Loading...
Loading...
October in numbers: 495 organisations disrupted by one cloud provider outage; 8.2M people affected in iRhythm’s breach (regulator filing); 41% of ransomware victims reported threats against staff (Semperis survey); and $93M+ in crypto reportedly drained via tampered wallets (on-chain estimate).
Read one at a time, October’s headlines look like a blur of breaches and ransomware claims. Read together, they tell one story: the organisations that suffered most were often not the ones that were breached. They depended on someone who was. Below we group the month’s main incidents by how the attackers got in, explain what would have helped, and close with a checklist and what it all means for organisations in Nigeria.
THE SHORT VERSION
Your vendors are your attack surface. A cloud outage in Japan hit 495 organisations, a contractor incident stopped every US bankruptcy court from sending notices, and a data vendor’s access exposed Denmark’s national population register.
Old, exposed devices are now a physical risk. Attackers warmed refrigeration units in about 700 French supermarkets through internet-exposed controllers.
Act this week: patch self-hosted BeyondTrust Remote Support (CVE-2026-102764), enforce phishing-resistant MFA for staff and vendors, and confirm you can meet Nigeria’s reporting clocks: 24 hours to the CBN for banks, and 72 hours to ngCERT and the NDPC.
On October 7, a ransomware attack disrupted IDCF Cloud, the cloud service run by SoftBank subsidiary IDC Frontier, after attackers hit its East Japan Region 1. The company said 495 companies and local governments using the service were affected. In its October 14 update, IDC Frontier said it had found no evidence that data was taken out. It did report that attackers viewed registration records for 48 customer companies in its cloud portal, including login IDs, hashed passwords and notification email addresses, but it found no sign those records were removed. Railway operators JR East and JR Kyushu separately said email-delivery data may have been exposed, which the company has not publicly reconciled with its own finding. Availability was the bigger harm. By October 14, only 194 of the 495 affected customers could retrieve their snapshot data, and at least one, Six Apart’s Movable Type cloud, is moving its customers to another provider from backups.
The pattern repeated in the US. A cyber incident at BAE Systems, which runs the Bankruptcy Noticing Center on behalf of the federal judiciary, halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the country. Separately, a breach at testing provider ETS (Educational Testing Service), which runs California’s Smarter Balanced and English-proficiency exams, exposed data on about 7 million students, including names, addresses, demographic information and disability status. Social Security numbers and financial data were not taken.
In Denmark, the way in was an authorised data vendor. An attacker misused the access of Pays ApS, an IT company permitted to query the national Central Register of Persons (CPR), and ran about 14 million automated searches between September 10 and 20. Danish authorities confirmed on October 5 that data on about 8.8 million people was affected. That is more than Denmark’s population of about 6 million because the register also holds records of deceased people and former residents; reports put the split at roughly 5.5 million living and 3.3 million deceased. Pays has confirmed its access was misused. The person claiming responsibility says at least three company accounts, including an administrator account, used the password “123456”; authorities have not confirmed that detail. The breach was spotted on October 2, when a government employee noticed an invoice showing unusually high activity.
In each case, the failure sat outside the customer’s direct control, but the accountability did not. Each organisation still owned the decision to depend on that provider, the access it granted, and the plan for when it failed.
Third-party risk is first-party risk. Concentration on a single provider turns one intrusion into hundreds of outages, and a vendor with standing access to your data is part of your attack surface. Due diligence should cover continuity and exit plans, the vendor’s own access controls (MFA, password policy, alerts on bulk queries) and contractual breach-notification timelines. Denmark’s breach was found through an invoice, not a security control.
MITRE ATT&CK: T1199 Trusted Relationship · T1078 Valid Accounts · T1486 Data Encrypted for Impact
The most unusual story came from France. Overnight on Sunday, October 11, attackers hijacked supermarket refrigeration controllers and triggered their defrost cycles, warming chilled and frozen display units and spoiling stock; some stores also reported fires. France’s Finance Minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected, including Intermarché, Netto, Carrefour and Monoprix stores. The Paris prosecutor’s cybercrime unit is investigating.
Most affected units ran refrigeration management software from Danfoss, which said most were older products that no longer received updates. The full picture is more mixed than “unpatchable”. France’s cybersecurity agency ANSSI also reported compromises involving Copeland modules; Claroty’s Team82 had disclosed flaws in both vendors’ controllers in August, including CVE-2025-41450 and CVE-2025-41451 in the Danfoss AK-SM 800A (fixed in firmware R4.3.1) and CVE-2026-25085 and CVE-2026-21718 in the Copeland XWEB Pro (fixed in firmware 1.13), with a Danfoss patch available since September 18; and one researcher counted 2,752 Danfoss systems exposed to the internet, 1,590 of them in France. Security researcher Bruce Schneier pointed out that connected devices that cannot be updated are vulnerable, and that updatable ones are not automatically safe either.
In a separate incident, Ahold Delhaize took its network offline after detecting a cyberattack. Websites, apps and customer service went down at Albert Heijn, Etos and Gall & Gall in the Netherlands, Delhaize in Belgium, and US chains including Stop & Shop, Hannaford and Food Lion, while stores stayed open. The company notified the Dutch National Cyber Security Centre within 24 hours. As of October 20, no group had claimed the attack and the company had found no evidence that sensitive customer, employee or partner data was stolen. Treat that as an early status update, not a final finding.
Devices that control physical processes (refrigeration, HVAC, building access, generators) need the same lifecycle management as servers: an inventory, patching, network segmentation, and a retirement date once vendor support ends. Check what is reachable from the internet the way an attacker would. If a device cannot be patched, it should not be reachable from the internet at all.
MITRE ATT&CK: ICS: T0883 Internet Accessible Device · T0831 Manipulation of Control
The largest personal-data story is cardiac monitoring company iRhythm Technologies, and it is another third-party case. Attackers used social engineering to reach third-party-hosted business applications and downloaded data between June 3 and June 8. After its forensic review, the company began notifying affected people on October 2, and its filing with the Oregon Department of Justice puts the total at 8,179,772 people. Exposed data includes names, contact details, dates of birth, insurance numbers, iRhythm account and device serial numbers, and dates of service. The company says its devices and clinical systems were not affected.
Utilities fared no better. CenterPoint Energy told the Texas Attorney General that 1,062,060 Texans were affected, with names, addresses, Social Security numbers and driver’s licence numbers exposed; a hacker separately claimed about 7.5 million records, which has not been verified. At Southern Company, an attacker reached the online customer portal and accessed about 400,000 accounts: roughly 300,000 Georgia Power and 100,000 Alabama Power customers, with Mississippi Power also affected. Exposed data included names, addresses, phone numbers, email addresses and the last four digits of Social Security numbers.
A caution: some very large numbers circulating online, such as a claim of 80 million patient records stolen from a South African laboratory, come from the attackers themselves and have not been independently verified. Extortion groups routinely inflate figures to increase pressure.
Health and identity data is long-lived: a date of birth or national identifier cannot be changed like a password. The most reliable way to limit a breach is to hold less data, for less time, and to watch the SaaS and business applications that hold it as closely as the core systems. Data minimisation and enforced retention schedules are security controls, not just compliance paperwork.
MITRE ATT&CK: T1566 Phishing (social engineering, iRhythm) · T1078 Valid Accounts. Techniques for the utility breaches have not been disclosed.
Small footholds keep turning into big incidents. Meta is notifying about 1,500 people, mostly US employees, after an outside group used one employee’s stolen credentials to access some of its GitHub repositories. Meta says about 99% of what was taken was source code; the personal data should never have been stored there under company policy. At AI coding-tool maker OpenCode, attackers stole the AI-provider API keys that 1.4% of OpenCode Console users had stored in their workspaces, then ran up charges on those users’ OpenAI, Anthropic and Google accounts, in some cases above $1,000. OpenCode says refunds are under way and has told affected users to revoke and reissue their keys.
The most serious technical story of the month is a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764 (CVSS 4.0 score 9.3, affecting versions 26.2.3 and earlier). It was exploited from August 29. Mandiant and Google Threat Intelligence attribute the activity to ARMORY CASTLE, a suspected China-nexus espionage group formerly tracked as UNC5221. Once inside, the actor gained root access, tried to harvest stored credentials and used the tool’s permissions to reach downstream systems. BeyondTrust released patches on October 8–9 under advisory BT26-05, applying them automatically to SaaS customers, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on October 16. Self-hosted customers should patch immediately and, given weeks of quiet exploitation, look for signs of compromise rather than assume patching closed the door. Google’s ARMORY CASTLE report lists indicators of compromise and hunting guidance.
Credentials and remote-access tools are now the front door. Standard MFA helps, but phishing-resistant MFA (FIDO2 security keys or passkeys) is what stops stolen-session and token-replay attacks. Keep remote-support and other management interfaces off the open internet, and treat secrets and personal data committed to code repositories as already exposed: scan for them continuously and rotate on discovery.
MITRE ATT&CK: T1078 Valid Accounts · T1190 Exploit Public-Facing Application · T1555 Credentials from Password Stores
Two stories show how far the supply chain now stretches. Researchers reported hidden implants in Ledger hardware wallets sold through CryptoBilis, a Malaysia-based reseller operating across Southeast Asia. Investigators describe an added circuit, powered by a smaller replacement battery, that captures the 24-word recovery phrase during setup and sends it out over a cellular connection. Ledger has confirmed that an affected customer’s device contained an unauthorised implant. On-chain analysts at Bitquery put the losses at about $93 million across 315 wallets, with other estimates ranging from $86 million to $103 million; Ledger has not verified any of these totals. In Europe, MediaMarktSaturn pulled Ledger devices from sale after a customer in Germany reported an implant. Owners of any hardware wallet bought outside official channels should follow their manufacturer’s guidance.
Meanwhile, Citizen Lab reported that Israeli adtech firm Discover-Tech was used to deliver Candiru spyware through targeted online adverts, a zero-click technique the researchers call “AdFection”. At least 45 devices belonging to Al Jazeera staff were targeted in 2024 and 2025; that figure counts targets, not confirmed infections. Discover-Tech ads were also found inside networks of NATO, the UN, EU institutions and at least 24 governments, which suggests device profiling even where no spyware was delivered.
If the device or the channel can be tampered with before it reaches you, trust has to be verified, not assumed. A manufacturer’s authenticity check confirms the secure chip is genuine, but it cannot see extra hardware added around it. Buy security hardware only from the manufacturer or an authorised channel, and treat any wallet bought elsewhere as compromised: move funds to a new device with a new recovery phrase. For high-risk staff (executives, journalists, finance teams), block ads at device and gateway level and enable Lockdown Mode or equivalent protections.
MITRE ATT&CK: T1195.003 Compromise Hardware Supply Chain · T1189 Drive-by Compromise
People inside the perimeter were a story too. The US Department of Justice announced the arrest of an OpenAI employee for allegedly installing a covert audio recording device in an executive conference room. OpenAI has dismissed him. Prosecutors allege the aim was to capture sensitive conversations about the company’s technology. Reporting on the complaint describes a recorder hidden in a roll of toilet paper and plugged into a television’s USB port, and says he used an internal productivity tool to look up meeting rooms and calendars. The allegations have not been tested in court.
Separately, the FBI disclosed in mid-October that it had searched more than 40 Texas homes in late September under Operation Lonestar Roundup. The homes allegedly hosted “laptop farms”: setups that help North Korean IT workers pose as remote employees at US companies, earning salaries and, in some cases, gaining access to company systems. A related Ohio indictment charges 14 people over a scheme that allegedly placed workers at more than 70 US companies and moved about $3 million to North Korean entities.
Insider risk is a hiring and access problem as much as a technology one. Verify remote hires’ identity on live video, confirm where company laptops actually connect from, flag unapproved remote-access software, watch for staff using internal tools to map rooms and executives’ calendars, and periodically check sensitive meeting rooms for unauthorised devices.
MITRE ATT&CK: T1219 Remote Access Tools · T1585 Establish Accounts (laptop farms). The recording-device case is a physical intrusion with no ATT&CK equivalent.
A Semperis survey of 1,200 IT and security professionals at organisations hit by ransomware found that 41% reported psychological or physical intimidation, and 37% said attackers had threatened employees’ friends or family members. A quarter reported that employees or relatives were doxxed, and 23% reported swatting. This is vendor research, so read it as a strong signal rather than a census. It fits a wider trend of gangs adding personal pressure and data theft as better-prepared organisations recover from backups and become less willing to pay.
Backups solve encryption, not extortion. Incident response plans now need a data-theft playbook and a staff-safety playbook: who supports an employee who is being doxxed or threatened, and who decides how the organisation responds.
MITRE ATT&CK: T1657 Financial Theft · T1567 Exfiltration Over Web Service · T1589 Gather Victim Identity Information
IDCF Cloud (Japan). Entry point: Ransomware at a shared cloud provider. Impact: 495 organisations disrupted. What would have helped: Vendor continuity and exit plans; multi-provider resilience.
BAE Systems / US courts. Entry point: Incident at a contractor. Impact: Bankruptcy notices halted nationwide. What would have helped: Third-party risk tiering; fallback processes.
Denmark CPR (via Pays ApS). Entry point: Misused vendor access; weak password reported. Impact: Data on ~8.8M people, living and deceased. What would have helped: MFA and banned passwords for vendors; alerts on bulk queries.
California testing vendor. Entry point: Third-party breach. Impact: ~7M student records. What would have helped: Data minimisation; contractual security requirements.
French supermarket refrigeration. Entry point: Internet-exposed, outdated controllers. Impact: ~700 stores; spoiled stock. What would have helped: OT inventory, patching, segmentation, retirement.
iRhythm. Entry point: Social engineering into third-party business apps. Impact: 8.2M people notified. What would have helped: Phishing-resistant MFA; SaaS access monitoring.
Meta GitHub. Entry point: Stolen employee credential. Impact: Source code; data on ~1,500 people. What would have helped: Phishing-resistant MFA; secret and PII scanning.
BeyondTrust Remote Support. Entry point: Zero-day CVE-2026-102764. Impact: Root access; credential theft. What would have helped: Fast patching; management interfaces off the internet.
Ledger wallets. Entry point: Tampering at a reseller. Impact: ~$93M reportedly drained. What would have helped: Buy direct; treat third-party devices as compromised.
Discover-Tech ads. Entry point: Malicious targeted adverts. Impact: ≥45 Al Jazeera devices targeted. What would have helped: Ad blocking; Lockdown Mode for high-risk staff.
Laptop farms. Entry point: Fraudulent remote hires. Impact: Insider access for a state-backed scheme. What would have helped: Identity verification; device location checks.
None of October’s headline incidents happened in Nigeria, but the same patterns have already played out here this year. In March and April, a group calling itself ByteToBreach claimed attacks on Sterling Bank and the Remita payments platform, and the Corporate Affairs Commission reported a cyberattack on April 15; the Nigeria Data Protection Commission (NDPC) has opened an investigation into the CAC breach. In July, Zenith Bank was listed by the ExfilSquad extortion group, and the bank later confirmed a data breach.
This section is general guidance, not legal advice. Confirm your specific obligations with your legal or compliance team.
HOW INFOASSURE CAN HELP
Infoassure helps organisations assess third-party and cloud dependency risk, review NDPA, CBN and Cybercrimes Act reporting readiness, and run incident response tabletop exercises that cover data theft and extortion. Talk to our team to find out where your weakest link is before an attacker does.
Email: [email protected] · Web: www.infoassureltd.com
This roundup reflects reporting up to October 22, 2026. Figures will keep moving as breach notifications arrive. We will update it in early November and record any corrections in this section.
Figures are as reported up to October 22, 2026. Where possible we link to the organisation’s own statement, a regulator, or the original research. Survey figures from security vendors are labelled as vendor research.
