Thirty-one days, 438 incidents, one attack every 100 minutes. This infographic distills October 2026 into a single scroll. Cyber Crime was the loudest motive, while nearly half of all attacks left their motivation unknown. Malware led the arsenal, exploited public-facing applications opened the most doors, and Information & Communication took the brunt of targeting.

October 2026 closed with 438 recorded cyber incidents. Cyber Crime drove 44.1% of them, while nearly half of all motivations remained undetermined. Malware led the named attack techniques at 15.7%, ahead of Vulnerability Exploitation and Account Takeover. Exploiting public-facing applications was again the top initial access vector, and Information & Communication was the most targeted sector. The report breaks down motivations, attack vectors, initial access, sectors and geography.

Hackers are targeting outdated iPhones and Android phones through infected websites to steal passwords and sensitive data. Here's how to protect your device.

The post Hackers Target iPhones and Android Phones: Here’s What We Know appeared first on TechRepublic.

Hackers altered refrigeration controls at three French blood service sites, but staff protected plasma supplies and prevented damage to blood products.

Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems.   The disclosure adds to a wave of airline cyberattacks that has now hit at least 15 carriers across Asia, Europe and Australia, and it highlights how cyberattacks on airlines reach passengers through shared third-party platforms rather than airlines' own networks. 

What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident 

SIA briefed the media on 3 November 2026. According to the airline, most of the affected records contained passengers' names, booking reference numbers, travel itineraries and booking classes.  A smaller group of about 620 records carried more sensitive details. For these, email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been viewed.  The airline said no bank account or credit card data was exposed and no bookings were altered. SIA also stated that its own IT systems were not breached. It is reaching out directly to affected customers who have upcoming trips so they can change their booking reference numbers. 

Cathay Pacific: 53,000 Bookings Accessed Over Three Years 

Cathay Pacific went public with its own statement on 30 October 2026, updated at 16:11 HKT (GMT+8) that day. The Hong Kong carrier said Amadeus first notified it on 28 October 2026 and shared further details on 29 October.  According to Cathay, an unauthorized party had gained access to travel reservation data in Amadeus's systems "using login credentials assigned to its system account." Data supplied by Amadeus showed that around 53,000 Cathay Pacific bookings were affected, with the unauthorized access running from August 2023 to September 2026.  In most cases, the exposed information covers booking references, passenger names, and flight details. In a smaller subset, email and phone contacts, travel document details, and frequent flyer numbers may also have been accessed. Cathay said there is no evidence that financial or payment data was touched.  The airline said Amadeus has contained the incident, including through a password reset, and has added enhanced monitoring and detection on its systems. Amadeus has so far found no evidence that the data has been misused.  Cathay stressed that the incident "has not impacted and is not impacting" its own systems or operations. It has informed the relevant authorities that they are still analyzing the information from Amadeus and plans to notify affected customers individually once the details are confirmed. "We apologise to our customers for the concern and inconvenience caused by this incident," the airline said. 

Malaysia Airlines Urges Vigilance 

Malaysia Airlines issued its notice on 31 October 2026, describing Amadeus as its third-party airline reservation technology provider. The carrier said some customer information processed through Amadeus between August 2023, and September 2026 may have been affected.  The airline said its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It is working with Amadeus and other relevant parties to investigate and gauge the impact.  As a precaution, Malaysia Airlines asked customers to stay alert to suspicious or unsolicited messages, "particularly those requesting personal or financial information." The carrier said it would share further updates as more information emerges. 

Japanese and Korean Carriers Report Similar Airline Cyberattacks 

Japan Airlines (JAL) reported earlier that Amadeus had informed it of unauthorized access to reservation records for both JAL and Japan Transocean Air flights. About 92,000 customers were affected, making JAL the hardest-hit carrier so far. Names, booking references, and flight information were exposed.  Korean Air and Asiana Airlines also confirmed unauthorized access to data managed by Amadeus. Both said there was no evidence that their internal systems or databases had been breached. 

How Amadeus Explains the Breach 

Amadeus has attributed the exposure to a software glitch that made certain booking-display data accessible. That explanation sits alongside Cathay Pacific's account, which describes an unauthorized party using system account login credentials.  The company said its investigation is continuing and that it has found no evidence of payment or financial information was accessed. Amadeus also said there is no sign that the vulnerability was used for ransomware. It has since rolled out fixes, together with stronger monitoring and detection measures. 

The Full Reach of These Cyberattacks on Airlines 

At least 15 international airlines are either confirmed as directly affected or are investigating possible customer data exposure from the supply-chain attack on the Spanish IT and reservations company. Because the breach hit a centralized booking display environment, it reached flag carriers as well as the regional partners that route reservations through them. 

Major carriers with confirmed exposure 

Airline	Reported impact
Japan Airlines (JAL)	About 92,000 passenger records
Cathay Pacific Airways	About 53,000 passenger bookings
Singapore Airlines (SIA)	About 46,000 booking records
All Nippon Airways (ANA)	Up to 37,800 customer profiles
Malaysia Airlines	Customer data exposed across August 2023 to September 2026
Korean Air	Unauthorised access to customer reservation databases
Asiana Airlines	Passenger booking references exposed through system account credentials
Condor Airlines	Part of the German leisure carrier's international flight data accessed

 

Regional and subsidiary carriers 

Several smaller airlines were drawn in because they share back-end ticketing technology or corporate ties with the larger groups: 

Airline	Link to the breach
Japan Transocean Air (JTA)	Affected through parent company Japan Airlines
Air Do	Affected through shared system pathways with ANA
StarFlyer	Affected through shared system pathways with ANA
Solaseed Air	Affected through shared system pathways with ANA
Ibex Airlines	Still determining the scope of exposure via its ANA integration
Oriental Air Bridge	Still determining the scope of exposure via its ANA integration

Under investigation 

Qantas Airways is formally investigating whether any Australian customer files were compromised. The airline maintains that its internal databases have not been breached. 

What the Amadeus Cybersecurity Incident Means for Travelers? 

With the access window stretching from August 2023 to September 2026, the Amadeus cybersecurity incident spans more than three years and stands out among airline cyberattacks for how many carriers it touched through a single provider. None of the affected carriers has reported misuse of the data so far, and no airline has said payment details were taken.   Even so, names, itineraries and booking references can be enough for convincing phishing attempts. That is why carriers such as Malaysia Airlines and SIA are asking passengers to watch for suspicious messages and, where advised, change their booking references.   As investigations continue, more airlines may update their figures on how far these cyberattacks on airlines have reached. 

Mandiant warns that enterprise LLMJacking cloud attacks drain API quotas. Attackers use LLMJacking cloud attacks to resell access via illicit mixer portals.

Related Posts:

• Kimsuky Operation GitPower Staging Infrastructure Stays Live on GitHub
• Binance Hack Report Details Fake Job Interview, AI Tool Abuse and EIP-7702 Wallet Drain
• Kaspersky Uncovers CyberStrikeAI Framework Attacks on Schools

The post Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks appeared first on Daily CyberSecurity.

Suspected cyberattacks disrupted refrigeration across seven European countries. Learn how stores were affected and what EMEA retailers should do next.

The post European Supermarket Freezers Set to 122°F in Suspected Hacks appeared first on TechRepublic.

mSeven Software, the developer of the mSecure password manager, has advised customers to secure all confidential data stored in the app after detecting “suspicious activity.” The notice provides minimal technical details. The email is dated November 3, 2026. It says mSeven “recently learned of suspicious activity associated with the mSecure password management application.” The company […]

The post mSecure Password Manager Reports Suspicious Activity, Urges Users to Change All Stored Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers changed refrigeration settings at European supermarkets, forcing stores to discard produce, while UK suppliers reported attacks on…

Binance explains how North Korean hackers used fake job interviews, malicious developer tools and an internal AI tool…

Bitdefender details a 3AM ransomware attack on a UK school estate that encrypted 37 systems, with command timing suggesting possible AI-assisted troubleshooting.

Follow the cyber attacks of November 2026 as they happen. This live HACKMAGEDDON dashboard is updated every day with newly vetted incidents. It shows the leading motivations, attack vectors, targeted sectors and countries on an interactive map, plus a filterable, searchable timeline linking to each source.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

A new wave of fridge cyberattacks hit supermarket refrigeration systems across five European countries, raising temperatures and causing food losses.

A new wave of fridge cyberattacks has affected supermarket refrigeration systems in several European countries. Fridges and freezers suddenly rose in temperature overnight, with some incidents suspected to be caused by hackers. On Monday, November 2, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg. Swedish supermarket chains ICA and Coop also reported similar problems.

“Ahold Delhaize and Colruyt said on Monday that an IT ​incident overnight hit fridges and freezers in dozens of stores in Belgium and Luxembourg, while Swedish grocers ‌ICA and Coop reported similar temperature spikes, with one store blaming a cyberattack.” Reuters states.

BREAKING: Swedish grocery giant ICA, one of Sweden's largest supermarket chains, says several of its stores have been hit by a cyberattack overnight, causing refrigerators and freezers to be remotely set to 50°C.

The incident has likely resulted in large quantities of food… pic.twitter.com/wrcmGHw1qV

— GeoInsider (@InsiderGeo) November 2, 2026

“Problems were discovered at several grocery stores in Sweden overnight Monday.” reported Sweden Herald.

“We are aware that a limited number of stores were affected by an incident overnight that affected their refrigeration and freezer systems. Ica is providing support in handling the incident, Ica Group press officer Gustaf Nilsson tells TT.”

The latest incidents follow a similar wave of fridge cyberattacks in France last month. In mid-October, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.

The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out.

The attack caused fires and food losses. However, cybersecurity consultant Emil Olofsson of Integrity 360 told Swedish news agency TT that temperatures reached 80°C in some cases and several units caught fire. This figure differs from the one reported by police.

ICA Kvantum in Sjöbo said on Facebook that a cyberattack caused the refrigeration problems. ICA Hägerstensåsen in Stockholm was also reportedly affected. According to the Sjöbo store, the temperature inside its fridges and freezers rose to 50°C.

In Belgium, Delhaize detected unusual temperature increases in its refrigeration systems on Monday. Spokesperson Sarah De Meester said the company is investigating the incident.

Stephan Moelans, CEO of Sabcobel, the company that manages Delhaize’s refrigeration systems, told news agency Belga that hackers had switched the units’ evaporators to defrost mode. His office declined to comment to Reuters. Colruyt Group, which operates Spar stores in Belgium through a franchise system, said five stores had suffered attacks on their refrigeration systems. Meanwhile, Belgian newspaper Le Soir reported that dozens of Delhaize and Carrefour stores were affected.

UPDATE: REFRIGERATION DISRUPTIONS SPREAD ACROSS EUROPE – SWEDEN AND BELGIUM AFFECTED

IN SWEDEN:
• At least 6 ICA supermarkets affected by suspected refrigeration system hacks.
• Coop has now CONFIRMED that 6 of its stores in central Sweden are also affected.
• Freezer… https://t.co/a3oGMrGdmz pic.twitter.com/8Q3CFDDLhT

— Coffe Report (@CoffeReport) November 2, 2026

It follows a similar attack in France last month. Police said hackers seized control of the cooling units at hundreds of supermarkets and raised temperatures as high as 50 degrees Celsius (122 Fahrenheit), which caused fires and food losses. Cybersecurity consultant Emil Olofsson of Integrity 360 told TT, Sweden’s news agency, that temperatures there reached 80 degrees and some units caught fire, a figure that differs from the police number.

In Belgium, Delhaize noticed temperature increases in its cooling systems on Monday, spokesperson Sarah De Meester said, and the company is investigating. Stephan Moelans, CEO of the refrigeration firm Sabcobel, which runs Delhaize’s systems, told the news agency Belga it was a cyberattack that switched the units’ evaporators to defrost mode. His office declined to comment to Reuters. Colruyt Group, which runs Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked, and Le Soir reported that dozens of Delhaize and Carrefour stores were affected.

Ahold also reported a cybersecurity incident to Dutch police last month, after it detected suspicious activity in its infrastructure. Nothing in the reporting ties that report to Monday’s incident.

Fridges and freezers at dozens of supermarkets in Belgium and Sweden overheated overnight in a suspected cyberattack, similar to the one that hit French stores three weeks ago. Delhaize calls it an "IT incident."

Delhaize said about 40 of its Belgian stores were affected… pic.twitter.com/qzw6uDybWb

— The Informant (@theinformant_x) November 2, 2026

In Sweden, John Billow, head of the national cybersecurity centre, told Reuters his team was working on several incidents involving refrigeration systems in grocery stores around the country. An ICA Kvantum store in Sjöbo said on Facebook that a cyberattack caused its problems, and an ICA store told its followers that its temperatures had been “hacked” overnight and set to 50 degrees. Fifty degrees is fine for a beach and poor for ice cream. That store later said it had opened.

At ICA Baronen in Stockholm, a notice said all the freezers were broken because of a cyberattack. The sales manager said the attack came at 2 a.m. and staff noticed it at 5:30 a.m. ICA Hägerstensåsen in Stockholm was reportedly hit too.

ICA said only a limited number of stores were affected and that it is helping them deal with the incident. However, press officer Gustaf Nilsson did not say how many stores were involved.

Coop told Swedish news agencies Aftonbladet and TT that six stores in central Sweden had similar problems. Press manager Carlos Cancino said it was still unclear whether any food would need to be thrown away or whether the refrigeration units had simply stopped working or had switched to heating mode. He also did not rule out further incidents affecting other stores.

An Estonian supermarket chain was also affected. Its refrigeration systems were reportedly set to 50°C, technology provider Kitman Coldtech told public broadcaster ERR. CEO Jann Mutso did not reveal the name of the supermarket chain, saying: “This is very recent. It happened this morning.”

How did the attackers get in? In France, Olofsson says they obtained login details for the control systems, which were exposed directly to the internet. He says the attack targeted a product that controls the cooling systems and that the hack isn’t very complicated, so amateurs may have carried it out.

Billow says Swedish authorities have noticed in recent weeks that quite a lot of exposed operational technology devices exist in Sweden, and they’ve been clear that these must be updated or patched.

Refrigerators and heating systems, security cameras and alarm networks were once largely mechanical, and now they can be monitored and controlled remotely. That gives cybercriminals new openings. Authorities haven’t said who was behind last month’s incidents, and nobody has claimed responsibility.

The Sweden Herald reported that the cause of the attacks on Swedish supermarkets remains unknown.

Update 20:00 Rome Time

The company at the center of the European supermarket refrigeration cyberattacks is Danfoss the same company whose refrigeration systems were targeted during the cyberattacks in France a few weeks ago.

Danfoss says the incidents are primarily exploiting vulnerabilities in… pic.twitter.com/3tDNVMOyhn

— GeoInsider (@InsiderGeo) November 2, 2026

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, fridge cyberattacks)

Emergency alert app cyberattacks in Russia and Ukraine triggered a series of false warnings, including alerts about air raids, radiation threats, chemical attacks and alleged nuclear strikes. Ukrainian authorities said their air raid warning application had been affected, while Russian officials reported a separate attack on their emergency alert app hours later. The incidents raised concerns about the reliability of digital public warning systems during an ongoing conflict. According to BBC live reporting, Ukraine's air raid app issued false red-level air raid warnings nationwide. Some residents, including people in Kyiv, also received warnings about radiation, chemical attacks and street fighting. Ukrainian authorities cancelled the alerts within an hour and urged residents to disregard suspicious messages. Russia subsequently reported that its emergency alert app had also been targeted. The extent of the false warnings distributed through the Russian application remained unclear.

Emergency Alert App Cyberattacks Trigger False Warnings

Ukraine was the first to report problems with its emergency alert application, which is supported by the country's Ministry of Digital Transformation and provides notifications about the beginning and end of air defence alerts. Following the incident, the Ukrainian Air Force said the application had probably experienced hostile interference. It specifically denied that Kyiv faced the radiation threat indicated by the false alerts and asked residents to remain calm and follow official updates. Ukraine's Centre for Strategic Communications also urged users to disregard strange messages appearing in the application. The centre blamed Russia for the incident in a post on X and highlighted an alert containing a message in Russian about the Oreshnik missile system. The supplied reporting does not establish how the attackers gained access to the application or how the false messages were inserted into the alert system.

Russia's Emergency App Issues False Nuclear Warning

Several hours after Ukraine reported the incident, Russian authorities said their emergency alert application had suffered what they described as a massive cyberattack. One false message reportedly warned Russian residents that nuclear warheads mounted on P1-Suns, identified in the message as a Ukrainian attack drone, had been launched towards all regions of Russia. The alert also instructed people to stock up on food for three weeks and hide. A Ukrainian espionage group claimed that fake nuclear strike warnings had been sent to users in Russia. However, the available reporting did not independently establish who was responsible for the Russian application incident. Russia's emergencies ministry said the mobile application was an additional information service and that the wider public warning system continued to operate normally. The ministry said emergency information was also distributed through sirens, loudspeakers, text messages, television and radio broadcasts. It added that specialists were working to restore the application and described the situation as under control.

Cybersecurity Expert Warns of Further Attacks

Herbert Lin, a senior research scholar specialising in cyber policy and security at Stanford University, described the reported compromise of Ukraine's air raid warning application as concerning. Speaking to the BBC's Newsday programme, Lin said he believed it was the first time an official Ukrainian information application had experienced such an incident. He warned that similar attacks could occur again but stressed that the method used to compromise the application was not yet known. The incident highlights the potential consequences of interference with emergency alert systems, which are designed to deliver time-sensitive information to people facing security threats. False warnings can create uncertainty about whether a reported threat is genuine, particularly when residents rely on mobile applications for immediate updates during military attacks. However, the supplied reporting does not establish the wider impact of the incidents on public behaviour or emergency response operations.

False Alerts Coincide With End of Kherson Ceasefire

The false warnings in Ukraine appeared just minutes before the scheduled end of a localised ceasefire in the frontline Kherson region, according to BBC reporting. The six-day ceasefire involving the area around Oleshky, which has been under Russian occupation since 2022, had enabled hundreds of people to evacuate. The arrangement was brokered with assistance from US First Lady Melania Trump and Pope Leo XIV. Both sides had accused each other of using the ceasefire period to strengthen their frontline positions. Ukrainian officials said the humanitarian operation could provide a basis for further solutions, although the Kremlin viewed such operations as separate from the wider peace process. The timing of the false alerts was reported, but the available information does not establish that the cyber incidents were connected to the ceasefire or its conclusion.

Russia and Ukraine Continue Exchanging Energy Strikes

The reported cyberattacks on Russia and Ukraine occurred amid continued strikes against energy infrastructure on both sides. Russian authorities reported drone strikes against an industrial enterprise east of Moscow, identified by Ukrainian media as the Kstovo oil refinery. Nizhny Novgorod regional governor Gleb Nikitin reported significant damage, possible power outages and reduced hot water supplies. One woman was reportedly injured by falling drone debris. Ukrainian President Volodymyr Zelensky also said Russian strikes had hit energy infrastructure in four Ukrainian regions, leaving hundreds of thousands of homes without power. The emergency application incidents add another layer of concern to the conflict, where digital information services are used to communicate immediate threats to civilians. Investigations into the reported attacks, including who was responsible and how the applications were compromised, remain unresolved in the supplied reporting.

The Cloudflare DDoS report Q3 2026 reveals 18.2M network attacks, a 208% surge in short-burst floods, and a major shift toward DNS and UDP attacks.

Related Posts:

• Chinese Hackers Deploy Chrome Zero-Day Exploit Chain
• NCSC Warns of Physical Disruptions from Cyberattacks on OT Systems
• Google Tracks Russian Cyber Espionage Clusters

The post Cloudflare DDoS Report Shows 18.2 Million Network Attacks in Q3 2026 appeared first on Daily CyberSecurity.

Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas.

A hacker has leaked 115 GB of Summit Public Schools data containing billions of lines, student and staff…

NorForge uncovered 20+ exposed Cairn AI panels showing how threat actors use the Cairn AI hacking tool to breach e-commerce and payment sites.

Related Posts:

• Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets
• GMO Desktop Cloud Breach Exposes 26,000 FX Servers
• Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign

The post Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets appeared first on Daily CyberSecurity.