Cyber Security
October’s cyber attacks and what businesses can learn from them
By 19 October, HACKMAGEDDON’s indexed October timeline listed 221 vetted cyber incidents for the month so far. That is one tracker’s collection of publicly reported cases, rather than a complete worldwide count. Nearly three weeks into Cybersecurity Awareness Month, the public picture already includes customer data breaches, compromised business applications and supermarket refrigeration manipulated by attackers. Live Dashboard
The wider scale is more worrying. The UK Government’s latest Cyber Security Breaches Survey estimates 5.19 million cyber crimes against UK businesses over its preceding 12-month reporting period, predominantly phishing. Averaged across a year, that is approximately 430,000 a month. This provides context for the scale of cybercrime; it is not an estimate of undisclosed major breaches this October. No reliable global total exists for those incidents still undiscovered or absent from public reporting. GOV.UK
For businesses, the value of examining these stories goes beyond knowing who was attacked. Each raises questions about the systems we trust, the access we grant and the arrangements we depend on when something goes wrong.
Below, we examine 13 significant October incidents and campaigns, followed by two major disclosures published this month. Where investigations remain open, we distinguish confirmed information from unanswered questions.
Backup applications need access to the information they protect. That makes their identities and permissions particularly important, especially when attackers can use that trusted access to enter connected business systems.
ConnectWise confirmed unauthorised access involving Cloud Backup application identities. Huntress identified unauthorised sign-ins across 162 Microsoft 365 tenants within its visibility by 16 October. ConnectWise suspended affected services while investigating and remediating the incident. That observed figure should not be treated as the worldwide total. Huntress
The technical distinction matters. Investigators described an attacker authenticating as approved software, using permissions already granted to it. A service principal is an application’s identity within a Microsoft 365 environment. Unlike an employee, it can perform authorised tasks without an interactive user login. User MFA therefore does not provide the same checkpoint for this access path. Todyl
The business lesson: an account review should include applications as well as people.
Consider the services connected to your Microsoft 365 environment. Which can read company information? Which can change it? Are there permissions left behind by tools the business stopped using?
For affected organisations, resetting employee passwords alone does not resolve compromised application access. Investigation needs to cover application sign-ins, permissions, role changes and credentials added elsewhere. Huntress specifically warned that disabling an abused application would not remove credentials an attacker had already added to other applications. Huntress
This was one of October’s clearest examples of a cyber incident causing physical damage. Disrupted refrigeration turned a digital attack into spoiled stock, lost sales and immediate problems for supermarket staff.
Attackers interfered with supermarket refrigeration systems overnight on 11–12 October. Retailers confirmed disruption, and later reporting described hundreds of affected stores. Food had to be removed from sale and discarded. BleepingComputer · Le Monde
Le Monde reported defrost-system temperatures increased to 50°C, with cycles extended from one hour to eight hours. It also relayed an individual store’s report of equipment reaching 80°C. Those are reported examples, rather than evidence that every fridge reached the same temperature. Le Monde
The attack illustrates an often-overlooked part of cybersecurity: operational technology, meaning equipment and systems that control physical processes.
A supermarket’s exposure includes its refrigeration controls. Other organisations may depend on connected heating, building access, production machinery or environmental monitoring.
The business lesson: identify the equipment your organisation cannot safely operate without.
Who maintains it? Who can access it remotely? Is it still supported? Would its alarms continue working if the management platform failed?
These questions need input from operational staff and equipment specialists. A technical change that looks straightforward to IT may affect safety, stock preservation or essential services.
A useful recovery exercise should therefore test more than restoring files. It should establish how the business protects physical operations while systems are unavailable.
A compromised employee identity can give attackers access to the tools a business uses to communicate with customers. At ASOS, unauthorised app notifications brought the consequences of that access directly into public view.
On 6 October, ASOS customers received unauthorised app notifications. A subsequent company notice, reproduced by BleepingComputer, attributed the incident to an attacker impersonating a trusted contact and obtaining an employee’s credentials. Those credentials enabled access to third-party platforms used by ASOS. The retailer said payment card information and customer passwords were not accessed. BleepingComputer
This is a practical example of social engineering: manipulating someone into revealing information or taking an action.
The request does not have to look obviously suspicious. It may appear to come from a familiar colleague, supplier or support contact.
The business lesson: give staff a simple way to verify unusual requests through an independently known channel.
Customer communication tools also deserve close attention. Marketing platforms, notification services and other outward-facing systems carry the company’s credibility. Unauthorised messages sent through those channels can create immediate confusion.
Review who can access these tools, whether elevated permissions are necessary and how the business would issue a verified correction during an incident.
Staff training should support those controls. Employees need a clear reporting route and confidence that reporting a concern quickly is helpful, even when they are unsure whether anything has gone wrong.
Several familiar high-street brands experienced IT disruption while their stores remained open. The incident raises practical questions about which systems different parts of a business share and how they continue working when those systems fail.
TFG identified an incident on 11 October affecting systems used by Phase Eight, Hobbs and Whistles. Its announcement said stores remained open, although several IT systems were unavailable. Other named brands and its separately operated African and Australian systems were unaffected. Investigation into possible information compromise continued. TFG announcement, 13 October
The disclosure provides a useful opportunity to examine dependencies between different parts of a business.
A shared platform may make everyday work easier while also becoming a shared point of disruption. Separate systems can reduce common exposure, although the announcement does not establish exactly which controls limited this incident.
The business lesson: map systems to the activities they support.
If a central application becomes unavailable, can individual branches continue serving customers? Can staff accept orders, check availability or communicate with suppliers safely?
Business continuity plans become more useful when they describe those activities explicitly. “Restore the system” is a technical objective. “Keep customer orders moving while the system is unavailable” is an operational requirement.
Both need an owner, an agreed process and a realistic test.
Customer apps and loyalty programmes can hold substantial amounts of personal information. Burger King Japan’s disclosure shows why those records deserve protection even when payment card details are not involved.
Burger King Japan disclosed unauthorised access between 2 and 7 October involving approximately 11.18 million app membership records. Its notice listed personal and account fields, said credit card numbers were not held and reported no confirmed password leakage. It also warned customers about suspicious messages and calls. Burger King Japan
A record count is not necessarily a count of unique people. Equally, the absence of payment card information does not make a personal data incident harmless.
Information associated with a familiar brand can help make subsequent impersonation convincing.
The business lesson: review customer information according to its potential misuse, alongside its commercial value.
Why is each field retained? Who can retrieve it? Does an application need access to the complete customer population?
After an incident, communication should help customers recognise plausible follow-up scams. Explain how they can contact the company independently and what information the company will never request through an unexpected message.
That guidance should be specific enough to act on. A general instruction to “stay vigilant” gives people less help than a clear explanation of the requests they should challenge.
An attack on a cloud provider can interrupt the work of hundreds of organisations at once. For its customers, recovery depends on arrangements that may extend well beyond their own systems and IT teams.
IDC Frontier confirmed ransomware disruption affecting IDCF Cloud’s East Japan Region 1 from 7 October. Reporting said 495 companies and local governments were affected. The provider isolated impacted systems and restricted management-console access during its response. BleepingComputer · IDC Frontier
The cloud changes how infrastructure is operated. It does not remove the need to understand recovery dependencies.
A business may have live systems and snapshots in the same environment, managed through the same accounts. Whether that arrangement is sufficient depends on the incident being planned for.
The business lesson: ask how recovery works when the provider or management platform itself is unavailable.
Can the organisation access a usable copy elsewhere? Who can authorise restoration? How long would rebuilding essential services take?
Two terms help make that conversation concrete:
- Recovery time objective: the target time for restoring a service.
- Recovery point objective: how much recent data loss the business is prepared to tolerate.
These should reflect operational needs and tested capabilities. They become less useful when they exist only as contractual wording or assumptions.
Read about Logixal’s approach to layered security and backup protection.
Responding to an attack can require a business to take important systems offline. Ahold Delhaize’s incident illustrates the operational pressure that comes with containing a threat while keeping stores and services running.
Ahold Delhaize confirmed a cybersecurity incident on 12 October and took some systems offline as a protective measure. Stores remained open, while reporting described disruption to certain digital services. Its initial statement did not establish the intrusion method or extent of any data compromise. Ahold Delhaize · BleepingComputer
This is an important distinction for incident planning. Services can become unavailable because responders deliberately isolate them to prevent further harm.
That decision may be necessary, but it still affects staff, customers and suppliers.
The business lesson: agree how operational decisions will be made during containment.
Who can authorise a shutdown? Which processes depend on the affected system? What information can customer-facing teams safely provide while the investigation develops?
Maintain an alternative communication route in case the normal environment cannot be trusted or accessed.
A short, current dependency map can be more useful during an incident than a lengthy document that nobody has practised using. It should help decision-makers understand the consequences of taking a system offline before they have to make that decision under pressure.
Recruitment businesses rely on shared platforms to coordinate candidates, clients and placements. When a critical service becomes unavailable, that dependence can quickly affect everyday communication and time-sensitive work.
Recruitment businesses rely on shared platforms to coordinate candidates, clients and placements. When a critical service becomes unavailable, that dependence can quickly affect everyday communication and time-sensitive work.
Bullhorn temporarily disabled platform access during its response to a cyber incident. Its status page changed during this research: on 20 October, it reported all ATS/CRM regions online and continued monitoring, alongside remaining issues. It also warned customers about criminals impersonating its personnel to request credentials or verification codes. BleepingComputer · Bullhorn status
For customers, the operational problem can be immediate even when their own networks are unaffected.
Recruitment businesses depend on timely communication, accurate records and coordinated processes. An unavailable platform can create difficult decisions about how to continue work without introducing further risk.
The business lesson: prepare controlled fallback arrangements for critical software.
Know which information is essential, how it can be accessed securely and who is permitted to use an emergency export.
Treat unexpected support contact carefully during an outage. A real incident gives an impersonator a convincing opening: they can refer to genuine disruption while asking for something the legitimate supplier would never request.
Verify requests through established channels rather than relying on urgency or familiarity with the situation.
Technology designed to protect remote access can itself become a target for attackers. When a security appliance is compromised, the investigation may need to extend to credentials and systems elsewhere in the business.
Volexity identified exploitation of an Ivanti Connect Secure appliance that was fully patched at the time of compromise. Its investigation described a zero-day chain and attempts to obtain sensitive credentials. Fixes for the identified authentication-bypass and code-execution components followed on 13 October. Volexity
A zero-day incident should not automatically be described as an organisation neglecting an available update. The timing of the fix matters.
The case also raises a wider question: how closely are the systems protecting remote access monitored?
The business lesson: treat security appliances as privileged systems requiring their own oversight.
Maintain an accurate inventory, identify who receives vendor advisories and establish a route for urgent maintenance.
When compromise is suspected, installing a fix addresses the identified weakness. It does not establish that earlier activity left no consequences.
Investigation may need to consider the credentials accessible through the appliance and the systems those credentials could reach. Recovery should therefore follow current vendor and investigator guidance, supported by appropriate specialist help where required.
The systems used to manage backups need protection of their own. An attack on that infrastructure can raise difficult questions about the tools and processes a business would depend on during recovery.
Huntress observed attackers exploiting AhsayCBS from 7 October, chaining vulnerabilities to deploy webshells and, in some cases, cryptocurrency-mining software. Its updated investigation corrected affected-version information and documented hotfix guidance. Some malicious components were disguised to resemble Microsoft Edge software. Huntress
The visible payload is only part of the concern. A compromised backup-management system raises questions about the trustworthiness of the environment used to support recovery.
The business lesson: protect backup administration as carefully as other sensitive infrastructure.
Review who can reach the management interface, which identities administer it and whether that access is separated from everyday user activity.
A completed backup job does not answer every recovery question. The organisation also needs confidence that it can identify a trustworthy recovery point and restore it through a secure process.
For affected systems, use the updated original guidance. Early reporting can become outdated as researchers establish the scope and vendors release fixes.
Application files can contain information that helps attackers reach other systems. The Atlassian case shows why the consequences of a vulnerability depend partly on the credentials and connections behind the affected software.
Atlassian’s October advisory covered a file-access vulnerability affecting several self-hosted products. Research demonstrated how exposed application credentials could enable broader access in certain Crowd-integrated configurations. Exploitation attempts were subsequently reported. Atlassian distinguished affected self-managed deployments from its patched cloud products. Atlassian · watchTowr · BleepingComputer
The important business issue is what an application contains and connects to.
A collaboration platform might hold internal procedures, project information or configuration details. Its identity may also connect it with other systems.
The business lesson: assess the consequences of exposure across those relationships.
First establish whether the organisation uses the affected deployment type. Then follow the relevant vendor instructions and consider what information or credentials could have been accessible.
Permissions should match the application’s actual purpose. Broad access granted for convenience can increase the consequences when one component is compromised.
A routine software download can introduce a threat when the distribution process is compromised. For businesses relying on WordPress, this incident brought website maintenance and recovery arrangements into focus.
Rank Math confirmed malware in certain PRO version 3.0.123 downloads distributed during a limited window on 15–16 October. Its notice excludes the free WordPress.org plugin and distinguishes downloaded, installed and activated packages. Customers who activated an affected build were told to treat the site as compromised and follow recovery guidance. Rank Math
This story is relevant to marketing teams because a company website often sits between several owners: the internal team, hosting provider, developer and external agency.
During an incident, uncertainty over responsibility can slow the response.
The business lesson: establish website security ownership before something goes wrong.
Keep a record of paid components, maintenance responsibilities and emergency contacts. Confirm that a clean recovery copy exists and that someone knows how to use it.
A replacement software package is not necessarily a complete recovery. Where malicious code has already executed, the response may need to address changes and exposed credentials elsewhere.
Remote-management tools can hold powerful access to the websites they support. When the keys authorising that access are stolen, attackers may use an established connection to make unauthorised changes.
TeamUpdraft disclosed unauthorised access identified over 17–18 October and said it believed its customer database had been accessed. Patchstack reported attackers using valid UpdraftCentral keys to install backdoor plugins on connected sites. The vendor’s updated notice included releases designed to disconnect older connections. TeamUpdraft · Patchstack
A legitimate command channel can become dangerous when the credentials authorising it are compromised.
That makes remote-management keys an important part of access control, even when users rarely see them.
The business lesson: include remote-management connections in your security inventory.
Know which tools can install software, change settings or administer websites, and understand how that access can be revoked.
For affected services, follow current instructions and investigate connected systems for unauthorised changes. Removing an exposed connection does not, by itself, remove something already delivered through it.
The broader question applies beyond WordPress: which trusted services can act on your behalf, and how would you recognise their misuse?
Two further major disclosures published in October
Denmark’s Central Person Register
Legitimate access to a sensitive register can cause significant exposure when it is misused. Denmark’s disclosure highlights the importance of monitoring what authorised organisations retrieve and how that access is controlled.
On 5 October, the CPR administration disclosed that unauthorised parties had abused a company’s legitimate access to obtain information relating to approximately 8.8 million registered people. The authority suspended that access and reported the matter for investigation. CPR administration
The lesson is to look beyond whether a supplier is authorised. Consider how much information it can retrieve, whether abnormal activity would be detected and how quickly access can be suspended.
California student information held by ETS
Sensitive information can remain exposed to risk while held by a contractor or transfer service. This disclosure highlights why organisations need a clear view of where their data goes and who can access it.
California’s Department of Education published October notices concerning unauthorised access to and copying of student information from an ETS-operated file-transfer site. The announcements alone do not establish an October intrusion date. California Department of Education announcement · Incident letter
The lesson is to map sensitive information held by contractors, including transfer locations and access permissions.
What should your business do with these lessons?
These cases provide useful scenarios for reviewing your own organisation. They do not establish that one product or control would have prevented every incident.
Start with five questions:
- Which suppliers and applications have access to our information? Include backup, remote-management, marketing and website services.
- Which supplier outage would stop us working? Identify the essential activity and its fallback.
- Can we recover if the normal management environment is unavailable? Test access and restoration, alongside checking backup completion.
- Who receives urgent security notices? Make sure responsibility survives holidays, absence and staff changes.
- Would staff know how to verify and report an unusual request? Give them a practical route they can use quickly.
The NCSC’s supply-chain guidance offers a structured starting point for understanding supplier dependencies and assessing the confidence an organisation should place in them.
For further background, explore Logixal’s guides to Cyber Essentials, incident response planning and layered cybersecurity protection.
Cybersecurity Awareness Month is an opportunity to make these conversations specific. A headline becomes useful when it helps a business identify an overlooked dependency, remove unnecessary access or practise a decision before the pressure arrives.
