this week in security — october 18 2026 edition

THIS WEEK, TL;DR

European supermarkets hit by mass-hack targeting refrigeration units
BBC News ($): We start this week in France, where unknown hackers caused thousands of refrigerator units in hundreds of supermarkets and grocery stores across the country and wider Europe to not only defrost but actively heat up and spoil the food inside. The Danish maker of refrigerators, Danfoss, said the models were older and no longer received security patches. The mass hacks resulted in huge food waste and caused massive disruption to food supplies. As hacks go, targeting the food supply is about as real-world as it gets — and there are still thousands of exposed fridges exposed to the internet. According to Bruce Schneier: "Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable." He already has a law named after him… so, is this Schneier's paradox?
More: Financial Times ($) | France24 | Clubic | Tom's Hardware | Ars Technica | RNZ | Seznam Zprávy | @GossiTheDog | @PogoWasRight | @dey | @fs0c131y 

Ahold Delhaize goes offline after detecting cyberattack, causing widespread outages
Grocery Dive: Food-related hacks also hit stateside this week, as grocery stores across the U.S., including Stop & Shop, Hannaford, and Food Lion, continue to experience website and app outages. This comes after Dutch parent company and supermarket operator Ahold Delhaize identified a cybersecurity incident and pulled its network offline. No known hacking group has taken credit (yet), but the company said it's restarting its systems and bringing them back into operation. Ahold Delhaize said there's no evidence of personal information taken… but it's early days and so don't hold your breath. 
More: Ahold Delhaize | Philadelphia Inquirer | SecurityWeek | 6ABC | Fox Business | Seafood Source | New Hampshire Union Leader | Bleeping Computer

OpenAI charged after allegedly planting covert recording device in conference room
San Francisco Standard: Gobsmacking details from OpenAI about an brazen insider threat, after a Saudi national on the product team allegedly planted a recording device in one of the company's executive conference rooms in its San Francisco office. OpenAI allegedly caught him in the act with a hidden camera. The suspicion is that the employee was conducting espionage — for whom it isn't clear, such as another company or a government. The FBI arrested and charged the employee, and OpenAI fired him. While the company called the recording device "sophisticated" in nature, it looks more like an off-the-shelf internet-connected microphone. 
More: Department of Justice | Wired ($) | Bloomberg ($) | Wall Street Journal ($) | Runa Sandvik | @OpenAINewsroom | @BNONews

Governments are using online ads to infect people with zero-click spyware
Citizen Lab: A "nightmare scenario" just came to pass: Government spyware can now infect phones and computers by simply displaying an online advert on someone's phone or computer. Citizen Lab found an Israeli ostensible adtech firm called Discover-Tech that they say pretty much only exists to give spyware makers a way of targeting and hacking specific people's devices with "zero-click" spyware — that's when it invisibly plants on your device without having to click or tap on anything. Citizen Lab found this company was used to launch spyware attacks on dozens of devices belonging to media organization Al Jazeera with the notorious Candiru zero-click spyware. Using an ad-blocker helps, but as threats go, this is a hair-raiser. More from Confiant.
More: Cyberscoop | Wired ($) | The Guardian | Reuters ($) | Politico

Someone is planting hidden implants in Trezor and Ledger hardware crypto wallets
Kim Zetter's Zero Day: Security researchers are sounding the alarm that some Trezor and Ledger customer hardware wallets, which are used to store seed phrases for securing crypto on the blockchain, may have been compromised by hackers who added an implant to their devices. The implant appears to allow the theft and transmission of those seed phrases over the cell network. The attacks appear to be "deliberately targeting authorized sellers" of the wallets. Around $100 million in crypto has been stolen so far as a result in recent weeks, likely in rapid succession as word of hacks spread quickly among the crypto community. This was spectacular reporting by Zetter.
More: Bleeping Computer | Bloomberg ($) | Decrypt | @Ledger

THE STUFF YOU MIGHT'VE MISSED

Meta admits personal data stolen during GitHub breach
SecurityWeek: The Facebook and Instagram owner is notifying ~1,500 people, mostly employees, that their personal information was compromised after hackers used an employee's stolen credentials to raid the company's GitHub repos. Much of the stolen data included product source code. Also in privacy lapses: Meta's "pervert glasses" were caught recording conversations without anyone using the wake-word to trigger the microphone. The company said the "issue has been resolved," without saying what the issue was or how it fixed it, which is all to say:

India's new privacy law leaves government power unchecked
Tech Policy Press: Five years after it became law, India's data protection law (akin to Europe's GDPR) will soon take effect across the world's largest population in May 2027. But the law has broad carve outs for police, law enforcement, and the government at large, setting up a legal challenge at India's top court. Here's a solid explainer of what's going down and why it matters.

The private-eye at the center of a climate hacking scandal
The New York Times ($): The Times profiles an alleged hacker, Amit Forlit, who was charged by U.S. authorities with overseeing a cyber operation aimed at discrediting environmental protectionists on behalf of oil companies Exxon (via a commissioning firm), which they deny. Forlit allegedly worked for Indian hacking-for-hire firms trying to stymie or end court cases, which relied on phishing and other hacks to target lawyers and victims. Reuters ($) has also done extensive reporting. 

Researchers reveal untethered iOS 27.0.1 jailbreak for iPhone 18
Heise: Researchers with @calif_io demonstrated an untethered jailbreak for the latest iOS 27 version for iPhone 18 at the HexaCon conference in Paris, showing it's possible to break out of Apple's security walled garden and also survive a device restart. Untethered means it doesn't need to be plugged into a computer to work, and can be exploited by opening a file — in this case a PDF. It's not clear what vulnerabilities were used to escape Apple's restrictions, but clearly be careful opening PDFs on your iPhone for the time being. (via @christopherkunz, @jonah, @bellis1000)

One-third of ransomware attacks involve threats, global survey found
Semperis: A new survey of 1,200 organizations hit by ransomware reveals about 37% of attacks (during the first-half of 2026) involve physical or psychological threats targeted at employees and their friends or family, such as doxxing, threatening messages, or swatting. The Register has some yarn, too. Throwback to a similar survey that I ran with DataBreaches.net earlier this year, which examined both the legal demands and criminal threats facing security researchers who investigate or remediate cyberattacks.

A look at the risks and resilience issues of under-sea internet cables 
APNIC: Here's a fascinating blog about the global collection of under-sea fiber optic cables that sit on the seabed but carry the bulk of the world's internet communications. The blog discusses some of the risks associated with sub-sea cables, such as chokepoints, where multiple cables meet, and the rising cost of repairs (especially amid espionage and sabotage).

AI agents aren't going "rogue." Model makers aren't doing the security basics
CSO Online: Always a good read from @metacurity, who dives into some bullsh*t-busting on the recent spate of AI models breaking out of their containment and hacking into companies. These aren't AI agents going "rogue," but instead these incidents should be attributed to "inexcusable failures on cybersecurity basics" by the AI model makers and the model testing companies.

OTHER NEWSY NUGGETS

Canada's big encryption squeeze: Canada's anti-encryption bill, C-22, is rapidly snaking its way through the country's parliament, which if passed will force companies to turn over customer data through a legally mandated backdoors. Some companies in Canada say they'll bail from the country if the bill passes, including Signal and some VPNs. (via Wired ($), Freedom of the Press Foundation, Mozilla, Citizen Lab) 

Hello? Yes, this is hacker: An interesting lawsuit alleges that hackers skirted the customer helpdesk of the Tennessee-based bank First Horizon, which allowed them to steal millions of dollars in fraudulent wire transfers from two companies. First Horizon claims the customer didn't employ an additional security feature of having a second person approve each transfer. Sure, this looks like a very Spiderman-meme situation but could be an interesting suit to watch for liability. (via American Banker ($), TraderKnows)

Feds slam Africa scam: Dozens of arrests were made across West Africa as part of a wide-scale operation aimed at cutting down on "scam centers." These are buildings packed with people, often trafficked, and forced into scam work. Some 3.4 million online accounts were seized during the raids. (via DOJ, ABC News, ITWeb Africa)

40 laptop farms found: Sticking with transnational crime… The DOJ seized dozens of devices after raiding at least 40 homes in Texas hosting "laptop farms," which are packed with laptops North Korean facilitators in the U.S. rely on to get real North Korean spies embedded in U.S. companies. Their goals are to earn a wage and steal data for the regime (which can be later used in extortion), but it's a growing problem that U.S. businesses continue to face. The FBI has an updated PSA report for your reading. We know this is a huge ongoing threat from North Korea, but the feds are only starting to get visibility into how far it actually goes. (via DOJ, CrowdStrike, Houston Public Media)

iRhythm hack hits 8+ million: A data breach at cardiac monitoring service iRhythm Technologies exposed the personal and health data of 8.1 million people, per state attorneys general filings. Also in big breaches: Utility giant CenterPoint Energy had a breach affecting over 1 million customers in Texas alone, including Social Security numbers. And: A hack on a third-party academic testing company exposed the names, addresses, disability status, and demographic data of all 7 million kids in California schools over the past three years… that's a really bad one. (via HIPAA Journal, DataBreaches.net, Politico)

Bankruptcy courts breached: A cyber incident at U.K. defense and IT giant BAE Systems took out the U.S. bankruptcy courts' ability to send out bankruptcy notices. The courts are calling it a "nationwide" disruption. (via Cyberscoop, U.S. Courts)

Kazakhstan hack-back: Hackers in Kazakhstan hacked a Russian oil refinery and spied on a local Russian government authority, in what researchers are saying is a rare case of a former Soviet state hacking the former Soviet state. It's also a little-known example of espionage outside of the classic bloc of cyber nation states. If Kazakhstan suddenly falls out of a window (heavy wink) we'll know why. (via Reuters ($), VirusBulletin [PDF])

Hackers crack OpenCode Console: A security breach allowed hackers to steal the API tokens of more than 1% of customers who use OpenCode Console (which is different from its coding agent.) @mattjay warned that some customers found that their AI tokens got burned up following the hack, leading to spikes in billing charges. It doesn't matter if it's a "legacy" system if your keys are still inside it, he explained. (via @opencode, @sudoingX)

THE HAPPY CORNER

Welcome back to the happy corner, the cool relief we all need after a spicy week in the world of cyber.

Someone made a web-based PBX phone that you can phreak to your heart's content! (As everyone over the age of 40 groans in collective aches and pains…) You can check out the Reddit thread for more.

This is really cool: tinylittleoffice.com is a web-based set of office tools by @ftrain, including a spreadsheet maker to a document editor, which works in your browser. The interesting thing here is that the document is the URL. That means the data you type in never leaves your computer, but that whatever you write/type or create can still be easily shared with a web address. It's private by default, which means by default nothing is stored on your device or anywhere else — just the URL. Here's an example. I love this so much. (h/t @masnick)

Here's an incredible blast from the past, 1998 edition: Someone found a bug in ICQ (a very early internet messaging app) that allowed anyone to log in with someone's account without knowing their password. Just enter any password that's 9-characters or more, and bingo!, thanks to an 8-character password overflow bug. 

Speaking of 30 years ago… MapQuest, the mapping site that you once relied on for printed directions, got an update this week allowing users to check out where surveillance cameras are located, including license plate readers like Flock. I wrote some words for the blog.

This week's bonus cybercat: "cat.exe has been installed successfully."

And this week's caption contest. Tell me what is going on in the photo below? (Mine: "Become ungovernable.") The best replies will go in next week's edition!

Have good news to share? Get in touch! this@weekinsecurity.com.

CYBER CATS & FRIENDS

This week's cyber cat is Lucy, who can be seen here showcasing the need to "trust but verify." Thanks so much to Robin L. for sending in!

SUGGESTION BOX

Thank you so much for reading this busy, packed edition of ~this week in security~, let's do this all over again next Sunday!

As always, please do reach out if you have any feedback for the newsletter, or if you have anything you want to flag with me for next week's edition. It's a real joy hearing from you, so don't be shy and say hello.

If you liked this newsletter, please share it on your social media!

Enjoy the rest of your weekend, and I hope you have a great week as well.

Catch you then,
@zackwhittaker