Black October: who holds the keys to your clients' PII?

Yarin Vaknin

CTO at Corsa

Oct 26, 2026

In short: Most of the data lost in Black October left because attackers reached keys and credentials, not because anyone broke the encryption. The vendors that hold your clients' identities, KYC providers included, are getting easier to breach every month. With BYOK or HYOK, the key to your clients' data stays with you, so a breach at your vendor doesn't have to become a breach of your clients' data. Corsa is one of the first compliance platforms to offer both.

Between October 19 and 22, 2026, a pile of serious security disclosures landed at once: a remote-code-execution bug in PHP, a poisoned AI library, a certificate authority with keys an AI agent could guess, and two cloud platforms telling customers their secrets were exposed. By October 23 the press had a name for it: Black October. It didn't stop there. By the end of the month, nine AI developer platforms had admitted breaches, a prediction market and an Indian exchange had lost user funds, and on October 29 attackers took about $6.3 billion from Binance hot wallets.

Most of the coverage is about patching, and that's the right first reaction. But compliance teams at crypto and fintech companies should take away something else: where your customers' personal data actually lives, and who holds the key to it.

Your clients' names, government ID numbers, emails and addresses don't only sit in your own database. They sit with your KYC provider, your screening tools and your compliance platform. Most of those vendors encrypt the data and hold the key themselves. That puts the weight on how well each vendor guards its keys.

At Corsa, all data is encrypted at rest and in transit as standard. On top of that, customers can add field-level encryption to their clients' most sensitive fields, in one of three tiers: Corsa-managed keys, BYOK (bring your own key) or HYOK (hold your own key). We decided to build the customer-held tiers before Black October. The week showed why having the choice matters.

What happened

Black October was a wave of disclosures more than a wave of new attacks. SecurityToday found many of the attacks had been running for weeks or months before anyone announced them. These are the incidents that matter most for anyone holding personal data:

Meta Muse shared links (Oct 23). More than 6,800 links to private AI conversations were indexed and opened with no login, exposing bank transaction details, loan applications and work calendars.
PHP2Shell (Oct 21, CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Unauthenticated remote code execution in every PHP release back to 5.4, found with frontier AI models in August. Amazon saw exploit attempts on October 17, four days before the patch. PHP runs about 70% of websites, and a server takeover means the databases behind it too.
Railway (Oct 21). Attackers reached the systems that store customer secrets. Encrypted environment variables may have been accessed, and some decrypted. Railway paused deployments and told all customers to rotate everything. Wiz later traced the October 20–22 intrusion to privilege escalation in Railway's build infrastructure.
LiteLLM 1.107.0 (Oct 21). A stolen maintainer token pushed a malicious release to PyPI and Docker. In about two hours live, it harvested browser, cloud, Kubernetes and SSH credentials from every machine that installed it.
GitLab (Oct 21, CVE-2026-110264, CVSS 10.0). Unauthenticated remote code execution on self-managed instances, putting source code and the secrets stored next to it at risk.
Zeabur (Oct 20–22). Internal credentials were stored in plaintext, and admin tokens hadn't been rotated since January 2024. Attackers took 321,810 accounts and about 3.2 million environment-variable records. Zeabur will shut down on December 31.
eMudhra (Oct 17–20). Eight intermediate certificate authority keys were so weak that local AI agents recovered one on the first try. Browsers removed trust, and about 30,000 certificates need replacing.
ETS / California Department of Education (Oct 16). A compromised SFTP login let attackers copy records of every California public-school child of the last three years, including disability status: more than 5.7 million students.

The wave kept growing through the rest of the month:

Nine AI developer platforms (Wiz report, Oct 30). Wiz tied Railway and Zeabur to a wider set of breaches at platforms that hold their customers' secrets: Fireworks AI, Andromeda, Lightning AI, OpenCode, Warp, CommandCode and Northflank as well. In two cases, stolen enterprise keys were tested within 30 minutes of the vendor breach and then used for about 800,000 and 1.7 million Amazon Bedrock calls, more than $100,000 at list price.
Northflank (Oct 30). Told customers to assume their environment variables had been decrypted and their secrets stolen. Customers confirmed their AI API keys were used without permission.
OpenCode Console (Oct 16–17). OpenAI, Anthropic and Google API keys stored in the console were exposed for 1.4% of its users over at least 48 hours. Some users woke up to more than $1,700 in charges.
Warp (detected Oct 23). Attackers came in through a third-party vendor and exposed AI agent decision logs and telemetry for about 1% of more than 800,000 users.
Polymarket (Oct 29). A hijacked DebugBear monitoring script on the international site drained users' crypto wallets. About $2.5 million was traced to the attacker, and Polymarket halted trading for an hour and promised refunds.
CoinDCX (Oct 20, confirmed Oct 25). About $16 million in USDT was drained from retired deposit and hot wallets left over from its July 2025 hack, after the service that swept them stopped working. Users had kept depositing to the old addresses.
Sony So-net and plala (disclosed Oct 27). About 2.59 million customer records were accessed, including 54,401 email addresses with their passwords.
State Bank of India (Oct 16–21). About 375,000 records appeared on the dark web, 3,897 of them with customers' personal data.
TiDB Cloud (reported Oct 19). A misused internal service account exposed account emails, saved SQL queries and encrypted API keys. Customer databases weren't affected.
OVHcloud CLI (Oct 19). Releases 0.11.0 to 0.15.0 shipped binaries that stole secrets from disk, live for 94 minutes.

Then, on October 29, attackers drained about $6.3 billion from Binance hot wallets, the largest crypto theft on record. Fortune and others count it as the culmination of Black October. It's a different kind of attack, about signing keys rather than PII, so we cover it in a separate post: The $6.3B Binance hack: stop it before the signature.

October also brought a joint FBI, CISA and international advisory on the SafePay ransomware group, with at least 600 victims, and breach notices for older incidents such as Paradigm Healthcare (more than 970,000 people's names, birth dates and Medi-Cal numbers).

The pattern: nobody broke the encryption

Look at how data actually left these companies. In almost every case, nobody broke the encryption. Attackers got hold of something that could use the key.

Plaintext credentials. At Zeabur, admin tokens stored in plaintext and never rotated opened every account at once.
Keys next to the data. At Railway and Northflank, secrets were encrypted, and some were still decrypted, because the attacker reached the system that held both the data and the means to decrypt it.
Stolen access. LiteLLM's malicious release existed to steal cloud credentials. The California student data left through one compromised SFTP login. The AI API keys stolen from developer platforms were in use within 30 minutes.
Bad keys. eMudhra's certificates were encrypted with keys so weak they offered almost no protection.
Forgotten keys. CoinDCX lost $16 million from wallets it had retired but whose keys still worked and whose addresses still received deposits.

AI is shrinking the time between a bug and its exploit. Wiz says frontier models lowered the bar for proving PHP2Shell could be exploited. Cloudflare's CEO reported exploit attempts going from thousands before the announcement to millions after it. Rapid7 found that severe vulnerabilities in the third quarter were exploited an average of three days after disclosure.

So encryption at rest is the minimum. What decides how far a breach spreads is how the keys are guarded and who can use them.

Your KYC vendor is a bigger target than ever

Black October hit the companies that hold other companies' secrets: deployment platforms, AI developer tools, a cloud database, a monitoring script running inside a trading site. Your KYC provider is the same kind of target, and a richer one. It holds passports, ID numbers, selfies, proof-of-address documents and screening results for every company it serves. One breach there exposes your clients and everyone else's.

Three things from this month make that risk grow:

Exploits come faster. AI is cutting the time from a bug to a working exploit to days. A vendor that patches monthly now has a long window of exposure.
Attacks come through the vendor's vendors. Warp was breached through a third-party provider, and Polymarket through a monitoring script. Your KYC provider has its own suppliers, and each one is a way in.
Stolen keys get used in minutes. The keys taken from AI developer platforms were in use within 30 minutes. Once an attacker has a vendor's keys, there's no time to react.

You can't audit every vendor's patch cycle or supply chain. You can decide who holds the key. If your clients' data is encrypted under a key you control, a breach at your vendor gets the attacker ciphertext. With BYOK you can switch the key off the moment you hear about a breach. With HYOK, the vendor never had the means to decrypt in the first place.

Our decision: three tiers, and honesty about each

Corsa runs transaction monitoring, screening and case management for crypto and fintech companies, so we hold some of their most sensitive client data. Customers kept asking us one question: if Corsa is breached, what happens to our clients?

Every workspace gets standard encryption at rest and in transit. For sensitive client fields, the right answer differs between customers, so we offer three optional tiers of field-level encryption.

Corsa-managed keys: an extra layer, nothing to manage. Sensitive fields get their own layer of encryption under keys Corsa holds and guards, and every feature works. It fits teams that want field-level protection without running any key infrastructure.
BYOK: own the key, keep every feature. Some banks, auditors and frameworks such as DORA and NYDFS Part 500 look for key ownership and the ability to revoke access. They don't require you to decrypt the data yourself. BYOK keeps fuzzy sanctions screening, rules and AI investigation on every field.
HYOK: stored PII unreadable to Corsa. For a few fields, such as government ID numbers, some customers accept fewer features in exchange for Corsa not being able to decrypt what it stores.

Customer-held keys are common in cloud infrastructure and banking, but rare in compliance software. Most transaction monitoring, screening and KYC platforms still hold every key themselves. Corsa is one of the first compliance platforms to let customers hold the key to their clients' data, and, with HYOK, to keep sanctions screening, rules and case management running on data Corsa itself can't read.

That takes a security-first engineering team. Corsa's engineers come from security and cryptography backgrounds, and we design for the case where Corsa itself is breached: keys apart from data, fail-closed defaults, audited controls under SOC 2 Type II, regular penetration tests and releases you can verify. BYOK and HYOK are what that thinking looks like when you hand the key to the customer.

We made three decisions along the way:

Fail closed. If your key is revoked or your HYOK stack is unreachable, protected fields show as masked. Corsa never falls back to a different key.
Publish the trust model, including the gaps. HYOK isn't magic, and we say exactly where Corsa can still learn something. You'll find the details in the next section.
Make the code you run verifiable. HYOK runs in your AWS account, so you shouldn't have to take our release on trust. After a week in which a poisoned release of a popular library stole credentials, this one matters more than ever.

How it works

Every workspace starts with standard encryption: all data is encrypted at rest (AES-256) and in transit (TLS 1.2 or later). The three optional tiers add field-level encryption for sensitive client fields: names, government ID numbers and contact details. They differ in who holds the key.

Standard for every workspace

Databases, object stores and backups are encrypted with AES-256. Keys live in a dedicated key management service, apart from the data, and rotate automatically. Application secrets and credentials sit in a dedicated secrets manager, never in code, config files or environment variables. Services talk to each other over mutual TLS. An independent auditor checks these controls under SOC 2 Type II.

Corsa-managed keys: an extra layer, nothing to manage

Sensitive client fields are encrypted one by one, on top of the standard encryption, under keys Corsa holds. There's nothing to run on your side, and you keep every feature: fuzzy sanctions and PEP screening, rules on any field, AI investigation and plaintext exports. If Corsa were breached, the keys sit in a separate key management service, behind controls audited under SOC 2 Type II.

BYOK: your key, every feature

You create one AWS KMS key from a template the Corsa app prefills for your workspace. Its policy lets Corsa use the key only for your workspace's data. Each protected field is encrypted with AES-256-GCM and bound to its workspace, record type and field. You get a kill switch, a key policy scoped to your workspace and a CloudTrail record of every key use.

If you disable the key, protected fields show as masked, and writes to them fail. Corsa's cached data keys expire within 5 minutes. Nothing is lost: re-enable the key and Corsa resumes. BYOK doesn't hide plaintext from Corsa while your key allows access, because screening and rules need to read it. What it gives you is ownership, a full audit trail and an off switch.

HYOK: decrypted only on your side

You install one CloudFormation stack from the Corsa app. Corsa stores only ciphertext and a keyed search index. To see a value, your user signs in to your own sign-in (passkeys or your identity provider), and the value is decrypted in their browser, through a Secure Viewer hosted in your AWS account. The plaintext isn't sent back to Corsa.

HYOK decryption flow: Corsa's access check issues a short-lived token, your sign-in and your KMS key in your AWS account unwrap the data key, and the browser decrypts the value

Corsa can't decrypt alone, because the key and the sign-in are in your account. Your users can't decrypt alone either: they also need a token Corsa issues only after its access check. Every unwrap, allowed or denied, is logged in your AWS account.

We're specific about HYOK's limits, and you should be too:

Exact match only. Search and sanctions screening on encrypted names use a keyed hash, so they miss typos and transliterations such as Mohammed and Muhammad. If you need fuzzy screening on names, choose BYOK or keep names unencrypted.
Low-entropy values can be guessed. The search index uses a per-workspace salt that Corsa holds. Corsa can't reverse it, but it could test guesses, which is practical for short values such as phone numbers.
Corsa-run KYC integrations pass through Corsa. Data from integrations such as Sumsub or Persona is encrypted with your public key on arrival, but it passes through Corsa's memory first. Encrypt with the Corsa SDK before sending if that matters to you.
You can verify what you run. Every HYOK release is signed and reproducible. You can read the source in the app, check the signature offline and confirm the stack in your account runs that exact release.

Coverage keeps growing

BYOK and HYOK protect clients' names, government ID numbers and contact details today. We're extending them, release by release, to all customer data, including KYC documents, attachments, case notes and investigation files, so everything you hold about a client sits under your key. Every extension ships with the same guarantees: fail closed, logged in your account, and verifiable.

What to do now

Patch first. Then ask every vendor that holds your clients' PII, Corsa included, five questions:

Who holds the key to my clients' data: you or me?
Can I revoke your access myself, without opening a ticket?
Can I see every time you use the key?
What happens to my data if your key store or admin accounts are breached?
Can I verify the code that touches my key?

If you're a Corsa customer, you don't need to change anything: your data is encrypted at rest and in transit today. If you want field-level encryption on your clients' sensitive fields, a workspace Owner can choose a tier under Settings → Encryption. Corsa-managed keys add that layer with nothing to run on your side. BYOK takes one KMS key in your AWS account and keeps every feature. HYOK takes one CloudFormation stack and suits identifiers you never need to screen fuzzily, such as ID numbers. Your Corsa representative can help you weigh the trade-offs.

Black October won't be the last month like this, and the next breach may be at a vendor you've never heard of. If you hold sensitive client data, we recommend BYOK at a minimum and HYOK for identifiers you never need to screen fuzzily. Either way, a breach at your vendor, Corsa included, doesn't have to become a breach of your clients' data.