CEO News: October 2026

This month, I have spent a great deal of time reflecting on the trust you place in TWINO and the responsibility that comes with it. Our recent security incident, which involved unauthorised access to limited amount of investor data, has weighed heavily on me. I know this has caused concern, particularly for those affected, and I want to offer my sincere apology. Protecting the information you entrust to us is a responsibility I take personally.

Those steps matter, but I also recognise that reassurance about financial activity does not remove the concern about personal information. Your data deserves protection in its own right. As CEO, I take responsibility for how we respond and for making sure the lessons from this incident lead to lasting improvements.

In August, I wrote about preparing for difficult scenarios and how trust becomes meaningful when circumstances do not go according to plan. This month, that responsibility feels especially personal.

We are living in a new security reality. Artificial intelligence is helping people build software, analyse information and solve problems faster. Those capabilities are also available to attackers. The UK’s National Cyber Security Centre has warned that AI is making parts of cyberattacks more efficient, including researching vulnerabilities and developing ways to exploit them. It also expects the time available to address newly disclosed weaknesses to shrink further. (NCSC assessment)

For companies holding personal information and providing financial services, this raises the standard we must meet. Security has to keep pace with attackers’ capabilities, and our own experience revealed an unexpected challenge. The attacker used AI during the incident, and we also used AI to support our defense. Yet some of the most advanced models initially restricted the help they would provide, requiring us to explain and justify the defensive purpose of our requests. I understand why these safeguards exist, but encountering that friction while responding to an actual attack was sobering. It highlighted a difficult imbalance: safeguards intended to prevent misuse can also slow legitimate defenders. That is a challenge AI developers and security teams need to address together, while our responsibility for protecting investors remains firmly with us.

October has brought several reminders of the scale of this challenge. The vulnerabilities known as PHP2Shell affected PHP, software used to run many websites and online services. On 21 October, the PHP team released urgent security updates for two critical weaknesses that could allow attackers to run code on vulnerable servers without logging in. For me, this is a reminder of how much security depends on the software underneath a service, including components that its users never see. (PHP security advisory)

Closer to home, reports in Lithuania this month revealed that travellers personal information, including names, contact details, passport information and travel histories, had appeared on a Russian black market. The reports linked the exposure to a wider incident involving Tez Tour systems, with around 395 million records reportedly affected. That figure refers to records, rather than individual travellers, and the scope remains under investigation. For me, this illustrates how personal a data breach can become: information shared when booking a holiday can create concerns that last long after the trip itself. (LRT reporting)

Then, on 29 October, Binance reported a major security incident with an estimated impact of around $6.3 billion. At the time of writing, the investigation and efforts to freeze affected assets are continuing, so that figure should not be treated as a final unrecovered loss. (Associated Press)

These incidents differ in their causes and consequences. They reinforce my conviction that security requires constant attention, but they do not lessen our responsibility for what happened at TWINO. The broader environment makes it even more important that we learn, adapt and strengthen our protection.

There are also practical steps each of us can take to reduce our exposure. After a data breach, particular care is needed with unexpected messages - criminals can use personal details to make an email or phone call sound convincing. Knowing your name, or knowing which platform you use, does not prove that someone represents that company, so be careful.