ZeroFox Daily Intelligence Brief - October 19, 2026
|by Alpha Team
ZeroFox Daily Intelligence Brief - October 19, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- Rhysida Ransomware Group Targets Maryland Government Data
- BAE Systems Hack Disrupts U.S. Federal Bankruptcy Court Operations
- Global Fast-Food Giant Burger King Japan Discloses Data Breach
Rhysida Ransomware Group Targets Maryland Government Data
Source: https://cloud.zerofox.com/intelligence_new/advanced_dark_web/112564
What we know: Rhysida ransomware group has listed Anne Arundel County in Maryland on its dark web leak site, claiming to have stolen 2.6 TB from government systems comprising 814,500 files. Anne Arundel County confirmed a cyberattack that took place in August 2026 without naming the threat group. The incident comes ahead of Midterm elections.
Context: The alleged dataset includes 721 background-check dossiers with full Social Security numbers (SSNs), medical faxes containing patient names and diagnoses, 47,602 medical assistance files with driver’s licenses, Green Cards, and banking data, methadone (used to treat opioid use disorder) clinic records protected under federal confidentiality law, jail gang-intelligence files, and county payroll registers. The county has not confirmed the specific nature of the copied files.. The actor is selling the data for 25 BTC (approximately USD 2 million).
- Rhysida has previously targeted public sector entities including the City of Berlin in August 2026, which had confirmed a cyberattack. The Berlin hack also came ahead of elections for both a new state parliament and local district councils.
Analyst note: Rhysida ransomware group’s Berlin hack very likely indicates that the Anne Arundel County is a timed operation ahead of elections to either influence outcomes, sow distrust in government institutions, or increase pressure for ransom payment. The hacking claims are likely to be legitimate, though the extent of data stolen cannot be ascertained. Publication of methadone clinic records and gang-related intelligence files would almost certainly increase physical risks to exposed individuals and hinder ongoing law enforcement operations.
BAE Systems Hack Disrupts U.S. Federal Bankruptcy Court Operations
What we know: The Administrative Office of the U.S. Courts (AOUSC) has confirmed a cybersecurity incident affecting the systems of Bankruptcy Noticing Center (BNC) operated by contractor BAE Systems.The BNC produces and sends bankruptcy notices for all federal bankruptcy courts in the United States.
Context: BAE Systems notified the AOUSC of the disruption on October 9, 2026. BNC operations including issuing and transmission of bankruptcy notices, its websites, and the National Creditor Registration Service website are offline as a result. Despite the outage, electronic filing notifications remain operational, and courts continue to accept filings and open new cases.
Analyst note: Bankruptcy deadlines are likely to be disrupted if the outage continues as they depend on notices being delivered. Threat actors are likely to take advantage of the disruption by sending fake bankruptcy notices impersonating courts or the BNC to debtors and creditors. If data was accessed, the personal and financial details the BNC handles, are likely to be used to defraud people.
Global Fast-Food Giant Burger King Japan Discloses Data Breach
Source: https://hackread.com/burger-king-japan-data-breach-11-million-app-members/
What we know: Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, has reportedly confirmed a data breach affecting more than 11.18 million customer records after attackers accessed a server managing information for its official smartphone app.
Context: Exposed data reportedly includes names, dates of birth, gender, email addresses, phone numbers, and order history. The company blocked the unauthorized access and reported the incident to Japan’s Personal Information Protection Commission (PPC).
Analyst note: The exposed customer data is likely to be leveraged for targeted phishing, fraud, and impersonation of Burger King Japan.
DEEP AND DARK WEB INTELLIGENCE
Telegram user ShinyHunters: A Telegram channel and associated forum account operating under the banner “ShinyHunters” have claimed a breach of Sweden-based clothing retailer H&M. ZeroFox assesses the activity as a likely impersonation of the actual ShinyHunters group, based on a mismatch between the PGP keys published by the account and those of the legitimate ShinyHunters data leak site. The Telegram user was also observed reusing datasets already published on the group's official leak site, and links to a forum account previously banned for impersonating LAPSUS$.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2026-102764: A critical zero-day vulnerability in BeyondTrust Remote Support, caused by improper origin validation in an internal messaging component, enables unauthenticated remote attackers to perform file operations on affected appliances without user interaction. China-linked cyber espionage group Armory Castle reportedly exploited the flaw to deploy a PHP web shell, escalate privileges, steal credentials, and move laterally.
Affected products: BeyondTrust Remote Support versions 26.2.3 and earlier
Tags: DIB, tlp:green