Cyber News Bytes: What’s Happening in Cybersecurity This Week

This week had it all across cyber news headlines, from the largest crypto theft on record to a hospital forced to divert ambulances.

Here are four stories worth your time. →

1. Hackers stole $6.3 billion from Binance in about 20 minutes, and the FBI says North Korea did it

On October 29, an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes, according to TRM Labs. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack in early 2025. The FBI confirmed on Saturday that North Korea's TraderTraitor group was behind it.

TRM says the preparation began at least 36 hours before the money moved. Binance confirmed its own hot wallet was affected and says it has found no evidence that a private key leaked, though one outside expert told Reuters he suspects attackers accessed keys for at least two wallets. Binance suspended withdrawals, says deposits were unaffected, and has set aside more than $6.3 billion to cover all user losses. Working with partners like Tether, it has frozen at least $3 billion of the stolen funds.

Why it matters: This attack was staged in advance and executed in minutes, which leaves almost no time for a human response. Whether you protect crypto or a bank, the lesson is the same: put automated limits and out-of-band approvals on high-value transfers, and watch for preparation activity long before the money moves. If you hold crypto, this is a good moment to review which accounts you use and turn on every security option available.

Read more at NPR

2. A ransomware attack forced New Mexico's only Level 1 trauma center to divert ambulances

On Monday, October 26, the University of New Mexico Health Sciences Center detected a cyberattack that knocked out critical electronic systems. UNM Hospital, the state's only Level 1 trauma center, diverted ambulances and limited new patients for two hours that afternoon, and appointments and outpatient surgeries were canceled at more than 30 clinics. Classes at the medical, nursing, pharmacy, and population health schools were canceled too, and some staff were sent home. Workers reportedly heard an automated message on their computers threatening to take the university down.

The FBI assisted, and neighboring health systems took on extra patients. By October 28, hospitals were fully open and clinics were back to regular schedules. A ransomware group has claimed responsibility and says it stole patient data, but UNM has not confirmed any data theft and is urging the public not to engage with groups claiming responsibility.

Why it matters: Even a two-hour diversion matters in a state where this hospital is the only trauma center of its kind for roughly 400 miles. Healthcare security teams need tested downtime plans and backups so care can continue when systems go dark. If you're a UNM patient, confirm any rescheduled appointments directly with your clinic and be wary of unexpected requests for personal information.

Read more at HIPAA Journal

3. A hacktivist leaked personal details on more than 40,000 Homeland Security employees

On October 28, the nonprofit leak site Distributed Denial of Secrets published a database with details on more than 40,000 Department of Homeland Security employees, roughly one-fifth of the department's workforce. A hacker calling themselves "Department of Peace" says the data came from an Okta single sign-on system DHS uses to give employees and contractors access to its network, and the group described the leak, dubbed "Icepick," as a protest against immigration enforcement.

The data includes names, titles, agencies, offices, phone numbers, email addresses, and supervisors, covering staff at CBP, ICE, CISA, and other components, and a source told CNN that some undercover personnel were exposed. TechCrunch verified a portion of the records as authentic, and timestamps suggest the data was copied around mid-August. DHS says it is aware of a potential breach and is working to address it, while Okta says it has no evidence its own systems or data were compromised.

Why it matters: Whatever your view of the politics, a leaked directory of names, supervisors, and assignments is a ready-made map for phishing, doxxing, and harassment. Organizations should treat single sign-on directories as crown jewels by restricting bulk exports, monitoring for unusual access, and assuming employee lists will be used to target staff.

Read more at TechCrunch

4. A hidden text message can crash Android phones and drop emergency calls, and the exploit is now public

A researcher published a working proof-of-concept exploit on October 29 for CVE-2026-58882, a critical Android flaw dubbed "SMS of Death." A specially crafted eight-byte message is processed before it ever reaches the inbox, so the victim sees nothing and has to do nothing, yet it crashes Android's phone service and drops active calls, including calls to emergency services. Researchers warn that repeated messages can trap a phone in a crash loop that may take a factory reset or an involved recovery to fix. The flaw disrupts service rather than stealing data.

Google fixed the bug in its October 2026 update for Android 14 through 17, but reports say Android 12 and 13 phones are outside the update window and won't get the fix, and Cybernews puts the affected range at Android 12 through 16. The researcher reported the bug to Google in May, and the fix only reached retail phones this month.

Why it matters: Anyone with a phone number and the public exploit can send this message, with no action needed from you. Check for system updates in your Settings now, and if your phone no longer receives security updates, make sure you can reach emergency services from another device.

Read more at BleepingComputer

This week's stories show how quickly trust can turn into exposure: a hot wallet that moved billions in minutes, a hospital whose systems went dark, a single sign-on directory that doubled as a target list, and a text message nobody can even see.

The common thread is preparation, whether that means tested downtime plans, tight access controls, or simply installing the update.

Stay secure out there!

Sandra | Cyber With Sandra