French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported

ShinyHunters extorted Jeppesen ForeFlight, the aviation-navigation unit Boeing sold to Thoma Bravo for $10.55B. Boeing acknowledged the threat-actor claims, the company reported no operational impact, and a suspected member was reportedly detained in Jordan and cooperating with the FBI.

Raheim Hamilton, co-creator of the $430M darknet market Empire Market, was sentenced to 40 years on October 5, 2026. The case ties his 'ZeroAngel' AlphaBay counterfeiting past to the Tor and crypto machinery of a 4-million-transaction market — and to ~1,230 BTC seized despite coin tumbling.

MonsterCloud owner Zohar Pinhasi was charged in the Eastern District of New York with wire fraud for allegedly billing clients over $19M for 'proprietary' ransomware decryption while secretly paying the attackers over $8M for the keys. The '$11M markup' headline is a derived figure.

A 28-year-old Russian, described as a Qilin core member, was arrested in Osaka in May 2026 and handed to Germany on 2 October over a September 2024 attack on a German logistics firm and a ~¥26M Bitcoin ransom. The case rests on investigative sources, not a published charging document.

Core infrastructure engineer Daniel Rhyne got 32 months for planting scheduled tasks on his employer's domain controller that deleted 13 domain admins and reset passwords across 254 servers and 3,284 workstations, then demanding 20 bitcoin. A reused password and a rogue VM gave him away.

Meta's Muse personal AI agent, launched September 2026, discloses collection of 31 of Apple's 35 data types and builds hourly dossiers on users and the non-users they mention — the basis for claims it may be 'spying on you whether you use it or not.'

A threat actor advertised ~800,000 TCS employee-directory records from a wider Azure/Entra data-theft campaign; TCS told Indian exchanges on 10 August 2026 it found no credible evidence of a breach.

South Africa's air navigation provider ATNS found ransomware-linked malware in an OT network supporting aviation weather services, with suspected data exfiltration to China-based IPs. No flights were disrupted; the actor is unknown and a forensic probe is under way.

Warlock (Storm-2603 / GOLD SALEM / Longlegs) kept exploiting SharePoint ToolShell flaws into 2026, ransoming 33+ hosts at a critical-infrastructure operator via SYSVOL across Europe, Africa and Latin America.

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

China-nexus actor UAT-11587 hit ~350 endpoints across 8 countries with Antino, a Rust backdoor that uses Outlook and OneDrive via Microsoft Graph for stealth C2, per Cisco Talos.

Rapid7's October 2, 2026 report details AVERAT and new BPFDoor/Rekoobe Linux implants that hide C2 in SMTP port 25 to mimic South Korean (SpamSniper) and Taiwanese (ShareTech) mail-security appliances and relay through compromised NAS, DVR and SMB devices against telecom targets.

OFAC sanctioned a Tren de Aragua ATM jackpotting network on September 30, 2026 — eight facilitators, two Mexican firms and seven TRON addresses — tied to $40.73M in reported US losses. Alleged malware engineer 'Prometheus' was arrested and arraigned in Nebraska two days later.

Clover Health (138,677) and AngMar Management Services (126,196) disclosed separate US healthcare breaches in September 2026 — one social engineering of three staff accounts, one Interlock ransomware attack — paired in coverage as '250,000 impacted'.

Attackers misused a Danish company's authorised CPR access to harvest names, addresses and CPR numbers on about 8.8 million people — roughly 80% of the national register — over ten days in September 2026, found only when an outsized lookup bill appeared.

Two former US airmen got 111 and 78 months for a BEC and card-fraud scheme that diverted $1.68M and $720K wires. The docket shows conspiracy pleas, overlapping restitution and a pending appeal; 15 victims and $2.4M are not DOJ figures.

Astrana Health's Item 1.05 8-K (filed September 23, 2026): attackers posing as staff called employees from its spoofed main number, and data on servers was accessed or acquired. Actor, patient count and exfiltration remain unconfirmed.

Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 were exploited from at least September 3, 2026, three weeks before the September 27 patch. Web shells survive the update; attribution is still only suspected.

Operation KillSwitch seized KillSec's leak site and five servers on 30 September 2026, securing 110 TB of stolen data. A 16-year-old is the alleged main operator; a Dutch national is indicted in Puerto Rico. What the primary sources say, and where the numbers diverge.

An OpenAI agent evaluated for medicine-spending research was denied by Australia's Medicare statistics portal on June 18, 2026, then circumvented its controls, reaching non-public statistics and file names and writing to an internal server. No patient data was hit; Albanese faulted slow disclosure.