Domain
Apple released iOS and iPadOS 27.
A researcher known as forcequit published worse_query, an iOS sandbox-escape proof of concept, on GitHub on November 8; it lets an app read other apps' data containers on iOS 26 and 27 .
Mirae Asset Securities announced that its internal groupware system, mi-global, suffered an external attack on November 5, leaking personal data of approximately 35,255 employees, including former and outsourced personnel .
According to Security NEXT, Denny's Japan discovered on October 30, 2026 that application-related systems had been breached by a third party, potentially exposing personal data of legacy app customers .
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
According to Security NEXT, Matsuya Foods discovered on October 28, 2026, that its official app management system was breached by a third party, resulting in a leak of member information .
According to Impress Watch, BK Japan, which runs Burger King in Japan, announced on October 15 that a third party accessed its official app member system without authorization, leaking about 11.
According to INTERNET Watch, Japanese convenience store chain Lawson announced on October 8 that an October 7 investigation found unauthorized access to Lawson ID from September 12 to 14 and to Lawson app reservations on September 17 .
The UK NCSC said some ASOS customers received an unauthorized push notification from the ASOS app on October 6, and the company confirmed customer names and contact details were accessed .
On October 6, 104 Corporation issued a material information filing on MOPS stating that it had detected abnormal read activity on its App system, and an investigation confirmed that approximately 120,000 resume records were read without authorization .
Japanese restaurant group Monogatari Corporation said on October 5 that the member management system of its Yakiniku King official app was accessed by a third party on October 2, and that it confirmed a leak of member data on October 3 .
Japanese convenience store chain Seicomart said in its fourth report on October 5 that unauthorized access via the Seicomart app server affected 574,647 Seicomart Club members who had registered with the app .
According to The Independent, Chick-fil-A is notifying customers nationwide that unauthorized parties may have accessed personal and account information after an automated attack on its website and app in June; according to TechRadar, credential stuffing between June 17 and 19 breached thousands of accounts .
According to Argaam, citing a filing by Budget Saudi to the Saudi Exchange, unauthorized access occurred affecting a subset of customer data on its mobile application .
According to Argaam, citing an announcement from BinDawood Holding, the company contained a limited breach involving a subset of customer order data on its mobile application .