Black October Never Ended: Financial Trust Is Still Breaking

TL;DR

• Between 14 October and 8 November 2026, financial institutions and regulators across five countries faced data breaches, a crypto-exchange theft, a bank-resolution process, a cyber heist and tighter payment-security requirements.

• South Korea confirmed data-breach incidents at 16 companies with approximately 100,000 pieces of customer data involved. Brazil's Mercado Bitcoin suffered substantial on-chain outflows. Paraguay's Ueno Bank entered resolution after its solvency ratio fell below the legal minimum. France's Crédit Mutuel Arkéa reported approximately €100 million stolen. India's RBI issued consolidated cyber-resilience directions including six-hour incident reporting.

The Black October analysis showed how software, identity and cryptographic failures can expose weaknesses across the digital ecosystem. These five events were not one connected campaign, but they share a common requirement: resilience across technology, governance and the cryptographic foundations on which digital trust depends.

14 October: South Korea

South Korea's FSC reported data-breach incidents at 16 financial companies, with approximately 100,000 pieces of customer data involved, including names, contact details, resident registration numbers and email addresses. The FSC said no hacking-related breach involving account passwords or credit-card numbers had been reported at the time of its 14 October update. Separately, 130 of 555 companies completing a 12-point cybersecurity checklist reported areas requiring improvement, mainly relating to security patches and control systems; the FSC did not identify these findings as specific to the 16 affected firms. Authorities were investigating whether AI had been used; this had not been established as fact.

2 November: Brazil

Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals after wallets were drained across multiple blockchain networks. The exchange said no data breach had occurred and that it would cover affected customer losses. In an on-chain investigation, Bitquery estimated approximately US$48.6 million had left wallets across 11 blockchains, with 36,042 Ethereum customer deposit addresses emptied and activity continuing for about four hours after the exchange said the attack was contained. The US$48.6 million is Bitquery's independent on-chain estimate, not a loss confirmed by the exchange.

2 November: Paraguay

Paraguay's central bank began a resolution process for Ueno Bank after finding its solvency ratio had fallen below 50% of the legal minimum. This was a solvency event, not a cyberattack. Accounts belonging to nearly three million customers were frozen. By 7 November, 1.2 million customers had received partial or full reimbursement. On 6 November, the Senate voted to remove President Santiago Peña after Congress rejected his resignation and proceeded with impeachment. On 7 November, prosecutors charged Peña with breach of trust; allegations remain under investigation, and Peña has denied wrongdoing.

4 November: France

Crédit Mutuel Arkéa reported that hackers stole approximately €100 million through fraudulent transactions using a bank account. Customer assets were not affected. Reuters reported a third-party service provider's platform was used in the attack; the provider was not identified and the reporting does not establish it as the confirmed entry point. French prosecutors opened an investigation. For financial institutions, the question is how third-party platforms and associated access paths are identified, monitored and included in risk assessments.

5 November: India

On 5 November, the Reserve Bank of India published consolidated 2026 Master Directions on Cyber Resilience and Digital Payment Security Controls for authorised non-bank Payment System Operators, bringing together directions first issued on 30 July 2024. Specified incidents must be reported to the RBI within six hours of detection, with cybersecurity incidents also reported to CERT-In. The directions apply immediately for large and medium non-bank PSOs; small PSOs are covered from 1 April 2028.

8 November: AI Infrastructure Faces a Market Question

Moneycontrol reported on 8 November, citing NSDL data, that FPIs had invested ₹38,971 crore in Indian equities over the preceding week amid a global technology and AI-stock sell-off attributed to concerns about AI-related investment and a possible slowdown in data-centre spending. This market movement was not connected to the cyber incidents above, but raises a timely question: as AI infrastructure expands, are its cryptographic controls being assessed alongside its compute capacity?

The Longer Question: Can Today's Cryptography Protect Tomorrow's Data?

Harvest now, decrypt later (HNDL) describes collecting and retaining encrypted data today, with the intention of decrypting it when a capable quantum computer becomes available. It applies to quantum-vulnerable encrypted data, not to every record exposed in a breach.

NIST published its final Interagency Report 8547, Transition to Post-Quantum Cryptography Standards, on 27 October 2026, setting 2035 as the primary target for US federal systems. Executive Order 14412 sets earlier targets for specified high-value federal systems: 2030 for key establishment and 2031 for digital signatures. These are US federal timelines, not universal deadlines.

India's DST/National Quantum Mission published its Quantum-Safe Ecosystem in India roadmap in May 2026. For Critical Information Infrastructure: 31 December 2027 for foundations, 31 December 2028 for high-priority systems and 31 December 2029 for full PQC adoption. For other enterprises: 31 December 2028, 31 December 2030 and 31 December 2033. The roadmap places BFSI among sectors with accelerated CII timelines; this should not be assumed to apply automatically to every financial institution.

What Financial Institutions Should Prioritise Now

The migration guidance from NIST and India's National Quantum Mission points to a practical sequence:

• Build a cryptographic inventory: map every algorithm, key, certificate, application and third-party service relying on cryptography.

• Identify quantum-vulnerable dependencies: locate where public-key cryptography is used for key establishment, authentication and digital signatures.

• Prioritise long-lived sensitive data: assess which information must remain confidential for years, as HNDL risk applies to encrypted data that may be retained for future decryption.

• Sequence migration by risk and criticality, test post-quantum and hybrid approaches, and build crypto-agility and supplier accountability into procurement and migration planning.

QNu positions QShield 2.0 as the platform underlying its National Cryptographic Assessment and Assurance Framework, with capabilities described as cryptographic asset discovery, risk assessment, crypto-agility and assurance. QNu says its AI Security module extends cryptographic assurance to AI models, training pipelines and autonomous agents. These are QNu's stated product capabilities, not an independent assessment.