Top news stories this week
- Losing its cool. Cyberattacks target refrigeration systems across Europe.
- Good Will hacking. Binance reveals how fake recruitment led to record-breaking crypto theft.
- Token heist. Stolen AI keys fuel million-dollar LLMJacking attacks.
- Turbulence ahead. Amadeus breach hits airline passengers.
- Box clever. Google disrupts botnet built into Android TV boxes.
- Patch now. Critical flaws put remote access, Linux and security appliances at risk.
1. Cyberattacks target refrigeration systems across Europe
Supermarket fridges and freezers across Europe were disrupted in a cyberattack, causing temperatures to rise and food to spoil. Separately, French Blood Establishment sites were affected by a cyber incident that raised refrigeration temperature, however monitoring and alarm systems detected the changes and staff intervened before any damage was done.
So what?
Organisations should independently monitor OT environments and maintain safeguards that can detect and limit the impact of an attack, particularly where legacy systems are difficult to patch or replace.
[Researcher: Gabriella Nolan]
2. Binance reveals how fake recruitment led to record-breaking crypto theft
Binance has revealed how attackers used fake recruitment and malicious coding tools to target its engineers. One engineer received malware disguised as a coding assignment during a fake job interview, allowing the attackers to access the device and move through trusted internal systems to reach a platform capable of authorising fund withdrawals.
The investigation also identified an earlier compromise involving a tampered installer for a popular AI coding tool, suggesting the attackers had been conducting reconnaissance ahead of the theft.
So what?
Organisations should ensure technical controls are paired with robust compliance processes and employee security programmes.
[Researcher: Lester Lim]
3. Stolen AI keys fuel million-dollar LLMJacking attacks
Criminals are increasingly hijacking stolen corporate LLM API keys and cloud credentials in “LLMJacking” attacks, consuming AI services at victims’ expense and generating charges exceeding USD 100,000 per day and, in some cases, USD 1 million. Attackers are industrialising the technique through specialised operations such as LLM mixers, rapidly creating accounts, rotating stolen keys, bypassing rate limits and reselling access to premium AI models at heavily discounted prices.
So what?
To protect against LLMJacking organisations should implement stronger identity and access controls, least-privilege permissions, centralised secrets management and automated scanning for exposed API keys.
[Researcher: Milda Petraityte]
4. Breach at reservation provider Amadeus exposes passenger data across major airlines
A threat actor accessed booking data for over three years between August 2023 and September 2026, using credentials from an Amadeus system account. Multiple Asian airlines have now told customers that their data was exposed, including Japan Airlines, ANA, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines, and now Malaysia Airlines. The Australian airline, Quantas, is also investigating its exposure. Exposed data includes names, booking references, flight itineraries, and in some cases passport numbers and contact details.
SO WHAT?
A limited pool of reservation providers within the aviation supply chain demonstrates how one breach led to the data exposure of multiple airlines. As such, organisations should treat travel and booking platforms as part of their own attack surface.
[Researcher: Robin Toulalan Parr]
5. Google disrupts botnet built into Android TV boxes
Google and its partners have disrupted the XCPE botnet, which compromised more than 1.3 million devices, predominantly Android TV boxes, across over 200 countries. Google assesses that a backdoor was deliberately embedded in device software, allowing criminal affiliates to use affected devices for advertising fraud, routing malicious traffic and installing malware. The operation also disrupted related threats potentially involving millions more compromised devices.
So What?
Consumers should favour reputable manufacturers with established security and software-update practices, as malicious firmware installed before purchase can be difficult or impossible for users to remove.
[Researcher: Asya Sonnichsen]
6. Critical flaws put remote access, Linux and security appliances at risk
Security patches have been released for critical vulnerabilities affecting Ivanti Connect Secure, Node-RED, TeamViewer, the Linux kernel and Barracuda appliances. Ivanti and internet-exposed Node-RED systems are already being exploited, enabling privileged command execution and malware delivery. Other flaws could allow code execution, system compromise or root access.
SO WHAT?
Organisations should prioritise patching and active monitoring of actively exploited and internet-facing systems, particularly edge devices, OT systems, remote-support endpoints and Linux servers.
[Researcher: Tlhalefo Dikolomela]
The information contained herein is intended for informational purposes only. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details. S-RM does not assume, and shall have no liability for the control, correction, continuation or modification of any existing conditions or situation.
