Our views on technology, security, marketing & design
AllAICloud BackupCloud SecurityConsumer ProtectionCritical InfrastructureCybersecurityData BreachData ProtectionDigital MarketingEmployee TrainingEthicsIT SecurityLocal BusinessLocal NewsMacNewsPrivacyScamsSelf-HostingShared HostingSmall BusinessSmart HomeTechnologyTips & TricksUncategorizedWeb Design
If you’ve tried to open the Food Lion app this week and gotten an outage notice, it’s not your phone. Food Lion — headquartered right here in Salisbury, NC — and its sister chains Giant, Stop & Shop and Hannaford have had their websites and apps offline since Monday after parent company Ahold Delhaize detected a cybersecurity incident and took systems down as a precaution. Stores, pharmacies and fuel stations are open. Online orders that weren’t filled are being refunded. The company says it has no evidence so far that customer data was taken. Here’s what’s confirmed, what isn’t, the scams you should expect to ride on this news (fake refunds, ‘restore your rewards’ links, apology gift cards), and — for business owners — what a large company’s first days of incident response look like when they go reasonably well.
You may have seen the headline: Japan has declared a ‘state of emergency in cyberspace.’ More than 20 major Japanese companies have disclosed attacks in a matter of weeks — a car-sharing service, a rail line, a convenience store chain, a securities firm — exposing records on millions of people. But the most important part of the story isn’t the phrase in the headline (which, it turns out, the viral version overstates a little). It’s a quieter decision that followed: Japan’s financial regulator told banks to STOP ACCEPTING DRIVER’S LICENSES as proof of identity. Think about what it takes for a country to stop trusting its own driver’s licenses. Here’s what was actually declared, the wave behind it, why leaked license images broke a whole verification system, where AI does and doesn’t fit, and what it means for any business that checks who it’s dealing with.
Twice this fall, when we wrote about attacks on systems that run physical equipment, we used the same example: the walk-in cooler. Overnight Sunday, it stopped being hypothetical. Attackers got into the refrigeration controls at hundreds of French supermarkets and switched on the defrost function — then left it running. Chilled cases and freezers climbed to as high as 50C (122F) for about six hours, and by morning stores were hauling meat, dairy, and frozen goods to the dumpster. No data stolen. No ransom demanded. The damage was physical, immediate, and expensive. Here’s what’s confirmed (and what the viral posts got wrong), why the attackers didn’t break the equipment but used it, and four lessons for any business with connected equipment: the fix already existed, the systems were vendor-managed, it happened on a Sunday night, and the losses landed on inventory.
Two Colorado water utilities were broken into in late August. Attackers got into the systems controlling drinking water equipment, changed settings, altered pumping cycles, disabled remote access, and switched off the alarms. Operators regained control and the water was never affected. Now the number that makes this matter to you: each utility serves FEWER THAN 200 PEOPLE. Not two hundred thousand — two hundred. Smaller than a lot of the businesses reading this. If you’ve ever told yourself your business is too small to interest an attacker, this should end that conversation. Nobody chose these utilities; experts describe the wave as opportunistic — attackers scan the internet for reachable equipment and break into whatever answers. You’re not being evaluated as a target. You’re being scanned. Here’s why the alarms went first, why the utilities were fine anyway, and the refreshingly simple federal advice every business can follow.
On Tuesday, visitors to the FBI’s jobs website found a message that looked a lot like the notices the Bureau places on criminal sites it shuts down: this site had been seized — by a hacking group called ShinyHunters. The job listings and special agent applicant portal went offline. Then the group claimed something far more serious: sensitive data on nearly every FBI employee and every person who has ever applied to work there, with a sample of 5,000 records including home addresses and details on spouses. It’s the same group behind the Florida DMV breach we covered — where its account of how it got in turned out to be wrong. So here’s what’s established versus claimed, and the part that applies to your business: the only confirmed intrusion landed on the JOB APPLICATION PAGE. HR and applicant systems hold the most dangerous data any business keeps about its people — and usually get the least attention.
A supertanker a thousand feet long, carrying roughly two million barrels of crude, left Egypt bound for Texas. A week in, passing through the Strait of Gibraltar, something went wrong with its network. Two weeks later an FBI and Coast Guard cyber team boarded it in the Gulf of Mexico and spent four days going through its systems. They found evidence of malicious cyber activity. A second vessel was boarded three days after that. Nobody was hurt, nothing spilled, and the ship has since been cleared — but buried in the Coast Guard’s explanation of what actually worried them is one sentence describing a risk sitting in a great many ordinary businesses. (Also: that viral graphic saying ‘cyberattacks hit U.S. tankers in Galveston port’ is wrong twice over, and we’ll fix it.) Here’s what really happened, what’s claimed versus confirmed, and why a supertanker is — in IT terms — a small business.
Europe’s largest fintech has around 80 million customers, operates as a bank in 30+ countries, and was recently valued at roughly $115 billion. And according to the Financial Times, criminals walked away with complete identity files on hundreds of its customers — passports, driver’s licenses, verification selfies, home addresses, full transaction histories — without breaching a single system. They ASKED for it. And the company handed it over, politely, for about five months. The requests came from a genuine government email domain with valid authentication, and looked exactly like the law-enforcement data requests a bank answers routinely. Every technical control worked correctly — the messages really were coming from where they appeared to come from. The account behind them had just been stolen. Here’s how the con worked, why no security product could have caught it, and why authority impersonation is one of the most dangerous techniques aimed at ordinary businesses right now.
The headline says researchers used one AI company’s model to hack another in under 72 hours. Accurate — but three things it leaves out change what the story means, and the most useful one has nothing to do with AI. First: this was AUTHORIZED. It was OpenAI’s own bug bounty program. The researchers proved access with a harmless pull request and stopped; OpenAI patched within 14 HOURS and paid a $6,500 bounty. That’s the system working, not a breach. Second: the vulnerabilities were completely ordinary — an image-library bug, a single sign-on weakness, an over-connected account. AI didn’t create a new threat; it compressed the time to weaponize old ones. Third, and the one that should change something in your business this week: one employee’s account was connected to everything. A public forum led to a code repository because each convenient link in the chain existed for a good reason. Your business has the same structure.