The most recent cyber attacks hitting American organizations include confirmed data exposures at Uber, the University of Texas at Arlington, Amplifon Americas, and Baker Tilly, alongside major U.S. government actions against North Korean cryptocurrency theft schemes. These incidents, many disclosed or updated in early to mid-November 2026, affect drivers, students, patients, clients, and public services while highlighting ongoing risks from third-party vendors, ransomware, and sophisticated social engineering.
Uber Confirms Thousands of Drivers’ License Data Stolen via Vendor
Uber is notifying drivers that personal information, including driver’s license details, was accessed during an October 2026 incident at a third-party tech provider. The company received notice on October 9 that compromised credentials allowed unauthorized access to Uber data; its investigation confirmed the exposure by October 13. Notices began going out around November 10.
State filings show impacts including 2,567 people in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island, with additional drivers notified in California and other states. Uber has severed connections with the provider (identified in reporting as Fireworks AI) and is offering free credit monitoring and fraud assistance through Cyberscout. No confirmed misuse of the data has been reported so far.
University of Texas at Arlington Confirms Personal Information Accessed
The University of Texas at Arlington, which serves more than 41,000 students, disclosed that a cybersecurity incident discovered on October 26, 2026, involved access to personal information. The university is working with law enforcement and outside experts to determine whose data was affected and the exact scope. It will contact impacted individuals directly once identified.
MachForms, an online tool used for event registration, service requests, and surveys, remains offline. The Qilin ransomware group has claimed responsibility, though the university has not confirmed that attribution. Official updates are available on the university’s cybersecurity incident page: uta.edu/cybersecurity.
Amplifon Americas Discloses Health and Identity Data Exposure
Amplifon Americas, the Minneapolis-based U.S. arm of the hearing-care company, notified customers of a breach in which an unauthorized party copied files between January 18 and February 8, 2026. Suspicious activity was detected on February 11; a review completed on October 6 identified potentially affected data. Notices to state attorneys general and individuals followed in early November.
Exposed information can include names, contact details, dates of birth, driver’s license or other government ID numbers, hearing and medical information, service dates, and health insurance details. For some individuals, Social Security numbers and financial information were also involved. State filings list 85,804 Texas residents and 1,027 Vermont residents among those affected; some reports citing a Texas Attorney General filing reference a nationwide total exceeding 1.3 million. The company says it is not aware of fraudulent use of the data.
Baker Tilly Notifies Clients of Third-Party Vendor Breach
Accounting and advisory firm Baker Tilly began notifying clients that personal information was obtained from a platform operated by a third-party service provider. The firm became aware of the potential incident on September 6, 2026, completed its review on October 28, and issued notices around November 9–10.
Texas filings indicate 10,456 residents were affected, with exposed data including names, addresses, and Social Security numbers. Other state reports reference additional individuals, including dependents. Baker Tilly is offering two years of complimentary Experian IdentityWorks credit monitoring. The compromise was limited to the vendor platform; the firm’s own systems showed no evidence of intrusion.
FBI and DOJ Disrupt North Korean FaceStealer Crypto Scheme
In a major enforcement action announced in mid-November 2026, the FBI and Department of Justice disrupted infrastructure tied to North Korean hackers’ “FaceStealer” social engineering scheme. The operation has stolen more than $400 million in cryptocurrency over the past 18 months. Attackers use compromised accounts, secretly recorded webcam footage, and deepfakes to impersonate trusted contacts on imposter video-call platforms, then trick targets into installing malware.
Authorities seized cloud infrastructure and more than 900 webcam videos of victims in the crypto and Web3 industries. The FBI attributes the activity to North Korean groups tracked as Sapphire Sleet, APT38, BlueNoroff, and related names. Separately, the DOJ obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency linked to a larger Binance theft also attributed to North Korean actors. Details are available from the FBI: fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme and the Justice Department: justice.gov/usao-cdca/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency.
CISA Flags New Exploited Vulnerabilities; Ransomware Hits Public Services
On November 13, 2026, the Cybersecurity and Infrastructure Security Agency added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-114713 in UnrealIRCd and CVE-2026-123039 affecting Check Point products. Federal agencies must prioritize remediation of high-risk KEV entries on publicly exposed assets. CISA’s alert is here: cisa.gov/news-events/alerts/2026/11/13/cisa-adds-two-known-exploited-vulnerabilities-catalog.
In New York City, Queens Public Library continues recovering from a ransomware attack confirmed on November 4, 2026. The incident disrupted the website, mobile app, digital media services, and public computers across its 66 branches. As of mid-November, free Wi-Fi and checkout/return machines have been restored at open locations, and public computers are available at a handful of sites, but core digital services remain limited. All physical locations stayed open.
What These Attacks Mean for Readers and Practical Steps
These incidents underscore persistent third-party and supply-chain risks, the value of stolen identity and health data to criminals, and the effectiveness of social engineering even against technically aware targets. Driver’s license numbers, Social Security numbers, and medical records enable identity theft, tax fraud, and targeted phishing long after the initial breach. Crypto and open-source developer targeting by state-linked actors continues at scale.
Affected individuals should watch for official notices, enroll in any offered credit monitoring, and monitor accounts and credit reports. Place a fraud alert or freeze credit with the major bureaus if sensitive data was exposed. Be wary of unexpected video-call invitations or “audio fix” links, even from known contacts. Organizations should inventory vendor access, enforce multi-factor authentication, prioritize patching of known exploited vulnerabilities, and test incident response plans.
The pace of disclosures and enforcement actions is unlikely to slow. Readers should continue monitoring official channels from CISA, the FBI, and affected organizations for updates on these and new incidents.
Share your experiences with recent data breach notices or questions about protecting your information in the comments—staying informed helps everyone respond faster.