Incident
US grocery giant Ahold Delhaize takes systems offline after cyberattack
Ongoing — updated 12 October
One of the largest supermarket groups in the world, behind Stop & Shop, Food Lion and other US banners, confirmed it is dealing with a cybersecurity incident and deliberately took systems offline as a precaution. Stores stayed open but online shopping, pharmacies and internal systems took the hit. The incident is still active.
The lesson: shutting everything down fast is expensive but it is often the only move that stops an intruder spreading. Recovery planning matters as much as prevention.
Breach
ASOS confirms data breach through a third-party platform
8 October
The British online fashion retailer confirmed hackers compromised a third-party communications platform, letting them send rogue emails that looked like they came from ASOS. Customer contact data was exposed in the process. ASOS is a household name in the UK, which makes this one worth watching if you have an account.
The lesson: an email "from" a real company is not proof it is real. Treat unexpected attachments and links with suspicion even from brands you trust, and check whether your password appears in breach data with our Breach Database Search tool.
BreachSupply Chain
8.7 million karaoke users exposed in Daiichi Kosho supplier breach
12 October
Japan's largest karaoke operator confirmed a breach at one of its suppliers exposed personal data belonging to roughly 8.7 million users. The company itself was not directly hacked, the supplier was. It joins a string of Japanese firms from insurers to telecoms hit in recent months.
The lesson: your data is only as safe as the weakest company holding it. Give every service a unique email or alias where possible so one leak does not unlock everything.
Trend
Japan sounds the alarm as data leaks hit millions
12 October
Japan's ruling party described the situation as a "state of emergency in cyber space" after a wave of attacks on Japanese organisations leaked data from millions of customers. Security researchers traced many of the intrusions to two things: abused APIs in mobile apps and unpatched Metabase dashboards left exposed to the internet.
The lesson: forgotten dashboards and unattended APIs are behind a scary number of breaches. If you run anything internet-facing, inventory it and patch it, or take it down.
Breach
More US law firms disclose breaches — Holland & Knight and Squire Patton Boggs
9 October
Two more large American law firms disclosed data security breaches, continuing a pattern of attacks on the legal sector through 2026. Law firms are prime targets because they hold privileged client documents, deal information and identities all in one place.
The lesson: sensitive documents are often most exposed at the most trusted third party. Where you can, ask the firms you deal with how they secure your files.
TrendFraud
Seven South Korean banks hit, and a $19M "recovery" fraud case
9 October
Seven South Korean banks were reported hit by cyberattacks in a coordinated stretch of incidents, and separately a case came to light involving roughly $19 million lost to fraudsters posing as ransomware recovery specialists, charging victims for "help" that either never came or made things worse.
The lesson: after any incident, be doubly suspicious of anyone who contacts you offering to fix it. Recovery scammers hunt the desperate.