Hackers Triggered Supermarket Freezers Across France

iRhythm — a digital health company that makes wearable heart monitors and uses cloud software to turn that data into medical insights — is notifying at least 360,000 patients that their personal information was stolen, according to SecurityWeek.

The attackers got in through third-party business applications that stored patient records. Between 3 and 8 June, they quietly pulled out names, addresses, email addresses, dates of birth, phone numbers, insurance numbers, device serial numbers, and account data before anyone noticed. On 9 June, the company received a ransom demand threatening to publish the stolen records online.

iRhythm says there is currently no evidence the data has been used to commit identity theft. That careful phrasing — paired with no public confirmation of a refusal to pay — suggests the ransom was settled quietly.

The confirmed figure of 360,000 comes from state-level regulatory filings in Texas and South Carolina alone. The real total is almost certainly higher.

What to do: If you are an iRhythm patient, watch for phishing emails using your personal details to appear legitimate. Consider placing a free credit freeze with all three major credit bureaus as a precaution — it costs nothing and stops anyone opening new accounts in your name.

Attackers remotely triggered the defrost function on refrigeration units inside roughly 400 French supermarkets overnight Sunday, spoiling fresh food across hundreds of stores, according to The Record.

The targets were refrigeration controllers made by Danish manufacturer Danfoss. Older versions of the software were reportedly what the attackers went after. Researchers at Claroty had previously found that a compromised controller can cut cooling while still showing normal temperatures on staff dashboards — meaning the damage was done before anyone knew something was wrong.

France's national cybersecurity agency, ANSSI, confirmed it was responding at both national and European level. The Coopérative U chief executive called the attack "unprecedented" and "of extreme gravity."

This is a textbook operational technology attack: the goal was not to steal data but to cause immediate, physical harm to food supply infrastructure.

What to do: If your organisation uses internet-connected industrial control systems of any kind, this is a direct reminder to audit which devices are exposed online and ensure older software versions are patched or replaced.

CVE ID not confirmed in source — check the original advisory before acting.

What Bricksforge is: A commercial add-on for the Bricks visual site builder that extends WordPress websites with features like custom forms, animations, an email designer, and custom admin pages. It is used by approximately 6,000 websites.

What it is: A critical file upload flaw that lets completely unauthenticated users — no account, no login required — push arbitrary files onto a WordPress server and trigger those files to execute as code. Think of it like a letterbox with no filter: anyone walking past can post whatever they want inside, and the house automatically opens and reads it.

Who's at risk: Any WordPress site running Bricksforge version 3.1.8.9 or earlier. Active exploitation has been confirmed since 7 October.

CVSS: 9.8 (Critical — patch today, without waiting for a maintenance window.)

Root cause: The plugin failed to validate or restrict uploaded file types before accepting them. No authentication check was in place to confirm who was making the request, meaning the vulnerability could be triggered by anyone on the internet.

Attack vector: An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a malicious PHP file attached. Because no authentication or file-type validation is enforced, the server accepts the file and stores it. The attacker then requests that file's URL, the server executes it, and the attacker gains full control of the site. Patchstack observed two automated attack clusters — one using 44 different IP addresses firing identical payloads, another testing 25 variations of PHP file extensions — suggesting organised, scripted exploitation.

Detection strategies:

1. Check server logs for POST requests to Bricksforge form endpoints containing unusual file extensions (.php, .phtml, .php5).
2. Look for unfamiliar PHP files in WordPress upload directories (typically /wp-content/uploads/).
3. Review your WordPress admin user list for any accounts you did not create.

Recommended actions:

1. Update Bricksforge to version 3.1.8.10 immediately.
2. Audit uploaded files in your WordPress installation for anything suspicious added after 7 October.
3. Restrict direct PHP execution in your uploads directory via your server configuration or hosting control panel.

Let's Encrypt — the free certificate authority that provides the padlock in your browser — is shortening the lifetime of the security certificates it issues, according to SecurityWeek. From February 2027, new certificates will last 64 days instead of 90. A further reduction to 45 days follows in 2028.

Shorter lifespans mean a stolen or compromised certificate becomes useless sooner — good for everyone.

For website owners: check whether your certificate renewal process runs automatically. Fully automated setups that support ACME Renewal Information (ARI) — a protocol that lets Let's Encrypt signal your system when to renew — should handle this without any changes. If yours is hardcoded to renew a fixed number of days before expiry, update that trigger to roughly two-thirds of the certificate's lifetime so renewals still land in the right window.

Not sure what you're running? Ask your hosting provider — most handle this for you already.

The UK's National Cyber Security Centre (NCSC) is running research into how organisations evaluate, select, and adopt EASM (external attack surface management — tools that map what parts of your organisation are visible and reachable from the internet) solutions. They want input from anyone involved in procurement, risk decisions, or security governance.

Participation is voluntary and confidential. To take part, complete the short registration form linked in the NCSC blog post — it is hosted by Optimal Workshop and takes around five minutes.