FortiBleed, Oracle Health and a Cloud Shutdown in Japan: 6 Security Lessons from October 2026’s Biggest Breaches
Three breaches, one pattern
October 2026 brought some of the year’s most-searched security stories. A healthcare breach affecting nearly 20 million people, a ransomware attack that shut down a Japanese cloud used by 495 companies and local governments, and an ongoing campaign that has exposed tens of thousands of Fortinet firewall logins all point to the same weak spots: stolen credentials and old, unpatched systems.
In short:
- Oracle Health: nearly 20 million people affected by a breach of a legacy Cerner server, reportedly accessed with stolen customer credentials.
- IDC Frontier (SoftBank): a ransomware attack on 7 October disrupted the IDCF Cloud service used by 495 companies and local governments.
- FortiBleed: working credentials for more than 86,000 Fortinet devices circulated across 194 countries, according to researchers.
- Most of these attacks could have been made much harder with multi-factor authentication, credential rotation and retiring legacy systems.
The October 2026 breaches at a glance
| Incident | What happened | Scale | Likely entry point |
|---|---|---|---|
| Oracle Health (Cerner) | Patient data copied from a legacy server between January and April 2025; full tally reported October 2026 | Nearly 20 million people | Stolen customer credentials on an old server not yet moved to the cloud |
| IDC Frontier / IDCF Cloud | Ransomware attack starting 7 October 2026; East Japan Region 1 shut down, management consoles disabled in all regions | 495 companies and local governments | Not yet disclosed |
| FortiBleed | Credential-harvesting campaign against internet-facing Fortinet firewalls and VPNs, first flagged in June 2026 and still being cited this month | 86,000+ devices, 194 countries | Brute force, reused and never-rotated passwords |
| Asos | Retailer confirmed a breach through its mobile app, then said more data was taken than first reported | Not disclosed | Not disclosed |
1. Oracle Health: 20 million records from one old server
A Texas attorney general filing, reported on 8 October 2026, puts the Oracle Health breach at nearly 20 million people, including almost 3 million in Texas. The stolen data includes names, Social Security numbers, diagnoses, medicines and test results.
Oracle told customers the attacker likely used stolen customer credentials to reach “an old legacy server not yet migrated to the Oracle Cloud,” then copied the data out.
The lesson: systems waiting for migration are often the least protected. Old servers still holding live data need the same monitoring and access controls as new ones, or they need to be retired.
2. IDC Frontier: a cloud provider taken offline
On 7 October 2026, SoftBank subsidiary IDC Frontier disclosed a ransomware attack on its IDCF Cloud service. The company shut down its East Japan Region 1 data center cluster and disabled customer access to management consoles in every region while it investigated. About 495 companies and local governments use the service.
IDC Frontier has not yet said how the attacker got in. A message seen by customers, which has not been independently verified, claims the attacker breached the infrastructure in seven minutes and wiped hundreds of thousands of snapshots.
The lesson: your cloud provider’s outage is your outage. Keep backups outside your main provider and test how quickly you can run critical systems elsewhere.
3. FortiBleed: firewall logins in the wrong hands
FortiBleed is a large credential-theft campaign against internet-facing Fortinet firewalls and VPNs. Researchers at SOCRadar raised their count of affected devices from 30,000 to more than 86,000, across 194 countries (SecurityWeek). Researcher Kevin Beaumont estimates the data covers about half of internet-facing Fortinet firewalls.
Attackers used automated scripts to test usernames and passwords, including logins from older breaches that had never been changed. Once inside, they moved into internal networks.
CISA’s advice to affected organisations:
- End active sessions and reset all credentials.
- Turn on phishing-resistant multi-factor authentication (MFA).
- Review logs for suspicious logins.
- Restrict who can reach management interfaces from the internet.
The lesson: the device that protects your network is itself a target. Firewall and VPN logins need MFA, regular rotation and close monitoring.
6 security lessons for every business
- Turn on phishing-resistant MFA everywhere, especially for VPNs, firewalls, cloud consoles and admin accounts.
- Rotate and retire credentials. Change passwords after any breach and remove accounts for staff and vendors who have left.
- Retire or ring-fence legacy systems. Anything awaiting migration needs patching, monitoring and limited access until it is shut down.
- Hide management interfaces. Firewall and server admin panels should never be openly reachable from the internet.
- Back up outside your main cloud. Keep tested, offline or cross-provider backups so ransomware cannot wipe everything.
- Monitor and rehearse. Centralise logs, set alerts for unusual logins and run an incident-response drill at least once a year.
How Tech Solutions can help
Many companies know what they should do but lack the people to do it. Tech Solutions (techsolutions.ae) provides cybersecurity, cloud and infrastructure engineers through IT staff augmentation, and supports security reviews through its IT infrastructure and IT consulting services. You can add experienced engineers to harden firewalls, roll out MFA, plan legacy migrations or set up backups, without a long hiring process.
Want a second pair of eyes on your security? Contact Tech Solutions to get started.
Frequently asked questions
What is FortiBleed?
FortiBleed is a credential-theft campaign targeting internet-facing Fortinet firewalls and VPNs, first flagged in June 2026. Researchers say working credentials for more than 86,000 devices in 194 countries were exposed through brute-force attacks and reused passwords.
How many people were affected by the Oracle Health breach?
Nearly 20 million people, according to a Texas attorney general filing reported in October 2026. The attack hit a legacy Cerner server between January and April 2025 and exposed names, Social Security numbers and medical information.
What happened to IDC Frontier’s IDCF Cloud?
A ransomware attack starting on 7 October 2026 forced SoftBank subsidiary IDC Frontier to shut down its East Japan Region 1 cluster. The service is used by 495 companies and local governments, and the entry point has not yet been disclosed.
What is the most effective way to prevent credential-based attacks?
Phishing-resistant multi-factor authentication is the single most effective step. Combine it with regular password rotation, removing unused accounts and monitoring for unusual logins.
How can a small company improve security without a full security team?
Start with MFA, patching and off-site backups, which cost little and stop most common attacks. For specialist work such as firewall hardening or cloud security, add cybersecurity engineers through staff augmentation instead of hiring a full team.
