ConnectWise and Ahold Delhaize Incidents Headline This Week's CISO Briefing

Security leaders enter the week watching two live incidents: ConnectWise has suspended its Cloud Backup service after attackers abused its application identities to reach hundreds of customer Microsoft 365 tenants, and Ahold Delhaize is still restoring grocery brands' sites and apps after its October cyberattack. Regulators and legal filings added more pressure, with a CISA patch deadline for exploited Palo Alto, Cisco and Ahsay flaws, an 8.2 million-person iRhythm breach confirmation, and an $80 million Conduent breach settlement.

ConnectWise suspends Cloud Backup after attackers abuse its Microsoft 365 access

ConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services after attackers used a compromised credential tied to the Cloud Backup application to sign in as that app across customer Microsoft 365 tenants. Huntress, which monitors small and mid-sized businesses, confirmed unauthorized access to at least 162 tenants and said nearly 1,000 Microsoft 365 accounts saw sign-in attempts from the attacker's address, with more than 300 successful. ConnectWise disabled seven application identities on October 17, revoked certificates and invalidated shared Cloud Backup credentials, but warned that access tokens issued earlier may still work until they expire. (Help Net Security)

Ahold Delhaize restores grocery brands' sites after cybersecurity incident

Ahold Delhaize gave an update on the cybersecurity incident it first disclosed on October 12, saying it took certain systems offline as a precaution and has since restored several brands' websites and apps, including Albert Heijn, Etos and Gall & Gall, with home delivery due back October 23. The company notified the Dutch National Cyber Security Centre within 24 hours of discovery and has now filed a formal police report with Dutch authorities. Investigators have found no evidence so far that sensitive customer, associate or partner data was taken, though all stores stayed open while phased restoration of digital services continues across Europe and the United States. (Ahold Delhaize)

CISA deadline hits for exploited Palo Alto, Cisco and Ahsay flaws; Ivanti chain also active

CISA added four vulnerabilities affecting Palo Alto, Cisco and Ahsay products to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, giving federal civilian agencies until October 17, 2026 to apply fixes. The same week, Microsoft patched a Mark of the Web bypass, CVE-2026-96951, that attackers were already exploiting, as part of a record Patch Tuesday fixing more than 1,400 bugs. Separately, a threat actor chained three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances, collecting credentials and exfiltrating configuration data. CISOs running any of these products should treat patching as urgent. (Help Net Security)

iRhythm data breach confirmed to affect 8.2 million individuals

The scale of iRhythm Technologies' June 2026 data breach has been confirmed at 8,179,772 individuals, according to the Oregon Attorney General's breach notification list. The wearable cardiac device maker, whose Zio monitors are used by about 8 million patients, began sending notification letters on October 9 after a threat actor exfiltrated patient names, addresses, insurance numbers, dates of birth and device serial numbers from a third-party hosted application. iRhythm says it is unaware of any misuse of the data and does not expect the incident to have a material impact on its financial condition or results of operations. (The HIPAA Journal)

Conduent agrees to $80 million breach settlement

Conduent agreed to pay $80 million to settle a class action over a 2024 breach that exposed personal and health data of around 62 million people, according to a filing with the US District Court for the District of New Jersey and an 8-K submitted to the SEC on October 16, 2026. The settlement splits claimants into two subclasses and caps individual cash reimbursement at $3,500 for documented fraud or identity-theft losses. Conduent denies fault, says the agreement is not an admission of liability, and does not expect the settlement to materially affect its financial results. (Infosecurity Magazine)

Pentagon CIO adds strategic technical advisor amid IT modernization push

Pentagon Chief Information Officer Kirsten Davies added Jon Steinbach as strategic technical advisor, continuing a run of appointments to her office as the department pushes to modernize IT and cybersecurity tools, streamline procurement and rework the Cybersecurity Maturity Model Certification program. Steinbach, whose background includes the CIA, the military's Special Operations Command and the Marine Corps, will advise on emerging technologies and issues at the intersection of national security and business. The appointment follows other recent CIO-office hires, including a deputy chief of staff and a principal deputy CIO, as Davies continues building out her leadership team. (DefenseScoop)

SUBCO combines CIO and CISO roles under new hire from Macquarie

Submarine cable operator SUBCO named Andrew Bacon as joint chief information officer and chief information security officer to lead its technology and cyber security strategy as it scales what the company calls the largest subsea infrastructure build in the Indo-Pacific. Bacon joined SUBCO after almost seven years as a divisional director in Macquarie Group's cyber security domain, where he led enterprise-wide programs to strengthen controls across more than 500 critical systems. He previously held roles at ING Australia and Commonwealth Bank. The appointment combines two executive functions under one leader during a period of major infrastructure expansion. (iTnews)