Paid media
Social media
SEO
AI automation
Web design
AI content
Branding
Lumia MKT Team
The last two weeks brought a string of cyberattacks that nobody in the digital world could ignore. Binance suffered the largest crypto theft in history, Polymarket had to pause trading, DreamHost forced customers to reset their passwords and Applebee's exposed customer data through a password left inside its app. All of this came right after PHP2Shell, the flaw that put millions of websites on alert.
The size of the hits is not the most interesting part. Almost none of them came through the front door. Attackers got in through a vendor, an API key, a reused password or a conversation with someone who seemed trustworthy. Those same doors exist in any small or midsize business. Here is what happened in each case, in plain language, and what you can do this week to keep the lights on in your business.
Recap: the cyberattacks that defined October and November 2026
| Platform | What happened | How they got in |
|---|---|---|
| Binance | Reported theft of about US$6.3 billion in crypto assets (October 29) | Social engineering with fake job interviews, malware and compromised internal tools |
| Polymarket | More than US$2.5 million drained in minutes; trading paused | A compromised third-party provider |
| DreamHost | FTP/SFTP and some webmail credentials exposed; forced password resets | A flaw in third-party software behind its file manager |
| Applebee's | Customer database reachable (names, emails, phone numbers, birth dates) | A password written inside its app's code |
| Public services | Outages and leaks at government portals in Moldova, Belgium and Florida's education system | Direct attacks on portals and identity providers |
Binance: the biggest heist in history started with a fake interview
On October 29, 2026 Binance confirmed an attack in which crypto assets worth about US$6.3 billion were taken, according to public reports, the largest crypto theft on record. The FBI linked it to groups tied to North Korea that are known for targeting financial platforms.
The most striking part is how it began. As reported, the attackers used fake recruitment processes: they contacted people in the industry with job offers, invited them to "technical tests" and installed malware along the way. From there they moved on to internal tools, including AI tools, that had access to the transaction signing systems.
Binance said it is covering user losses, managed to freeze or intercept a significant share of the funds and, on November 5, preventively deleted the API keys linked to an external platform. Its founder urged users to revoke third-party API keys they do not use and to turn on IP whitelisting.
Polymarket: when the problem is a vendor's code
That same October 29, the prediction market platform Polymarket switched to cancel-only mode after more than US$2.5 million was drained within minutes. The company explained that one of its third-party providers had been compromised, found and fixed the cause, brought the platform back and said it will reimburse affected traders.
This is known as a supply chain attack: they do not attack your site, they attack something your site uses. A plugin, an analytics script, a chat widget, a payment gateway, a library. If that third party falls, you fall with it.
DreamHost: hosting passwords exposed
On October 23 DreamHost, one of the best-known hosting providers in the United States, detected unauthorized access to its web file manager. The attackers exploited a flaw in third-party software and were able to see FTP and SFTP usernames and passwords, plus credentials for a limited number of webmail accounts. The company said the incident was not related to PHP2Shell.
DreamHost forced resets on the affected passwords and asked customers to do three things that apply to any business: also change passwords on other accounts that used the same or a similar one, check website files for changes they do not recognize, and review the forwarding rules on their email. That last point is key: an attacker who gets into your inbox will often create a silent rule to receive a copy of everything.
Applebee's: a password forgotten inside the app
In late October a researcher found, with help from AI, that Applebee's Android app had a database password written inside its code. With it, anyone could look up customer information: names, emails, phone numbers, birth dates and approximate locations. The company fixed the problem on October 29 and says it has found no evidence of unauthorized access, although the investigation is still open.
This mistake is more common than it seems. API keys pasted into a web page, passwords in a public configuration file, WhatsApp or payment gateway tokens inside a form. AI makes finding them faster every day, for researchers and criminals alike.
Not just giant platforms: governments and companies everywhere
The wave did not stay in the United States. In Europe, Moldova reported more than 80 public service websites offline and Belgium had to take its tax portal down. In Japan, the disaster alert system was abused to send phishing messages. In Latin America the media has followed the Binance case closely because of its impact on users in the region, while security firms warn that AI is speeding up the way criminals prepare their attacks.
The takeaway is simple: attackers are not only after the big players. They look for whoever leaves a door open, and small businesses usually have more open doors because nobody is watching them.
7 lessons your business can apply this week
We reviewed every case and they all come down to the same basic gaps. This is the list we use with our clients:
- Turn on two-step verification for email, hosting, your domain, Meta Business, Google Ads and banking. If a password is stolen, the second check saves you.
- Use a different password for every service, stored in a password manager. The DreamHost case shows why: one reused password opens every door.
- Inventory your vendors and plugins. Remove what you do not use: old scripts, connected apps, test integrations. Every third party is a possible way in.
- Revoke API keys and access you no longer need. Check which apps have permission over your email, Drive, Facebook page and online store. Do the same for former employees and previous agencies.
- No passwords inside the code. If you have a custom website or app, ask your developer to confirm that keys live in protected server files, not in code the browser can see.
- Train your team against social engineering. Job offers, urgent invoices, "tech support" or messages from "the boss" asking for payments. Golden rule: verify through another channel before you click, pay or install.
- Backups and a response plan. Daily backups stored off the server, and a clear list of who does what if something happens. Also review your email forwarding rules.
What this has to do with your digital marketing
A lot. Your website, your forms, your WhatsApp Business, your ad account and your customer base are marketing assets. If an attacker takes over your Facebook page, you lose years of community. If they get into your Google Ads account, they can burn your budget in minutes. If your form leaks data, you lose the trust that took so long to earn, and privacy laws make you answerable for it.
That is why at LumIA MKT we build websites with forms protected against spam and bots, keys kept out of public code, up-to-date servers and least-privilege access. See how we do it in our web design and development service or our marketing automation service, where integrations are designed with security in mind from day one.
FAQ about the recent cyberattacks
Is a small business really a target? Yes. Most attacks are automated: a program scans thousands of sites looking for weak passwords, outdated plugins or exposed keys. They do not pick you, they pick the open door.
What is a supply chain attack? It is when the attacker gets in not through your system but through a vendor you use: a plugin, a connected app or an external service. That is what happened to Polymarket.
What is an API key and why does it matter? It is a digital key that lets one tool connect to another, for example your store to your payment gateway. If someone gets it, they can act on your behalf. That is why keys must be stored safely and unused ones revoked.
How do I know if my email was compromised? Check recent sign-ins, forwarding rules and filters. If you see something you did not create, change the password, sign out of all sessions and turn on two-step verification.
My hosting is DreamHost, what should I do? Follow the provider's instructions: change your FTP, SFTP and email passwords, change them on any other account where you used the same one, and check your site for modified files.
Shall we shine a light on your digital security?
If you are not sure who has access to your website, email or ad accounts, or when your last backup was, now is the time to check. In a free 30-minute strategy session we review the most exposed points of your digital presence with you and tell you what to fix first. Shall we review it together this week?
Sources: Emol, FBI and Binance · Diario del Sur · The Block, Polymarket · BleepingComputer, DreamHost · WebHosting Today, DreamHost · Malwarebytes, Applebee's · This Week in Security. Information current as of November 6, 2026; figures may change as investigations continue.
