Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 12 Oct to 18 Oct 2026

Overview: On 12 October 2026, France’s national CERT (CERT-FR) issued alert CERTFR-2026-ALE-012 warning of numerous compromises of internet-reachable refrigeration controllers, after attacks on the night of 11 to 12 October disrupted cold storage in stores of several French supermarket chains. CERT-FR updated the alert on 13 October with further targeted equipment and on 16 October with revised recommendations.

Impact: About 700 of France’s 10,000 supermarkets, per the finance minister: 300 Intermarché and Netto stores, 80 Coopérative U stores, plus Carrefour, Monoprix and E.Leclerc. Fridges ran at 50 degrees Celsius for about six hours and stock was thrown out. No verified loss figure exists; the Paris prosecutor is investigating spoiled food and fires.

Details: CERT-FR names four affected product lines: Copeland xweb, Dixell xweb, Danfoss AK-SC series and Danfoss AK-SM series. Danfoss said most affected equipment was legacy AK-SM800 and AK-SC355 units that no longer receive software or security updates, and that the AK-SM800 units involved were running outdated firmware. CERT-FR states that exposing a management interface on the internet is contrary to good practice and tells operators to review defrost schedules, which maps to MITRE ATT&CK for ICS T0883 (Internet Accessible Device) and T0836 (Modify Parameter). The disclosures stop short of confirming how attackers authenticated to the controllers, and no CVE and no threat actor has been linked to the campaign by any authority. A Sekoia analyst reported affected units in Spain, Portugal, Poland, Germany and Belgium. CERT-FR warns that campaigns against these devices are probably still ongoing.

1Remove every refrigeration and building controller from direct internet exposure and allow access only through a VPN or protected network.

2Review each controller’s full configuration, starting with defrost schedules, and change any default passwords.

3Replace or isolate end-of-life units; CERT-FR notes that a factory reset alone leaves the device vulnerable to re-compromise.

CISO takeaway: Contractor-installed equipment sits on your network and under your IP ranges, so it belongs in the same asset inventory as your web servers. If nobody on the security team can list which controllers answer from the internet today, that is the first gap to close.

Overview: On 15 October 2026, Sourcenext, the Tokyo-listed software company behind the Pocketalk translator and the ZERO antivirus range, disclosed that unauthorized access to the system managing its registered members may have exposed 22,519,960 customer records. It is the second-largest breach in Japanese history after Benesse’s 35 million records in 2014.

Impact: Up to 22,519,960 records: name, email, postal address, phone and fax numbers, gender, date of birth, company and job title where given, password, services used, registration and last login dates. No card data; the affected system did not store it. Everyone registered as of 13:36 on 13 October 2026 is in scope, including people who had cancelled their membership, and Sourcenext has not said how passwords were stored.

Details: Sourcenext’s timeline puts the first unauthorized access on the morning of 9 October, detection on the morning of 13 October, and containment at 13:36 the same day, about four days of access. Sourcenext’s own notice attributes the theft to unauthorized use of its member-information retrieval API rather than a compromise of the underlying infrastructure, and says no further unauthorized access has been seen since containment. The company notified Japan’s Personal Information Protection Commission on 15 October, said it would file a police report on 16 October, and began emailing affected customers on 15 October with password reset instructions. It has not named an entry point, a threat actor or a ransomware group, and the data had not appeared for sale on any forum as of 18 October.

1Rate-limit and anomaly-monitor every API that returns member or customer records, and alert on bulk retrieval patterns from any single client or token.

2Confirm that stored passwords are hashed with a modern algorithm, because a breach notice that cannot say how passwords were stored forces every customer to assume the worst.

3If you hold a historical customer archive that includes people who are no longer customers, decide why, and delete what has no business purpose.

CISO takeaway: Twenty-two million records is a single API with no retrieval limit, left reachable for four days. The question for any consumer-facing company is not whether the member API is authenticated but how many records one authenticated caller can pull before someone is paged.

Overview: On 16 October 2026, Huntress disclosed that a credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) was used on 15 October 2026 to sign in to customer Microsoft 365 tenants. ConnectWise confirmed unauthorized access to application identities on 17 October and suspended three cloud services while it investigated. Microsoft Threat Intelligence described it as a supply chain attack in which a threat actor compromised the trusted OAuth app, and Todyl independently confirmed the same activity in its own customer base.

Impact: Huntress confirmed sign-ins in 173 tenants and more than 300 successful sign-ins across about 1,000 tenants that saw attempts, with post-compromise activity confirmed in 2. ConnectWise suspended three services and disabled seven application identities. It cannot see which customer tenants were accessed.

Details: Huntress observed the backup application’s client credential being used from 144.172.64[.]128, a hosting-provider address, to obtain Microsoft Graph tokens between 06:13 and 08:34 UTC on 15 October, moving through tenants a few seconds apart in sorted order, which points to a scripted target list. From 01:58 UTC that day, ConnectWise Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator, in about 50 Huntress-monitored tenants. In one tenant, the Cloud Management Microsoft Teams app added itself to Global Administrator and then added client secrets to two other applications, one of them Huntress’s own. Huntress maps the activity to T1078.004 (Valid Accounts: Cloud Accounts), T1098.003 (Additional Cloud Roles) and T1098.001 (Additional Cloud Credentials). ConnectWise has not said how the credential was obtained and has not attributed the activity.

1Disable, rather than delete, the ConnectWise Cloud Backup (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and Cloud Management enterprise apps in Entra until ConnectWise confirms credentials have been reset.

2Review every enterprise app and app registration for credentials and directory roles added since 13 October 2026 that you did not create.

3Search audit logs and service principal sign-ins between 01:00 UTC on 15 October and 02:00 UTC on 16 October for the backup app ID and 144.172.64[.]128.

CISO takeaway: A consented OAuth application is a standing credential into your tenant that you do not rotate and often do not monitor. Put third-party application access on the same review cycle as privileged human accounts, with an owner and a revocation plan for each.

Overview: On 12 October 2026, Ahold Delhaize announced that it was experiencing a security issue within its network and had taken some systems offline, and its 19 October 2026 update confirmed those systems included its brands’ websites and apps across most of its European and US brands.

Impact: Websites and apps offline across most European and US brands for at least a week; stores stayed open. Albert Heijn is back online with deliveries resuming 23 October, and the US brands (Food Lion, Giant Food, Stop & Shop) were expected back within days. No evidence of customer, associate or partner data taken as of 19 October.

Details: Ahold Delhaize has not disclosed the entry point, the malware involved or any threat actor, so no ATT&CK mapping is possible. What the disclosures do confirm is the containment choice: the company isolated customer-facing digital channels for at least a week while keeping physical stores trading. It notified the Dutch National Cyber Security Centre within 24 hours of discovering the malicious activity and filed a police report on 19 October 2026. The company has not commented on any link to the French refrigeration attacks, and none has been established.

1Map which customer-facing systems can be taken offline without stopping stores, branches or production, and document the dependencies before an incident forces the decision.

2Rehearse a multi-day e-commerce shutdown, including how orders, deliveries and customer communications are handled.

3Confirm your regulator and national CERT notification paths meet a 24-hour window, which Ahold Delhaize met with the Dutch NCSC.

CISO takeaway: Taking digital channels offline is a legitimate containment control, but its cost is set by decisions made before the incident. A board that knows the daily cost of an e-commerce outage will fund the testing that shortens it.

Overview: On 13 October 2026, the US Department of Justice announced coordinated actions against North Korean remote IT worker schemes: a four-count indictment in the Northern District of Ohio charging 14 people, two arrests, and searches of more than 40 Texas residences between 21 and 25 September 2026 under Operation Lonestar Roundup. DOJ did not announce charges from the Texas searches.

Impact: 187 laptops and KVM devices seized in Texas. More than 70 US employers and more than $3 million between 2019 and July 2025, per the Ohio indictment. Two arrests, ten defendants in China, two unnamed; the charges are allegations.

Details: The scheme relies on fraudulent remote hiring with stolen or purchased identities, while US-based facilitators host company-issued laptops so the workers appear to be in the United States, as described by DOJ and an FBI public service announcement issued the same day. DOJ attributes the workers to North Korea; CrowdStrike tracks the group as Famous Chollima. No intrusion is needed: the worker holds valid, employer-issued credentials from day one, which is closest to ATT&CK T1078 (Valid Accounts). The KVM devices in the seizure are the tell, since they let a remote operator control a physical laptop sitting in a facilitator’s home.

1Verify identity at hiring with live video and document checks, and re-verify when payroll, shipping or banking details change.

2Alert on remote-control tooling and KVM hardware on company laptops, and on laptops shipped to addresses that do not match the employee’s record.

3Compare login geolocation and network origin against each remote employee’s stated location.

CISO takeaway: An insider you hired through a fraudulent identity has more access than most external attackers will ever get. Hiring, IT asset shipping and identity checks are now part of the security perimeter, and they need an owner on the security team.

Overview: Meta began notifying about 1,500 people on 13 October 2026, most of them US-based employees, that an outside group had used a stolen employee credential to access some of the company’s GitHub repositories. Meta detected the intrusion several weeks earlier, cut off the access, and brought in GitHub and law enforcement.

Impact: About 1,500 people, mostly US employees. 99 percent of what was taken was source code; 1 percent was personal data stored in the repositories against policy, much of it synthetic test data. Meta has not said how many repositories were accessed or for how long.

Details: Meta states the incident was not a vulnerability in any Meta product and that its internal systems were not breached. The entry point was a single compromised employee account on a third-party code hosting platform, which maps to ATT&CK T1078 (Valid Accounts) and T1213.003 (Data from Information Repositories: Code Repositories). Meta has rotated secrets, added scanning for personal data uploaded to GitHub, and is offering credit and dark web monitoring.

1Enforce phishing-resistant MFA and SSO on every code hosting account, and alert on repository cloning volume that exceeds a developer’s normal pattern.

2Scan repositories continuously for secrets and personal data, and treat a hit as an incident, not a hygiene ticket.

3Inventory which third-party platforms hold source code and credentials, and confirm each one is covered by offboarding and credential rotation.

CISO takeaway: One stolen developer login gave an outside group the source code for shipping products at one of the largest software companies in the world. Code repositories hold secrets, infrastructure details and sometimes customer data, and they sit outside the perimeter most security programs test.

Overview: On 16 October 2026, a threat actor using the name Siriusim posted on the cybercrime forum BreachForums claiming to hold 375,000 rows of customer data and 2,722 PDF documents belonging to State Bank of India, the country’s largest lender. SBI received alerts the same day from its threat intelligence provider, the Defence Cyber Agency and CERT-In, and on 21 October 2026 filed a disclosure titled “Incident involving Data Loss” with the BSE and NSE under Regulation 30 of SEBI’s listing regulations (MediaNama’s report on the filing).

Impact: 375,000 rows and 2,722 PDFs claimed by the seller; 3,897 records with personal data confirmed by SBI so far. Fields include names, mobile numbers, dates of birth, email and residential addresses, customer identifiers and loan records. The bank expects no material effect on operations.

Details: The claimed dataset is described as loan applications, account-opening forms, Know Your Customer records and residential addresses. A Free Press Journal check of the four sample records found phone numbers still active and WhatsApp profile photographs matching the faces in the KYC documents, which suggests the data is real rather than fabricated, though SBI has not confirmed a breach of its own systems and no entry point has been disclosed. It is also unclear whether the data is new or recycled from earlier leaks, or whether it came from SBI, a subsidiary or a third-party service provider. SBI has appointed an independent CERT-In-empanelled cybersecurity agency to establish the source and authenticity of the leak. Note that 375,000 is a count of rows in a file, not necessarily distinct individuals, and that the bank’s own confirmed figure is two orders of magnitude smaller.

1Inventory every system and partner that holds KYC documents, loan files or account-opening forms, since these are collected once at onboarding and then sit in places outside the core banking platform.

2Monitor cybercrime forums for your own brand, and rehearse the verification step, since the gap between a forum post and a confirmed figure decides how fast you can tell customers anything useful.

3Raise phishing and social engineering detection for any customer whose records appear in a leak, because KYC data is what makes an impersonation call convincing. SBI directs customers to report attempts to [email protected].

CISO takeaway: A bank learned about its own exposure from outside agencies after the data was already published, five days passed between the alert and the exchange filing, and the filing does not say whether affected customers have been told. KYC and loan documentation is the hardest category of data to remediate after a leak, because customers cannot rotate a date of birth or a residential address. Know which internet-facing systems and partner portals can reach that documentation, and test them.