Week of April 6, 2026: Iranian actors disrupt US PLCs, and Stryker calls its March incident material

What mattered to security leaders in the week of April 6, 2026? On Tuesday, April 7, US agencies warned that Iranian-affiliated actors were tampering with internet-exposed PLCs and HMI displays across several critical infrastructure sectors, causing operational disruption. In SEC filings, Stryker said the cybersecurity incident it identified on March 11 had a material impact on first-quarter results, and Bitcoin Depot reported the theft of about 50.903 Bitcoin from company wallets.

Iranian-affiliated actors disrupt PLCs across US critical infrastructure

A joint advisory issued on April 7 said Iranian-affiliated APT actors had accessed internet-exposed programmable logic controllers, including Rockwell Automation and Allen-Bradley devices, from overseas IP addresses and leased third-party infrastructure using legitimate engineering software. They pulled project files and manipulated data on HMI and SCADA displays, causing disruptions and financial loss in energy, water and government networks. The agencies tied the activity to tensions involving Iran, the US and Israel. Any PLC reachable from the internet should be treated as already found. (Help Net Security)

Stryker amends its 8-K: the March attack was material to Q1

In an amended 8-K filed April 9, Stryker said the cybersecurity incident it identified on March 11, 2026 had a material impact on operations and on its first-quarter 2026 financial results, citing the scope and duration of the disruption and the systems affected. The company said it did not expect the incident to materially affect its 2026 full-year guidance and that manufacturing, ordering and distribution systems were fully restored. The filing shows how materiality can be determined weeks after an initial 8-K, once operational costs become clear. (SEC EDGAR)

Bitcoin Depot reports 50.903 Bitcoin stolen from its wallets

Bitcoin Depot disclosed under Item 1.05 that an intruder, discovered on March 23, gained control of credentials for its digital asset settlement accounts and moved about 50.903 Bitcoin, valued at approximately $3.665 million, out of company wallets. The company determined on April 6 that the incident was material given reputational, legal, regulatory and response costs, even though it did not expect a material financial impact, and said customer platforms were not affected. Settlement-account credentials deserve hardware-backed protection and transfer limits. (SEC EDGAR)

FirstEnergy hires former CISA official Brian Harrell as chief security officer

On April 9 FirstEnergy appointed Brian Harrell as vice president and chief security officer, with responsibility for corporate and field security, 24/7 security operations, enterprise cybersecurity, threat intelligence, risk and compliance, and security architecture. He reports to chief operating officer Toby Thomas. Harrell previously held senior roles at the Department of Homeland Security, including at CISA, and before FirstEnergy was chief security officer at Avangrid. The converged cyber and physical remit reflects how utilities are organizing grid security. The record is on CISO Tribune. (FirstEnergy)

UK NCSC: APT28 hijacks routers to redirect DNS

The UK's National Cyber Security Centre warned on April 7 that APT28, which it assesses is GRU Unit 26165, has been compromising small office and home office routers through known vulnerabilities and changing their DHCP DNS settings so that downstream laptops and phones query actor-controlled servers. Lookups for email and login services were then resolved to further attacker infrastructure. The group has run such malicious DNS servers on rented virtual private servers since 2024. Remote workers' home routers sit outside most asset inventories, which is the gap this exploits. (Help Net Security)

FBI IC3: reported cybercrime losses reach $20.877 billion for 2025

The FBI's Internet Crime Complaint Center reported $20.877 billion in losses for 2025, up 26% from the prior year, from more than one million complaints. Cyber-enabled fraud accounted for $17.7 billion, or 85% of losses; investment scams led at $8.6 billion, and cryptocurrency-related losses totaled $11.3 billion. Phishing and spoofing generated the most complaints, at 191,561. The figures are useful for sizing fraud risk in board reporting. (Help Net Security)

Acrobat Reader zero-day found in PDFs dating to November 2025

Researcher Haifei Li reported in a Tuesday, April 7 post that a zero-day in Adobe Acrobat Reader, tracked as CVE-2026-34621, had been exploited since at least November 2025. A malicious PDF submitted to his EXPMON sandbox on March 26 ran obfuscated JavaScript that collected system details, sent them to an attacker server and could fetch further payloads; a variant first appeared on VirusTotal on November 28, 2025. PDF readers remain a default install on nearly every endpoint, so this deserves fast tracking. (Help Net Security)