Hackers warm supermarket fridges in at least 11 European countries and reach British meat suppliers, and the EU plans a joint response

The stories

24 stories on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   Hackers warm supermarket fridges in at least 11 European countries and reach British meat suppliers, and the EU plans a joint response

   11

   European countries where shop fridges were hacked on Monday

   Germany, Romania and Britain reported theirs on Tuesday [1]

   1,825 to 220

   Danfoss fridge control pages in France open to the internet, before and after October

   counted by Censys, which scans the internet [5]

   50C

   the temperature some hacked freezers reached

   shops binned food worth hundreds of thousands of euros, some said [3]

   What happened

   • Hackers warmed supermarket fridges and freezers in at least 11 European countries on Monday, officials say. [1]
   • Germany, Romania and Britain reported their cases on Tuesday, a day after nine EU countries did. [1]
   • "These are not isolated incidents," said Thomas Regnier, a spokesperson for the European Union. [1] He said EU agencies are working with national authorities on a joint response. [1]
   • Belgium was among the hardest hit, and its federal prosecutors have opened a criminal investigation. [2]
   • In Italy, about 20 supermarkets were hit, including four Co-op stores in Sicily. [1]
   • Germany had 4 supermarkets hit and Romania 6, officials and companies said on Tuesday. [1]
   • Italy's government said the shops hit mostly had old systems, open to the internet, with weak password checks. [2]
   • In Britain, three members of the Association of Independent Meat Suppliers were hit, the trade group says. [4]
   • Its spokesman Tony Goodger called them "collateral", because they ran the same fridge software as the shops. [4]
   • The fridges hit were empty at the time, so no meat was lost, the group told the BBC. [3]
   • Britain's cyber agency, the NCSC, worked through the night to warn firms whose systems sat open online. [4]
   • The British firms' fridges were run by XWEB controllers from Copeland, a US maker of refrigeration controls. [4]
   • XWEB firmware 1.12.1 and older let attackers "take control without a password", a note to the meat group's members says. [4]
   • A fix had been out since August, but the firms hit were reportedly still running the old firmware. [4]
   • Danfoss, a Danish maker of fridge controls, told customers on 13 October to take their systems off the internet. [5]
   • Most stores did, but a small number did not, a Danfoss spokesperson told the Dutch broadcaster NOS. [5]
   • Researcher Kevin Beaumont says every freezer hit on Monday had a control page reachable from the internet. [5]
   • Lupovis, a security firm that runs decoy fridge controllers, saw logins tried with Danfoss's factory passwords from 20 October. [5]
   • The attempts peaked on 26 October, and the decoys refused every one of them. [5]
   • Exposed Danfoss control pages in France fell from 1,825 before the October attacks to 220, says Censys, an internet-scanning firm. [5]
   • No one has claimed the attacks. [1] No one has asked for a ransom either. [8]

   Who is involved

   • Belgium's federal prosecutors opened a criminal investigation
   • The NCSC Britain's National Cyber Security Centre; it warned exposed firms overnight [4]
   • Danfoss and Copeland Danish and US makers of shop fridge controllers; older or unpatched controllers of theirs were hit [4][5]
   • Danfoss Danish maker of fridge controls
   • Most stores went offline
   • A small number did not
   • The European Union the union of European countries; its spokesperson says EU agencies are planning a joint response [1]
   • Dan Cimpean head of Romania's cyber security directorate; he called the attacks semi-amateurish [1]

   How it unfolded

   This is the second wave: the first hit about 700 supermarkets, mostly in France, on 11 and 12 October. [5]

   The US Defense Department now suspects hackers caused freezer failures at US military bases in August, Scientific American reports. [8]

   1. Monday nine EU countries report hacked fridges
   2. Tuesday Germany, Romania and Britain report theirs
   3. 11-12 Oct First wave hits about 700 shops, mostly in France [5]
   4. 2 Nov Second wave hits at least 11 countries [1]
   5. August Copeland's fix is out
   6. Monday firms on old firmware are hit
   7. 20-26 Oct Decoys see login attempts with factory passwords [5]
   8. 26 Oct attempts peak
   9. Monday the second wave
   10. August freezer failures at US bases
   11. Oct and Nov two waves in Europe
   12. August Claroty discloses flaws in Danfoss and Copeland controllers [6]
   13. 13 Oct Danfoss tells customers to take systems off the internet [5]

   Why it matters

   Shops threw away food, and some said the losses reached hundreds of thousands of euros. [3]

   Grocers keep only about 1 to 3 percent of their takings as profit, Scientific American notes. [8]

   Claroty, which found the controller flaws in August, warns attackers could next hit warehouses that supply many shops. [8]

   How it works

   Refrigeration engineers call it a defrost cycle: heaters warm the cooling coils every so often, so ice cannot block them. [8]

   The attackers kept that heater switched on, so it warmed the whole freezer, in some shops to 50C. [8][2]

   Seen it before

   A toaster told to stay on burns the bread, even though toasting is its normal job.

   Why a rumour grows when something matters and nobody explains it

   Social psychologists say a rumour spreads with how much an event matters and how unclear its cause is, so a plain, early explanation slows it.

   The twist

   A rumour does not need a liar to start. An event that matters plus a missing explanation is enough, and the explanation is the one part the people in charge can supply.

   Step by step

   1. 1 Something that matters to many people happens
   2. 2 Its cause is unclear, or the explanation keeps changing
   3. 3 People fill the gap with their own guesses
   4. 4 The guesses travel faster than any check
   5. 5 A clear, early account shrinks the gap

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • The Westchester scanner fault

     The county gave one cause, withdrew it 20 minutes later, and posts calling it cheating reached 100 a minute.

   • The supermarket fridge attacks

     With no claim and no explanation of how attackers got in, experts' guesses ran from a Russian state group to semi-amateurs.

   • mSecure's warning email

     The maker said something happened but not what, so one customer asked whether all 800 of their passwords had to change.

   • Binance's account of its theft

     The opposite move: a step-by-step timeline from the fake interview to the signing service left fewer gaps to guess into.

   Where you've seen this

   A school closed for the day

   no reason given, and parents' group chats supply one by lunchtime

   A food scare

   a product pulled from shelves without a cause named sets off guesses about every brand

   A company's delayed results

   silence before the numbers lets talk of trouble push its shares down

   The catch

   An explanation given too fast can be wrong, and a corrected one can feed the rumour it was meant to stop, as Westchester's changing statement did.

   And the whole of it

   Each person who shared a Westchester post saw one jammed scanner and one guess, not the whole county's count. Anyone reading an alarming headline before the cause is known is standing in the same gap.

   The truth

   • What is really going on The fridge attacks and the BlackX bootkit both went through holes that already had a fix. [4][25]The British meat suppliers' controllers had an update waiting since August, and Microsoft's Windows start-up fix works only after a manual step few administrators took. [4][25]The attackers needed no new flaw, only owners who had not finished the old work. [5][25]
   • Why it works on people A freezer heated to 50C makes an attack look new and clever, even when it went through a published hole with a fix already out. [2][4]
   • Lupovis's chief executive says the attacks could be the work of a Russian state-backed group. [7] Romania's cyber chief called them "semi-amateurish" and said he does not suspect any state. [1]
   • Belgium's cyber agency says it may never be possible to identify who did it. [4]
   • Who pays Shop managers and staff in the hit supermarkets — They came in early to bin the stock, and one Delhaize manager said it made him feel like quitting his job. [2]
   • Nobody knows yet

     Who heated Europe's shop fridges, and why.

     No one has claimed it; one security firm's chief points to a Russian state-backed group, Romania's cyber chief calls it semi-amateurish, and Belgium's agency says it may never be known. [7][1][4]

   • Nobody knows yet

     How the attackers got into the fridge controllers on Monday.

     Officials have not explained it publicly, and Censys did not say whether any patched devices were among those hit. [5]

   • Nobody knows yet

     Whether the freezer failures at US military bases in August were the same attackers.

     The US Defense Department suspects hackers but has not said who, and investigators have not linked the two waves in Europe either. [8][5]

   Good news

   • A fruit and vegetable wholesaler, Langridge Organic, unplugged a fridge from the internet while it was being switched to defrost. [4] No stock was spoiled, its boss said. [4]
   • Sweden's Coop, whose seven hit stores ran their fridges over old 4G links, has sped up moving its fridge equipment onto modern 5G modems.

   What comes next

   The meat suppliers' group is asking Britain's government to treat food as critical national infrastructure. [4]

1. 02

   Binance says a fake job interview began its theft

   What happened

   • Binance, a crypto exchange, published on Tuesday its account of how hackers took about $6.34 billion. [9]
   • It says a software engineer was contacted in September by a fake recruiter, through a real job-hunting site. [9]
   • In a second interview he was told to download a coding test, which hid new malware. [9]
   • Antivirus tools did not spot the malware, Binance says. [9]
   • By 20 October the attackers had used his computer and an internal AI tool to reach 2 more staff. [9]
   • On 29 October they used stolen logins to send coins out through an internal wallet signing service. [10]

   Who is involved

   • Software engineer contacted in September
   • Fake recruiter on a real job site
   • FBI blames North Korea
   • North Korea denies it

   How it unfolded

   The FBI blames TraderTraitor, a North Korean state hacking group. [9] North Korea denies it. [10]

   1. September fake interview
   2. 20 Oct 2 more staff reached
   3. 29 Oct the coins are taken

   Why it matters

   Binance says it stopped 57 other North Korean attempts this year, including fake job offers. [10]

   About half the coins were frozen, but billions are still held by the thieves, Wired reports. [11]

   How it works

   Security teams call this social engineering: tricking a person, not a machine, as the fake recruiters did. [9]

   The fake team built trust over two interviews, with a video call and photos, before the download. [9]

   Seen it before

   A stranger who chats kindly for weeks before asking to borrow your house key is using the same trick.

   The opposite move: a step-by-step timeline from the fake interview to the signing service left fewer gaps to guess into.

   The idea, in story 01: Why a rumour grows when something matters and nobody explains it →

   The truth

   • Who gains TraderTraitor, North Korea's state hacking group — Billions in stolen coins that were not frozen are still in its hands while it launders them, Wired reports. [11]
   • Who pays Binance — It says it has set money aside to cover users' losses and rebuilt or replaced the systems hit. [11]
2. 03

   A ballot scanner fault feeds voting rumours

   What happened

   • Ballot scanners across Westchester County, New York, would not accept paper ballots when polls opened on Tuesday. [12]
   • Voters put their ballots into bags kept safe, to be counted later instead. [12]
   • Posts on X about the fault reached as many as 100 a minute, a University of Washington researcher found. [13]
   • Some posts claimed Democrats were cheating, and AP's fact check found no credible evidence of that. [12]
   • Mike Lawler, the Republican whose seat was at stake, said: "There's no shenanigans going on here." [12]
   • In Fulton County, Georgia, some voters got false texts about polling-place changes that the county never sent. [12]

   How it unfolded

   1. Tuesday ballots go into bags
   2. Wednesday the count is expected

   Why it matters

   The fault hit the hotly contested House race between Lawler and Democrat Cait Conley. [14]

   How it works

   The county gave one cause, withdrew it 20 minutes later, and posts calling it cheating reached 100 a minute.

   The idea, in story 01: Why a rumour grows when something matters and nobody explains it →

   The truth

   • The county board first blamed thick ballot paper, then dropped that 20 minutes later for a general paper issue. [14] AP reports the cause as a programming glitch. [12]
   • Who pays Cait Conley's and Mike Lawler's voters in Westchester — Their ballots wait in bags for a count expected to run until at least Wednesday. [12]
   • Nobody knows yet

     What made Westchester's ballot scanners fail.

     The county first blamed thick paper and withdrew that within 20 minutes, while AP reports a programming glitch. [14][12]

   What comes next

   A judge let officials move thousands of these ballots to a secure warehouse. [12] Counting was expected to take until at least Wednesday. [12]

3. 04

   Man charged over 700 powder letters to officials

   What happened

   • Robin Patrick Martin, 67, of Oklahoma City, is charged with mailing threatening letters with white powder to officials. [16]
   • Prosecutors say he sent more than 700 letters to state and federal officials, including members of the US Congress. [16]
   • Early tests found the powder was harmless yeast or flour, though not every letter has been tested. [16]
   • Some letters carried messages in ink that shows only under ultraviolet light. [15]

   Who is involved

   • Robin Patrick Martin 67, of Oklahoma City; charged

   How it unfolded

   The letters began reaching state election officials on 16 September 2024, headed "DECLARATION OF WAR". [15]

   1. Sep 2024 first letters arrive
   2. Now Martin is charged

   Why it matters

   Officials in nearly every US state received similar mailings over two years, CyberScoop reports. [15]

   How it works

   Detectives call it following the paper trail: phone records led to a Walmart, where video showed a man matching Martin. [15]

   Records from the phone also placed Martin at postal centres around Oklahoma, investigators say. [15]

   Seen it before

   A shop receipt in your pocket shows where you were and what you bought.

   The truth

   • FBI Director Kash Patel said the Biden administration "failed to catch" Martin. [15] The Trump administration has run the case since January 2025. [15]

   Good news

   • Federal agents arrested a 67-year-old Oklahoma City man accused of mailing more than 700 powder letters to officials, and the powder tested so far was yeast or flour.
4. 05

   Police shut a firm that sold fake trading sites to scammers

   What happened

   • Europol, the EU's police agency, says police arrested 7 people and seized more than 100 servers. [19]
   • The target was a company accused of selling fake trading websites and call centres to criminal gangs. [17]
   • It was run from Cyprus and Israel, with call centres in Albania, Kosovo and North Macedonia, Europol says. [17]
   • Losses are put at more than 4 million euros, with possible victims in more than 50 countries. [18]

   Who is involved

   • The company sold sites and call centres
   • Criminal gangs bought them
   • Cyprus and Israel where the firm was run
   • Albania, Kosovo, North Macedonia the call centres

   How it unfolded

   The case began in 2022, when a German couple could not withdraw money from an online trading platform. [17]

   Why it matters

   Victims saw fake profits that pushed them into bigger transfers, then were cut off when they asked for money. [17]

   How it works

   Police call it crime as a service: one firm supplies the tools, and many gangs rent them. [18]

   Here the firm built the sites and sold stolen contact details, and the gangs' call centres did the phoning. [17]

   Seen it before

   A shop that rents disguises to every robber in town is easier to close than each robber.

   The truth

   • Dark Reading reports searches at 17 locations. [18] CyberScoop reports searches across 17 countries. [19]

   Good news

   • An operation involving police from seven countries arrested seven people and seized more than 100 servers used to sell fake trading websites to scam gangs.
5. 06

   Password manager mSecure tells users to change everything

   What happened

   • mSecure, an app that stores people's passwords, emailed customers on 3 November to change their passwords. [20]
   • It also suggested resetting two-step login checks and removing passkeys. [20]
   • Its maker, mSeven Software, said it found "suspicious activity" but did not say what happened. [20]
   • It has not said when this happened, or whether anyone's stored data was reached. [21]

   Why it matters

   One customer asked whether the email meant changing all of their more than 800 passwords. [20]

   How it works

   Cryptographers call this end-to-end encryption: mSecure says vault data is scrambled on your device before syncing. [21] So even its makers cannot read it, it says. [21]

   Seen it before

   A diary whose lock only you have the key to stays private, even from the shop that sold it.

   The maker said something happened but not what, so one customer asked whether all 800 of their passwords had to change.

   The idea, in story 01: Why a rumour grows when something matters and nobody explains it →

   The truth

   • Germany's BSI found in 2025 that one older Android version could, in theory, let its maker read stored data. [21]
   • Who pays mSecure's customers — Without knowing what happened, some face changing hundreds of saved passwords by hand. [20]
   • Nobody knows yet

     What actually happened at mSecure.

     Its maker has not said what the suspicious activity was, when it happened, or whether stored vaults were reached. [20][21]

6. 07

   AI attack tool reaches two more firms

   What happened

   • WorkOS, which runs sign-in tools for apps such as OpenAI and Anthropic, says an attacker reached an internal sales app. [22]
   • The attacker took business contacts and summaries of customer calls and chats, but no app data, WorkOS says. [22]
   • WorkOS says the attacker used ARTEX, an AI tool that automates the steps of an attack. [22]
   • Chainstack, which runs servers for blockchain apps, says an attacker reached parts of its live systems through a third-party component. [23]
   • Customer names, emails and password hashes, scrambled forms of passwords, were exposed, Chainstack says. [23]
   • The attacker got into a development system on 26 October, and Chainstack cut it off on 31 October. [23]

   Who is involved

   • WorkOS runs sign-in tools for OpenAI, Anthropic and others
   • Chainstack runs servers for blockchain apps

   How it unfolded

   Chainstack's break-in overlaps with a China-linked campaign using ARTEX, The Hacker News reports. [23]

   1. 26 Oct attacker gets in
   2. 31 Oct access cut off

   Why it matters

   Chainstack asks customers to change node keys, API keys and any reused passwords. [23]

   How it works

   Security staff call this automated reconnaissance: software scanning a target for weak spots, as WorkOS says ARTEX did. [22]

   Seen it before

   A burglar with a robot that tries every door on a street at once needs far less time.

   The truth

   • Chainstack says it has no evidence the node keys were read, but treats them as exposed. [23]
7. 08

   Red Hat fixes a top-rated Linux flaw; Ubuntu still testing

   What happened

   • Red Hat, which sells a business version of Linux, shipped fixes on 1 November for a flaw rated 9.8. [24]
   • An attacker can trigger it by sending connection requests to any open port, with no login needed. [24]
   • Red Hat first rated it 5.9, then raised it to 9.8 and called it critical. [24]
   • Ubuntu's fixes are still only in an opt-in testing channel, with no release date. [24]

   How it unfolded

   The bug has been in Linux since version 4.4, and the main fix landed in October. [24]

   1. Linux 4.4 the bug arrives
   2. October the main fix lands
   3. 1 Nov Red Hat ships fixes

   Why it matters

   Servers need a restart after the update, so owners must plan for downtime. [24]

   How it works

   Programmers call it a use-after-free bug: the system reads memory it has already handed back. [24]

   Here a repeated connection request arrives while another processor still reads options already freed. [24]

   Seen it before

   Reading a note you already threw away, after someone else wrote on it, gives you the wrong message.

   Good news

   • Fixed versions are out for Red Hat's 3 current releases, 8, 9 and 10. [24]
8. 09

   Bootkit beats fully updated Windows computers

   What happened

   • Kaspersky, a security firm, found a bootkit called BlackX on Windows computers with every update installed. [25]
   • A bootkit is malware that starts before Windows does, when many defences are not yet running. [25]
   • It uses Baton Drop, a flaw in Windows start-up that Microsoft fixed in 2022. [25]
   • Microsoft's 2024 fix blocks old start-up files only if administrators take an extra manual step. [25]

   Who is involved

   • Kaspersky security firm; found BlackX

   How it unfolded

   BlackLotus, a bootkit found in 2023, used the same flaw. [25]

   1. 2022 Microsoft fixes the flaw
   2. 2023 BlackLotus uses it
   3. Now BlackX uses it

   Why it matters

   Kaspersky says few organisations knew the step mattered, and the attackers counted on that. [25]

   How it works

   Engineers call this revoking a certificate: telling a computer to stop trusting an old signed file. [25]

   Microsoft did not force it, because revoking too early could leave millions of PCs unable to start. [25]

   Seen it before

   A school that changes its locks but lets the old keys keep working has not really changed them.

   The truth

   • Microsoft's guidance from two weeks ago does not warn that the patches alone leave this gap, Ars Technica reports. [25]
9. 10

   German lawmakers among Apple spyware targets

   What happened

   • German lawmakers and foreign-policy staff were among people Apple warned last week about spyware, Germany's BSI says. [26]
   • The BSI is Germany's information security agency. [26] It told those warned to assume their devices are infected and replace them. [26]
   • Green Party co-leader Franziska Brantner said on Tuesday that she was one of them. [26]
   • Many were travelling with Chancellor Friedrich Merz in South Korea, Japan and Singapore, Der Spiegel reported. [26]

   Who is involved

   • German lawmakers and staff warned by Apple
   • BSI Germany's information security agency

   How it unfolded

   Apple's warnings went to people in 99 countries. [26]

   Why it matters

   European lawmaker Hannah Neumann says it looks like a large attack on Germany's political leaders. [26]

   How it works

   Phone forensics experts separate being targeted from being infected, and the BSI says it cannot yet tell which is which. [26]

   Seen it before

   A note saying someone tried your door handle does not tell you whether they got inside.

   The truth

   • Nobody knows yet

     How many German officials' phones were actually infected.

     The BSI says it cannot yet tell infected devices from ones that were only targeted. [26]

10. 11

    Harvard breach counted at 851,000 email addresses

    What happened

    • Data stolen from Harvard University in 2025 holds 851,000 unique email addresses, Have I Been Pwned says. [27]
    • Have I Been Pwned is a service that tells people when their email turns up in a leak. [27]
    • The files cover alumni, donors, parents, staff and some students, from its fundraising systems. [27]
    • They include dates of birth, home addresses, ethnicity and citizenship status, The Register reports. [28]

    Who is involved

    • Alumni and donors in the fundraising files
    • Parents and some students also in the files

    How it unfolded

    Harvard found the break-in on 18 November 2025, and the ShinyHunters gang claimed it. [27]

    1. 18 Nov 2025 Harvard finds the break-in
    2. Now 851,000 emails counted

    Why it matters

    Harvard says the systems held no Social Security numbers, passwords or card details. [27]

    The truth

    • Harvard did not say how many people were hit, so this count comes from outside analysis of the leaked files. [27]
    • Who pays Harvard's donors, alumni and parents — Their dates of birth, addresses and citizenship status sit in files the gang published. [28][27]
11. 12

    School software breach reaches 1.3 million people

    What happened

    • Frontline Education, which makes office software for US schools, is telling over 1.3 million people their data was stolen. [29]
    • Hackers got in on 14 August through a flaw in another company's software, Frontline says. [29]
    • Stolen data can include Social Security numbers, passport numbers and Medicaid IDs of staff and students. [29]
    • State filings count 1,298,917 people, and the real total is likely higher, SecurityWeek reports. [29]

    How it unfolded

    1. 14 Aug hackers get in
    2. Now 1.3 million people told

    Why it matters

    Frontline says it has told school districts, which are helping it reach families by email or letter. [29]

    How it works

    Security staff call this third-party risk: a hole in a supplier's product let attackers reach Frontline. [29]

    Seen it before

    A burglar who gets in through a neighbour's shared fence never needs your front door.

    The truth

    • Nobody knows yet

      How many people the Frontline breach really reached.

      The 1,298,917 figure comes from only five states' filings, and other states keep no public portal. [29]

12. 13

    Hackers push a backdoor through a security tool's updates

    What happened

    • Attackers used stolen logins to send a backdoor through the update system of cPGuard, a security suite for web servers. [30]
    • Servers that updated after 02:06 UTC on 2 November could get the poisoned versions. [30]
    • The script took password hashes, database settings and server login keys. [30]
    • Its maker, OpsShield, says the attacker took 32 files from each customer server. [30]
    • Hosting firms use cPGuard, and Namecheap offers it on its servers. [30]

    Who is involved

    • Namecheap a web hosting firm that offers it

    How it unfolded

    1. 02:06 UTC poisoned updates begin
    2. 12 hours on they are stopped

    Why it matters

    OpsShield tells admins to update to 5.88.25 and change passwords, database logins and keys. [30]

    How it works

    Security engineers call this a supply-chain attack: the attackers sent the backdoor through cPGuard's own update channel. [30]

    Seen it before

    A fake parcel brought by the real postman gets opened, because you trust the postman.

    Good news

    • OpsShield stopped the poisoned updates within 12 hours of the first one. [30]
13. 14

    Barracuda patches two flaws that give full control

    What happened

    • Barracuda, an email security company, told customers to patch two flaws that can give attackers full control of devices. [31]
    • One weakness lets attackers change an email gateway's settings. [31] The other lets an admin run commands with full power. [31]
    • Both need access to the device's admin page, so Barracuda advises allowing only trusted networks there. [31]

    How it unfolded

    In 2023 a hacking group called UNC4841 used another Barracuda gateway flaw for at least 7 months. [31]

    Why it matters

    Almost a third of the gateways hacked in 2023 belonged to governments, Mandiant found. [31]

    How it works

    Security engineers call this chaining: two weaker flaws used together give full control. [31]

    Seen it before

    One key opens the gate and another opens the door, and with both you are inside.

14. 15

    Ransomware hits UK schools in a suspected AI-run attack

    What happened

    • An attacker using 3AM ransomware locked about 37 of nearly 50 computers it reached at a group of UK schools. [32]
    • Bitdefender, a security firm, says the attacker may have used AI-written commands in an automatic loop. [32]
    • The commands repeated with small changes every 40 to 100 seconds, which is what Bitdefender noticed. [32]
    • The attacker took stored passwords from 3 backup servers and made 2 hidden admin accounts. [32]

    How it unfolded

    The attack ran from 10 to 19 September. [32]

    1. 10 Sep the attack begins
    2. 19 Sep the attack ends

    Why it matters

    The attacker also searched for links to other schools and joined separate networks together. [32]

    How it works

    Security staff call this moving sideways: using passwords from one machine, here backup servers, to reach the next. [32]

    Seen it before

    A thief who finds the caretaker's key ring can open every classroom.

    The truth

    • Bitdefender says it cannot tell which AI model was used, or whether a person copied commands by hand. [32]
    • Nobody knows yet

      Which AI model, if any, ran the attack on the UK schools.

      Bitdefender could not reach the attacker's machine, so it could only describe the pattern of commands. [32]

15. 16

    Russia detains 3 in a rare hacking arrest

    What happened

    • Russian police detained 3 suspected members of VasyGrek, a gang that sent fake emails to steal company logins. [33]
    • The suspected leader is under house arrest, and 2 others face travel limits. [33]
    • Kaspersky, a Russian security firm, helped the investigation, Russia's Interior Ministry said. [33]

    Who is involved

    • Suspected leader house arrest
    • 2 others travel limits
    • Kaspersky Russian security firm; helped

    How it unfolded

    The group, also called Fluffy Wolf, has targeted Russian companies since at least 2016. [33]

    Why it matters

    Such arrests are unusual in Russia, where many known hacking groups have worked for years. [33]

    How it works

    Security staff call this phishing: here, an email dressed as a business partner's, with malware hidden in a finance file. [33]

    Seen it before

    A letter with your bank's logo can still come from a stranger.

    The truth

    • The ministry did not say whether police in other countries helped. [33]

    Good news

    • Russian police detained three suspected members of VasyGrek, a phishing gang that had targeted Russian companies since 2016.
16. 17

    Defence firm pays $13 million over cyber rules

    What happened

    • ILC Dover and ILC Astrospace, US defence and space suppliers, agreed to pay $13 million to settle US government claims. [34]
    • The US government says they billed the Army, NASA and the Missile Defense Agency while breaking contract security rules. [34]
    • It says ILC kept sensitive data with a cloud firm without proper safeguards, from 2018 to 2024. [34]
    • Parent company Ingersoll Rand says it inherited the problem when it bought ILC Dover in June 2024. [34]

    Who is involved

    • Army, NASA, Missile Defense Agency were billed
    • ILC broke the rules, the US says
    • Ingersoll Rand owner of ILC Dover since 2024

    Why it matters

    US Attorney Benjamin Wallace said the rules exist to stop bad actors taking advantage of US technical work. [34]

    How it works

    Lawyers call this a False Claims Act case: billing the government while knowingly breaking the contract's terms. [34]

    Seen it before

    Charging for a guarded car park while leaving the gate open is still charging for a guard.

    The truth

    • ILC settled without admitting liability, and its owner says the problems were fixed by October 2024. [34]
    • Who gains Ingersoll Rand, owner of ILC Dover — Paying $13 million closes the US government's case without any admission of liability. [34]
17. 18

    CrowdStrike buys two firms that check AI agents

    What happened

    • CrowdStrike, a big security company, agreed to buy two AI security firms, Fiddler AI and Dreadnode. [35]
    • The Wall Street Journal put the prices at about $400 million and $95 million. [36]
    • Fiddler watches AI agents, programs that act on their own, and explains the decisions they make. [36]
    • Dreadnode attacks AI models with more than 100 known tricks before they go live. [35]
    • CrowdStrike's chief, George Kurtz, called Fiddler "the flight recorder for every agent". [35]

    Why it matters

    Agents can hold real logins and still make bad choices, which older security tests do not reach. [35]

    How it works

    Engineers call this observability: keeping a record of each step a system takes, so a mistake can be traced. [35]

    Seen it before

    A teacher who sees your working, not just the answer, can tell where you went wrong.

    The truth

    • Who gains CrowdStrike — Buying Fiddler and Dreadnode lets it sell checks on AI agents to the companies now putting agents to work. [35]

    What comes next

    The deals are expected to close by the end of January 2027. [36]

18. 19

    Android update fixes over 200 flaws

    What happened

    • Google's November Android updates fix more than 200 flaws, two dozen of them rated critical. [37]
    • The worst lets an attacker run code on a phone without its owner tapping anything. [37]
    • The first part fixes 119 flaws and the second part fixes 97. [37]
    • Google sent 17 of the fixes early, through Google Play system updates. [37]

    Why it matters

    The second part covers parts made by Qualcomm, MediaTek and other chip makers inside many phones. [37]

    How it works

    Google calls it the security patch level: a date that shows which fixes a phone holds. [37] A level of 2026-11-05 or later has them all. [37]

    Seen it before

    A date stamp on milk tells you how fresh it is without opening it.

19. 20

    NATO drill puts AI agents into cyber training

    What happened

    • More than 250 people from over 40 countries began NATO's Crossed Swords cyber exercise in Tallinn, Estonia, on Monday. [38]
    • It is run by NATO's cyber defence centre in Tallinn and lasts until Friday. [38]
    • New this year, players build AI agents and work beside them. [38]
    • For the first time, the drill also uses OpenAI's Daybreak cyber defence tool. [38]

    Who is involved

    • NATO's cyber defence centre runs the drill

    Why it matters

    Its director, Jozef Kostelansky, says cyber attacks must be timed to the minute with military action. [38]

20. 21

    Russia-aligned spies target Ukrainian courts and councils

    What happened

    • ESET, a security firm, says a Russia-aligned spy group it calls Gorbag has targeted Ukraine since February 2025. [39]
    • About a quarter of targets were justice and police bodies, and another quarter local councils near the front line. [39]
    • In early 2026 it switched to booby-trapped files using a flaw in WinRAR, a common tool for opening compressed files. [39]
    • Its stealer took saved passwords, browser cookies, VPN settings and documents. [39]

    Who is involved

    • ESET security firm
    • Gorbag Russia-aligned spy group
    • Justice and police about a quarter
    • Local councils about a quarter

    How it unfolded

    1. Feb 2025 targeting begins
    2. Early 2026 booby-trapped WinRAR files

    Why it matters

    ESET says the targets match Russia's wartime intelligence priorities, possibly including war-crimes cases. [39]

    How it works

    Researchers call it a path traversal flaw: a file in the archive lands where it should not go. [39] Here that was Windows' Startup folder, so it runs at every start. [39]

    Seen it before

    A parcel addressed to the hall that ends up in your bedroom has got past the front door.

21. 22

    Fake bank sites pretend to be shut down

    What happened

    • KELA, a security firm, found 248 live fake banking and scam sites tied to 189 US banks and financial firms. [40]
    • On a second visit, the sites show a fake "account suspended" page. [40]
    • Many of the site names pair a bank's name with words like secure or cancel. [40]
    • Scanners and takedown teams check a reported site twice, so they see what looks like a finished takedown. [40]
    • A victim usually follows a link only once, and sees the cloned bank page. [40]

    Why it matters

    Many of the fake sites aim at business banking, KELA says. [40]

    How it works

    Security staff call this cloaking: showing one page to checkers and another to victims. [40]

    Seen it before

    A pupil who looks busy only when the teacher walks past is playing the same trick.

22. 23

    US agency confirms attacks on a WordPress flaw

    What happened

    • CISA, the US cyber-defence agency, added a WordPress core flaw to its list of bugs attackers are using. [41]
    • WordPress is free software that runs many websites. [42]
    • US federal agencies must fix flaws on that list quickly, under CISA's orders. [41]

    Who is involved

    • WordPress free software that runs many websites

    How it unfolded

    A WordPress core race flaw fixed on 28 October drew nearly 63,000 attack attempts in 24 hours. [42]

    Why it matters

    Website owners who have not updated stay open until they do. [42]

    How it works

    Programmers call it a race condition: the attacker must act in the instant WordPress unpacks an update. [42]

    Seen it before

    Grabbing a seat in the second it is empty is a race you win only by timing.

23. 24

    Security investor Ballistic seeks $490 million

    What happened

    • Ballistic Ventures, a US investor that backs cybersecurity start-ups, is raising $490 million across two new funds, TechCrunch found. [43]
    • Filings show $360 million for its third main fund and $130 million for a separate one. [43]
    • Ted Schlein, a former partner at the investor Kleiner Perkins, co-founded the San Francisco firm in late 2021. [43]
    • It has backed Talon Cyber Security, later bought by Palo Alto Networks, and Pangea, bought by CrowdStrike. [43]
    • Neither new fund had taken in any money when the filings were made. [43]

    Who is involved

    • Ted Schlein co-founder; formerly of Kleiner Perkins

    How it unfolded

    Its first fund, in 2022, was $300 million. [43]

    1. 2022 first fund, $300 million
    2. Now $490 million sought

    Why it matters

    TechCrunch ties the raise to fears of AI-driven attacks and new openings as companies adopt AI agents. [43]