Black October: one month, millions of people's data

8 min read

A month that earned a nickname

Most people find out about a data breach the same way. A letter or an email arrives from a company they had nearly forgotten about, saying their details were taken. In October 2026, a lot of those messages went out at the same time.

On Oct 22, according to the security news site SecurityToday, an account on X called AISafetyMemes posted a numbered list of incidents, described the previous 48 hours as the worst in cybersecurity history, and gave the month a name: "Black October." SecurityToday made a useful point: the announcements bunched up between Oct 19 and Oct 22, but many of the attacks behind them had started weeks or months earlier. October is when the public found out.

What happened

Most items on that list involved software that businesses use. Two of them, the California student records and the grocery outage, reached families directly. So did two other October breaches, at Capcom and at a Discord tool.

California students. ETS is a nonprofit testing organization that works under contract with the California Department of Education. The state says someone used a compromised login to get into its secure file-transfer site, a server the two organizations used to pass test files back and forth. Files were copied between May 22 and Sep 18, 2026. ETS spotted the activity on Sep 25, took the site offline and built a new one with tighter controls.

The state announced the breach on Oct 16, the same day letters to families started going out. Letters are expected to continue into early November. The state says the affected group covers students enrolled in California public schools from 2023 to the current school year, plus some former students who left as far back as 2006 without a confirmed transfer. Enrollment for the 2025-26 school year alone was more than 5.7 million, and the Los Angeles Times, as cited by SecurityToday, says the total is well above that. Depending on the student, the files include names, birth dates, home addresses, school, student ID numbers, demographic details, test results, disability status and testing accommodations. The state says Social Security numbers, driver's license and passport numbers, financial details, passwords and parent information were not involved. ETS says its monitoring has found no sign the data was posted publicly. Families are offered two years of free identity protection through Experian, with an enrollment deadline of Mar 19, 2027.

Capcom. Capcom is the Japanese company behind games such as Resident Evil and Street Fighter. CAPCOM ID is its shared account system for its websites and some online games. Capcom confirmed the break-in on Oct 19 and reported it to the police and to Japan's privacy regulator on Oct 21. The attackers took 11,774,247 email addresses, along with each account's creation date, last login date, number of logins and the internet address used at the last login. For 43 accounts they also got birth dates, gender, nicknames and countries. They changed the passwords on 196 accounts, which Capcom has since reset. Capcom says other members' passwords and credit card details were not exposed, and its online services stayed available. It has not said how the attackers got in.

Discord. Double Counter is a bot, a small automated program, that many Discord communities add to screen people who join. It is run by a French company, Tellter SAS, which says it protects more than 600,000 communities. On Oct 4, an attacker spent nearly six hours inside its cloud systems. According to Cybernews, the attacker had spent the day before probing an old server left over from a previous hosting setup, used a flaw in an exposed analytics tool to get an administrator's login, and then pulled out the bot's Discord key. About 12 GB of data was copied: roughly 28 million Discord user IDs and usernames, roughly 27 million internet addresses with rough locations down to city and postal code, and about 1 million email addresses. The attacker also used the bot's identity to post invitations in about 50 large communities. Tellter published a report on Oct 5 and notified France's data protection regulator. On Oct 7, the breach-alert site Have I Been Pwned listed 274,922 unique email addresses from the part of the data posted publicly. Discord said the same day that its own systems were not breached, and it blocked new installs of the bot while it looked into the matter.

Food Lion and Stop & Shop. On Oct 12, the shopping websites for Food Lion, The Giant Company, Giant Food, Hannaford and Stop & Shop showed notices that they were down. Their parent company, Ahold Delhaize, said it had found a security issue and taken some systems offline on purpose. Brands in the Netherlands and Belgium were hit too. Physical shops, pharmacies and fuel stations kept operating. The company told the Dutch national cybersecurity agency within 24 hours and filed a police report. Food Lion's website and app came back on Oct 20, and by Oct 21 all five US brands were working normally again. The investigation is still going on. So far, the company says, it has found no evidence that sensitive customer, employee or partner data was taken. This was its second major attack in recent years: a November 2024 attack on its US systems exposed information on more than 2.2 million people.

How this kind of thing happens

These four stories share a few simple patterns.

One login can open a big door. A file-transfer site is a locked drop box that two organizations use to swap large files. If one person's login falls into the wrong hands, whoever has it can get in the way an authorized user would. That may not look unusual, and at ETS the copying went on for nearly four months before it was spotted.

Forgotten equipment is a weak spot. Old servers that nobody uses anymore can be overlooked when security work is done. An attacker who finds one can use it as a starting point, which is how Cybernews says the Double Counter attack began.

Software keys are as good as passwords. A bot proves who it is with a long secret code called a token. Anyone who copies that token can post messages that look like they came from the bot.

Shared systems hold a lot in one place. A single account system for many games, or a single platform for five grocery brands, is convenient. It also means one break-in reaches millions of people at once. When a company sees an intruder, it often shuts systems down on purpose to keep the problem from spreading, which is why grocery apps went dark while stores stayed open.

Why it matters at home

Nobody in these stories was hacked at home. Their information was taken from places companies kept it: a testing contractor's file site, a game company's account system, a bot's servers. Many of the people affected may never have heard of ETS or Double Counter; the state or an online community chose them.

The harm is mostly about what comes next. An email address paired with a game account, or a username paired with a city, can help a scammer write a more believable message, which is why the state, Capcom and Tellter all warn about phishing. Children's records are a special case: disability and accommodation details cannot be changed the way a password can.

There is good news too. The school files had no Social Security numbers, Capcom says card details were safe, and Ahold Delhaize has found no evidence so far that customer data was taken. A few calm steps are the right response. The more places your information is stored, the more places it can be taken from.

What you can do

• California families: look for the letter from ETS, which has an activation code. The state says enrollment in the free Experian protection is open until Mar 19, 2027, needs no credit card, and that not getting a letter does not mean a student was unaffected. Questions go to the call center at 833-931-8488.
• Check before you click. The state warns about unexpected messages that mention the incident, Capcom warns about emails pretending to come from Capcom, and Tellter tells people to expect phishing. Tellter says it never asks for passwords, tokens or payments by email or direct message. To check a message about the school breach, the state points families to its own page at cde.ca.gov/ets.
• Consider a credit freeze. The state notes that adults can get free credit reports at annualcreditreport.com and place free security freezes, and that parents may consider free freezes for children under 16.
• Capcom players: Capcom says it is contacting affected customers in stages and has reset the 196 passwords the attackers changed. Treat any email that claims to be from Capcom and contains links or attachments with care.
• Discord server owners: Tellter advises deleting any Double Counter message sent on Oct 4 between 12:00 and 16:30 UTC that invites people to another server. Ordinary members, it says, do not need to change anything.
• Grocery shoppers: go to the store's own app or website directly rather than following links in texts or emails about refunds or coupons.
• Take stock. Make a short list of the companies that hold your family's details, and close accounts you no longer use.

Sources

1. SecurityToday, Oct 22, 2026
2. California Department of Education, Oct 16, 2026
3. California Department of Education, ETS incident page (reviewed Oct 22, 2026)
4. Cybernews, Oct 17, 2026
5. BleepingComputer, Oct 22, 2026
6. SecurityWeek, Oct 23, 2026
7. Digital Citizen, Oct 9, 2026
8. Cybernews, Double Counter breach
9. WBTV, Oct 13, 2026
10. BleepingComputer, Oct 20, 2026
11. The Shelby Report, Oct 20, 2026
12. Chain Store Age, Oct 2026

This article is based on the published reports listed above, written in our own words. Details are as reported on the dates shown. Spotted an error? Email support@krudodesigns.net and we will correct it.