Cyber, in brief

Hackers warmed supermarket fridges and freezers in at least 11 European countries on Monday, officials say. [1]

Germany, Romania and Britain reported their cases on Tuesday, a day after nine EU countries did. [1]

"These are not isolated incidents," said Thomas Regnier, a spokesperson for the European Union. [1] He said EU agencies are working with national authorities on a joint response. [1]

Shops threw away food, and some said the losses reached hundreds of thousands of euros. [3]

Grocers keep only about 1 to 3 percent of their takings as profit, Scientific American notes. [8]

Claroty, which found the controller flaws in August, warns attackers could next hit warehouses that supply many shops. [8]

Refrigeration engineers call it a defrost cycle: heaters warm the cooling coils every so often, so ice cannot block them. [8]

The attackers kept that heater switched on, so it warmed the whole freezer, in some shops to 50C. [8][2]

A toaster told to stay on burns the bread, even though toasting is its normal job.

Lupovis's chief executive says the attacks could be the work of a Russian state-backed group. [7] Romania's cyber chief called them "semi-amateurish" and said he does not suspect any state. [1]

Belgium's cyber agency says it may never be possible to identify who did it. [4]

A fruit and vegetable wholesaler, Langridge Organic, unplugged a fridge from the internet while it was being switched to defrost. [4] No stock was spoiled, its boss said. [4]

The meat suppliers' group is asking Britain's government to treat food as critical national infrastructure. [4]

Why a rumour grows when something matters and nobody explains it

Something that matters to many people happens

Its cause is unclear, or the explanation keeps changing

People fill the gap with their own guesses

The guesses travel faster than any check

A clear, early account shrinks the gap

A rumour does not need a liar to start.

The county gave one cause, withdrew it 20 minutes later, and posts calling it cheating reached 100 a minute.

With no claim and no explanation of how attackers got in, experts' guesses ran from a Russian state group to semi-amateurs.

The maker said something happened but not what, so one customer asked whether all 800 of their passwords had to change.

The opposite move: a step-by-step timeline from the fake interview to the signing service left fewer gaps to guess into.

An explanation given too fast can be wrong, and a corrected one can feed the rumour it was meant to stop, as Westchester's changing statement did.

Each person who shared a Westchester post saw one jammed scanner and one guess, not the whole county's count.

The fridge attacks and the BlackX bootkit both went through holes that already had a fix. [4][25]

The British meat suppliers' controllers had an update waiting since August, and Microsoft's Windows start-up fix works only after a manual step few administrators took. [4][25]

The attackers needed no new flaw, only owners who had not finished the old work. [5][25]

A freezer heated to 50C makes an attack look new and clever, even when it went through a published hole with a fix already out. [2][4]

They came in early to bin the stock, and one Delhaize manager said it made him feel like quitting his job. [2]

Who heated Europe's shop fridges, and why.

No one has claimed it; one security firm's chief points to a Russian state-backed group, Romania's cyber chief calls it semi-amateurish, and Belgium's agency says it may never be known. [7][1][4]

How the attackers got into the fridge controllers on Monday.

Officials have not explained it publicly, and Censys did not say whether any patched devices were among those hit. [5]

Whether the freezer failures at US military bases in August were the same attackers.

The US Defense Department suspects hackers but has not said who, and investigators have not linked the two waves in Europe either. [8][5]

Sweden's Coop, whose seven hit stores ran their fridges over old 4G links, has sped up moving its fridge equipment onto modern 5G modems.

Binance, a crypto exchange, published on Tuesday its account of how hackers took about $6.34 billion. [9]

It says a software engineer was contacted in September by a fake recruiter, through a real job-hunting site. [9]

In a second interview he was told to download a coding test, which hid new malware. [9]

Antivirus tools did not spot the malware, Binance says. [9]

By 20 October the attackers had used his computer and an internal AI tool to reach 2 more staff. [9]

On 29 October they used stolen logins to send coins out through an internal wallet signing service. [10]

The FBI blames TraderTraitor, a North Korean state hacking group. [9] North Korea denies it. [10]

Binance says it stopped 57 other North Korean attempts this year, including fake job offers. [10]

About half the coins were frozen, but billions are still held by the thieves, Wired reports. [11]

Security teams call this social engineering: tricking a person, not a machine, as the fake recruiters did. [9]

The fake team built trust over two interviews, with a video call and photos, before the download. [9]

A stranger who chats kindly for weeks before asking to borrow your house key is using the same trick.

The opposite move: a step-by-step timeline from the fake interview to the signing service left fewer gaps to guess into.

Billions in stolen coins that were not frozen are still in its hands while it launders them, Wired reports. [11]

It says it has set money aside to cover users' losses and rebuilt or replaced the systems hit. [11]

Ballot scanners across Westchester County, New York, would not accept paper ballots when polls opened on Tuesday. [12]

Voters put their ballots into bags kept safe, to be counted later instead. [12]

A judge let officials move thousands of these ballots to a secure warehouse. [12] Counting was expected to take until at least Wednesday. [12]

Posts on X about the fault reached as many as 100 a minute, a University of Washington researcher found. [13]

Some posts claimed Democrats were cheating, and AP's fact check found no credible evidence of that. [12]

Mike Lawler, the Republican whose seat was at stake, said: "There's no shenanigans going on here." [12]

In Fulton County, Georgia, some voters got false texts about polling-place changes that the county never sent. [12]

The county board first blamed thick ballot paper, then dropped that 20 minutes later for a general paper issue. [14] AP reports the cause as a programming glitch. [12]

The fault hit the hotly contested House race between Lawler and Democrat Cait Conley. [14]

The county gave one cause, withdrew it 20 minutes later, and posts calling it cheating reached 100 a minute.

Their ballots wait in bags for a count expected to run until at least Wednesday. [12]

What made Westchester's ballot scanners fail.

The county first blamed thick paper and withdrew that within 20 minutes, while AP reports a programming glitch. [14][12]

Robin Patrick Martin, 67, of Oklahoma City, is charged with mailing threatening letters with white powder to officials. [16]

Prosecutors say he sent more than 700 letters to state and federal officials, including members of the US Congress. [16]

Early tests found the powder was harmless yeast or flour, though not every letter has been tested. [16]

Some letters carried messages in ink that shows only under ultraviolet light. [15]

The letters began reaching state election officials on 16 September 2024, headed "DECLARATION OF WAR". [15]

Officials in nearly every US state received similar mailings over two years, CyberScoop reports. [15]

Detectives call it following the paper trail: phone records led to a Walmart, where video showed a man matching Martin. [15]

Records from the phone also placed Martin at postal centres around Oklahoma, investigators say. [15]

A shop receipt in your pocket shows where you were and what you bought.

FBI Director Kash Patel said the Biden administration "failed to catch" Martin. [15] The Trump administration has run the case since January 2025. [15]

Federal agents arrested a 67-year-old Oklahoma City man accused of mailing more than 700 powder letters to officials, and the powder tested so far was yeast or flour.

Europol, the EU's police agency, says police arrested 7 people and seized more than 100 servers. [19]

The target was a company accused of selling fake trading websites and call centres to criminal gangs. [17]

It was run from Cyprus and Israel, with call centres in Albania, Kosovo and North Macedonia, Europol says. [17]

The case began in 2022, when a German couple could not withdraw money from an online trading platform. [17]

Losses are put at more than 4 million euros, with possible victims in more than 50 countries. [18]

Victims saw fake profits that pushed them into bigger transfers, then were cut off when they asked for money. [17]

Police call it crime as a service: one firm supplies the tools, and many gangs rent them. [18]

Here the firm built the sites and sold stolen contact details, and the gangs' call centres did the phoning. [17]

A shop that rents disguises to every robber in town is easier to close than each robber.

Dark Reading reports searches at 17 locations. [18] CyberScoop reports searches across 17 countries. [19]

An operation involving police from seven countries arrested seven people and seized more than 100 servers used to sell fake trading websites to scam gangs.

mSecure, an app that stores people's passwords, emailed customers on 3 November to change their passwords. [20]

It also suggested resetting two-step login checks and removing passkeys. [20]

Its maker, mSeven Software, said it found "suspicious activity" but did not say what happened. [20]

It has not said when this happened, or whether anyone's stored data was reached. [21]

One customer asked whether the email meant changing all of their more than 800 passwords. [20]

Cryptographers call this end-to-end encryption: mSecure says vault data is scrambled on your device before syncing. [21] So even its makers cannot read it, it says. [21]

A diary whose lock only you have the key to stays private, even from the shop that sold it.

Germany's BSI found in 2025 that one older Android version could, in theory, let its maker read stored data. [21]

The maker said something happened but not what, so one customer asked whether all 800 of their passwords had to change.

Without knowing what happened, some face changing hundreds of saved passwords by hand. [20]

What actually happened at mSecure.

Its maker has not said what the suspicious activity was, when it happened, or whether stored vaults were reached. [20][21]

WorkOS, which runs sign-in tools for apps such as OpenAI and Anthropic, says an attacker reached an internal sales app. [22]

The attacker took business contacts and summaries of customer calls and chats, but no app data, WorkOS says. [22]

WorkOS says the attacker used ARTEX, an AI tool that automates the steps of an attack. [22]

Chainstack, which runs servers for blockchain apps, says an attacker reached parts of its live systems through a third-party component. [23]

Customer names, emails and password hashes, scrambled forms of passwords, were exposed, Chainstack says. [23]

Chainstack's break-in overlaps with a China-linked campaign using ARTEX, The Hacker News reports. [23]

The attacker got into a development system on 26 October, and Chainstack cut it off on 31 October. [23]

Chainstack asks customers to change node keys, API keys and any reused passwords. [23]

Security staff call this automated reconnaissance: software scanning a target for weak spots, as WorkOS says ARTEX did. [22]

A burglar with a robot that tries every door on a street at once needs far less time.

Chainstack says it has no evidence the node keys were read, but treats them as exposed. [23]

Red Hat, which sells a business version of Linux, shipped fixes on 1 November for a flaw rated 9.8. [24]

An attacker can trigger it by sending connection requests to any open port, with no login needed. [24]

Red Hat first rated it 5.9, then raised it to 9.8 and called it critical. [24]

Ubuntu's fixes are still only in an opt-in testing channel, with no release date. [24]

The bug has been in Linux since version 4.4, and the main fix landed in October. [24]

Servers need a restart after the update, so owners must plan for downtime. [24]

Programmers call it a use-after-free bug: the system reads memory it has already handed back. [24]

Here a repeated connection request arrives while another processor still reads options already freed. [24]

Reading a note you already threw away, after someone else wrote on it, gives you the wrong message.

Fixed versions are out for Red Hat's 3 current releases, 8, 9 and 10. [24]

Kaspersky, a security firm, found a bootkit called BlackX on Windows computers with every update installed. [25]

A bootkit is malware that starts before Windows does, when many defences are not yet running. [25]

It uses Baton Drop, a flaw in Windows start-up that Microsoft fixed in 2022. [25]

BlackLotus, a bootkit found in 2023, used the same flaw. [25]

Microsoft's 2024 fix blocks old start-up files only if administrators take an extra manual step. [25]

Kaspersky says few organisations knew the step mattered, and the attackers counted on that. [25]

Engineers call this revoking a certificate: telling a computer to stop trusting an old signed file. [25]

Microsoft did not force it, because revoking too early could leave millions of PCs unable to start. [25]

A school that changes its locks but lets the old keys keep working has not really changed them.

Microsoft's guidance from two weeks ago does not warn that the patches alone leave this gap, Ars Technica reports. [25]

German lawmakers and foreign-policy staff were among people Apple warned last week about spyware, Germany's BSI says. [26]

The BSI is Germany's information security agency. [26] It told those warned to assume their devices are infected and replace them. [26]

Green Party co-leader Franziska Brantner said on Tuesday that she was one of them. [26]

Many were travelling with Chancellor Friedrich Merz in South Korea, Japan and Singapore, Der Spiegel reported. [26]

Apple's warnings went to people in 99 countries. [26]

European lawmaker Hannah Neumann says it looks like a large attack on Germany's political leaders. [26]

Phone forensics experts separate being targeted from being infected, and the BSI says it cannot yet tell which is which. [26]

A note saying someone tried your door handle does not tell you whether they got inside.

How many German officials' phones were actually infected.

The BSI says it cannot yet tell infected devices from ones that were only targeted. [26]

Data stolen from Harvard University in 2025 holds 851,000 unique email addresses, Have I Been Pwned says. [27]

Have I Been Pwned is a service that tells people when their email turns up in a leak. [27]

The files cover alumni, donors, parents, staff and some students, from its fundraising systems. [27]

They include dates of birth, home addresses, ethnicity and citizenship status, The Register reports. [28]

Harvard found the break-in on 18 November 2025, and the ShinyHunters gang claimed it. [27]

Harvard says the systems held no Social Security numbers, passwords or card details. [27]

Harvard did not say how many people were hit, so this count comes from outside analysis of the leaked files. [27]

Their dates of birth, addresses and citizenship status sit in files the gang published. [28][27]

Frontline Education, which makes office software for US schools, is telling over 1.3 million people their data was stolen. [29]

Hackers got in on 14 August through a flaw in another company's software, Frontline says. [29]

Stolen data can include Social Security numbers, passport numbers and Medicaid IDs of staff and students. [29]

State filings count 1,298,917 people, and the real total is likely higher, SecurityWeek reports. [29]

Frontline says it has told school districts, which are helping it reach families by email or letter. [29]

Security staff call this third-party risk: a hole in a supplier's product let attackers reach Frontline. [29]

A burglar who gets in through a neighbour's shared fence never needs your front door.

How many people the Frontline breach really reached.

The 1,298,917 figure comes from only five states' filings, and other states keep no public portal. [29]

Attackers used stolen logins to send a backdoor through the update system of cPGuard, a security suite for web servers. [30]

Servers that updated after 02:06 UTC on 2 November could get the poisoned versions. [30]

The script took password hashes, database settings and server login keys. [30]

Its maker, OpsShield, says the attacker took 32 files from each customer server. [30]

Hosting firms use cPGuard, and Namecheap offers it on its servers. [30]

OpsShield tells admins to update to 5.88.25 and change passwords, database logins and keys. [30]

Security engineers call this a supply-chain attack: the attackers sent the backdoor through cPGuard's own update channel. [30]

A fake parcel brought by the real postman gets opened, because you trust the postman.

OpsShield stopped the poisoned updates within 12 hours of the first one. [30]

Barracuda, an email security company, told customers to patch two flaws that can give attackers full control of devices. [31]

One weakness lets attackers change an email gateway's settings. [31] The other lets an admin run commands with full power. [31]

Both need access to the device's admin page, so Barracuda advises allowing only trusted networks there. [31]

In 2023 a hacking group called UNC4841 used another Barracuda gateway flaw for at least 7 months. [31]

Almost a third of the gateways hacked in 2023 belonged to governments, Mandiant found. [31]

Security engineers call this chaining: two weaker flaws used together give full control. [31]

One key opens the gate and another opens the door, and with both you are inside.

An attacker using 3AM ransomware locked about 37 of nearly 50 computers it reached at a group of UK schools. [32]

Bitdefender, a security firm, says the attacker may have used AI-written commands in an automatic loop. [32]

The commands repeated with small changes every 40 to 100 seconds, which is what Bitdefender noticed. [32]

The attacker took stored passwords from 3 backup servers and made 2 hidden admin accounts. [32]

The attack ran from 10 to 19 September. [32]

The attacker also searched for links to other schools and joined separate networks together. [32]

Security staff call this moving sideways: using passwords from one machine, here backup servers, to reach the next. [32]