A French blood bank cyberattack targeted EFS plasma refrigeration units, altering temperature thresholds before emergency alarms prevented product loss.

Related Posts:

• APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits
• Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures
• mSecure Security Notification Prompts Password Resets

The post French Blood Bank Cyberattack Hits Plasma Storage appeared first on Daily CyberSecurity.

Borderless, the company that runs the US equities trading platform Stockal, has issued a statement responding to recent reports of a Stockal cyberattack in which unauthorized trades were placed in several customer accounts. The firm said it wanted to set out the facts and explain how it is assisting the customers who were affected.  According to Borderless, its US brokerage and custody partner, DriveWealth, flagged unauthorized trading in 13 customer accounts on October 16 (India time), which was October 15 during US market hours. Access to those accounts was restricted shortly afterwards to stop any further activity.  The company said an unauthorized third party appears to have logged into 26 customer accounts using valid credentials. In 13 of them, existing large-cap US equity holdings were sold, and the proceeds were used to buy thinly traded microcap securities. Borderless said its investigation so far shows that no funds were withdrawn. 

No Breach of Borderless Systems Found 

Borderless stated that it has found no evidence that its platform, interface, infrastructure or internal systems were breached or compromised in the cyberattack on Stockal. It has brought in independent cybersecurity specialists to examine its systems.  The company believes the account holders may have been targeted through a social engineering attack that used information exposed in another company's data breach several weeks earlier. However, it stressed that this link remains unconfirmed and under active investigation. 

Support for Customers Hit by the Stockal Cyberattack

Borderless called support for affected customers its immediate priority. Its teams have been in direct contact with them since shortly after the incident and are working with DriveWealth to establish the facts, review the transactions and explore "appropriate avenues for a fair resolution."  The company noted that this help is offered in good faith and "does not constitute an admission of liability, wrongdoing, negligence or responsibility for the unauthorized activity." It added that it will keep supporting customers while the facts and respective responsibilities are established. 

New Safeguards After the Stockal Cyberattack 

As a precaution, Borderless has introduced additional authentication and account-protection measures. Based on the information reviewed so far, it said the unauthorized trading identified was limited to the 13 accounts. It has found no evidence of threats to the wider Borderless platform, its other products or other customer accounts, and it continues to monitor its systems as the investigation progresses. 

Cooperation With Authorities 

Borderless said it is cooperating with relevant authorities and regulators over the Stockal cyberattack. It also clarified that it had responded substantively to media enquiries before reports were published, sharing the information it had at the time. The company said its statement reflects its current understanding and may be updated as further facts emerge.  The firm said transparency, accountability, and protecting customers' interests remain central to how it operates. It added that it built Borderless on the belief that customers deserve "a trusted, responsible & globally connected financial platform," and that it will keep communicating as verified information about the cyberattack on Stockal becomes available. 

The doors are open, but most of what happens inside a modern library has stopped. The Queens Public Library ransomware attack has knocked out computers, Wi-Fi, borrowing machines and the library's website across all 66 branches in the New York City borough. The library says a ransomware gang encrypted its systems, and as of Thursday evening, no group had taken credit. The library system serves Queens' 2.3 million residents. On Wednesday, it published several alerts confirming that the disruption was caused by a ransomware attack.

What the Queens Public Library Ransomware Attack Shut Down

In a statement on Instagram, the library described a network outage affecting every location. All branches remain open on schedule, but several services are unavailable:

• The library website, queenslibrary.org
• On-site computers
• Check-out and return machines
• Free Wi-Fi access
• The QPL mobile app
• Digital services, including digital media

[caption id="attachment_115271" align="aligncenter" width="600"] Image source- Instagram[/caption] Some virtual and in-person programmes may also be affected, and the library has asked visitors to check with their local branch. Renewals are unavailable during the outage. The library reminded customers that it does not charge late fines on borrowed materials. "Our IT department is working to resolve the issue, and we will keep you informed," the library said, adding that people can call (718) 990-0728 for help. When The Cyber Express tried to access the library's official website, it would not load and displayed the message "This site can't be reached." The Cyber Express reached out to the library for more information but had not received a response at the time of writing.

Why the Impact Reaches So Far

The scale of the system explains why an outage here matters. Queens Public Library is one of the largest library systems in the country, offering free access to more than 5 million books in 50 languages. Its reach also goes beyond its branches. It runs dozens of learning centres in public housing complexes across the borough, along with several mobile libraries. When on-site computers, free Wi-Fi and the website all go down at once, the services people come to a library for, beyond borrowing books, stop working too.

Libraries Have Been Hit Before

The Queens Public Library ransomware attack follows a series of incidents at other libraries, and the pattern of disruption looks familiar. In 2024, the Seattle Public Library faced a ransomware attack that crippled its computer systems. On May 28, libraries across South Seattle were noticeably quiet, with signs telling patrons that all computer services were down. That included computer terminals, printing and in-building Wi-Fi, which many library users rely on. In December 2023, officials confirmed that a cyberattack was behind branch closures and service disruptions at the London Public Library. Three of its sixteen branches, Carpenter, Lambeth and Glanworth, were closed until January 2. The library said it experienced a systems outage early on December 13, 2023, and that cybersecurity experts were engaged immediately. It worked with a third-party security firm to repair the damage. In October 2023, the British Library faced a major outage that first looked like a technical glitch but quickly grew into a widespread disruption. It affected online systems, including the website, and onsite services such as public Wi-Fi and phone lines. Across all four cases, the same things tend to go dark: public computers, Wi-Fi and websites. Each library cyberattack shows how much everyday library services now depend on networks that can be taken down in one go.

What Is Still Unknown About the Queens Public Library Ransomware Attack

Several key questions remain open. No ransomware gang has claimed responsibility, so it is not known who is behind the attack. The library has not said when services will be restored, whether any data was taken, or whether a ransom has been demanded. For now, the library's IT team is working on the issue, and updates are being shared through its social media channels.

The University of Texas at Arlington is investigating a cybersecurity incident that may have involved unauthorized activity in some of its information technology systems. The suspected UTA cyberattack came to light Thursday, when the university sent a notice to students and employees about the situation.  According to the notice, the incident has affected MachForms, an online form platform the university uses for several purposes, including event registrations, inquiries from prospective students, service requests, and surveys.  The university said it is still working to determine whether the UTA cyberattack has spread to other university systems or disrupted additional operations. 

Timeline of the UTA cyberattack  

Problems first appeared on Oct. 27, when MachForms became temporarily unavailable, according to the university's cybersecurity website. Technicians from the Office of Information Technology began investigating the issue at that time. On Wednesday, the office started corrective measures aimed at restoring services as soon as possible.  Since then, public information has been limited. As of Tuesday night, the cybersecurity website had not posted any updates since Thursday. 

What the University of Texas Is Asking Students and Employees to Do 

The university's email outlined several steps for students and staff to follow while the investigation into the cyberattack on UTA continues.  First, the university asked everyone to follow official guidance from the Office of Information Technology and the Information Security Office, and to pay close attention to university communications.  Second, anyone who notices suspicious activity, such as unusual computer behavior, a suspicious email or anything else that raises cybersecurity concerns, should report it to the Information Security Office at opsec@uta.edu.  Third, students and employees were told not to investigate the incident on their own or circulate unverified information. Questions should be directed to a department head or the Office of Information Technology, and people should rely on official updates for confirmed information. If a journalist reaches out, students and employees are asked to refer them to UTA's media relations team.  Finally, the notice asked the campus community to follow any additional instructions. If action involving passwords, devices, systems, or work practices becomes necessary, students and employees will receive specific guidance through official university channels.  MachForms remains affected for now. Students and employees who need access to the platform for urgent and significant operational needs can contact the Office of Information Technology service desk at uta.edu/help.  The University of Texas at Arlington has not said how long the investigation will take or when full service will be restored. 

Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia were throwing out spoiled food on Monday after their fridges and freezers stopped doing their job. In at least two cases, temperatures had been pushed to 50 degrees Celsius (122 degrees Fahrenheit). The apparent supermarket cyberattack came only weeks after attackers took control of cooling equipment in hundreds of stores across France. That raises an obvious question: why are supermarket freezers suddenly a target, and why now?

How the Supermarket Cyberattack Unfolded Across Europe

Sweden saw some of the clearest signs of tampering. ICA Group spokesperson Gustaf Nilsson told the TT news agency that "a limited number" of stores were affected overnight by an incident involving refrigeration systems. One ICA Kvantum store in Sjöbo, in southern Sweden, was more direct. In a Facebook post, it said its fridges and freezers had been hacked and set to 50 degrees Celsius, and that staff were discarding affected products. The Coop chain also reported problems with fridges and freezers at six stores in central Sweden, according to TT, though it did not immediately share details. In Belgium, Delhaize said an "IT incident" had affected refrigeration in several dozen stores, mostly in Belgium and a few in neighbouring Luxembourg. "In the affected stores, the range of fresh and frozen products is temporarily somewhat limited. Our distribution centers are operating normally, and there has been no disruption to deliveries to our stores," spokesperson Sarah De Meester said. Carrefour said a cyberattack targeting refrigeration had affected 15 of its more than 700 Belgian stores, and described the impact as "extremely limited. In Ireland, Musgrave Group said refrigeration systems in 13 SuperValu stores were affected by the "cyber incident." Chilled and frozen products were removed from sale as a precaution. By Monday afternoon, the company said the incident had been "fully resolved" and that restocking of chilled and frozen ranges was "well under way." In Estonia, refrigeration technology company Kitman Coldtech said attackers had accessed a computer controlling a client's refrigeration system and raised the temperature to 50 degrees Celsius, public broadcaster ERR reported. Chief executive Jann Mutso declined to name the store but said the attack was addressed within minutes and caused no significant damage. The Selver supermarket chain confirmed that one of its outlets was affected.

Is This Supermarket Cyberattack Linked to France?

None of the companies has publicly linked Monday's incidents to France, but the pattern is hard to miss. Last month, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France. They pushed fridge and freezer temperatures as high as 50 degrees Celsius. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, which kept units heating instead of cooling. By morning, tonnes of food had perished. Some equipment had melted, and in some stores the heat had sparked fires. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5% of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores. He added that some individual branches reported losses of about €250,000. Retailers say millions of euros' worth of food was spoiled, which makes food losses the most visible cost of the attack.

Why the Supermarket Cyberattack Targeted Fridges

The French case offers the strongest clue. The attack did not rely on a new exploit. It targeted ageing systems: internet-connected devices that were still online years after their manufacturer stopped supporting them. Experts say this weakness is common across retail and industry. The cyberattacks in France appeared to target old systems in particular. Timing made the damage worse. In France, the attackers struck while shops were closed, so temperatures kept rising for hours with no one in the store to notice. Monday's incidents in Sweden also happened overnight. Estonia shows the other side of the picture. There, the intrusion was caught within minutes and caused no significant damage. The difference between tonnes of ruined stock and almost no loss came down to how quickly someone noticed.

What We Still Don't Know

Key questions remain open. The reports do not say who is behind the attacks or what they want. The full scale is also unclear. Estimates for France range from around 400 to more than 500 stores, and ICA has not said how many of its Swedish stores were hit. The chains affected on Monday have not confirmed whether their equipment shares the ageing, unsupported setup seen in France. What is clear is that the same tactic has now reached at least five European countries, with fridge temperatures set to 50 degrees Celsius each time.

An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday.   The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Angeion Group LLC will contact affected individuals about submitting claims under Columbia's $16.1 million settlement over the breach. 

The Motive Behind Cyberattack 

In June 2025, the hacker told Bloomberg they were looking for evidence that Columbia still used affirmative action in admissions after the Supreme Court struck down the practice in 2023. The same hacker claimed responsibility for a March 2025 breach at New York University, where admissions data was posted to NYU's website. That data purported to show that Asian and white students admitted to NYU had higher average GPAs and test scores than admitted Black and Hispanic students.  About a month after the cyberattack on Columbia University, the school agreed to share applicants' admissions data with President Donald Trump's administration. The move was part of a broader deal to restore federal funding that had been canceled over allegations of campus antisemitism.  The hacker stole contact information, Social Security numbers, health data, and financial aid data belonging to around 870,000 Columbia applicants and affiliates. In September, the University agreed to pay $16.1 million to settle a class action lawsuit over the breach. 

Settlement Terms for the Cyberattack on Columbia University 

A federal court overseeing the settlement appointed Angeion Group, LLC, as claims administrator. The group has launched a website with settlement information and will send claim instructions to affected individuals. Columbia directed questions about the process to Angeion Group.  Each plaintiff may claim two years of credit monitoring services and either an estimated $100 payment or up to $8,500 in reimbursement for documented losses.  The court granted preliminary approval in September. Affected individuals have until Dec. 22 to submit objections, comments, or exclusions. An exclusion removes a person from the plaintiff group but preserves their right to take independent legal action against Columbia. Claims are due in late January, and a final approval hearing, where the court will review objections and decide whether the settlement is reasonable, is set for Feb. 23, 2027. 

Security Upgrades After the Columbia University Cyberattack 

In its Friday statement, Columbia said it took “proactive steps to strengthen our data security and governance practices” after the attack, adding that the settlement includes a commitment to further enhancing cybersecurity.  The University worked with cybersecurity companies to recover its compromised systems. In June, it said it was removing Social Security numbers of nonaffiliates from its systems “subject to relevant legal restrictions.”  A University official told Spectator that Columbia has since increased network segmentation, which divides networks into smaller sections to contain threats. The official said the school also deployed additional endpoint detection and response tools, which monitor systems in real time to flag unusual activity.  “We regret the concern that this incident has caused our community and believe the actions we have taken and commitments we have accepted in the agreement reflect the seriousness with which we are approaching this matter,” the statement concludes. 

A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak.

The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unauthorized external access to the Yonsei Portal Service,” the office stated.

What the Yonsei University Cyberattack Exposed 

The compromised data included student identification numbers, mobile phone numbers, and email addresses, along with system management details such as login identification keys and the number of failed password attempts on affected accounts. Resident registration numbers were not exposed. 

From 1 p.m. Thursday, affected individuals could check on Yonsei University’s official website which details were compromised. 

Two Hacking Attempts in Less Than a Day 

The cyberattack on Yonsei University reportedly began at around 7:41 p.m. on Tuesday. 

“An attack on the university’s system was detected at the time, and we immediately blocked the IP [internet provider] address,” a university representative told the JoongAng Ilbo. “While we were analyzing the cause at around 10 a.m. the following day, a second hacking attempt was made from a different IP address, which we also blocked.” 

Yonsei reported the incident to the Personal Information Protection Commission (PIPC) on Wednesday afternoon. The Personal Information Protection Act requires organizations to report a personal data breach within 72 hours of becoming aware of it and to notify affected individuals. 

“We plan to gather additional evidence related to the hacking attacks and refer the case to investigative authorities,” the representative said. 

The university also plans a comprehensive security review of its systems, along with stronger monitoring and security measures. It urged students and graduates to be wary of text messages, phone calls, and emails claiming to be from the university, and to avoid clicking links from unknown sources or entering personal information on suspicious websites. 

Sogang University and a Wider Pattern of Breaches 

The cyberattack on Yonsei University follows a series of attacks on higher education institutions. On Aug. 14, Sogang University suffered an external cyberattack that exposed approximately 180,000 records containing personal information of students, graduates, and university staff, according to a notice posted on the Sogang University website. 

The problem goes beyond recent cases. According to data the Ministry of Education submitted to People Power Party Rep. Kim Meen-geon, personal data breaches at universities affected 2.8 million people between 2022 and July this year. 

Calls for Support After Yonsei and Sogang University Incidents 

Experts have called for more cybersecurity personnel and greater funding as hacking attacks grow increasingly sophisticated, including through the use of AI. 

“Just as the government develops information security measures for small- and medium-sized businesses, it should establish support measures to strengthen cybersecurity at universities,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Support appears particularly necessary for private universities that lack sufficient funding for cybersecurity.” 

site-verification-ok

Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country.

The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The incident has also halted the BNC’s production and distribution of bankruptcy notices for the courts.

The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services.

Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record.

The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor.

West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records.

According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky’s case, exposure was limited to appellate court data stored within the C-Track infrastructure.

Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services.

In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.

site-verification-ok

Ahold Delhaize cyberattack took brand sites offline in Europe and the US. Albert Heijn outage ends as the app returns; no data theft found yet.

Related Posts:

• UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering
• UAT-6275 Threat Actor Targets CIS Governments Using WinRAR Exploit
• Microsoft and Proofpoint Disrupt CoGUI Phishing Kit, YAM Store, and Iron Man

The post Ahold Delhaize Cyberattack Knocks Brand Websites and Apps Offline in US and Europe appeared first on Daily CyberSecurity.

Overnight, while shoppers slept, hundreds of French supermarkets were quietly cooking their own stock. In a French supermarket cyberattack confirmed by retailers on Monday, hackers took remote control of internet-connected refrigeration systems and pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F). By morning, tonnes of food had perished, some equipment had melted, and in some stores the heat had sparked fires. The cyberattack did not rely on a new exploit. It targeted ageing connected devices that were still online years after their manufacturer stopped supporting them, a weakness experts say is common across retail and industry.

What Happened in the French Supermarket Cyberattack

The attackers struck when shops were closed, raising temperatures remotely through the refrigeration control systems. French TV channel BFM reported that they appeared to trigger a forced defrost option, keeping units heating instead of cooling. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. The full scale is still unclear. Some reports put the total above 500 shops. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores, with some individual branches reporting losses of about €250,000. Retailers say millions of euros worth of food was spoiled.

Danfoss Refrigeration Controllers at the Center

France's government cybersecurity agency, ANSSI, identified the targeted systems as Danfoss refrigeration controllers, including the AK-SM800 and AK-SC355 models. The Danish manufacturer told AFP that most affected units were legacy products running outdated firmware, and that it had previously advised supermarkets to update them. ANSSI has urged companies using the affected models to disconnect them from the internet or restrict access, and to install software updates immediately. Authorities have opened an investigation and are liaising with other European countries that may have been affected. It remains unclear who carried out the attack. The incident follows President Emmanuel Macron's order last month to protect France's critical infrastructure from Russian "hybrid attacks." Officials have not linked the supermarket attack to any group or country.

Exclusive: Why These Devices Were Left Exposed

In comments shared exclusively with The Cyber Express, Neil Carter, Managing Director of CRAReady.co.uk, explained why systems like these remain vulnerable for so long. "Most of these devices were never designed to be updated in the field. A supermarket refrigeration controller is installed by a contractor, commissioned once and then left alone for ten or fifteen years. Nobody owns it as an IT asset, so nobody is watching for firmware releases. There's also a mismatch in lifetimes. The hardware lasts far longer than the vendor's support for it. Danfoss ended support for the AK-SM 800 in 2021 and the AK-SC 355 in 2016, but those boxes were still running cold chains in 2026. The third problem is how they're connected. Remote access is added for the maintenance company's convenience and simply left open to the internet. Updating carries risk too: if a firmware update fails on a controller running a store's freezers overnight, the stock is lost. So the safest-looking choice is always to leave it alone."

A Night-Long Threat to the Cold Chain

The overnight timing turned a technical breach into a major cold chain failure. Mark Eccleston, Senior Software Engineer at OxBlue, pointed out on LinkedIn that a fridge can go about four hours without power before food is at risk. "Hackers got a whole night with hundreds of them," he wrote. Retailers were forced to discard fresh and frozen products to avoid health risks, and the incident has raised wider questions about how much of Europe's food supply depends on internet-connected equipment running legacy firmware.

What Businesses Should Learn From the French Supermarket Cyberattack

Carter outlined clear steps for businesses running connected equipment: "First, know what you have. Treat building and plant controllers as part of your attack surface and keep an inventory with support end dates. Second, nothing operational should be directly reachable from the internet. Remote maintenance should go through a VPN or be restricted to the contractor's addresses. Third, ask about end of life when you buy, not after. Under the EU Cyber Resilience Act, manufacturers will have to declare a support period that matches realistic product lifetimes. Buyers should already be asking for that in writing. This attack didn't need a zero-day. It needed old, forgotten kit on the open internet, and there's a lot of that out there."

Seoul National University (SNU) has been struck by 28 hacking incidents since 2021, and more than 1,100 pieces of personal information belonging to students, faculty and staff were exposed along the way. The SNU cyberattack figures come from data the university submitted on Sunday to Rep. Baek Seung-ah of the Democratic Party.  The breakdown shows eight attacks in 2021 and 10 in 2022, the highest annual total in the period. Activity then dropped sharply to a single incident in 2024 before rising again to five in 2025. Four more have been confirmed so far this year. Together, these yearly figures account for all 28 incidents, which means none were recorded in 2023.  Departmental systems were the most frequent target, hit in 19 of the 28 incidents. Laboratory systems came next with six, followed by research systems with two. One attack affected an institutionwide system. 

2021 SNU Cyberattack Behind Nearly All Leaked Data 

Across the six-year span, a total of 1,132 pieces of personal information were leaked. Almost all of them, 1,130 records, trace back to a single cyberattack in 2021. In that breach, hackers planted malicious software on SNU servers, which let them run commands remotely and steal personal details of university members, including their portal IDs.  The remaining two pieces of personal information were exposed in 2024, when attackers went after a university research institute. Their focus was on files containing researchers' biographies and résumés.  According to the data, no personal information leaks were confirmed in any of the other hacking incidents. 

Seoul National University Faces Hundreds of Attempts Every Year 

Beyond the confirmed breaches, the university has dealt with a steady stream of attempted intrusions, numbering more than 500 annually in recent years. SNU logged 561 hacking attempts in 2024 and 575 in 2025. Another 588 have been detected so far this year, already exceeding the totals of both previous years.  Explaining the numbers, the university said, "These figures represent hacking attempts detected and blocked through our security monitoring." It added, "We prevented the incidents from spreading through real-time responses and immediately completed the necessary security measures." 

How SNU Handled Reporting After Hacking Incidents 

On the question of reporting, SNU said it notified either the Ministry of Education or the Personal Information Protection Commission whenever a personal information leak was confirmed. However, the university has never requested an investigation by law enforcement authorities into any of the attacks.  The disclosure offers a clearer picture of the digital threats confronting a major South Korean university. While the number of successful breaches has fallen since its 2022 peak, the yearly count of attempted attacks has continued to climb.   That trend suggests the pressure on Seoul National University's networks remains significant, and the SNU cyberattack record is likely to keep questions about how the institution safeguards its community's data in focus. 

A massive French supermarket cyberattack targeted Danfoss refrigeration systems, causing catastrophic food spoilage and fires across 400 retail locations.

Related Posts:

• Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower
• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers

The post Massive Cyberattack Paralyzes French Supermarket Refrigeration appeared first on Daily CyberSecurity.

An attacker got into some of Andover's computer systems during the Andover cyberattack in August; Town officials confirmed Thursday, though they cannot yet say whether any data was taken.  "The Town has identified unauthorized access to certain systems and is continuing to determine the nature, scope, and sensitivity of any data that may have been accessed or acquired," Chief Communications Officer Phil Geoffroy said in written answers to Andover News.  Some reviewed material appears routine or publicly available, he said, but the full data set remains uncharacterized. 

What Is Known About the Andover Cyberattack 

It is the Town's clearest admission that the Aug. 13 cyberattack on Andover reached its systems, though not proof of copying, removal or publication.  Geoffroy did not identify the systems, say whether they belonged to the municipality or Andover Public Schools, or give a completion date. Investigators must check any accessed data for personally identifiable information, he said. Officials first secured and restored the network, reconnecting equipment, even printers, across municipal and school offices. Another update will come "if/when appropriate."  Town Counsel Doug Heim told the Select Board Sept. 28 that it was unclear whether state-protected information was involved. 

Investigators and Ransom Questions 

The Town hired law firm Constangy, Brooks, Smith & Prophete and cybersecurity firm Vector3 on the evening of Aug. 13. Vector3 is tracing how the attacker entered, reconstructing the attacker's activity, assessing whether data was accessed or removed, and helping monitor more than 3,000 devices.  On ransom demands or negotiations, Geoffroy said only that the Town "did not make or authorize any payments in connection with this incident." Vector3's agreement allowed up to $3,000 for possible communication with the attacker and monitoring of negotiation channels for up to 60 days, though its use is unconfirmed.  No culprit has been named. On Aug. 30, a ransomware group called WallStreet listed Andover as a purported victim on a dark-web site, which proves neither responsibility nor data theft.  Geoffroy would not name agencies notified: "The Town is coordinating with appropriate legal, forensic, and governmental partners as required and cannot comment on any law enforcement-related aspects of the event at this time."  If Chapter 93H, the Massachusetts breach law, applies, the Town must notify the Attorney General's Office, state regulators and affected people. That office had received no notice as of Sept. 22. 

Who Pays for the Cyberattack on Andover?

An Oct. 5 public records appeal response said the Town had received no bills and incurred no costs beyond its insurance policy, seemingly conflicting with agreements estimating at least $39,605 in initial Vector3 and Constangy work. The insurer pays them directly, Geoffroy said.  "Subject to the limits of our policy, Andover will bear no additional costs for these contractors and bills will be paid by our insurer," he said.  The policy covers up to $1 million for several categories of cyber expenses and $100,000 for cyber-extortion, with a $10,000 retention on most categories. The Town did not address overtime, replacement equipment, security upgrades or the retention. 

Town Defends Its Preparedness 

"Based on what is currently known, the Town does not believe this incident reflects a lack of investment in information technology or incident preparedness," Geoffroy said. He credited past spending on technology, cyber insurance and response planning with helping contain the attack, restore services and coordinate quickly, noting longer disruptions elsewhere.  The Andover cyberattack disrupted the municipal and school network for four days, with some restoration continuing afterward. Shared drives returned fully Aug. 21, and VPN access stayed down during its rebuild. Public safety, municipal buildings, phones and Town-operated utilities kept operating. 

Nihon Keizai Shimbun disclosed on October 4 that a Nikkei cyberattack had compromised employees' Microsoft 365 business software accounts. Attackers then used those accounts to send roughly 9,000 spoofed emails to people inside and outside the company.   The publisher also revealed a second, separate breach: a cloud service it uses had been accessed without authorization since late July, possibly exposing the personal information of 1,646 employees and business partners.  In a statement, the company said: "We deeply apologize for the inconvenience and concern caused to all those affected. We ask everyone to remain vigilant against suspicious emails while we continue our investigation. We take this incident seriously and will further strengthen our security measures to ensure thorough information management." 

How the Nikkei Cyberattack Unfolded?

A third party gained unauthorized access to the Microsoft 365 accounts that employees use for email and other work functions. On September 30, the attackers used the hijacked accounts to send about 9,000 emails containing links to malicious websites. The recipients included Nikkei staff as well as numerous external sources and contacts who had previously corresponded with employees.  Because the messages came from Nikkei's genuine accounts, the sender address alone gave recipients little reason for suspicion. The attack is believed to have exposed recipients' names and email addresses, along with the content of some messages.  Nikkei has since changed the affected passwords and says it has detected no further unauthorized logins. It has contacted each recipient individually and asked them to delete the emails. 

Google Workspace Breach Dates Back to July 

In a separate incident, outsiders also logged in to the Google Workspace cloud accounts that employees use for work. Since late July, names, email addresses and other information belonging to 1,646 people may have leaked. Nikkei learned of the problem in early August, when Google notified the company. According to Nikkei, the leaked data did not include information on readers or sources, and no secondary damage has been confirmed.  The incidents unfolded in this order: 

• Late July 2026: Unauthorized access to Google Workspace begins. 
• Early August 2026: Nikkei discovers the access after Google notifies it. 
• September 30, 2026: Attackers hijack Microsoft 365 accounts and send about 9,000 spoofed emails. 
• October 4, 2026: Nikkei announces the incidents publicly and reports them to the Personal Information Protection Commission. 

Nikkei Cyberattack Reported to Regulator 

Nikkei has reported both incidents to Japan's Personal Information Protection Commission. Under the Act on the Protection of Personal Information, organizations must report to the Commission and notify affected individuals when a breach caused by unauthorized access could harm people's rights and interests. Breaches affecting more than 1,000 people are also subject to mandatory reporting.   A preliminary report is due within roughly three to five days of discovery. A final report is due within 30 days, or within 60 days if the breach was carried out for malicious purposes. Nikkei is still investigating the full scope of the breach and the number of personal records involved.  The company warned that spoofed emails posing as Nikkei or group company staff may increase. It asked anyone who receives a suspicious message to contact it through its inquiry form. 

The Shinhan Bank cyberattack has exposed personal and financial information belonging to about 25,000 customers in South Korea, with investigators examining whether advanced artificial intelligence tools were used to carry out the intrusion. The leaked information reportedly includes customers’ names, phone numbers, loan borrowing details and annual income. South Korea’s Financial Supervisory Service has launched an emergency on-site inspection as authorities investigate how the breach occurred and whether the suspected use of AI points to a wider risk for financial institutions.

Shinhan Bank Cyberattack Under Investigation

Shinhan Bank said the information was leaked on Wednesday after hackers gained access to its systems. The bank immediately formed a response team and took measures aimed at limiting further damage. These measures included blocking access from external IP addresses and suspending the affected services. The bank said it had completed safety measures related to the incident. Sources cited in the reports said the attackers are suspected to be based overseas and may have used advanced AI tools during the attack. Experts said the bank may not have been specifically targeted, but could instead have been caught in attacks against vulnerable online platforms. The Financial Supervisory Service sent a team to the bank to examine the incident. Its investigation is expected to take months as officials determine the nature and extent of the data exposure.

AI Agent-Assisted Attacks Raise Concern

The suspected use of AI has added another concern to the Shinhan Bank breach. Cybersecurity experts said AI tools originally developed or shared for defensive purposes can also be adapted for malicious activity. Mun Chong-hyun, director at cybersecurity firm Genians, said several recent attacks in South Korea have involved such AI tools. He described the technology as a double-edged sword because capabilities created for cybersecurity can also be used to facilitate cybercrime. The concern is not limited to Shinhan Bank. An industry official said the wider financial sector could be exposed to AI agent-assisted attacks, and that financial institutions should conduct their own security checks to identify potential weaknesses and abnormal access attempts. The incident also highlights the type of information that can be exposed in attacks against banks. Unlike a breach involving only basic contact information, the Shinhan incident reportedly exposed both personal details and financial information.

South Korean Banks Face More Data Breaches

The Shinhan Bank cyberattack comes amid several recent incidents affecting South Korean lenders. KB Kookmin Bank said last Friday that personal information belonging to 119 customers had been leaked following an external intrusion. Hana Bank also reported a separate hack affecting 89 customers. South Korea’s Financial Services Commission has already held a meeting with local banks over the recent breaches and is expected to hold another meeting this week. The latest incidents have raised concerns about how AI-powered hacking could affect the financial sector, particularly if attackers can use automated tools to identify vulnerable systems or support attacks at greater scale. The Shinhan incident is relatively small compared with some of South Korea’s largest data breaches in terms of the number of affected people. However, the combination of personal and financial information makes the breach significant. Sungho Hwang, Korea country manager at NordVPN, said the exposed information could be used to create personalized scams. He also noted that generative AI has made such scams more convincing.

South Korea Faces Wider Cybersecurity Pressure

The banking incidents come as South Korea cyberattacks have increased across other sectors. Cyberattacks targeting South Korean military systems reached 18,951 cases in 2025, the highest annual figure in five years. The number was up 31 percent from 2024 and 108 percent from 2022. South Korea has also expanded its use of AI for defensive cybersecurity. The Ministry of Education and the Korea Education and Research Information Service operate an AI-based system designed to detect suspicious activity and issue automated alerts across 435 monitored institutions. In 2025, the system detected about 480 million potential cyber threat indicators, of which around 86,000 were confirmed as actual intrusions. As the investigation into the Shinhan Bank breach continues, the suspected role of AI is adding to concerns that financial institutions may need to account for increasingly automated forms of cyberattacks.

The Queensland government department in charge of the state's cybersecurity efforts has disclosed a loss of roughly $800,000 from a cyberattack during the last financial year. Details of the CDSB cyberattack, which involved a third-party messaging service being "misused" for financial gain, appear in the QLD cybersecurity department's latest annual report, released on Friday.  The Customer Services, Open Data, and Small and Family Business department (CDSB) directs the Queensland government's cybersecurity strategy, governance, policy and investment. According to its annual report, the department lost $809,000 during the 2025-26 financial year as "a result of an external cyberattack for financial gain." 

How the CDSB Cyberattack Unfolded?

The report said the breach did not reach sensitive records. No government data or sensitive information was compromised during the incident," it stated. "The department blocked the attack and engaged a third party to mitigate any further exposure."  A CDSB spokesperson told Information Age that the attackers had not been paid.  "In July 2025, a third-party messaging service used by the Queensland government was misused to generate an inflated number of unauthorised SMS messages for financial gain," the spokesperson said in a statement.  "... Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."  The spokesperson added that the Queensland government "is committed to protecting the security and resilience of its systems and services." 

Audit Found the QLD Cybersecurity Department 'Needs to Do More' 

The incident follows a Queensland Audit Office report, released in March, which found that CDSB "needs to do more" to help the state's public sector manage third-party cybersecurity risks.  Auditors found the QLD cybersecurity department was "not actively assessing and monitoring third-party cyber capability across the public sector," although improvements were in progress.  "The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks," the audit said. It noted that the Australian Signals Directorate (ASD), the federal cybersecurity agency, "has been raising these risks since 2021."  During testing, auditors gained the "highest level of access" to two Queensland government entities. They did not name either entity, to "avoid publicly identifying any security vulnerabilities."  CDSB addressed the audit in its annual report. "In our cybersecurity leadership role, we agreed to all relevant recommendations and progressed actions during the reporting period, including initiatives to strengthen whole‑of‑government cybersecurity capability," it said.  The report described cybersecurity as something that "remains a daily discipline" for CDSB and the wider Queensland government.  "Investing in, and securing Queensland's digital assets remains important, as cyber threats become more complex, and national incident data shows that malicious actors continue to target all sectors of the economy," it added. 

Queensland Tops Cybercrime Reports 

The CDSB cyberattack comes against a broader backdrop of cybercrime in the state. ASD's latest Annual Cyber Threat Report found that Queensland reported the highest share of Australia's cybercrime incidents in the 2024-25 financial year.  Queensland accounted for 28 per cent of national cybercrime reports. Victoria followed with 26 per cent and New South Wales with 22 per cent. ASD found these figures were "disproportionately higher" than the three states' respective populations when compared with other jurisdictions.  Average losses were highest elsewhere. "The Australian Capital Territory reported the highest average self-reported financial losses – around $37,700 per cybercrime report – followed by those in New South Wales, with around $33,000," the report said. 

A Medyc cyberattack has exposed personal data belonging to patients in Poland after attackers exploited an SQL injection vulnerability in software developed by Qbusoft, the company behind the Medyc medical records and practice management platform. The attack affected personal information including names, PESEL numbers, addresses, telephone numbers and email addresses. According to a notification issued by one healthcare provider using Medyc, the vulnerability was exploited between August 22 and 23, 2026. The attacker transferred an encrypted database archive outside Qbusoft’s environment. The incident was detected during the night of September 8 to 9.

How the Medyc Cyberattack Happened

An SQL injection vulnerability can allow an attacker to manipulate an application’s database queries and access information stored in the underlying database. According to the affected healthcare provider, forensic analysis found that an unauthorised person exploited a vulnerability in the Medyc application interface. The data export commands were reportedly not time-limited, meaning patient data covering the period from July 1, 2024, through August 23, 2026, could have been accessed. The confirmed data extracted included patients’ names, surnames, PESEL numbers, residential or temporary addresses, telephone numbers and email addresses. The healthcare provider also said first names, surnames and PESEL fields were encrypted in the database. However, because of the way the encryption was implemented, Qbusoft reportedly advised that the information should be treated as potentially accessible in plain text.

Medical Records Remain Under Investigation

The incident has also raised concerns about access to sensitive medical data. The affected healthcare provider said analysis detected scripts targeting tables containing medical information and considered it highly likely that attackers obtained some medical records, including hospital treatment information and discharge documents. However, Qbusoft later provided a different update. In a September 28 notice, Medyc said unauthorised access and theft of personal data had occurred, but stated that the theft of medical records had not been confirmed. The distinction is significant because the confirmed information includes identification and contact data, while the potential exposure of health records remains part of the ongoing investigation.

Qbusoft Takes Security Measures

Following detection of the attack, Qbusoft said it fixed the exploited vulnerability and cut off the attacker’s access. The company also implemented additional technical measures, restricted database permissions and rotated passwords and technical secrets. Its infrastructure was placed under continuous monitoring. Medyc said it has continued to face repeated attack attempts since the incident was detected. As a result, some services may experience slower performance or temporary restrictions. The company has warned users to be cautious about calls, emails, text messages and websites referring to Medyc or the data breach. Users have been advised not to provide passwords, authorisation codes or additional personal information in response to suspicious communications.

Polish Authorities Investigate the Incident

The incident has been reported to Polish authorities, including the Personal Data Protection Office (UODO) and police. Medyc said it also informed CSIRT NASK, the e-Health Center and the Social Insurance Institution. Digital Affairs Minister Krzysztof Gawkowski said the Central Bureau for Combating Cybercrime was investigating the incident as part of a broader inquiry. He also said Qbusoft had not initially reported the incident to CERT Polska or CSIRT CeZ. [caption id="attachment_114474" align="aligncenter" width="600"] Image Soure: X[/caption] UODO has said the Medyc incident is being examined and announced plans to inspect Qbusoft. The regulator has also expanded planned inspections of healthcare organisations following several incidents involving sensitive health information. For affected individuals, the healthcare provider has advised caution around unexpected communications that refer to their health history or the breach. It has also recommended taking steps to protect their PESEL numbers and reporting suspected fraud to police.

Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets. In the Duelbits crypto hack, the stolen assets were moved across four blockchains, and most of them were then converted into Ether.  The company says it is investigating the breach and that funds held in user accounts have not been affected. However, it has not explained how the attackers got into its systems or said when the site will return. 

How the Duelbits Cyberattack Unfolded 

Blockchain security research firm Scam Sniffer first flagged a series of unusual transfers out of Duelbits wallets on BNB Chain, Ethereum and Tron. Later, it spotted a further loss of 8.1 BTC from the casino's Bitcoin wallet.  All the affected wallets were hot wallets. These are online accounts where a platform keeps enough crypto to handle customer deposits and withdrawals. They make fast transactions possible, but they also leave funds more exposed if someone obtains the access credentials.  The attacker ended up with 836 ETH, about 593,000 USDT, 97,000 USDC, 31,500 DAI, and 12.4 billion SHIB. 

Co-Founder Confirms Duelbits Crypto Hack 

Duelbits co-founder Joe acknowledged the incident in a public post: 

Confirming a ~$7M hack. Still investigating exactly what happened and how.  Until we have clarity, Duelbits stays offline. User funds are safe.  Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.  I'll keep posting updates as I have them.  Duelbits will be back up asap.  Updates to follow" 

Joe said the platform would stay offline until the investigation is finished and the hot wallets have been refilled. No one has independently verified his claim that user funds are safe. 

Compromised Private Key Suspected 

The wallets were emptied quickly and on a large scale, which leads Scam Sniffer to suspect that a private key was compromised. A private key is the master credential for a crypto wallet. Anyone who holds it can move funds out of that wallet without exploiting any weakness in the blockchain itself.  Duelbits has not confirmed this explanation. 

Stolen Funds From Duelbits Cyberattack Swapped Into Ether 

Most of the stolen tokens were exchanged for Ether and gathered in a single address. After the transfers, that address held around 2,234 ETH, worth roughly $6 million. When the funds were traced, they had not moved any further.  Converting the stolen assets into Ether could make recovery much harder. The companies behind USDT and USDC can freeze those tokens. Ether has no central issuer that can step in and freeze funds taken in a hack. 

Unanswered Questions After the Duelbits Crypto Hack 

Several important questions remain open. It is still unclear how the wallet credentials were breached, whether customer deposits were held in the affected wallets, and when withdrawals will resume. Duelbits has not addressed these points so far.  Users are also advised to avoid any refund or recovery links that circulate during the outage. Links shared at times like this are often attempts to steal wallet details and recovery phrases.  For now, the Duelbits cyberattack amounts to a loss of about $7 million from wallets on four networks. Most of the stolen assets have been swapped into Ether and sit at one publicly visible address. 

A Burnaby School District cyberattack is being investigated after an incident disrupted internal network services and phone lines across the district. The Burnaby School District said the cyber incident came to its attention on Monday, September 21, and that staff are working to contain the incident and restore affected services. The district has not disclosed whether any personal or sensitive information was accessed or stolen. However, the disruption has raised concerns about potential data leaks as the investigation continues.

Burnaby School District Cyberattack Disrupts Operations

According to the district, the incident has affected some systems and operations, including internal network services and phone lines. Staff across Burnaby Schools are working to restore normal operations while limiting the impact on students. The district said the disruption has not affected student learning and that staff are working to ensure schools can continue supporting students. Families, staff, and district partners were contacted earlier in the week about the incident. The district said it will provide additional updates as efforts to contain the incident and restore services continue. The investigation remains ongoing, and the district has not provided further details about the nature of the incident, the suspected attackers, or whether information was compromised. The latest incident follows other school district cyberattacks and cybersecurity incidents that have disrupted education services and raised concerns about the security of student and staff information.

Education Sector Faces Repeated Cybersecurity Incidents

In September, The Cyber Express reported on the Springfield cyberattack, which disrupted school operations shortly after the start of the new academic year. The incident forced schools to close for part of the week and affected services relied on by families, including childcare and school meal programs. The district arranged grab-and-go meals at six locations while the YMCA of Greater Springfield provided full-day care for families enrolled in its programs. Students were expected to return to classrooms the following Monday. The Springfield incident highlighted how a cyberattack against school systems can extend beyond IT operations and affect essential services used by students and families. Earlier in 2026, a separate QLearn cybersecurity incident involving education technology provider Instructure affected educational institutions globally. Queensland Education Minister John-Paul Langbroek confirmed that the Queensland Department of Education had been briefed about the international breach. Early assessments indicated that the incident could affect more than 200 million people and more than 9,000 institutions worldwide.

Education Authority Cyberattack Targeted School Systems

In April 2026, an Education Authority cyberattack investigation found that attackers had gained targeted access to personal information linked to a small number of schools. Authorities identified the incident on April 10 after being alerted to suspicious activity affecting school systems. A forensic investigation later determined that attackers had accessed specific personal information associated with certain schools. The findings added to concerns surrounding cybersecurity risks in the education sector, where school networks can contain sensitive information belonging to students and staff. For the Burnaby School District, the current investigation is focused on containing the incident and restoring affected services. The district has not confirmed any data theft or provided details about possible unauthorized access. As the investigation progresses, further updates are expected from the district on the scope of the incident, affected systems and any potential impact on personal information.

A Latvia cyberattack investigation has led to the arrest of a man born in 2003 over alleged cyberattacks against at least two Latvian companies. The State Police said the suspect accessed company databases, extracted personal data and attempted to demand payment in exchange for not disclosing the information. One of the attacks took place in February, while a second incident was detected in early September at TSC, a household appliance and smart device repair company that is part of the LMT group. Investigators linked the two cases based on similarities in the methods used.

Latvia Cyberattack Investigation Links Two Cases

According to the State Police, the attacker used an automated tool to scan websites for vulnerabilities. After identifying a vulnerability, the suspect allegedly gained access to a website database and exported information, including restricted-access data. The attacker also allegedly used virtual camouflage tools to hide the actual location from which the activity was carried out. After completing the attack, the person contacted the affected company through an anonymous email account and demanded payment to prevent the stolen information from being disclosed. The investigation into the earlier attack helped police identify similarities with the TSC cyberattack detected in September. The State Police worked with LMT Security Service and CERT.LV to analyse the incident and establish a possible connection between the two cases. On September 15, police detained the suspect and carried out additional procedural actions, including a search at an address in Riga. Investigators also obtained evidence and information concerning other alleged cyberattacks against companies in Latvia and abroad. Those investigations are continuing.

TSC Cyberattack Exposed Customer Repair Data

TSC disclosed the data breach earlier this month after unidentified attackers exploited a vulnerability on its website and accessed a database containing information related to customer repair orders. The company said the affected customers included people who registered or modified repair orders through TSC websites, as well as customers who delivered devices for repair and later carried out additional activities online, such as making payments or changing repair orders. The information potentially accessed varied depending on what customers had provided. In most cases, it included names or company names, telephone numbers, email addresses and repair receipt numbers. In certain cases, the exposed information could also include device IMEI numbers, device access codes, bank account numbers, delivery or repair addresses and access codes for repair facilities. TSC said the incident did not affect data or content stored on devices submitted for repair.

Hacker Arrested as Investigation Continues

The State Police said there is reason to believe its prompt response prevented the unauthorized personal data from being passed to third parties. Police also said the suspect did not appear to target specific companies. Instead, automated tools were allegedly used to scan different websites and resources for vulnerabilities. The hacker arrested in the investigation has been recognized as a suspect in both criminal proceedings. Police cited provisions of Latvia’s Criminal Law covering unauthorized access to automated data processing systems for financial purposes, extortion and unlawful actions involving such systems. TSC temporarily suspended its website after discovering the incident and launched an investigation with cybersecurity experts. Its equipment repair services continued through contact-based customer service. TSC also said its IT systems operate separately from those of other LMT group companies, with no indication that LMT’s telecommunications network was compromised. The criminal investigation remains ongoing. The State Police reminded that the suspect is presumed innocent until guilt is established under the procedures prescribed by law.