November opens the way October closed: with your data and your money sitting on someone else's server, and someone else working hard to take it. Three disclosures this weekend tell the same story from three angles — a nation-state, a vendor, and a government agency. The throughline is custody. You almost never hold the thing you're accountable for.
North Korea's biggest payday yet
The regime that runs on stolen crypto just set a record. The FBI blamed North Korea for a record $6.3 billion crypto heist from Binance. That is not a rounding error on a balance sheet somewhere — it is a sanctioned state funding itself by breaking into the plumbing of the digital economy, at a scale that dwarfs most corporate fraud losses combined.
The operator's take: if you touch crypto anywhere — treasury, payments, a stablecoin rail a vendor quietly added — you are now in a nation-state threat model, not a fraud-prevention one. The attackers are patient, well-funded, and motivated by geopolitics, not quarterly numbers. Key management, withdrawal controls, and hardware-backed custody stop being a compliance checkbox and start being the whole game. Assume the adversary is better resourced than your security team, because it is.
One vendor, seven airlines
Here is what concentration risk looks like in practice. Amadeus, the third-party technology provider that runs reservations for much of the airline industry, suffered a cybersecurity incident involving unauthorized access to its passenger reservation systems, and began notifying affected carriers in late October 2026. The breach reached multiple airlines, primarily in Asia — Japan Airlines, All Nippon Airways, Korean Air, Asiana Airlines, Cathay Pacific, Malaysia Airlines, and Star Flyer. Malaysia Airlines warned that three years of customer booking data may have been exposed and urged fliers to stay vigilant against unsolicited messages asking for personal or financial information.
The operator's take: none of these airlines were breached — their vendor was, and they inherited the blast radius anyway. That is the uncomfortable math of SaaS: you can outsource the system, but you cannot outsource the accountability or the customer trust. Map which vendors hold your most sensitive data, demand breach-notification SLAs in writing, minimize what you hand over in the first place, and have the customer-comms runbook drafted before you need it, not during the fire.
4.9 million students, one website
The public sector keeps the most sensitive identity data and often guards it the least. Florida's Department of Education disclosed that unauthorized criminal access to its Student Financial Aid website — discovered on October 19, 2026 — may have exposed Social Security numbers and personal information for 4.9 million people. The department says it stopped and contained the activity and believes the breach was limited to the website rather than the wider financial-aid network.
The operator's take: as a CIO in education, this one stings, because it is so common and so preventable. Financial-aid data is identity gold — names, SSNs, and enough context to open accounts for years. A single public-facing web app became the entire blast radius, which means the real failure was architectural: no segmentation between the front door and the vault. Treat applicant and student PII as a crown jewel, not a form field. Minimize what you collect, wall off what you keep, and assume the website is hostile territory.
Also on my radar
- Telecom data keeps leaking. A Sony ISP subsidiary disclosed a breach exposing more than 2.5 million customer records — connectivity providers sit on identity and billing data that is just as valuable as a bank's, so hold them to a bank's standard.
- Energy isn't exempt. ENGIE disclosed a data breach exposing customer details and energy contracts — critical-infrastructure firms are squarely in the crosshairs, and their customer data is the soft underbelly.
- Even the security-conscious crowd. Keystone said a website breach exposed its hardware-wallet buyers' shipping addresses — a reminder that the marketing site is as much an attack surface as the product.
The throughline is custody, and the honest admission that you don't have it. North Korea is monetizing the crypto you don't personally hold, Amadeus was carrying passenger data for airlines that never touched the breach, and Florida's most sensitive records lived behind one website. The operator's edge isn't pretending you control these systems — it's planning as if you don't. Minimize what you hand over, segment what you keep, demand breach terms from every vendor in writing, and treat identity data as the liability it is. The boring rigor was the answer before any of this hit the headlines, and it still is. That's the Signal for today.
Paul Sapio is the CIO of Mikhail Education and a full-stack AI engineer. Open to contract work in security, networking, AI, and SaaS development — reach out.