Transportation & logistics

Researchers use default admin:admin console on ForgeRock servers to breach two automakers' identity systems, take over accounts and remotely unlock and start cars

Researchers Shubham Shah and Sam Curry disclosed on Nov 7 that in early 2026 they found a vulnerability chain giving them remote code execution on production ForgeRock servers handling customer logins for two unnamed automakers, letting them create a valid session for any customer account and locate, unlock and remotely start connected vehicles .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .

According to RTHK, Hong Kong's privacy commissioner received breach notifications from several airlines and electrical retailers and opened investigations, logging 51 complaints and 48 enquiries as of October 30 with losses from about HK$10,000 to over HK$1.

According to BleepingComputer, Japan Airlines said Amadeus notified it on October 23 of unauthorized access to its Passenger Service System between August 10, 2023 and September 23, 2026, exposing booking codes, names and flight details of about 92,000 JAL customers, plus emails, phones and passport numbers for about 2,000; ANA, Asiana and Korean Air also confirmed impact .

Vulone disclosed on Oct 18 that a China-linked, financially motivated operator built an AI-agent intrusion platform on the open-source Cairn framework and ran 66 operations between Sep 24 and Oct 14, 48 of which reached at least session-level access .

Japan's Adventure Inc.

According to The Business Standard, citing a statement from Pathao, a cybersecurity incident on October 4, 2026 disrupted platform services and allowed malicious actors to obtain certain user information .

Abnormal access to the web system of Times Car, the car-sharing service of Japan's Park24, was detected on September 25, and the company announced a possible personal data leak that day and began a forensic investigation .

According to BleepingComputer, an Advance Passenger Information System (APIS) database linked to a Vietnamese organization was accessible online through chained misconfigurations, holding about 220 million passenger and crew records from January 2017 to April 2026, including passport numbers and flight details .

Manchester Airports Group (MAG) confirmed on August 27 that an unauthorized third party obtained customer data tied to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, Stansted and East Midlands airports, including email addresses, phone numbers, vehicle registrations and postcodes .

Latvia's CERT.

According to Argaam, citing a filing by Budget Saudi to the Saudi Exchange, unauthorized access occurred affecting a subset of customer data on its mobile application .

According to BleepingComputer, Carnival began notifying 5,995,277 people that attackers used social engineering in April to deceive an employee, accessed part of its IT systems and stole personal data, which the company confirmed was copied on April 22 .

According to The Korea Times, Seoul Facilities Corporation, which runs the Ttareungyi bike service, said on January 30 it was told by police that data of about 4.

According to Security NEXT, Nippon Travel Agency and JR West discovered on November 28, 2025, that passenger records for certain TWILIGHT EXPRESS Mizukaze departures were missing from a data server .

According to LOG, citing an announcement from Turkey's Personal Data Protection Authority (KVKK), personal data belonging to some customers of ticketing platform Biletal was put up for sale on an illicit online forum .

According to The Record, Russian authorities confirmed that Aeroflot suffered a cyberattack that caused multiple flight delays and cancellations .

On 2025-07-02, Qantas confirmed that a third-party servicing platform used by a contact center was breached and that the system has since been contained .

According to LOG, Turkey's Personal Data Protection Authority (KVKK) said Manisa transport company Manulaş reported that its systems were hit by a ransomware attack on 25 May 2025 and that the incident was detected the same day .