Breach of the Day

The FBI, U.S. Secret Service, and IRS Criminal Investigation have jointly attributed the largest cryptocurrency theft in history to TraderTraitor, a North Korean state-sponsored hacking group, according to The Hacker News.

The group drained more than $6.43 billion from Binance — the world's largest crypto exchange — across 11 blockchains, with 82% of the stolen funds moving through Ethereum and Bitcoin. That figure nearly doubles every dollar North Korean-linked hackers have ever stolen in crypto combined.

The FBI says the stolen assets are being converted into Ethereum and then funnelled through DeFi (decentralised finance — peer-to-peer financial platforms that operate without a central bank or broker) and instant-swap services to obscure the trail. Blockchain firms Tether, Circle, Ripple, and others have managed to freeze $2.85 billion of the stolen funds on-chain so far. Binance has resumed limited withdrawals after a temporary pause.

TraderTraitor has been active since at least 2020 and is responsible for prior heists targeting Bybit ($1.46 billion, February 2025), DMM Bitcoin, and others. The group's method is specific: they pose as job recruiters, use AI to build convincing fake personas, and trick targets — often software engineers and security professionals — into downloading malware-laced applications.

If you applied for any job in blockchain, crypto, AI, or cybersecurity and downloaded something from a "recruiter" in recent months, run a full malware scan immediately. Do not open any files sent by unfamiliar contacts through LinkedIn, Telegram, or email. Verify recruiter identities through company websites before engaging.

Since July 2025, attackers have quietly planted loader code — small scripts that pull in malicious payloads — across 953 online stores, most running Magento (an open-source e-commerce platform popular with small and mid-sized retailers), according to Sansec.

The attackers cycled through five different domains to deliver their scripts. When earlier domains expired, they simply re-registered them and kept going. In October 2026, they switched to a new loader domain sitting behind Cloudflare's infrastructure, making it harder to detect. That domain alone has already appeared on 83 stores.

The loader is designed to be selective: it only activates for real visitors, not security researchers or automated scanners. Previous versions served scripts from crypto-themed sites, including one mimicking the Ledger crypto wallet brand — strongly suggesting the goal is financial theft from shoppers at checkout.

One patched store with no known security gaps was compromised within an hour of a clean scan. Investigators found a rogue administrator account and a backdoor (a hidden access point planted by attackers) had already been installed weeks earlier.

Sansec notes the final payload has not yet been captured, but the pattern points squarely at payment card theft.

What you should do: If you shop online, check your card statements for unfamiliar transactions after any purchase from a smaller or independent online store. If you run a Magento store, scan for unauthorised admin accounts, audit for backdoors, and apply all available patches immediately.

Capcom — the Japanese studio behind Resident Evil, Street Fighter, and Monster Hunter — confirmed this week that its CAPCOM ID membership system was accessed without authorisation, according to Bleeping Computer. CAPCOM ID is the shared login platform players use to access Capcom's web services and online games.

Suspicious activity was detected on October 19. By October 20, the company confirmed customer data had been taken. Two days later, the incident was reported to Japanese police and the country's data protection authority.

For the vast majority of the 11.7 million affected accounts, the exposed information includes email addresses, account creation dates, last login timestamps, login counts, and the IP address used at last login. Passwords were not exposed for most users, and no payment card data was affected.

For a smaller subset of 43 accounts, additional personal details — dates of birth, gender, nicknames, and country — were also taken. In 196 cases, attackers actually changed account passwords to lock owners out; Capcom has since reset those.

How the attackers first got in has not been disclosed. The company says its online services remain operational.

This is Capcom's second significant breach in recent years. In 2020, the Ragnar Locker ransomware gang claimed to have stolen 1 TB of data in a separate attack, later traced to an old, unpatched VPN device.

What to do: Check your email for official communication from Capcom. Be suspicious of any message claiming to be from Capcom that asks for personal information or contains links — the company has warned users to expect phishing attempts following this breach. If you reused your CAPCOM ID password anywhere else, change it on those accounts now.

LiteLLM is a Python library that lets developers connect to dozens of AI models through a single interface. It is widely used in AI development workflows. According to The Hacker News, version 1.107.0 of LiteLLM was compromised in a supply chain attack (where an attacker poisons a software package before it reaches the people who install it), slipping a credential stealer and a backdoor into the official release on PyPI (the central repository where Python developers download packages).

The attacker did not break into LiteLLM's servers directly. Instead, they used stolen GitHub CLI OAuth tokens (temporary login passes that let tools act on your behalf on GitHub) belonging to three engineers' accounts. Two accounts were used in sequence — one to trigger the release pipeline and one to approve it. The compromised package was quarantined and the malicious Docker images were removed, but not before the damage was done.

The malware, which ran automatically the moment the package was imported, harvested cloud tokens, private keys, browser data from Chrome and Firefox, AI tooling credentials, and environment variables. Everything collected was bundled up and sent to an attacker-controlled server. A second component acted as a backdoor, checking in every hour for new instructions.

Who is at risk: Developers or teams who installed LiteLLM 1.107.0 between its release and the quarantine.

What to do: If you installed that version, revoke and replace every credential from a clean machine immediately. Pin your LiteLLM installation to version 1.106.2 by digest so that future installs pull a verified, unmodified copy.

Ahold Delhaize — the Dutch retail group behind Food Lion, Stop & Shop, Albert Heijn, and others — confirmed this week that a cyberattack forced it to take systems offline across its U.S. and European brands, according to The Record.

The company detected suspicious activity in its IT systems last week and filed a police report in the Netherlands on Monday. Physical stores stayed open throughout, but online shopping services took the hit. U.S. brands including Food Lion and Stop & Shop are still down at time of writing. Dutch brands Albert Heijn, Etos, and Gall & Gall restored their websites and apps, though home deliveries from Albert Heijn are not expected to resume until Friday. Services in Belgium and Central and Southeastern Europe are back online.

Ahold Delhaize says it has no evidence that customer, employee, or partner data was stolen — but the investigation is ongoing, and that picture could change. The company declined to say whether ransomware was involved or whether a ransom demand was made.

This is not the company's first incident. A 2024 attack on Ahold Delhaize resulted in the theft of information belonging to more than 2.2 million people.

What you should do: If you shop with any of these brands, keep an eye on your payment card statements over the coming weeks. No confirmed data theft yet, but the investigation is live. If you used a stored card with Stop & Shop or Food Lion, consider setting up transaction alerts with your bank now rather than waiting for a confirmation that may or may not come.

Overnight on Monday, attackers broke into refrigeration controllers at major French grocery chains and quietly turned freezers into ovens, according to Dark Reading. Temperatures climbed to 50°C (over 120°F), spoiling everything inside and reportedly igniting small fires in some units.

More than 700 stores were hit in a single night. Intermarché alone reported tens of millions of euros in losses. The damage spread beyond France: a Sekoia analyst told Reuters that Spain, Portugal, Poland, Germany, and Belgium were also affected. A major Dutch supermarket chain shut its systems down as a precaution.

The attackers were careful. To stop store staff noticing the temperature spike, they extended the systems' normal defrost cycles — the routine process where freezers melt accumulated ice — so the rising heat looked like scheduled maintenance rather than an attack.

The likely entry point was unpatched firmware in Danfoss AK-SM 800A refrigeration controllers. Three vulnerabilities disclosed in August allowed attackers to execute remote code on these systems. Danfoss patched them, but left installation to customers. Many were still running end-of-life hardware: the AK-SM 800 reached end of life in 2021; its predecessor, the AK-SC355, in 2016. France's national CERT (CERT-FR) also identified a second platform — XWEB, from Dixell and parent company Copeland — as involved in the attacks.

The lesson here is not subtle. Firmware running on internet-connected industrial equipment is as much a security surface as any laptop or server. If your business relies on third parties to manage that equipment, ask them directly when they last applied security updates.

What you should do: If you own or manage any internet-connected industrial or building equipment — fridges, HVAC, access control — contact your maintenance provider today and ask for written confirmation of the current firmware version and when it was last updated.

Microsoft, working alongside Japan's National Police Agency and healthcare security group Health-ISAC, obtained a US court order this week to seize and redirect domains powering three phishing platforms: YAM Store, CoGUI, and Iron Man. The full announcement is available according to The Record.

Together, the three platforms sent over 750 million malicious messages to Microsoft customers since January — targeting people in more than 150 countries. If you have received a fake toll fine text, a bogus parcel delivery notice, or a spoofed bank email recently, these are the people responsible.

Iron Man is a phishing-kit-as-a-service (a subscription service that lets criminals rent ready-made scam infrastructure) offering over 2,300 pre-built fake pages impersonating postal services, tax agencies, banks, and telecoms. CoGUI provided similar fake websites before criminals migrated to Iron Man mid-year. YAM Store is an initial access broker marketplace — a criminal marketplace selling compromised Microsoft and Google accounts — that let attackers buy cheap fraudulent accounts to power their campaigns.

Microsoft disabled more than 20,000 accounts connected to YAM Store and is blocking over 100,000 impersonation domains.

What to do: These platforms stole login credentials and banking information. If you have clicked a link in an unexpected delivery or fine text in the past year, check your Microsoft, banking, and email accounts for any logins you do not recognise. Enable multi-factor authentication (a second verification step beyond your password) on any account that supports it.

iRhythm — a digital health company that makes wearable heart monitors and uses cloud software to turn that data into medical insights — is notifying at least 360,000 patients that their personal information was stolen, according to SecurityWeek.

The attackers got in through third-party business applications that stored patient records. Between 3 and 8 June, they quietly pulled out names, addresses, email addresses, dates of birth, phone numbers, insurance numbers, device serial numbers, and account data before anyone noticed. On 9 June, the company received a ransom demand threatening to publish the stolen records online.

iRhythm says there is currently no evidence the data has been used to commit identity theft. That careful phrasing — paired with no public confirmation of a refusal to pay — suggests the ransom was settled quietly.

The confirmed figure of 360,000 comes from state-level regulatory filings in Texas and South Carolina alone. The real total is almost certainly higher.

What to do: If you are an iRhythm patient, watch for phishing emails using your personal details to appear legitimate. Consider placing a free credit freeze with all three major credit bureaus as a precaution — it costs nothing and stops anyone opening new accounts in your name.

iRhythm, according to The Record, makes the Zio Patch — a chest-worn sensor used for long-term cardiac monitoring and heart arrhythmia detection. This week the company began filing breach notices across multiple US states, confirming that hackers accessed third-party business systems between 3 and 8 June.

The entry point was a social engineering attack (where attackers manipulate people into handing over access, rather than breaking through technical defences). At least 298,647 people in Texas and 69,526 in South Carolina are confirmed affected, with California filings also submitted.

What was taken: names, addresses, phone numbers, patient account numbers, device serial numbers, insurance numbers, dates of service, and dates of birth. iRhythm says its clinical systems, medical devices, and operations were not disrupted.

In a June filing with the US Securities and Exchange Commission, iRhythm disclosed that it received a communication from the attacker demanding payment in exchange for not publicly releasing the stolen data. The company has not confirmed whether any payment was made, and no hacking group has claimed responsibility.

iRhythm says it has "no evidence" the stolen data has been used for identity theft so far. That is reassuring, but medical data is valuable for years after a breach.

What you should do: If you have ever used an iRhythm device, monitor your insurance statements for unfamiliar claims and consider placing a free fraud alert with the major credit bureaus.

Southern Company, the Atlanta-based energy holding company behind Georgia Power, Alabama Power and Mississippi Power, is notifying roughly 400,000 customers that an unauthorised third party accessed their accounts through its online customer portal, according to Security Week.

Around 300,000 of those accounts belong to Georgia Power customers. Alabama Power accounts for the remaining 100,000. Mississippi Power is listed as affected, but no figure has been released for its customers.

The attacker got names, mailing addresses, phone numbers, email addresses, and in some cases the last four digits of Social Security numbers. Bank account numbers, payment card numbers and driving licence details were not accessed, the company says.

Southern Company has not disclosed how the attacker got into the portal, or when.

Affected customers will receive notification by mail or email and are being offered one year of free credit monitoring. Accept it. Even if the exposed data feels minor, partial Social Security numbers combined with addresses are enough to assist identity fraud.

If you are a Southern Company customer, also consider placing a free credit freeze with all three major bureaus — Equifax, Experian and TransUnion. A freeze costs nothing and prevents anyone from opening new accounts in your name, regardless of what data they hold.