October was Cybersecurity Awareness Month, which apparently nobody mentioned to the attackers.
Six breaches stood out this month, from an IT vendor’s backup tool to Florida’s student aid website. Here is what happened and what it means for your business.
October at a Glance
- ConnectWise: one stolen credential opened Microsoft 365 at hundreds of organizations
- Florida Department of Education: up to 4.9 million people, Social Security numbers included
- Oracle Health: nearly 20 million patients, about 3 million in Texas
- Quest Diagnostics: patient data accessed through a lab ordering portal
- Dexcom: a few phone calls, then stolen internal documents
- ETS: one login, four months inside California student records
The Breaches
1. ConnectWise: One Stolen Credential, 2,250 Microsoft 365 Tenants
ConnectWise Cloud Backup protects Microsoft 365 for thousands of IT providers and their clients, which is exactly what made it worth stealing from. Microsoft says the China-aligned group Storm-0940 tried to sign in to more than 2,250 tenants, and Huntress confirmed break-ins at 173.
How it happened: Attackers stole the backup tool’s application secret and signed in as the trusted app itself, so there was no password to guess and no MFA prompt to get past. From there they planted backdoors and sped things up with an AI attack framework called ARTEX. (A backup tool needs broad access to do its job; so, it turns out, does whoever steals its keys.)
2. Florida Department of Education: 4.9 Million People, Social Security Numbers Included
The state announced on October 29 that the Florida Student Financial Aid website had been breached ten days earlier.
What was exposed: – Social Security numbers and dates of birth – Names, home addresses, phone numbers, and email addresses
How it happened: The state has not said, beyond calling it “unauthorized criminal access.” It is Florida’s second state agency breach in two months, after the DMV’s DAVID database in September. Fake financial aid emails usually follow a breach like this, so it is worth a heads-up to your team.
3. Oracle Health: Nearly 20 Million Patients, 3 Million in Texas
The break-in happened in early 2025, but an October filing with the Texas Attorney General is what revealed its size. Names, Social Security numbers, and medical records were exposed for patients of hospitals running older Cerner systems.
How it happened: The attacker used stolen customer credentials to get into two old servers that had not been moved to Oracle Cloud yet, according to Oracle’s notices. The servers were on their way out; the attacker got there first.
4. Quest Diagnostics: The Lab Portal Half of US Doctors Use
Quest told the SEC on October 22 that someone accessed Quanum, the system clinicians use to order tests and pull results. Patient health data was involved, and the number of people affected is still unknown.
How it happened: Quest has not said. Lawsuits allege an employee opened a file carrying ransomware and that the data was not encrypted, which is unproven but sadly familiar. (This is Quest’s third major patient data incident, for those keeping score.)
5. Dexcom: A Few Phone Calls, Then Eight Lawsuits
The glucose monitor maker confirmed on October 10 that attackers reached internal documents “following targeted vishing events,” and at least eight lawsuits followed within days.
How it happened: Vishing, meaning phone calls from someone posing as a person the employee trusts. It is the same playbook that hit Charter and Carnival in June.
6. ETS: One Login, Four Months Inside California Student Records
Educational Testing Service, California’s state testing contractor, exposed records for every student enrolled in the past three school years.
What was exposed: – Names, birth dates, and home addresses – Disability status and statewide test results
How it happened: One compromised login reached an ETS file transfer server between May and September. Nobody noticed for four months, which is a long time for one password to go unquestioned.
Not sure if your business has exposure from any of October’s incidents? → Schedule a free security assessment with Rob.
What October Is Telling Us
Two patterns stood out: – Vendors were the way in. ConnectWise, ETS, and Oracle Health all came down to one credential at a company someone else trusted. – AI joined the attackers. Storm-0940 went from target to admin-level cloud access in under three hours, and Chainalysis was breached using what it called “offensive agentic techniques.”
Ask yourself the same three questions we come back to every month:
- Which third-party apps have admin access to your Microsoft 365, and when did anyone last check?
- If a vendor used one stolen password to get into your data, how long would it take you to notice?
- When a vendor reports an incident, do you know what to rotate, revoke, and review on your side?
If any answer is uncertain, that is where to start.
The businesses that don’t get breached aren’t lucky; they are prepared.
