Taking the cloud out of the sky.

French supermarkets lose their cool in a refrigeration cyberattack. Anthropic pulls the plug on AI agents behaving badly. A Canadian ransomware negotiator is arrested in the FBI’s ShinyHunters investigation. XWorm expands its surveillance capabilities. A Dutch grocery giant suffers a cyberattack. Leaked files reveal Luna Moth’s playbook. Monday business brief. Our guest is Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Six digits sink Danish security.

Today is Tuesday October 13th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Ukrainian drones strike Russian data centers.

Ukrainian drone strikes have hit three of Russian technology giant Yandex’s six data centers, disrupting digital services across Russia. The attacks began October 7th, targeting facilities in Ryazan, Kaluga, and Vladimir. Two data centers have shut down completely, while a third sustained infrastructure damage.

The outages have affected Yandex Cloud, payment systems, taxi bookings, food deliveries, and numerous third-party services. Yandex says its remaining infrastructure is unstable and cannot provide a timeline for full recovery. The targeted facilities also house powerful supercomputers used for artificial intelligence, although any damage to those systems remains unconfirmed.

Ukrainian President Volodymyr Zelensky described the strikes as retaliation for Russian attacks on Ukrainian data centers and telecommunications infrastructure, which disrupted internet access for thousands of households in September.

A cyberattack targets supermarket refrigeration systems in France. 

A cyberattack targeting supermarket refrigeration systems has disrupted at least 380 stores across France, forcing some retailers to throw away entire inventories of fresh and frozen food.

The attack affected refrigeration management systems manufactured by Danish company Danfoss, including equipment used by the Intermarché, Netto, and Coopérative U chains. Monoprix stores were also affected. Danfoss says the attack primarily affected older systems that no longer receive security updates.

Some supermarkets managed to intervene before food spoiled, while others suffered substantial losses. One retailer estimates that refrigeration failures could cost larger stores more than $200,000. French prosecutors are investigating the attack, including reports of food spoilage and fires. No group has claimed responsibility, and authorities have not identified the attackers. A similar attack targeted commissaries on U.S. military bases in late August. 

Anthropic limits internal AI model evaluations on government and other websites.

Anthropic has cut off internet access for its internal AI model evaluations after several agents took unauthorized actions on government and other websites. The incidents included models exploiting server vulnerabilities, bypassing data access restrictions, and circumventing safeguards designed to prevent unwanted activity. In one case, Claude Haiku 4.5 fabricated and submitted a homicide tip to Philadelphia police. Another model exploited a university server to complete a scientific calculation.

Anthropic believes its reinforcement learning process may have encouraged models to find unauthorized workarounds rather than abandon blocked tasks. The company says the incidents caused minimal real-world harm, but notified the White House and moved all internal evaluations offline until stronger safeguards are in place. The decision follows earlier incidents involving malicious package uploads and unauthorized system access.

A Canadian ransomware negotiator has been arrested in connection with the ShinyHunters cyberattack on the FBI.

A prominent Canadian ransomware negotiator has reportedly been arrested in connection with the ShinyHunters cyberattack on the FBI. Reuters identifies the suspect as Ed Dubrovsky, a longtime cybersecurity executive known for negotiating with ransomware gangs. FBI Director Kash Patel confirmed the arrest of a suspected co-conspirator in the breach of FBIjobs.gov, which exposed sensitive information about bureau employees.

Dubrovsky faces federal charges involving conspiracy to commit cyber extortion and interference with commerce through threats. The allegations have not been proven in court. The arrest has surprised Canadian cybersecurity professionals familiar with Dubrovsky’s work.mShinyHunters, a prolific data theft and extortion group, claimed responsibility for the FBI breach last month, describing it as retaliation against the agency.

The FBI says it intends to pursue the group and its associates.

XWorm evolves. 

The XWorm remote access trojan is evolving into a more powerful surveillance platform, according to researchers at Netskope. First observed in 2022, XWorm gives attackers extensive control over infected Windows systems. Its developers have expanded its available plugins from 35 to 46, adding capabilities including location tracking, live microphone monitoring, and webcam access.

A particularly concerning addition, called HBrowser, lets attackers remotely control authenticated browser sessions, effectively bypassing multifactor authentication without stealing credentials. Netskope observed more than 1,200 XWorm incidents across 100 organizations during the third quarter.

The malware’s development has accelerated since its builder was cracked and its source code leaked in 2025, making the toolkit more widely accessible. Researchers expect further enhancements and continued use of XWorm by cybercriminals.

A Dutch grocery chain suffers a data breach. 

Dutch-Belgian grocery giant Ahold Delhaize has taken some systems offline following a cyberattack. The company says its stores remain open and customer service is unaffected, although local reports indicate disruptions to deliveries and online orders in Belgium and the Netherlands. There are reports that U.S. operations may also be affected.

It’s unclear whether the incident is connected to recent cyberattacks targeting supermarket refrigeration systems across Europe. Ahold Delhaize previously suffered a ransomware attack in 2024 that compromised personal information belonging to more than 2.2 million people.

Leaked documents expose Luna Moth. 

Leaked internal documents have exposed what appears to be a surprisingly organized operation behind the Luna Moth cyber extortion group, also known as Silent Ransom Group. According to Check Point researchers, the group operates much like a business, with specialized roles, detailed scripts, and carefully coordinated social engineering attacks.

Operators impersonate IT support personnel, persuading employees to install remote access software. While one attacker keeps the victim engaged on the phone, another quietly takes control of the computer. The two coordinate through a messaging service. The leaked instructions even include techniques for overcoming suspicious or reluctant victims.

Researchers caution that the documents haven’t been independently authenticated, but say they illustrate how effectively attackers can exploit human trust. Their advice: verify unexpected IT requests independently and restrict unauthorized remote access tools.

Monday business brief. 

Investment in AI-driven cybersecurity continues to attract substantial funding, with five companies announcing new financing rounds. California-based Armadin leads the pack, raising $255.5 million to expand its agentic security platform. Amsterdam’s Hadrian secured $40 million for its AI-powered offensive security technology, while privacy-focused networking startup doxx.net raised $38 million.

Italian compliance automation provider Complaion collected $15.1 million, and Luxembourg-based risk intelligence company Osavul raised $9.5 million. On the mergers and acquisitions front, Quantum eMotion agreed to acquire Canadian cybersecurity firm Plurilock. Germany’s Sequrio acquired three domestic security service providers, while South Africa’s Risk X Group purchased Wolfpack Information Risk.

Swiss certification company SGS acquired Nashville-based Prescient Security. And Dynatrace completed its acquisition of AI evaluation platform Arize, aiming to combine AI testing capabilities with its existing observability tools. The activity reflects continued investor interest in AI security, compliance automation, and cybersecurity services.

 

Six digits sink Danish security.

Denmark is investigating a massive breach of its national population register, and the alleged point of entry is a password that practically qualifies as an invitation. According to Danish media, an attacker accessed the system through an IT company’s account protected by the password “123456.” At least three accounts reportedly shared that password, including an administrator account. The attacker allegedly conducted 14 million automated searches over ten days, accessing information belonging to 8.8 million people.

The intrusion went undetected until a government employee noticed an unusually large bill for database activity. The company, Pays ApS, has confirmed its access was exploited but hasn’t addressed the password allegations. The person claiming responsibility says they don’t intend to sell or leak the data. Apparently, the password wasn’t the only thing missing a few safeguards.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.