Tech News Briefing — Tuesday, October 20, 2026

The stories IT students and working techs are talking about today — a Google Cloud outage knocks UK banks offline, a hacker uses AI agents to break into 100+ company websites, Microsoft treats agents as insider threats, ConnectWise suspends cloud services after app-identity abuse, a California student data breach widens, and BCG says finance is among the world's most AI-exposed industries. Each story includes why it matters for your certification studies.

1. Google Cloud outage hits europe-west2 — UK banks, Revolut and retailers down

Google Cloud is experiencing a multi-service outage in its europe-west2 region (London), and the blast radius hit consumer-facing services across the UK this morning. Revolut confirmed card payments, transfers, ATM withdrawals, sign-ins, and crypto and stock trades were all down; Lloyds Bank, Bank of Scotland, HSBC, Rightmove, Royal Mail, DPD, and the budgeting app Emma also reported problems, with Downdetector showing spikes from around 7am UK time. Google's status page listed dozens of affected products — including BigQuery, Cloud Run, Google Kubernetes Engine, Cloud SQL, Cloud Spanner, Cloud Storage, and Cloud Load Balancing — and said its engineers were investigating elevated errors and intermittent network failures. Google suggested impacted customers could try migrating workloads to another region if feasible. Revolut told customers their money and data were safe; the disruption was about access, not fund safety.

Source: Neowin coverage, Oct 20, 2026 · Glasgow Times/Revolut statement

2. One hacker's AI agents broke into more than 100 company websites

A Reuters investigation published October 19 reports that a Chinese-speaking hacker used AI agents running on Cairn — an open-source platform for coordinating agents to solve tasks with minimal human guidance — to break into more than 100 company websites, including those of farm equipment maker Deere, appliance maker SharkNinja, and engine manufacturer Cummins. Cybersecurity researcher Snorre Fagerland of AI security firm NorForge discovered the campaign while scanning the internet for exposed Cairn deployments, and Reuters independently identified the victims. The hacker reportedly described intrusion tactics in fewer than 100 Chinese characters; the agents then attempted breaches on more than 1,200 websites, with successful intrusions taking about 23 hours of automated probing each. The campaign is believed to have used DeepSeek and Anthropic's Claude Code, costing an estimated $5,000 in AI tokens — roughly $50 per successful breach. Deere said it had taken remediation actions with no indication sensitive information was accessed; SharkNinja said a standalone product-support site was hit and the threat contained.

Source: Sofx summary of the Reuters report · DigiSoul Hub analysis of the NorForge report

3. Microsoft treats AI agents as "agentic insiders" with new security controls

Microsoft announced on October 19 new enterprise controls aimed at AI agents running inside company environments, arguing organizations should treat these agents as insiders rather than trusted software. The controls extend Project Perception, Microsoft's agentic security system, and include Dynamic Agent Risk (a continuously updated risk score per agent, drawn from identity, data, endpoint, cloud, network, and runtime signals), Dynamic Permissions (agents start with minimal or no permissions, with access granted per task and high-impact actions requiring human review), Dynamic Conditional Access (stepped restrictions as risk rises), and new "Guardian Agents" that supervise other agents. Microsoft's Defender can now detect up to 60 types of AI agents on employee devices — up from 25 — including Claude Code, OpenAI's Codex, and GitHub Copilot. Microsoft security chief Hayete Gallot wrote that frontier models "cannot be trusted" because they are trained to get results rather than follow organizational norms; CEO Satya Nadella separately urged companies to keep safeguards outside the model itself.

Source: SecurityWeek, Oct 20, 2026 · eSecurity Planet

4. ConnectWise suspends Cloud Backup after attackers abused app identities to reach Microsoft 365

ConnectWise has suspended its Cloud Backup service (formerly SkyKick) and temporarily taken its SaaS Security and Cloud Management services offline after attackers gained unauthorized access to seven of the company's application identities and used them to reach customers' Microsoft 365 tenants. The attackers impersonated trusted applications and requested access tokens from Microsoft Entra ID, reaching services like Exchange Online, SharePoint, Teams, and directory data — a path that bypassed multi-factor authentication because application identities don't go through MFA. ConnectWise detected the activity through internal monitoring on October 14, disabled the affected identities on October 17, and revoked the applications' certificates. Huntress observed suspicious login activity from the IP 144.172.64.128 across roughly 1,000 Microsoft Entra tenants, with about 300 successful sign-ins (successful login does not necessarily mean data was accessed in every tenant). Microsoft called it an "active supply chain attack." ConnectWise says existing backup archives remain encrypted, isolated, and preserved, with no evidence they were breached — but scheduled backups are not running and archive/restore access is unavailable. Customers have been told to review service-principal sign-in logs, app roles, secrets, and certificates created since October 13.

Source: ThaiCERT advisory, Oct 20, 2026 · The Hacker News

5. California student data breach traced to a compromised SFTP login, active May through September

California's Department of Education announced on October 16 that Educational Testing Service (ETS) — the nonprofit contracted to administer statewide student assessments — has begun notifying families after unauthorized access to an ETS-operated secure file transfer (SFTP) site. Investigators found that an unauthorized party used a compromised login credential between May 22 and September 18, 2026, to copy files; ETS detected the activity on September 25. The affected population is large: records of students enrolled during the previous three school years, and even some former students whose transfers were never confirmed dating back to 2006. Compromised fields can include name, date of birth, home address, school, district, grade level, student IDs, gender, race/ethnicity, primary language, disability and accommodation status, and assessment results. Social Security numbers, driver's license and passport numbers, financial account data, and passwords were not involved. ETS says it has found no evidence the data has been made public and has rebuilt the SFTP site with enhanced controls. No total victim count has been published, but California enrolled more than 5.7 million public-school students in 2025–2026 alone.

Source: California Department of Education notice via Irvine Unified · SecurityWeek, Oct 19, 2026

6. BCG: finance and IT are the world's most AI-exposed industries; Canada named an AI Pioneer

Boston Consulting Group released its AI Maturity Matrix 2026 report today (titled "AI Is Transforming How Economies Develop and Compete"), covering 75+ economies across 33 indicators. Two headline findings: AI exposure is greatest where AI is already most capable — the most exposed sectors are information and communication, high-tech goods, retail, financial services, public services, and motor vehicle manufacturing — and execution speed, not ambition, now separates AI economies. Canada was confirmed as one of nine "AI Pioneer" economies, the top tier in BCG's ASPIRE readiness framework (Ambition, Skills, Policy and regulation, Investment, Research and innovation, Ecosystem), alongside the US, UK, Singapore, and Mainland China. New entrants to the top tier since BCG's 2024 edition are Japan and South Korea; eight economies moved up a tier overall. BCG's takeaway: AI has moved from potential to proven economic value, and governments that turn strategy into coordinated action are capturing the gains.

Source: Wealth Professional coverage, Oct 20, 2026 · BCG's own report summary