CISO Briefing: Grocery Freezers Hacked, Ledger Implant Steals $93M, China-Linked KEV Flaws

Security leaders should know that attackers hijacked Danfoss refrigeration controls at French supermarket chains and disrupted Ahold Delhaize's Dutch and Belgian stores, while a hidden hardware implant in some Ledger wallets has been linked to more than $93 million in stolen cryptocurrency. CISA, the FBI and NSA also detailed a China-linked hacking enterprise and added five new vulnerabilities to the Known Exploited catalog, as SonicWall patched a critical remote-access flaw and Turing named a new CISO.

Cyberattacks disrupt French supermarket freezers and Ahold Delhaize operations

On October 12, French retailers including Intermarché, Netto, Super U, Marché U, Leclerc, Carrefour Market and Monoprix reported that attackers remotely hijacked Danfoss refrigeration control systems overnight, defrosting freezers and spoiling stock with damage reaching hundreds of thousands of euros. Separately, Dutch multinational Ahold Delhaize confirmed a security issue forcing some systems offline, disrupting Albert Heijn, Etos, Gall & Gall and Delhaize stores along with their websites and apps; Stop & Shop staff also reported access problems. Ahold Delhaize said stores stayed open, and there is no confirmed link between the two incidents. (Help Net Security)

Hidden implant in some Ledger wallets tied to $93 million in stolen crypto

Ledger said all confirmed cases from an October 9 wallet-draining incident trace to devices sold through Southeast Asia reseller CryptoBilis, with on-chain researchers estimating losses above $93 million. Former Mt. Gox CEO Mark Karpelès said a tampered device he bought in Malaysia held a hidden circuit board with a microcontroller, antenna, LTE chip and e-SIM that could capture and transmit seed phrases. Ledger said its own systems and direct sales were not compromised, and it is urging affected users to move funds to new devices with new seed phrases. (Help Net Security)

CISA, FBI and NSA detail China-linked Integrity Technology Group's hacking toolkit

A joint advisory from CISA, the FBI, the NSA and international partners said Integrity Technology Group, a China-based for-profit company with links to the Chinese government, supplies tools and infrastructure that let state-linked hackers exploit networks across multiple sectors, including US critical infrastructure. The actors combine automated vulnerability scanning, cross-site scripting and password spraying against Microsoft Exchange and Office 365, and use legitimate VPN software to maintain persistence. Agencies urged organizations to review indicators of compromise, hunt for unauthorized access, and harden internet-facing services and remote access accounts. (Industrial Cyber)

CISA adds five more vulnerabilities, some a decade old, to Known Exploited list

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog: flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND, the oldest dating to 2015. The agency linked the additions to cyber operations tied to China-based Integrity Technology Group and ordered federal civilian agencies to fix the flaws by October 11, 2026. Alongside the KEV update, the US Department of Justice and FBI seized two tools allegedly operated by the company, Microscan and FishHub, which were used for network scanning and spear-phishing. (Security Affairs)

SonicWall patches pre-auth SSRF flaw letting attackers reach internal appliance functions

SonicWall fixed four vulnerabilities in its Secure Mobile Access (SMA) 1000 series, including CVE-2026-102255, a pre-authentication SSRF flaw that could let an unauthenticated remote attacker trick the appliance into making requests on its behalf, exposing internal functions normally hidden from the internet. The flaw adds to a string of remote-access appliance bugs CISOs have tracked this year across SonicWall and Citrix NetScaler products, and the vendor is urging customers running SMA 1000 to apply the patch without delay. (Help Net Security)

Turing names Patrick McKinney as Chief Information Security Officer

San Francisco-based Turing, which describes itself as a research accelerator for frontier AI labs and an enterprise AI deployment partner, announced on October 12 that Patrick McKinney has been appointed Chief Information Security Officer. The company has been named among the fastest-growing AI firms and ranked first on The Information's list of top business-to-business companies. The appointment adds security leadership at a company whose work spans training pipelines, coding and reasoning data for frontier AI labs, and enterprise AI deployment, areas CISOs increasingly scrutinize for model-supply-chain and data-handling risk. (Intelligence360)

Let's Encrypt to cut default certificate lifetimes from 90 to 64 days

Let's Encrypt said that starting February 10, 2027, it will issue TLS certificates valid for 64 days by default, down from 90 days, with the last 90-day certificate expected to expire May 11, 2027. The nonprofit Internet Security Research Group said the shorter lifetime reduces the risk of key compromise and mis-issuance and prepares users for a planned drop to 45-day default certificates in 2028. Admins using fixed renewal schedules rather than automated clients supporting ACME Renewal Info need to update their renewal timing before the switch. (Help Net Security)