ENISA warns of cyberattacks on European refrigeration systems, exposing risks to supermarkets, food supplies and industrial controls. The European Union has issued a coordinated cybersecurity warning after a series of attacks hit commercial refrigeration systems in several Member States. The incidents, which began in October and continued with a new wave on November 1 and 2, have raised concerns about the security of equipment that plays an essential role in food distribution and other critical operations. In a joint statement published on November 4, ENISA, the European Commission, Europol and European cybersecurity coordination bodies urged organisations to take immediate steps to protect vulnerable systems. “Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.” reads the advisory. The warning highlights the need for “immediate action to mitigate exposure”, as attackers continue to target systems that are often overlooked in traditional cybersecurity strategies. The attacks have already had tangible consequences. In France, hackers targeted refrigeration management systems used by hundreds of supermarkets, remotely changing their settings and forcing freezers into continuous defrost mode. Some systems reportedly reached temperatures of up to 50 degrees Celsius, destroying large quantities of fresh and frozen food. According to reports, around 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were affected. Other retailers also reported disruptions to their cooling equipment. The French incidents also exposed a broader problem: the security of industrial control systems that manage physical processes. These systems are increasingly connected to corporate networks and remotely accessible, but they don’t always receive the same security attention as traditional IT infrastructure. BFMTV revealed the attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires. Targeted devices were older Danfoss refrigeration controllers that had reached the end of their support life and no longer received security updates. Other systems were running outdated firmware. Researchers had previously identified vulnerabilities in some Danfoss controllers, including weaknesses that could allow attackers to bypass authentication. However, authorities haven’t confirmed whether those specific flaws were exploited in the attacks. The European response reflects the fact that these incidents aren’t isolated technical problems. ENISA says national cybersecurity teams and EU crisis management authorities are sharing information and coordinating their investigations. The agencies also stress the importance of “rapid information-sharing” and a coordinated response to understand the scale of the campaign and help affected organisations. ENISA has also published a collection of technical advisories from national CSIRTs to help organisations identify the risks and apply appropriate protective measures. These recommendations are particularly relevant to companies operating refrigeration equipment, supermarkets, food distribution networks and other facilities that depend on industrial control systems. The statement also draws attention to existing European cybersecurity legislation. Since September 11, 2026, manufacturers of hardware and software products have been required to report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting Platform. The main cybersecurity requirements of the CRA will apply from December 11, 2027, requiring manufacturers to adopt security-by-design principles and provide security support throughout the product lifecycle, including timely vulnerability fixes. The NIS2 Directive also requires organisations within its scope to manage cybersecurity risks affecting their operations and report significant incidents to their national CSIRT or competent authority. ENISA is supporting these efforts through its Secure by Design and Default Playbook, technical advisories and initiatives aimed at improving product security across the European market. The refrigeration attacks are a reminder that cybersecurity failures can have consequences well beyond data theft or temporary IT outages. Manipulating an industrial controller can destroy food stocks, disrupt business operations and potentially affect services that people depend on every day. Organisations must therefore treat the security of operational technology as a core part of their risk management strategy, rather than an issue to address only after an incident. “The main cybersecurity requirements laid down in the Cyber Resilience Act (CRA) will apply as of 11 December 2027. Manufacturers of hardware and software products (‘products with digital elements’) will be required to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.” concludes the Agency’s advisory. “In addition, entities to which the NIS2 Directive (Directive (EU) 2022/2555) applies must implement measures to manage the cybersecurity risks to their operations, and report significant incidents to their national CSIRT or authority. Furthermore, ENISA is actively contributing to strengthening cybersecurity across the EU by promoting secure-by-design and secure-by-default principles in the EU market.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, refrigeration systems)
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed
Attackers target IT service desks to bypass MFA by impersonating employees and convincing staff to reset passwords or register new authentication devices. Specops Software explains why traditional identity verification methods are no longer sufficient and how organizations can secure account recovery against social engineering risks.
A cybersecurity incident forced UNM Health to divert ambulances, cancel appointments, and pause care while it contained the threat. On Monday, October 26, the University of New Mexico Health System (UNM Health) faced the kind of security incident that healthcare leaders dread: one serious enough to change how patients could receive emergency care. A major hospital network in New Mexico worked urgently on Monday to fix a cybersecurity problem. The issue forced it to send ambulances to other hospitals and left the state without a hospital emergency department able to treat the most serious injuries. UNM Health operates New Mexico’s only Level 1 trauma center. These centers treat the most serious and complex injuries. Even a temporary closure can put extra pressure on other hospitals. UNM Health runs New Mexico’s only Level 1 trauma center. That matters because a Level 1 center handles the most complex injuries, and losing even temporary access to it puts pressure on every nearby hospital. The organization told patients not to come to its main Albuquerque hospital and canceled appointments across more than 30 clinics. “The University of New Mexico Health System is experiencing a cybersecurity issue at this time. UNM Health officials are actively working to resolve this issue. Currently, all ambulance traffic is being diverted to other hospitals and all appointments at all clinics today have been cancelled. UNM Health patients should not show up to UNM Health facilities on October 26. Emergencies should be handled by 911 and non-emergencies should be delayed until further notice.” reads the update published by the organization on October 26, 2026. “The cybersecurity threat is affecting the entire University of New Mexico Health Sciences Center. “ UNM said its IT security teams identified the threat around 11 a.m. and began containment work. They later said the event affected some end-user devices but did not reach core systems or servers. Leadership activated an Emergency Operations Center, brought in outside support, and notified state and federal law enforcement. That is the right sequence: isolate first, investigate second, communicate continuously. From 12:30 to 2:30 p.m., UN Health temporarily stopped accepting new patients while teams protected the network. “System outages also required the suspension of outpatient surgeries and appointments for the remainder of the day.” This was not an abstract IT problem. Patients arrived for care and were told to reschedule. Staff had to explain, repeatedly, why a hospital visit could not proceed as planned. UNM also canceled classes at its Health Sciences Center and sent nonessential employees home. Medical, nursing, pharmacy, and population health students lost a day of instruction because the institution had to protect its network. Other providers stepped in. Presbyterian Healthcare Services and Lovelace Health System coordinated with UNM and took additional patients, which is exactly what a functioning regional healthcare system should do. UNM Health began restoring its systems on Monday afternoon. By the following day, hospitals, ambulance services and clinics were back to normal. The incident is still under criminal investigation. Employees reported messages claiming that patient, student and staff data had been stolen, but UNM has not confirmed this. The hospital also warned people to watch out for phishing and fraud attempts by attackers exploiting the incident. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, UNM Health)
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Share: Opens in a new window Opens in a new window Opens in a new window Press Release CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity Recommended mitigations reduce risk to exploitation of vulnerabilities and security weaknesses Released November 05, 2026 Related topics: Cybersecurity Best Practices , Cyber Threats and Response , Critical Infrastructure Security and Resilience WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DOT) published a fact sheet that warns organizations of ongoing cyber threat activity targeting industrial refrigeration and cold chain monitoring systems. Critical infrastructure sectors that widely use these systems include Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems.
Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes), the Russian group tied to the SVR foreign intelligence service. A watering hole is a site that attackers poison so visitors infect themselves. Sekoia found the campaign in mid-October 2026. It involved hacked or cloned high-profile websites in the US, Ukraine, the Czech Republic and Bulgaria. There’s also a supply-chain attack on a Ukrainian web analytics service, Plerdy, loaded by thousands of websites, most of them Ukrainian. The attackers used three different methods to reach victims, but all led to the same malicious payload. They injected JavaScript into hacked websites, created fake websites that copied legitimate ones and secretly added malicious code, and compromised the Plerdy analytics service to infect websites using its script. Sekoia first spotted the campaign on the website of a Ukrainian gas production company. Other compromised sites included a major US chemical industry association, a European far-right political party and a Bulgarian website linked to the military. In the Bulgarian case, attackers modified an existing JavaScript library without changing the website’s visible pages. Researchers found no clear pattern in the targeted organizations, although they believe some websites may have been selected to reach specific individuals. Sekoia also identified two fake websites designed to impersonate legitimate services. One copied America250, the US initiative marking the country’s 250th anniversary, while another reproduced the website of Raffles London at The OWO, a luxury hotel close to the UK Ministry of Defence and Downing Street. “The second website, theowo[.]club, now offline, acted as a reverse proxy for the website of Raffles London at The OWO, a prestigious luxury hotel housed in the historic Old War Office building.” reads the report published by Sekoia. “The hotel’s location is particularly noteworthy because of its proximity to some of the United Kingdom’s most sensitive government institutions, including the Ministry of Defence and 10 Downing Street, the official residence and office of the British Prime Minister.” The hotel connection is particularly interesting because Ukrainian President Volodymyr Zelensky reportedly stayed there during a visit to London on October 14. Sekoia believes the fake website may have been used to target diplomatic delegations through spear-phishing, but stresses that this remains an unconfirmed possibility. Between August 27 and September 3, 2026, the attackers compromised the Plerdy tracker at a.plerdy[.]com. For a week, visitors loaded both Plerdy’s script and the attackers’ profiling script. Several affected sites relate to the military and military recruitment, including army, special forces and military equipment websites. “Between 27 August and 3 September 2026, the intrusion set compromised the Ukrainian Plerdy analytics tracker hosted under the domain a.plerdy[.]com, which is loaded by thousands of websites, the large majority of them Ukrainian.” reads the report. “It remains unclear whether the attackers intended to target visitors to specific websites or sought to compromise as many unpatched mobile devices as possible, indiscriminately exfiltrating data before selectively identifying and exploiting information of interest.” Sekoia can’t say whether the aim was specific visitors or as many unpatched phones as possible, with the sorting done later. It also considers that the attackers may have used Plerdy after failing to inject code directly into Ukrainian high-value sites that relied on it. The Plerdy payload pointed to a load-balancing domain that sent traffic across several delivery servers. The profiling script, which the attackers call UltimateFingerprinter, is attached to a minified AngularJS library that makes up 98 percent of a 2.3 MB file. Sekoia thinks that bulk might stop analysis by large language models, or make the script look legitimate. The script runs 61 collectors that build 394 fields, then sends them to a server that decides whether to answer with exploit code. Strangely, almost none of that data matters. Only implausible screen sizes, like 99999, or a device reporting zero touch points block delivery. Sekoia doesn’t know why the attackers collect so much and sees no sign the data was used later. Sekoia pulled three exploit chains from the delivery server. Class A hits iOS 16.7 and steals cookies. Class B hits iOS 18.5 and takes full device data. Class C hits Android Chrome versions 139 to 145, minus 143 for reasons Sekoia can’t explain, and steals Chrome cookies and Wi-Fi passwords. “During the investigation, we tested different browser profiles against the fingerprinting endpoint at static[.]flux-telemetry[.]com in order to retrieve the exploits served to visitors.” states the report. “This allowed us to retrieve three complete exploit chains (afternamed A, B and C), along with their final payloads, targeting both Android and iOS. Here is a summary of what we found:” Class B is DarkSword, which Sekoia describes as a suspected iOS exploit kit from a commercial surveillance vendor, uploaded to VirusTotal in September 2026. It takes text messages and iMessages, Mail indexes, voicemail, WhatsApp and Telegram databases, Keychain passwords and tokens, account credentials and Wi-Fi keys. It also takes contacts, call history, calendar, notes, Safari history and cookies, location caches, Health data, photos and iCloud Drive. The Android payload, which Sekoia calls AndroSnitch, collects Chrome cookies, saved logins and history, plus Wi-Fi settings. It stops on one phone model, the Samsung Galaxy S25 Ultra. It resembles a 2024 payload that Google TAG documented, called AndroSnatch, but the sample is too small to prove lineage. The iOS cookie chains set a marker cookie meant to block reinfection for a day, but a coding mistake makes it expire in a minute. All stolen data goes to ad.starx-net[.]com:8881/telemetry/v12. None of the chains persist on the device. All of them rely on known flaws, and none uses a zero-day. For attribution, Sekoia has several threads. A CERT said a compromised site’s backend files held traces matching a private report on a 2025 APT29 watering hole campaign, and Google TAG said the framework resembles an APT29 campaign against Mongolian government websites in 2024. Victims also skew to Europe and the US with a focus on Ukraine, infrastructure sits across multiple hosters, and a hacked Czech far-right site fits APT29’s record of targeting European political parties. It rates the link moderate to high confidence, and it’s coordinating with the CERTs of affected countries. The campaign shows how exploit kits move down the market. Sekoia says state-backed groups keep reusing frameworks from commercial surveillance vendors such as DarkSword, and that packaged exploit chains lower the cost and skill needed for advanced mobile attacks. It expects such reuse to become more frequent. The good news is that Sekoia’s attackers don’t have fresh tricks. Every flaw was fixed by its vendor before the campaign began, and none works against fully updated devices. “None of them contain zero-days or work against fully updated devices. Each flaw was resolved by the respective vendor before this campaign began. This operation targets unpatched devices using n-days; a user running an up-to-date operating system is safe from these attacks.” concludes the report. “This watering hole campaign, which we assess with moderate to high confidence to be linked to APT29, combines multiple web delivery vectors with n-day mobile exploit chains targeting Android and iOS devices. Across the directly compromised websites, no single sectoral targeting pattern emerges from our analysis. While the victimology shows a focus on Ukraine and the United States, the inclusion of unrelated entities such as an Australian medical clinic complicates a broad strategic interpretation. However, we assess that these websites may have been selected to profile and infect specific individuals of interest based on targeting intelligence to which we do not have visibility. The operators adapted by deploying Adversary-in-the-Middle-ish to intercept visitors associated with diplomatic or high-profile events.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, APT29)
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. To cause the persistent denial-of-service (DoS), the app triggers a vulnerability that researchers dubbed 'GhostMap' that makes Android map a file into an unallocated memory region. The affected process crashes when it attempts to read from that region. Romanian cybersecurity company Bitdefender discovered the flaw while analyzing an Android banking trojan that kept crashing its emulators when it tried to read an application resource. The researchers demonstrated the vulnerability by creating an app that contains no executable code, requests no permissions on installation, and does not need to be launched on the device. According to the company, Google has been aware of GhostMap since August but closed the issue without releasing a patch, classifying it as "not reproducible."
A Canadian man was extradited to the U.S. to face charges over hacking universities and hijacking their computers to mine cryptocurrency. A Canadian man, Ryan James Roach (35), has been extradicted to the United States to face charges tied to a hacking operation that targeted universities and other schools. Roach was extradited on October 28 and now faces federal charges alongside Mathiew James Stubbings, 41, of Ontario. The indictment alleges that, from June 2016 to December 2019, the two men hacked computers, stole login details, and used victims’ machines to mine cryptocurrency for themselves. “They used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials.” DoJ states. “Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts. Some of the computers damaged by the defendants were located at an institution of higher learning in the Western District of New York.” The targets were not random home PCs. Prosecutors say the pair went after U.S. schools with supercomputers, including institutions in New York, Tennessee, North Carolina and Massachusetts. Some affected computers belonged to a higher-education institution in western New York. “To carry out the scheme, Roach and Stubbings surreptitiously accessed victim computers without authorization, deployed malware to gain control, stole victim login credentials, exfiltrated the data to servers that they controlled, and forcing victim computers to use their processing power to mine cryptocurrency for the financial benefit of the defendants.” DoJ continues. That is a lot of effort to turn someone else’s research hardware into a personal crypto rig. The alleged method was also more involved than a single phishing email. The indictment says they looked for weaknesses in victims’ networks, used servers and compromised machines from one victim to hide their tracks, and then moved through the network once inside. The duo used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network. The charges include conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentional damage to a protected computer. Each carries up to 10 years in prison and a $250,000 fine. Prosecutors also allege the pair damaged at least 10 protected computers in one year and caused at least $5,000 in losses. Roach appeared before U.S. Magistrate Judge Mark W. Pedersen and is being held pending a detention hearing. Extradition proceedings for Stubbings continue in Canada. The FBI, the Justice Department’s Computer Crime and Intellectual Property Section, and the Office of International Affairs worked on the case. For security teams, the useful part is not the alleged crypto-mining. It is the reminder that universities remain attractive targets because they hold powerful computing resources, broad networks, and plenty of people with access. Patch quickly, watch for unusual processing load, and treat credential theft as a serious incident rather than a nuisance. “The fact that a defendant has been charged with a crime is merely an accusation and the defendant is presumed innocent until and unless proven guilty.” DoJ concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, University Supercomputers)
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a
October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption. Below, we examine five
Confirm this action.
Leaving now will discard your changes.