Day: October 30, 2026

  • ‘Wake Up Call:’ Fanfiction Writers and Readers React to AO3 Outage

    ‘Wake Up Call:’ Fanfiction Writers and Readers React to AO3 Outage


    ‘Wake Up Call:’ Fanfiction Writers and Readers React to AO3 Outage

    In the wake of fanfiction repository Archive of Our Own (AO3) announcing a weeks-long security incident outage, readers and writers are reflecting on why the site is important to the fanfiction community, and how they’re coping with the downtime.  

    On Thursday, the Organization for Transformative Works (OTW), the non-profit organization that runs AO3, posted that the site was down for maintenance, eventually updating to say the site restoration will take around two weeks, but could take up to a month. OTW confirmed in an updated status report Friday morning that this outage is due to a security incident. 

    Some have speculated that the outage is a result of the PHP scramble this week that led to several sites going down to update their security, but AO3 doesn’t use PHP. An OTW representative told CNET: “I can let you know that this is not related to the PHP security issue as the Archive uses Ruby on Rails.” 

    Massive Fanfic Site Archive of Our Own Says It’s Going Down for ‘Up to 4 Weeks’

    Oh my god?

    A lot of people are grieving the loss of Kinktober, AO3’s annual group writing exercise where writers upload a chapter or fic every day throughout October based on a prompt of the day. (The prompts are horny, if that’s not clear.) Several of the writers and readers who reached out to me following the outage brought up the poor timing around Kinktober.

    One writer I spoke to who posts her writing and reads others’ writing on AO3, told me that she was in the middle of racing to finish a work that was deliberately timed to Kinktober and Halloween when the outage happened. She was hitting “next chapter” while reading a fic on Wednesday night when she got the message that the site was down for maintenance, “which I initially took as a sign from the universe to go to bed,” she said.

    “The outage hasn’t derailed my desire to write. If anything, I want to have more chapters ready to go so my readers can eat good once it’s over,” she said. 

    💡
    Do you know anything else about what happened to Ao3? I would love to hear from you. Using a non-work device, you can message me securely on Signal at sam.404. Otherwise, send me an email at sam@404media.co.

    Some writers are considering posting elsewhere while they wait for AO3 to return, but it’s not an ideal workaround. AO3 author who goes by Selkie Myth told me they’re moving to Space Battles, another fanfiction site, during the outage. “I’m shrugging and just posting on SB [Space Battles] while the site’s down. Hopefully I’ll remember to post the chapters over on AO3 once it’s back up — the story is projected to end during the outage. I anticipate the same is true for a lot of other authors,” they said.

    Some people have said they’ll try fanfiction.net in the meantime, but it’s a much more bare-bones website. Fanfiction site Sufficient Velocity added a banner to its homepage welcoming AO3 refugees: “We’ve had a big influx of guests due to the AO3 outage. If you’ve been affected by the outage we’re sorry to hear that and hope that they’re able to get that fixed soon.” Wattpad, which many fanfiction writers and readers really, really hate for reasons I won’t get into here, posted on X: “we’re here to support you during this difficult time.” Overwhelmingly, the replies are from people telling Wattpad to go away.

    Another AO3 writer who goes by Ren told me she has two long works in progress right now with nowhere to post them. Posting elsewhere poses continuity and discovery problems, as some of these fanfiction works span chapters and hundreds of thousands of words of character and worldbuilding. “I could technically keep posting updates on sites like tumblr through the downtime, but both of these fics are quite long and I haven’t been posting them anywhere other than AO3 — if I drop a new chapter for my 130k Pokemon Black and White fanfic on Tumblr completely out of context, people just now finding my work aren’t going to be able to read the rest for a while :(“ she told me in an email. “I have seen other authors posting their gdocs and Ellipsus reader links in the meantime, but my draft files aren’t exactly presentable… I will keep marinating but what will probably happen is my wips [works in progress] will just be on hiatus for a bit. My readers are used to hiatuses at least.” 

    Another writer said she’s not considering posting elsewhere. “Wattpad can piss off,” she said. “But I may go back to fanfiction.net to save and physically print some of my favorite fics from way back in the day (the ancient/sacred texts, if you will) to ensure I have copies of those somewhere. This outage is a good reminder that things can vanish in the blink of an eye, whether a website crashes or is hacked or an author decides to suddenly delete their fic. If you love something, smash the kudos button, comment on it, bookmark it, subscribe, and consider downloading it. You never know.” 

    A reader who emailed me following the outage said they’ve been enjoying getting into AO3 as a new fan. “I was a big fanfic skeptic, but that’s changed lately. I’ve found some truly excellent writers, and real creativity. The free nature of it in this increasingly horrifying stage of capitalism is refreshing,” they said.

    AO3 has said in status updates and to journalists that they don’t expect any data loss. Losing works would be devastating for writers and readers, but AO3 is more than just a repository for writing; it’s a community of people commenting and reacting to those stories. Selkie mentioned the rigorous tagging habits of AO3 members, where stories are tagged with sometimes dozens of fanfiction tropes, character names, content hints and warnings, and can constitute a language specific to the platform and its readers; “Crack Treated Seriously,” for example, means writing a silly premise with a straight face, while “Idiots in Love” is self explanatory. 

    “To me, the more devastating thing would be to lose the comments and kudos on my fic. Technically I have them saved elsewhere because I get AO3 email alerts, but seeing them threaded in one place at the end of a chapter hits different,” a writer said. “Comments can turn an author’s entire day around and restore their will to live. I often reread them if I have writer’s block or a bad bout of imposter syndrome. They also turn the otherwise solitary act of writing into something communal. Seeing someone experience your story chapter by chapter is incredibly motivating and makes the writing process feel less isolating.” 

    OTW is entirely volunteer-run, and people on social media and in speaking to them directly have said they hope AO3 users go easy on staff during this time. “So many people rely on AO3 as an outlet for creativity and escapism as the real world burns, myself included. It’s also important to remember that the site is run by volunteers,” that writer said. “The work they do to protect writers, fight censorship and safeguard freedom of expression is extremely important and necessary, especially right now. They deserve all the respect and patience in the world as they work to get the archive back up and running. Be kind.” 

    Ren, echoing those sentiments, sent me a meme: 

    ‘Wake Up Call:’ Fanfiction Writers and Readers React to AO3 Outage

    “An additional sentiment I’ve seen is ‘ok so when AO3 comes back we’re all going to tell our favorite authors how much we missed their work, right?’ which I hope catches on — I’m writing for niche fandoms and had to disable guest comments due to bot spam, so comments are few and far between as it is,” Ren said. “I do kind of hope that the extended outage serves as a sort of wake-up call to anyone who’s been taking ao3 for granted lately. It certainly was for me.” 

    Source: 404 Media · 2026-10-30

  • $6.3 Billion Stolen from Binance in Attack Attributed to North Korea

    Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.

    Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to a DevOps engineer’s compromised laptop. Billions had moved out of wallets linked to the exchange.

    According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.

    “Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”

    Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion.

    Those figures came from blockchain tracking and differing estimates, so they didn’t necessarily show the amount stolen.

    Binance pointed out that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.

    The company said its user funds were “completely safe.”

    “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”

    That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.

    “Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Binance Co-CEO Richard Teng explained.

    “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”

    Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.

    Binance also said it had found “additional points of breach” and was still investigating. Co-CEO Richard Teng said the investigation had not identified anyone responsible. After the attack, Binance suspended deposits and withdrawals to carry out security checks, cancelled the permissions linked to the affected address, and began working with blockchain analysis firms and law enforcement to track the stolen funds.

    Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe. The company also plans to publish an updated Proof of Reserves once it has completed the recovery work. This commitment does not replace a detailed technical explanation or independent confirmation of the full impact of the attack.

    Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It attributes the attack to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis says it’s highly confident in that finding.

    TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

    “On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”

    Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.

    The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.

    Hot wallets help explain how this type of theft can happen. They store cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals quickly. But this also makes strong security controls essential. Investigators still need to determine who initiated the transfers, whether they were authorized, whether attackers gained control of the wallets, and whose funds were stolen.

    Binance co-founder Changpeng Zhao, who no longer runs the company, said the activity looked like a hack and expected customers to be fully compensated. Large transfers alone do not prove a cyberattack, but the findings that emerged later provided strong evidence of a breach.

    Customers also need to be careful. Attackers often exploit the confusion after a major incident by spreading fake announcements, pretending to be support staff, and directing users to fraudulent websites. Use only Binance’s official channels, avoid unexpected links, and never share passwords, authentication codes, or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to pressure employees into verifying their accounts.

    The lesson goes beyond Binance. A public blockchain records every transaction, but it cannot show who authorized it or how attackers gained access. Blockchain transparency does not guarantee operational security.

    Follow me on Twitter: @securityaffairs and Facebook and Mastodon

    Pierluigi Paganini

    (SecurityAffairs – hacking, Binance)

    Source: Security Affairs · 2026-10-30

  • TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs

    A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician…

    Source: HackRead · 2026-10-30

  • Android 17 adoption hits a staggering 1% – why you really should update now

    Android 17 adoption hits a staggering 1% – why you really should update now

    Only a quarter of Android phones have even made it to Android 16.

    Source: ZDNet Security · 2026-10-30

  • Bangkok Post Breach Claim Includes 822,140 Member Accounts and 6.9 GB Infrastructure Dump

    Data Exposure Report
    Bangkok Post Breach Claim Includes 822,140 Member Accounts and 6.9 GB Infrastructure DumpThailand
    Media
    Member & Infrastructure Data
    Leak Claim
    Unverified

    Bangkok Post Breach Claim Includes 822,140 Member Accounts and 6.9 GB Infrastructure Dump

    Claimed members822,140
    Claimed files49,783
    Employees385
    Extracted size6.9 GB

    Bangkok Post Breach Claim Includes 822,140 Member Accounts and 6.9 GB Infrastructure Dump

    An actor using the handle “d00101” claims to have leaked approximately 6.9 GB of data associated with Bangkok Post, including member data and internal infrastructure material.

    The listing advertises 49,783 files, 822,140 member records, 385 employee records, 9 hosts and 352 database tables. The actor says the dump includes member databases, CMS data, an MSSQL HR system, Active Directory-related material, host filesystems, cloud-tenant data and TLS private-key material. The breach, dataset contents, record counts and infrastructure claims have not been independently verified.

    Post details

    OrganizationBangkok Post
    CountryBangkok Post Breach Claim Includes 822,140 Member Accounts and 6.9 GB Infrastructure DumpThailand
    SectorMedia / publishing
    Actor“d00101”
    Claimed size6.9 GB
    Claimed files49,783
    Claimed members822,140
    Post date shown

    What the post claims

    • 6.9 GB extracted
    • 49,783 files
    • 822,140 member records
    • 385 employee records
    • 9 internal hosts referenced
    • 352 database tables
    • Member database material included
    • CMS data included
    • MSSQL HR system data included
    • Active Directory-related material included
    • Host filesystem data included
    • Cloud-tenant data included
    • TLS private-key material claimed
    • Password-hash material listed
    • Sample member records displayed
    • Internal infrastructure services listed

    The actor also lists password-hash collections using MD5, SHA-1 and bcrypt and claims that a portion of the hashes were already cracked. The screenshot includes sample member emails, public IP addresses and internal infrastructure details; those values are not transcribed in this report.

    Screenshots

    The supplied capture shows the Bangkok Post claim, the stated file, member, employee, host and database-table counts, sample member rows, password-hash references and internal infrastructure categories. Personal sample data and sensitive infrastructure values are not repeated here.

    IOCs & identifiers

    Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the breach claim.

    Type Identifier Source
    Actor handle d00101 Screenshot 1
    Named organization domain bangkokpost[.]com Screenshot 1

    The organization domain identifies the entity named in the claim, not malicious infrastructure. Internal RFC1918 addresses, private-key material, sample user emails and other sensitive values shown in the screenshot are intentionally not reproduced here.

    Mapped techniques

    Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.

    Potential impact

    If authentic, the claimed exposure could affect member accounts, employee records, authentication material, internal systems and cryptographic assets. The combination of member data, password hashes, internal infrastructure information and claimed TLS key material could increase risks of account takeover, phishing, credential reuse, internal-system targeting and broader follow-on compromise.

    Status Unverified

    Dark Web Informer has not independently verified the breach, 6.9 GB extraction size, file counts, member or employee totals, password-hash claims, private-key claims, infrastructure access or current availability of the purported material. The supplied screenshot documents the actor’s listing and visible evidence only.

    Dark Web Informer

    Source: Dark Web Informer · 2026-10-30

  • Scientists Analyzed Thousands of Psychedelic Trips. They Found Something Disturbing

    Scientists Analyzed Thousands of Psychedelic Trips. They Found Something Disturbing


    Scientists Analyzed Thousands of Psychedelic Trips. They Found Something Disturbing

    Researchers have amassed a trove of more than 25,000 calls to a support hotline for people during and after psychedelic trips, making it “the largest dataset of psychedelic support interactions ever assembled—exceeding the combined sample sizes of all published psychedelic clinical trials by an order of magnitude,” according to a study published on Friday in Science Advances.

    Despite the popularity of psychedelics as recreational drugs, and increasing interest in them as medically-prescribed therapeutic treatments, there is very little research about the effects of these substances outside of clinical settings with carefully-selected patients. That, scientists say, is limiting what we can learn about the effects of these drugs, because the vast majority of psychedelics are consumed by all kinds of people in homes, festivals, ceremonial gatherings, or other uncontrolled environments.    

    The Fireside Project, a nonprofit founded in 2020, has filled this knowledge gap with its Psychedelic Support Line, which connects callers who are on bad trips, or who are seeking more information about psychedelics, with trained volunteers who offer confidential peer support. 

    🌘
    Subscribe to 404 Media to get The Abstract, our newsletter about the most exciting and mind-boggling science news and studies of the week.

    The team has now published a compendium of 25,419 anonymized interactions with 220 hotline volunteers that took place between April 2021 and February 2026. The database opens an unprecedented window into the experiences of people on psilocybin, ketamine, MDMA, LSD, ayahuasca, and even cannabis, which is not generally considered a psychedelic but can trigger similar effects, such as mild hallucinations. 

    It’s a “treasure trove,” said Félix Schoeller, a senior research scientist at the Institute for Advanced Consciousness Studies, a California-based nonprofit, who led the study, in a call with 404 Media. “In general, we’re really lacking any evidence and data beyond what exists in the underground world, if you will, for psychedelic therapy.” 

    “There’s different types of knowledge,” continued Schoeller, who is CEO of ReWire Neurotechnologies, a startup focused on novel experiential treatments for depression. “Some cultures and communities have been doing that for thousands of years. But there’s a question about how to do this in a way that follows the principles of biomedical science.”  

    The interactions included phone calls and text exchanges with hotline volunteers who provided support by talking through the experience or connecting callers with emergency services in the most urgent cases. About 40.2 percent of callers (10,208 interactions) were actively tripping, while 32.1 percent of callers reached out after they had tripped, a period known as “integration.”  

    The rest of the calls fell into smaller categories, such as informational inquiries about certain substances, requests to prepare or buy drugs, or calls from “trip-sitters” assisting a person on psychedelics. 

    Psilocybin was the most commonly reported substance (9,348 callers), followed by LSD (2,247callers), cannabis (2,004 callers), and ketamine (1,194 callers), and MDMA (682 callers), with ayahuasca and other drugs logging much smaller numbers.  

    Surprisingly, callers who had used cannabis  reported the highest distress rate—47.2 percent had bad experiences with the drug. Though cannabis has a reputation as a low-stakes substance, the study confirms that it can induce real distress in some cases that warrant consideration for harm reduction. The distress rates for the rest of the commonly used psychedelics were only slightly lower than cannabis, ranging between 40 to 42 percent.

    The study also revealed 43 rare but disturbing instances of “facilitator abuse,” including at remote retreats or ceremonial gatherings involving ayahuasca. In these cases, callers reported abuse from the people providing psychedelics, such as reports they had deliberately been given extra doses without consent. 

    Those reports “provide the first quantitative documentation of this phenomenon in a community help-seeking sample,” according to the study. “The pattern of these reports—clustering in ceremonial settings involving plant medicines, presenting primarily as trauma-processing calls, and involving callers with elevated rates of prior PTSD diagnoses—suggests that even modest surveillance through existing peer support infrastructure can detect harm occurring in unregulated psychedelic settings.”

    Some calls also came from people who said they suffered from schizophrenia, or had taken multiple psychedelics, offering a rare glimpse of situations that could not be observed in clinical settings. 

    “This kind of data can inform us on these topics in the context of legalizing these drugs and making them accessible,” said Schoeller. “I’m glad that there’s this data that exists that people can look into to support or contradict the claims that they make as to how these things should be done.” 

    The study also outlines several limitations, including its sample bias of people who are inclined to call a hotline in the first place—which is not representative of psychedelic consumers at large—as well as self-reported accounts of doses, among other factors that are impossible to verify.

    Despite the noisiness of the data, however, it contains helpful clues about avenues for future research. In Schoeller’s view, one of the most important revelations was that the success of a call was strongly linked to the perception that the hotline volunteer showed genuine care and empathy toward the caller. Using 2,777 postinteraction satisfaction surveys, the team found that the few negative experiences with the hotline tended to stem from feelings that the volunteer was dismissive, or didn’t seem to care about the caller. 

    “My takeaway is that the number one thing that predicts whether a support call will not work” is “the volunteer being perceived as genuine,” Schoeller said. “That’s something that, in many ways, poses a problem to the biomedical system of centralized hospitals. I’m not trying to be ideological in any way, but when you create a centralized institution where you throw everybody to a single place to get care”  then “clinicians become burned out.”

    For this reason, Schoeller and his colleagues plan to follow up on the role of perceived care and empathy in treatment, and to emphasize this factor in guidance for community-based peer support for people in crisis due to psychedelics. It also reinforces the value of the Fireside Project’s hotline, which provides a safe and confidential service for people who might be reluctant to contact emergency services because of the criminalization of these substances or fear of incurring medical debt.

    “For many people, they have experiences with psychedelics, and they may not be required to go to the ER, but they still need someone to help them navigate the difficult experience,” Schoeller concluded. “The hotline can truly be a lifeline for them.” 

    Source: 404 Media · 2026-10-30

  • Defy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ Emails

    Data Exposure Report
    Defy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ EmailsIndia
    Social Crypto Platform
    User Contact Data
    Free Leak
    Unverified

    Defy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ Emails

    Claimed accounts23,149
    Phone numbers23K+
    Email addresses9K+
    Compressed size805 KB

    Defy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ Emails

    An actor using the handle “GoreTerminal” claims to have leaked a Defy Club dataset containing approximately 23,149 user accounts. The post describes DEFY.club as an India-based social crypto platform that lets users share and track portfolios, follow other investors and discuss cryptocurrency.

    The actor says the breach occurred on October 30, 2026 at 1:33 PM EDT and characterizes the release as a leak rather than a ransom event. The post highlights 23K+ phone numbers and 9K+ email addresses. The archive is described as JSON Lines, with an uncompressed file named DEFYCLUB_UNIQUE.JSONL at 6.4 MB and a compressed archive at 805 KB. The dataset, its source, the stated counts and current availability have not been independently verified.

    Post details

    OrganizationDefy Club
    CountryDefy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ EmailsIndia
    SectorSocial crypto / investment community
    Actor“GoreTerminal”
    Claimed accountsApproximately 23,149
    FormatJSON Lines
    Archive sizes6.4 MB raw / 805 KB compressed
    Claimed breach timeOct 30, 2026 at 1:33 PM EDT

    What the post claims

    • Approximately 23,149 user accounts
    • 23K+ phone numbers
    • 9K+ email addresses
    • JSON Lines format
    • 6.4 MB uncompressed file
    • 805 KB compressed archive
    • Country field included
    • Email field included
    • Phone and international-phone fields included
    • Mobile-carrier field included
    • Internet-protocol address field included
    • User and account identifiers included
    • Platform / device fields included
    • Build and previous-version fields included
    • Registration-region fields included
    • Profile-created timestamp included
    • Source / status fields included
    • Sample records displayed
    • Free download advertised

    The visible sample contains structured user-account records including contact, carrier, device and network-related metadata. Individual phone numbers, email addresses, IP addresses and user identifiers shown in the sample are not transcribed in this report.

    Screenshots

    The supplied captures show the Defy Club leak claim, the stated breach time, account, phone-number and email scope, JSONL archive sizes, schema fields, sample records and a free-download section. Direct download access and personal sample values are not reproduced here.

    IOCs & identifiers

    Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the breach claim.

    Type Identifier Source
    Actor handle GoreTerminal Screenshots 1–2
    Named organization domain defy[.]club Screenshots 1–2

    The organization domain identifies the entity named in the claim, not malicious infrastructure. No malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled infrastructure is visible in the supplied screenshots. Personal identifiers shown in the sample are not included in this table.

    Mapped techniques

    Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.

    • Collection
      T1213.006
      Data from Information Repositories: Databases
      Inferred
      The listing presents a structured JSONL user dataset containing account, contact, carrier, device and network-related fields. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Defy Club systems.

    Potential impact

    If authentic, the claimed dataset could expose phone numbers, email addresses, IP addresses, mobile-carrier information, device/platform details and account identifiers for more than 23,000 users. The combination could support targeted phishing, SMS abuse, account impersonation, profiling or other privacy-related abuse.

    Status Unverified

    Dark Web Informer has not independently verified the dataset’s authenticity, source, completeness, approximately 23,149-account count, phone or email totals, archive sizes, sample contents or the actor’s claimed October 30 breach time. The supplied screenshots document the listing and visible sample records, not independent confirmation of the underlying data.

    Dark Web Informer

    Source: Dark Web Informer · 2026-10-30

  • Samsung adds better sleep tracking to Galaxy Watches – here’s what to expect

    Samsung adds better sleep tracking to Galaxy Watches – here’s what to expect

    The FDA-approved sleep apnea tracking feature will first come to the Galaxy Watch Ultra 2, Watch 9, and Ring.

    Source: ZDNet Security · 2026-10-30

  • I’m finally ready for a smart calendar – why the Echo Show 16 stands out

    I’m finally ready for a smart calendar – why the Echo Show 16 stands out

    I’m finally ready to upgrade to a smart calendar – and Amazon’s newest Echo device looks like an organizational solution for my family and I.

    Source: ZDNet Security · 2026-10-30

  • Apple notifications alert victims in 99 countries about mercenary spyware infections

    Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers.

    “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. “The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”

    Apple didn’t immediately respond to a request for comment Friday about the countries targeted. Researchers and groups that work on spyware said the notifications were significant, however.

    “This again promises to be an important set of notifications with a bunch of cases, based purely on what we see publicly,” said John Scott-Railton, senior researcher at The Citizen Lab at the University of Toronto. He also posted on social media about how potential victims could defend themselves, warning people to be cautious about companies that offer paid solutions to spyware infections.

    He cautioned that the lack of notification doesn’t rule out an infection. The steps Apple recommends, which Scott-Railton seconded, were to enable Lockdown Mode and to get in touch with the digital rights group Access Now.

    “The number of Apple threat notifications we are seeing from countries around the world indicates that the fight against the scourge of spyware abuse is far from over,” said Natalia Krapiva, senior tech-legal counsel with Access Now. “While we have increased our capacity to investigate spyware abuse, and companies like Apple have done a lot to notify and protect people from it, repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures.”

    Apple sent its last major batch of notifications in August. The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting deeper investigations.

    The notifications come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process. The industry guidelines follow an earlier set of guidelines catered to governments.

    “The states that will ultimately adopt these guidelines must come to terms that the current system is not working, and that the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses,” Krapiva said.

    Source: CyberScoop · 2026-10-30