Hackers raise the heat on French supermarkets with attacks on refrigeration controls

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

• The full Metacurity archive: Every newsletter, searchable and browsable.
• Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
• Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
• A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

Several major retailers, including Intermarché and Coopérative U, were hit on Monday, October 12th, by a cyberattack targeting the refrigeration control systems of the Danish manufacturer Danfoss.

In some stores, temperatures were reportedly changed remotely, leading to the destruction of stocks of fresh and frozen products. In Alsace, two supermarkets, Intermarché and Super U, alone reported losses of €270,000. Nationwide, the total could reach several million euros.

On X, the head of Coopérative U confirmed the attack and judged that "attacking equipment essential to the preservation of fresh produce and the food supply of the French is extremely serious and unprecedented. It is unacceptable."

Normally, refrigeration systems are equipped with an automatic defrosting system that removes accumulated frost from the equipment. According to information gathered from industry professionals, these systems can be programmed to perform two hours of defrosting within a 24-hour period.

Hackers allegedly hijacked this function by forcing a continuous defrost cycle, with a temperature set to 50 degrees Celsius. The equipment would thus have heated up for several hours instead of keeping the goods cold.

In the early morning, when refrigerators and freezers were opened, "a wave of heat escaped," says a source in the sector.

In some stores, the attack reportedly began around midnight, allowing several hours for temperatures to rise and ultimately destroying all the affected products. In other stores, affected later in the night, employees reportedly managed to save some of the fresh produce. (Frédéric Bianchi, Raphaël Grably, Nicolas Matt and Gaétane Meslin / BFM TV)

Related: News.AZ, AFP, Infosecurity Magazine, Tom's Hardware

H&M Group, the world’s second-largest fashion retailer, is understood to have been targeted last week by the same cybercriminals behind the Asos attack.

The Swedish clothing company, which owns H&M, Cos, Arket and Monki, said it was investigating claims that it had suffered a data breach. The extent of the intrusion and whether any other company data was affected remain unclear.

An H&M spokeswoman said: “We are aware of the claims circulating online regarding a potential cybersecurity incident involving a limited scope of H&M Group data. Protecting the security of our systems and data is of utmost importance to us.”

Sources told the Times that the fast-fashion group was understood to have been targeted by the same group behind an attack at Asos, H&M’s competitor, last week. The hackers claimed to be called the Xuanye group, a name translating to “Mysterious Splendour." (Isabella Fish / The Times)

Artificial intelligence agents created by Anthropic, acting on their own, tried to gain access to a range of government websites, filled out visa applications on the State Department’s website and sent a fake homicide tip to Philadelphia’s Police Department.

Anthropic detailed the activity of its AI agents in a blog post on Friday, without naming the targeted websites. But two sources with knowledge of the incidents said Anthropic’s AI agents had submitted 20 visa applications through a form available on the State Department’s website. All the applications were incomplete and were not processed, they said.

Anthropic said that it discovered what its AI agents had done after it started a review of its AI activity in July. At the time, OpenAI had disclosed that its technology attacked another AI startup, Hugging Face. Anthropic and other labs also discovered that their technology had escaped from testing environments and conducted hacks.

Anthropic said an AI model it had been testing had taken several unauthorized actions, including using a flaw in a university website to download data and sending a government agency a form that it had been told not to submit.

White House officials said they were briefed on the agents’ actions on Friday, and demanded that AI companies immediately report rogue AI activity. It was the most aggressive statement so far on AI regulation by the Trump administration, which has sidestepped calls for tighter controls on the increasingly powerful technology.

A new White House AI task force, created this week, said Anthropic told it about the agents’ activities earlier on Friday. Called the Super Intelligence Force, the group includes Jay Clayton, the White House AI czar; Andrew Ferguson, the chair of the Federal Trade Commission; Scott Kupor, the director of the Office of Personnel Management; and Emil Michael, the chief technology officer of the Defense Department.

“We informed the company that we expect immediate and full transparency to the entities involved and the public,” they said in a statement. “We also expect that the company will immediately provide remediation services to the affected entities and any harmed Americans.” (Kate Conger, Mike Isaac, Julian E. Barnes, and David E. Sanger / New York Times)

Related: Anthropic, The Mac Observer, TechRadar, BBC News - World, Washington Post, Engadget

Agents with the Federal Bureau of Investigation (FBI) arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources told KrebsOnSecurity.

The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.

One source close to the investigation told KrebsOnSecurity the Canadian person arrested this week was visiting Pennsylvania for a cyber insurance conference, and that the suspect’s company specialized in handling ransomware negotiations with cybercrime groups. Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas.

An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website, its biggest sponsor was a Canadian security company called Cypfer.

According to LinkedIn, one of Cypfer’s “ex-founders” was Edward Dubrovsky, who is now associated with another Canadian security firm and sponsor called CyberSteward. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team.

Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on cyber extortion and conspiracy charges. Several of those documents — including the core complaint — are now sealed. But a handful of them were indexed at CourtListener.com, including a summary of the complaint, which charges the defendant with “conspiracy to threaten to impair the confidentiality of information with the intent to extort money,” and “interference with commerce by threats.” (Brian Krebs / Krebs on Security)

Related: Court Listener, Bleeping Computer, NextGov/FCW, CNN, New York Times, Reuters, Associated Press, ABC News, The Record, Newser, ScreenRant, Polygon.com, Joe.My.God., BleepingComputer, KTVZ-TV, Bloomberg, Nextgov/FCW

Reports have been mounting that users of the Ledger crypto wallet have seen their accounts drained, and suspicion is that it’s related to reseller CryptoBillis and a bit of spy hardware.

Ledger has asked CryptoBillis to pause all sales of its wallets while it conducts an investigation.

Photos and videos posted on X and Threads appear to show a small circuit board sandwiched under the screen. The implant allegedly intercepts anything displayed on the screen, including the seed passphrase shown during the initial setup. Using an embedded SIM card, the implant then sends that information back to the attacker, who can then siphon funds from user accounts.

Reports indicate that whoever is behind the hack has stolen over $86 million worth of crypto from hundreds of wallets. There’s no indication that Ledger’s systems have been compromised or that wallets purchased directly from the company have been affected. Instead, the issue appears to be a supply chain attack primarily involving users in Southeast Asia and the CryptoBillis reseller. Ledger has provided guidance on how to check if your wallet has been tampered with. (Terrence O'Brien / The Verge)

Related: Help Net Security, Gizmodo, CoinDesk, The Crypto Times, The Coin Republic, Cryptonews, CryptoSlate, Bitcoin Insider, Bitcoin News, CryptoPotato, Cointelegraph, The Daily Hodl, crypto.news, Inside Bitcoins

An alleged member of the Qilin ransomware group was arrested in Japan and subsequently extradited to Germany.

The suspect, a 28-year-old Russian national, was detained in Osaka in May and was reportedly handed over to the German authorities on October 2.

Believed to be a core member of the ransomware gang, the individual was wanted in Germany for hacking into a logistics company in September 2024, encrypting data on its systems, and extorting it of over $160,000 in cryptocurrency. (Ionut Arghire / Security Week)

Related: Japan's National Police, The Record, Security Affairs, The Japan Times, Computing, Bleeping Computer, Nippon

Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records.

The company is the largest karaoke maker in Japan, operating 521 karaoke venues nationwide, including the Big Echo chain, one of the most popular karaoke box chains in the country.

Daiichi Kosho outsources the handling of its customers’ personal information to Nippon Columbia Group (NCG), a Japanese entertainment group whose businesses include music, video and game software production and distribution, as well as artist management.

The record company informed Daiichi Kosho on October 5 that it had discovered malware on an employee’s computer and isolated the affected system the following day.

Daiichi Kosho says it has not confirmed any data theft or leaks but is advising customers to remain cautious due to the potential risk. (Bill Toulas / Bleeping Computer)

Related: DKKaraoke, Infosecurity Magazine

The White House has reinstated the UK’s access to the latest AI models for safety testing after lobbying from ministers, The Telegraph can reveal.

The UK’s AI Security Institute (AISI) will now be able to access the latest models from US tech companies before they are released, allowing British officials to run safety tests.

Last month, the White House asked Anthropic, OpenAI and other major AI companies to stop sharing their models with AISI, in a major blow to Andy Burnham’s attempt to become a world leader in AI regulation.

After the order from Donald Trump’s Office of the National Cyber Director, Anthropic restricted UK officials from reviewing its new Claude Mythos 5.1 model.

The Telegraph understands that decision has been reversed after lobbying from Kanishka Narayan, the AI minister, and AISI will be given pre-release access to models from Anthropic, Google DeepMind and OpenAI, the creator of ChatGPT. (Tony Diver / The Telegraph)

Related: The Guardian, Financial Times, Reuters, GB News, Pathfounders, Political.org, micahflee

Flock Safety plans to let go of about 18% of its employees, people with direct knowledge of the plans said, as the maker of AI-powered ​surveillance cameras and license-plate readers faces mounting opposition to its products from communities and ‌lawmakers.

The people said job cuts came after a voluntary buyout program and are expected to impact roughly 270 employees at Flock, a surveillance technology startup that has seen rapid growth in recent years. Employees will leave the company at the ​end of the month. Sources declined to be identified as the company has yet to ​make the plan public.

In September, Flock announced a voluntary separation ⁠program, asking employees to apply if they wanted to leave the company, Wired reported last month. The ​company has about 1,500 employees. (Krystal Hu and Helen Coster / Reuters)

Related: TechCrunch, NowGeorgia

Following concerns that license plate reader Flock was sharing data with Customs and Border Patrol, Elgin Community College in Illinois requested Flock remove its cameras.

According to Elgin’s President Peggy Heinrich, Flock rejected the request, saying it had not violated its contract. According to the Chicago Sun-Times, school officials reached out again in December, offered to pay for the remaining five months of the contract, and still requested that the cameras be removed. They were met with silence.

According to the Chicago Sun-Times, Heinrich said Elgin Community College staff began to cover the cameras using black trash bags and zip ties so that they would not be able to capture footage. But workers in an unmarked vehicle, which Heinrich assumed belonged to Flock, repeatedly removed the coverings.

“We were kind of in a back and forth for a bit where we’d cover, and then when they’d come to service, they’d remove,” Heinrich said. “Then we’d cover, and then they’d remove.”

This continued until April of this year when the college’s contract expired, and Flock removed the cameras. (Terrence O'Brien / The Verge)

Related: The Chicago Sun-Times

In response to a 404 Media investigation, Sen. Ron Wyden is demanding more information about how a federal license plate reader camera program works.

Last month, 404 Media reported on the High Intensity Drug Trafficking Area program’s license plate reader database, which mirrors data from city license plate reader programs onto federal databases. The HIDTA program falls under the White House’s Office of National Drug Control Policy, which infamously ran a secretive cell phone data surveillance project called Hemisphere.

404 Media reported that HIDTA has now created a complex system for the federal government to obtain license plate data from companies like Flock, Axon, and Motorola via a series of agreements with cities and towns across the country.

In a letter to Sara Carter, director of the Office of National Drug Control Policy, Wyden said that the office needs to publish a report it commissioned into the privacy practices of several of its surveillance programs, including the license plate reader database. (Jason Koebler / 404 Media)

Related: Senator Ron Wyden

Ukraine struck and partly disabled a major data ​center operated by Russian technology company Yandex on Friday in the second such action in successive days, widening the scope of its attacks inside Russia after ‌Moscow hit data hubs in Ukraine.

Yandex, which is heavily involved in Russia's AI development and is sometimes called Russia's Google, said its data center in the Kaluga region southwest of Moscow had been struck by Ukrainian drones and partly put out of action.

Ukrainian strikes disrupted Yandex data centers and reportedly sharply reduced automated traffic from a Yandex network; the effect on Russian disinformation operations remains unverified.

At least one report suggested Russian bot traffic has dropped dramatically in the past few days after Ukraine knocked out the Yandex center, with a third attack happening on Sunday.

Cloudflare reports that bot traffic from the Yandex network has dropped to just 0.4% of the maximum number of HTTP requests recorded in the past two weeks. It initially dropped to around 57% on Oct. 8, which happened when Ukraine hit a Yandex data center housing two supercomputers in Sasovo, Russia, located around 195 miles to the southeast of the Kremlin.

A second, bigger Yandex campus in Kaluga, about 220 miles to the west of Sasovo, was knocked offline yesterday.

However, the effect on Russian disinformation operations remains unverified and disputed online, with some observers saying Cloudflare’s “bot” classification measures automated requests—including legitimate search crawlers. It does not identify Russian influence operations or propaganda accounts. (Mark Trevelyan and Gleb Stolyarov / Reuters and Jowi Morales / Tom's Hardware)

Related: PCMag, Reuters, r/technology, BBC News, Ars Technica, Tom's Hardware

Domain Tools revealed a newly disclosed unprecedented surge in suspected Iranian VPN-over-DNS activity, with one domain generating 40 billion passive DNS observations within days.

The investigation documents infrastructure expanding across more than 100 domains during military conflict, while leaving its operators, transmitted content, and purpose unconfirmed.

The activity began around 07:00 UTC on March 1, 2026, and escalated sharply by noon. Engineers investigating congestion in DomainTools’ intake servers traced the processing backlog to supaghost[.]cc, which generated up to 500,000 observations per second.

DomainTools normally processes, deduplicates, and validates approximately one million observations per second. The single domain therefore increased intake by roughly 50%, eventually accumulating 40 billion observations before engineers began filtering its traffic. (Eswar / GBHackers)

Related: Domain Tools

Quantum-computing company IonQ struck an all-stock deal to buy Elisity in a transaction that values the cybersecurity firm at up to $1.3 billion, executives said.

IonQ’s quantum hardware and software aims to solve problems too difficult for traditional computers across a range of industries, from drug discovery to national defense. It specializes in what’s called trapped-ion quantum computers that have proved to offer greater accuracy. 

It is a bet that cybersecurity will be even more critical for companies as quantum computing and AI systems become more powerful and advanced, said IonQ Chairman and Chief Executive Niccolo de Masi. (Lauren Thomas / The Wall Street Journal)

Related: Bloomberg, Business Wire, Elisity

Best Thing of the Day: What Would Jesus Do?

The Christian community appears poised to put its stamp on AI early in an attempt to ensure it benefits all of humanity rather than a few tech billionaires.

Worst Thing of the Day: If I Get Rich I'll Leak GTA 6

The GTA 6 hacker called Cyberleek is threatening to leak a full build of GTA 6 if he hits a $30m market cap on his crypto coin.

Closing Thought