Nearly 90,000 Exposed in Law Firm Attacks
Social engineering attacks at Baker McKenzie and Troutman Pepper Locke exposed nearly 90,000 people’s personal information.
Neither firm reported unauthorized system access, suggesting attackers obtained confidential documents by deceiving employees.
Employees may have legitimate reasons to access confidential files, but external transfers should require additional verification.
Require independent verification of sensitive file transfers and use DLP tools and policies to flag unusual external sharing.
Suspicious Activity Disrupts Sageworks Banking Services
Abrigo shut down its Sageworks lending platform after detecting suspicious activity, disrupting services for U.S. banks and credit unions.
Most services resumed by November 2, but borrower-facing functions remained down, with no confirmed cyberattack or breach.
I think the bigger concern for banks is whether loan records remained accurate during the outage.
Reconcile loan applications, verify records, and test borrower workflows before resuming operations.
3AM Ransomware Hits UK School
A 3AM ransomware affiliate encrypted 37 computers at a UK school after stealing credentials and linking three separate Active Directory domains.
Bitdefender researchers identified unusual command patterns suggesting possible AI assistance, although its involvement remains unconfirmed.
I think the focus on possible AI involvement risks overshadowing a more important concern. Attackers were able to expand their access by manipulating trust relationships that should have been tightly controlled.
Audit domain trusts, limit privileged access, and monitor Active Directory changes to prevent lateral movement.
Frontline Education Breach Exposes 1.3 Million People
Threat actors exploited a third-party software flaw to breach Frontline Education, potentially exposing 1.3 million people.
Compromised records included Social Security numbers and government identification details of students and school employees across multiple districts.
I think schools need to know exactly what information their vendors retain and how long they keep it.
Audit vendor data inventories, enforce retention limits, and require secure deletion of unnecessary records.
AI Threats Demand More Than Reactive Security
Agentic AI is challenging traditional security defenses as attacks become more adaptive and automated.
Historical incident data remains valuable, but relying on past attacks alone may leave organizations unprepared for emerging threats.
AI-assisted attack simulations can help find weaknesses, but they need to reflect your actual network configurations and security controls to produce meaningful results.
Test detection rules through controlled attack simulations to identify security gaps before expanding AI-driven automation.
Are You Ransomware Ready?
Ransomware attacks continue to threaten organizations by encrypting critical systems and disrupting business operations.
How to reduce ransomware risk:
- Deploy ransomware protection solutions and EDR tools to detect suspicious activity and prevent encryption.
- Enforce MFA, restrict privileged access, and segment networks to limit unauthorized access and lateral movement.
- Prioritize patching critical vulnerabilities and maintain tested offline or immutable backups to support recovery.
Combining preventive security controls with tested recovery plans helps minimize ransomware damage and business downtime.
NCSC Warns Hot Fridges Are Just the Beginning
The head of the UK’s National Cyber Security Centre, Richard Horne, has warned that Britain should expect AI-powered cyberattacks on critical infrastructure within the next two years, as European supermarkets suffer another wave of exploits against refrigerators.
The NCSC has revealed in its annual report that it received 1,831 reports of attacks on UK organisations between September 2025 and August 2026, up from 1,727 a year previously, yet Horne has said in a speech that the latest supermarket attacks are “just the foothills” of something bigger.
Operational Impact: Horne, as well as other NCSC officials, have argued that the supermarket exploits have relied on old vulnerabilities in outdated hardware, and that UK organisations have “collectively got away with tech on the cheap,” implying that they now must invest in greater security.
- Supermarket Sweep: This week’s supermarket hack has affected outlets in eight European countries, including Germany, Italy, Sweden, Ireland, the Netherlands, Finland and Belgium, while a small number of meat-processing firms in the UK were targeted.
- 2028: A ransomware cyberattack involving AI-powered malware on Britain’s critical infrastructure is “highly likely” by 2028 according to the NCSC’s report, which also warns of a “digital divide” between organisations that do and don’t harness AI for cyberdefence.
- The Spectre of Shadow AI: The NCSC also warns against shadow AI, which it argues could result in organisations losing sight in how sensitive data is handled and accessed, and which may undermine workforce competency in cybersecurity.
SMS of Death
A security researcher has disclosed a critical Android vulnerability (CVE-2026-58882) that, while patched in Google’s October update, would enable hackers to interrupt even emergency phone calls and cause Android devices to crash repeatedly.
Short But (Not) Sweet
Cloudflare has revealed that it mitigated 18.2 million network-layer DDoS attacks between July and September, marking a 208% increase over the same period last year, with actors increasingly favouring shorter, repeated attacks over sustained exploits.
Eye Spy
Dutch cybersecurity firm Eye Security and French counterpart HarfangLab have partnered to offer European enterprises a service that combines endpoint detection with managed security operations, with a full launch arriving early next year.
Refrigeration Hacks Put Blood Supplies at Risk
Hackers have apparently decided to literally make European blood boil.
France’s national blood service, EFS, says cybercriminals cranked up the thermostats at three sites storing plasma and blood samples. This comes as an epidemic of supermarket freezer hacks sweeps across Europe.
Fortunately, EFS’s alarms tripped in time. The attack targeted a third-party supplier, and staff intervened before any blood products were ruined.
European grocers weren’t so lucky. Retailers were forced to toss mountains of food after cooling controls were hijacked, with one Swedish store inadvertently baking its frozen goods at 122°F (50°C). It’s a brutal sequel to the October grocery store attacks in France we covered last month.
Meanwhile, the Pentagon is investigating whether August freezer failures at six US military bases were also cyber-sabotage.
IT teams must yank refrigeration controllers off the public internet, secure vendor access, and test independent temperature alarms.
Apparently, “keep refrigerated” now requires a firewall.
Hackers Sell AI Access, Victims Get the Bill
Cybercriminals are running illicit “LLM Mixers” to fence stolen enterprise AI access, leaving unsuspecting businesses holding the bag for astronomical cloud fees. Google and Mandiant researchers caught threat actors racking up over $100,000 in unauthorized usage in a single day, with some organizations bleeding $1 million before anyone noticed.
The kicker? Some victims hadn’t even turned on AI services yet. Hackers simply hijacked their cloud credentials and flipped the switch for them. To avoid tripping security alarms, attackers quietly validate stolen keys using microscopic, single-token requests before unleashing heavy inference workloads.
IT teams, scour your environments for exposed API keys, strangle model permissions, and slap hard budget caps on all cloud resources. If an AI service suddenly wakes up on its own, nuke those credentials from orbit.
Someone else’s “unlimited AI” tier shouldn’t be bankrolled by your corporate card.