Cloudy with a chance of outages.

A Google Cloud outage disrupts UK banks. DHS bans DeepSeek. Shape-shifting ransomware targets Macs. Bank of America hires an army to patch AI-discovered flaws. Canada looks to bypass the U.S. with a transatlantic cable. A contractor breach exposes California student data. Cybersecurity hiring slumps, but AI skills are booming. Researchers expose the Silent Ransom Group’s playbook. A suspected Qilin ransomware operator takes a vacation straight into custody. Our guest is Roman Arutyunov, Co-Founder of Xage Security, discussing the next era of Zero Trust. A hotel phishing scheme gets a chilly reception.

Today is Tuesday October 20th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

A Google Cloud outage disrupts UK banking. 

A disruption at Google Cloud’s London data center Tuesday knocked several banks and other services offline, highlighting the growing dependence on a handful of cloud providers. Digital bank Revolut reported widespread outages affecting card payments, ATM withdrawals, and other services, though it said customer funds and data remained safe. ING Germany and Halifax Bank also reported online banking problems. Outage reports extended to other financial institutions, delivery services, and Britain’s National Health Service, though their connection to Google’s disruption wasn’t confirmed. Google said engineers were investigating the problem at its europe-west2 facility. The incident comes amid heightened regulatory scrutiny of cloud providers. Both British and European regulators have designated Google Cloud a critical third-party supplier to the financial sector, reflecting concerns about the systemic risks of shared infrastructure.

DHS bans DeepSeek AI products. 

The Department of Homeland Security is ordering U.S. civilian federal agencies to remove DeepSeek AI products and third-party services built using the Chinese company’s models from government systems. Agencies are also prohibited from acquiring them. DHS warns that DeepSeek could expose sensitive government information to China, potentially provide intelligence on U.S. citizens and federal agencies, and introduce malware or security vulnerabilities. The department previously instructed agencies to monitor government website traffic for potential DeepSeek-related threats. Several federal agencies and states have already banned the technology. The move is part of the Trump administration’s broader crackdown on Chinese technology, including restrictions on drones, consumer routers, and telecommunications equipment. The FCC is also preparing to vote on banning Chinese laboratories from testing electronics destined for the U.S. market.

Metamorphic ransomware targets macOS. 

Security researcher Patrick Wardle has uncovered Heartbreaker, an unusual macOS ransomware sample that attempts to rewrite and rebuild itself to evade detection. Written in Rust, Heartbreaker carries its own source code, allowing it to generate modified versions of itself with different file hashes while preserving its malicious behavior. The malware encrypts files in a victim’s Downloads folder, establishes persistence, and demands a Bitcoin ransom. Fortunately, its developers made a critical mistake: a hard-coded encryption key allows victims to recover their files without paying. Wardle also tested Heartbreaker against his open-source RansomWhere? tool, which successfully detected and suspended the malware by monitoring suspicious file encryption activity. The research demonstrates why behavioral detection can remain effective even when malware continually changes its appearance.

Bank of America throws people at an AI problem. 

Bank of America has brought in 1,000 outside contractors to help patch software vulnerabilities that advanced AI models, including Anthropic’s Mythos, can uncover and exploit. CEO Brian Moynihan told CNBC the contractors are working alongside 3,000 existing personnel to strengthen the bank’s internal systems and vendor software. The effort began earlier this year as increasingly capable AI models raised concerns about previously undiscovered security flaws. Moynihan said the bank spent more than $200 million in the third quarter on software remediation and anti-money laundering compliance issues, though he expects those costs to decline. Meanwhile, AI is delivering savings elsewhere. Bank of America has roughly 130 internal AI projects and expects annual savings from those initiatives to grow from $300 million this year to $700 million by 2027.

A proposed undersea cable could boost digital sovereignty. 

A Norwegian infrastructure company wants to build a transatlantic undersea cable connecting Canada directly to Europe, bypassing the United States. Dubbed Project Leif Erikson, the proposed 2,800-mile cable would run from Norway to Newfoundland and Labrador, then continue overland to Montreal. Developer Bulk Infrastructure says the project would strengthen Canada’s digital sovereignty and reduce its dependence on American infrastructure, an increasingly attractive proposition amid strained relations between Washington and Ottawa. The cable would support AI, telecommunications, and cloud computing, but significant hurdles remain. Bulk needs a majority investment partner, regulatory approvals, and additional financing for the project, estimated to cost more than $620 million. First proposed five years ago, the cable is gaining renewed interest as geopolitical tensions reshape digital infrastructure priorities.

A contractor data breach exposes personal information of California public school students. 

Personal information belonging to current and former California public school students has been stolen from Educational Testing Service, a contractor that administers state testing programs. According to California’s Department of Education, attackers used compromised credentials to access a file transfer system between May and September, copying student records. The exposed information includes names, addresses, birth dates, demographic details, and potentially sensitive disability and testing records. The breach affects students enrolled during the previous three school years and potentially some who left California schools as far back as 2006. No victim count has been disclosed, though California currently enrolls more than 5.7 million public school students. ETS says there’s no evidence the stolen information has been published. Affected students are being offered two years of identity protection.

The cyber job market stalls, except for AI. 

The U.S. cybersecurity job market has hit a four-year low, according to a new report from CyberSN. Job postings fell 26 percent during the first nine months of 2026 compared with the same period last year, dropping to roughly 236,000. But demand for certain AI-related skills is booming. Openings for AI Security Engineers surged 268 percent, while Cyber Data Scientist postings jumped 204 percent. By September, one in five cybersecurity job listings mentioned AI. Meanwhile, demand for traditional roles declined sharply, with postings for insider threat analysts, penetration testers, threat hunters, and cybersecurity risk analysts all falling substantially. CISO openings dropped nearly 39 percent, although they’re roughly level with 2024. The report tracks hiring demand, but doesn’t establish what’s driving these changes.

Researchers unpack the Silent Ransom Group. 

New research from Guide Point Security into the Silent Ransom Group reveals a cybercrime operation that relies less on malware than on social engineering and physical intrusion. The group allegedly recruits U.S.-based accomplices to impersonate IT personnel, infiltrate offices, and steal sensitive data using USB drives and legitimate remote-access software. Its targets include major law firms, whose executives receive direct calls demanding payment. Internal communications document increasingly aggressive plans involving coercion, kidnapping, and armed intimidation, though researchers found no evidence those schemes were carried out. The criminals’ own records claim nearly $207 million in ransom payments from 27 organizations in 2026, but those figures remain unverified. Researchers say the findings highlight the importance of verifying IT requests, restricting remote-access tools, and enforcing physical security procedures.

A suspected Qilin ransomware member is arrested while on holiday. 

German police have arrested a 28-year-old Russian man suspected of being a key member of the Qilin ransomware gang. Identified as Vladimir K, the suspect was detained in Japan in May and subsequently extradited to Germany. Investigators initially linked him to a 2024 ransomware attack against a German logistics company, but are now examining his possible involvement in the devastating attack on London pathology provider Synnovis. That incident disrupted blood-testing services across several hospitals, forcing cancellations of operations and appointments. An NHS investigation subsequently determined that delayed blood test results contributed to a patient’s death. British police are reportedly considering whether unlawful killing charges might be appropriate. Qilin has operated since at least 2022, reportedly targeting thousands of organizations and extorting more than $140 million.

Today on Industry Voices, we’re exploring why the next era of Zero Trust is about actions, not just access with Roman Arutyunov. And a hotel phishing scheme gets a chilly reception. Stick with us after the break for more.

We’re joined by Roman Arutyunov, Co-Founder and Chief Product Officer at Xage Security, to discuss how Zero Trust is evolving beyond access control. Here’s our conversation.

If you enjoyed our conversation with Roman Arutyunov, check out the full interview. You can find the link in the show notes.

A hotel phishing scheme gets a chilly reception. 

Japanese police have arrested a Chinese couple accused of turning a Kobe hotel room into an unlikely phishing headquarters. Investigators say 39-year-old Ye Jiafeng and an accomplice entered the hotel posing as guests, hid a small computer behind the refrigerator, connected it to the hotel’s Wi-Fi, and departed. The device allegedly sent some 480,000 phishing emails impersonating credit card companies. The operation unraveled when a suspicious recipient traced the messages to the hotel, where staff discovered the hardware. Apparently, the minibar wasn’t the only thing running up a tab.

Ye and his wife, Shen Qi, also face allegations involving fraudulent credit card purchases. Police recovered 74 smartphones from their home and are investigating transactions potentially totaling 10 million yen. Investigators believe others may have remotely operated the phishing computer, demonstrating that sometimes exploiting a network requires little more than a room key and a conveniently placed refrigerator.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.