Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. "Ahold Delhaize is experiencing a security issue within its network," it said at the time, adding that security teams, working to mitigate the issues, took "some" IT systems offline. READ MORE...
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. READ MORE...
Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California's Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department's behalf. READ MORE...
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info. The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. READ MORE...
Tech support scams seem like a dime a dozen these days, but researchers got an inside look at one long-running operation to see how cybercriminals are using legitimate tools and infrastructure to masquerade as Microsoft IT personnel. In a recent report, Infoblox detailed Help TDS [traffic distribution system], a malicious tool used by cybercriminals since 2017 to redirect Web traffic to their desired destinations. READ MORE...
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company's tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4. On 17 October, it updated the advisory to tell customers that version 4.0.9.8 resolves the issue. READ MORE...
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks. The supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, a Windows application for backing up data, cloning disks, and restoring systems. READ MORE...
Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the "Hey Meta" wake phrase. Users reported finding recordings and transcripts of conversations they did not knowingly save. Recording without anyone realizing raises privacy concerns for both the wearer and the people around them. The complaints surfaced on Reddit, where one owner described unexpected recordings occurring with three pairs of glasses. READ MORE...
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. As BBC News reports, detectives have linked the man to the 2024 attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient. The suspect, who has been named by German media only as "Vladimir K" was originally detained in May in Japan, after he travelled there on holiday. READ MORE...
Threat actors have been abusing open source AI platform Cairn to automate malicious operations against hundreds of websites worldwide, AI security firm Norforge reports. Cairn is a general-purpose problem-solving engine that can coordinate AI agents towards a set goal and can be used as an autonomous penetration testing engine. Each task in Cairn is considered a project, with an origin and a predefined goal, and agents work step by step from origin to goal. READ MORE...