20Breach%20&url=undefined%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F&title=FortiBleed%20Firewall%20Attacks%2C%20AI%20Bank%20Cyberattacks%2C%20ASOS%20Data%20Breach%20 "Share on Reddit") [ ](mailto:?subject=FortiBleed%20Firewall%20Attacks%2C%20AI%20Bank%20Cyberattacks%2C%20ASOS%20Data%20Breach%20&body=Check out this article: undefined%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F "Share via Email") ![Cybersecurity Attacks and Data Breaches](https://media.mailhop.org/dmarcreport/dmarc-lookup-8851-1791889217936.jpg) The week from 6 to 12 October 2026 brought a wave of cybersecurity incidents, including ransomware attacks, data breaches, critical software vulnerabilities, and [AI-powered cyber threats](https://www.businesswire.com/news/home/20260922596420/en/Object-First-Survey-70-of-IT-Professionals-Say-AI-Powered-Cyber-Threats-Increase-Workplace-Stress). From compromised Fortinet firewalls and attacks on South Korean banks to exposed renewable energy systems, these stories highlight the growing risks facing businesses, governments, and critical infrastructure. Here are the key cybersecurity developments organizations should know about and the **security lessons** they offer. ## FBI and Secret Service warn about FortiBleed attacks on Fortinet firewalls A joint advisory from 6 October says a [credential-harvesting campaign](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/) has compromised tens of thousands of **FortiGate devices**. Attackers sometimes delete or change the original admin accounts, locking owners out, and the access is being linked to ransomware affiliates. [Read the FBI IC3 advisory](https://www.ic3.gov/CSA/2026/261006.pdf) ## AI-driven attacks on South Korean banks Investigators believe an open-source, **LLM-based penetration-testing tool** was used against several [Korean banks](https://www.koreajoongangdaily.com/business/police-open-formal-ai-bank-hack-probe/12907472), exposing personal data of tens of thousands of people. _Every confirmed intrusion hit internal or partner-facing systems rather than customer apps, and the banks have not formally confirmed the tool’s use_. [Read the Korea JoongAng Daily report](https://www.koreajoongangdaily.com/business/police-open-formal-ai-bank-hack-probe/12907472) ## ASOS confirms a customer data breach after a rogue app notification On 6 October, [ASOS app](https://www.bbc.com/news/articles/cj62ylzpr6d3o) users received a push notification saying the company had been hacked. _ASOS confirmed that a third-party customer-messaging service was accessed, exposing basic contact details._ The attacker’s claim about Snowflake has not been confirmed. [Read the BBC report](https://www.bbc.com/news/articles/cj62ylzpr6d3o) ![Dmarc Record Generator 4403](https://media.mailhop.org/dmarcreport/dmarc-record-generator-4403-1791889784091.jpg) ## Osaka Metropolitan University hit by ransomware Around **500 servers** stopped working from 2 October, forcing the [university to cancel classes](https://therecord.media/osaka-university-cancels-classes-ransomware) for several days. Systems covering email, [payroll](https://en.wikipedia.org/wiki/Payroll) and accounting were affected, and reports suggest some backups were also encrypted. [Read The Record’s coverage](https://therecord.media/osaka-university-cancels-classes-ransomware) ## Warlock uses old SharePoint flaws to deploy ransomware **Symantec and Carbon Black report** that the [Warlock group attacked](https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html) at least four organisations in two months, including a water utility and a telecom provider. _The attackers used unpatched on-premises SharePoint servers as the entry point, then used domain replication to spread ransomware_. [Read The Hacker News’s coverage](https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html) ## Ransomware recovery CEO charged with fraud **US prosecutors** have charged the owner of a Florida ransomware remediation company, who allegedly claimed to have proprietary decryption technology while secretly [negotiating with hackers](https://therecord.media/ransomware-recovery-charges-doj). He has pleaded not guilty. [Read the BleepingComputer report](https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/) ## FBI arrests another suspect linked to the ShinyHunters breach A former executive of a [cybersecurity](https://dmarcreport.com/blog/what-is-a-password-attack-in-cyber-security/) firm was arrested in Pennsylvania on extortion and conspiracy charges. He is reportedly linked to the [ShinyHunters breach](https://cbsaustin.com/news/nation-world/fbi-arrests-another-suspect-tied-to-cybercrime-shinyhunters-group-accused-of-hacking-its-jobs-site-director-kash-patel-steal-data-personal-information-dark-web-third-party-vendor) of **FBI systems**, and a teenage suspect was detained in Jordan. [Read Krebs on Security’s coverage](https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/) ![Dmarc Report 6607](https://media.mailhop.org/dmarcreport/dmarc-report-6607-1791889824238.jpg) ## US and allies seize tools used by China’s Flax Typhoon Authorities seized websites hosting **vulnerability-scanning** and phishing tools used by the Chinese botnet operator [Flax Typhoon](https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-seizes-flax-typhoon-hacking-domains), also known as Integrity Tech. _CISA has published indicators of compromise so organisations can check their logs._ [Read the CISA advisory AA26-281A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a) ## Thousands of exposed renewable energy systems found online Researchers at Modat found more than [8,000 internet-exposed systems](https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/) across **European wind and solar parks**, including admin panels. In one case, a turbine dashboard had start, stop and reset controls. [Read the Modat research](https://modat.io/blog/modat-research-exposed-systems-wind-and-solar/) ## Fraudulent HTTPS certificates issued for Google domains Hackers took over three **country-code domains** (.gh, .sl and .as) and used them to issue fake [TLS certificates for Google](https://www.gadgetreview.com/hackers-obtain-unauthorized-tls-certificates-for-google-via-hijacked-domains) and other large services. Google said Chrome blocked the fraudulent certificates quickly. [Read Ars Technica’s coverage](https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/) ## Wave of cyberattacks prompts Japan to act Dozens of Japanese companies across retail, food, rental and rail were reportedly hacked, with [millions of records leaked](https://www.bloomberg.com/news/articles/2026-10-09/wave-of-cyberattacks-prompts-japan-to-urge-security-reviews). _Tokyo has declared a cyber space emergency, and the government has told banks not to accept driver’s licences as proof of identity for new accounts._ [Read the AP report](https://apnews.com/article/japan-security-cyberattacks-312fb8860f273d5794da4cc5f44bb0cb) ![Dmarc Check 2109](https://media.mailhop.org/dmarcreport/dmarc-check-2109-1791889756314.jpg) ## Critical SonicWall flaw exploited days after disclosure [CVE-2026-102255](https://securityaffairs.com/200816/hacking/sonicwall-patches-cvss-10-0-ssrf-flaw-as-attacks-begin.html) is a pre-authentication server-side request forgery flaw that attackers began exploiting within days of its disclosure. **CSO Online** argues the pattern of serious bugs in edge security appliances deserves attention in its own right. [Read the CSO Online analysis](https://www.csoonline.com/article/4232246/sonicwalls-latest-critical-flaw-indicates-a-security-pattern-not-another-one-off-bug.html) ## GitLab fixes a critical RCE flaw in AI Gateway GitLab has patched a critical vulnerability in its [AI Gateway](https://sqmagazine.co.uk/gitlab-ai-gateway-critical-rce-cve-2026-90970/) that could allow **remote command execution**. _Because the component manages tokens and connections to external AI models, a successful attack could have wide impact_. [Read Telefónica Tech’s weekly briefing](https://telefonicatech.com/en/blog/cybersecurity-briefing-3-9-october-2026) ## Ransomware affiliate uses an AI coding tool’s protocol as a command channel CloudSEK documented a [Gentlemen ransomware affiliate](https://gbhackers.com/ransomware-affiliate-operations/) using a [Model Context Protocol (MCP)](https://www.ibm.com/think/topics/model-context-protocol) interface to run commands inside compromised networks. The attacker turned tools normally used by an **AI programming assistant** into operational infrastructure. [Read Telefónica Tech’s weekly briefing](https://telefonicatech.com/en/blog/cybersecurity-briefing-3-9-october-2026) Strong cybersecurity also depends on email authentication protocols such as [DMARC](https://dmarcreport.com/), [SPF](https://dmarcreport.com/what-is-spf/), and [DKIM](https://dmarcreport.com/what-is-dkim/), which help prevent email spoofing, detect unauthorized senders, and reduce [phishing risks](https://www.infosecurity-magazine.com/news/cybersecurity-fails-to-detect/). ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F) [ ](https://twitter.com/intent/tweet?text=FortiBleed%20Firewall%20Attacks%2C%20AI%20Bank%20Cyberattacks%2C%20ASOS%20Data%20Breach%20&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Ffortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) - [ ![Cybersecurity ransomware news](https://media.mailhop.org/dmarcreport/dmarc-report-3120-1788259786008.jpg) Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Intermediate ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)[ Intermediate Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Sep 1, 2026 ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"FortiBleed Firewall Attacks, AI Bank Cyberattacks, ASOS Data Breach ","description":"Explore cybersecurity news from October 6–12, 2026, covering firewall attacks, AI-powered threats, ransomware, data breaches, and critical vulnerabilities.","url":"https://dmarcreport.com/blog/fortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach/","datePublished":"2026-10-13T00:00:00.000Z","dateModified":"2026-10-13T00:00:00.000Z","dateCreated":"2026-10-13T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/fortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-lookup-8851-1791889217936.jpg","caption":"Cybersecurity Attacks and Data Breaches"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"FortiBleed Firewall Attacks, AI Bank Cyberattacks, ASOS Data Breach ","item":"https://dmarcreport.com/blog/fortibleed-firewall-attacks-ai-bank-cyberattacks-asos-data-breach/"}]} ```