Boardroom Resilience: Your Weekly Security Update

Cyberattacks on refrigeration controllers spread across Europe and reached a few UK meat suppliers, and US agencies then issued a warning. We also cover an alleged AI voice-cloning fraud aimed at finance teams, and a three-year supplier breach at airline technology provider Amadeus.This weekFridge controllers hacked across Europe, a few UK suppliers hit: check who runs your site systemsUS charges over an alleged 129 million dollar AI voice-clone fraud: a test of payment controlsAmadeus breach ran for three years on valid credentials: airlines bear the customer falloutThree questions for your boardWhich of our sites have refrigeration, building or access control systems that can be reached from the internet, and who looks after each one, us or a contractor?If someone who sounds exactly like our chief executive asks for an urgent, confidential payment, which step in our process would stop it, and when did we last test it?For the suppliers who hold our customers' data, how quickly would we know if someone was using a legitimate login to read it?SourcesRefrigeration attacks: Insurance Journal (Reuters) · ITV News · BleepingComputerAI voice-clone fraud: Dataconomy · Gadget ReviewAmadeus breach: PhocusWire · The Cyber Express · Business TravellerBoardroom Resilience is general information for senior leaders, not professional advice for any specific organisation. To discuss your board's position, contact Logica Security at logicasecurity.com.

A record six billion dollar crypto theft traced to one engineer's laptop, a critical web software flaw that attackers were using before the fix arrived, and a big week for UK cyber regulation. This episode covers what each means for boards and what to ask your head of security.This weekBinance lost over six billion dollars via one laptop; FBI blames North Korea. Check privileged accessPHP flaws confirmed exploited, with attacks starting before patches. Check for compromise, not just patchesLords amend the proposed UK cyber bill; NCSC publishes a new minimum resilience baselineThree questions for your boardWho in our organisation could move money or change payment systems on their own, and how fast would we know?Can you show me evidence that we've checked for PHP compromise back to the seventeenth of October, including systems our suppliers run?Where would we fall short against the NCSC's Core Profile, and which of our IT providers will the Bill bring into scope?SourcesBinance theft: CNN · Yahoo Finance · France 24PHP2Shell exploitation: Tenable · Security Magazine · NCSC-NL on GitHubUK Bill and CAF Core Profile: UK Parliament · VinciWorks · ViakooBoardroom Resilience is general information for senior leaders, not professional advice for any specific organisation. To discuss your board's position, contact Logica Security at logicasecurity.com.

AI-assisted research found two critical flaws in PHP, the software behind most websites, and organisations around the world took sites offline to patch them. We also look at where Ahold Delhaize's cyber incident ended up, and at a remote-support tool that a suspected state group exploited for weeks before anyone disclosed it.This weekPHP flaws found with AI forced emergency patching; check supplier products as well as your own sitesAhold Delhaize restored US sites after eight-plus days; its shutdown decision hit stores and distributionBeyondTrust remote-support flaw exploited for weeks; supplier access tools need evidence, not trustThree questions for your boardHow quickly could we find every system running PHP, including inside supplier products, and has that search actually happened since Wednesday the twenty-first?If we pulled core systems offline as a precaution, which sites, deliveries and revenue lines would stop, and who has the authority to make that call?Which suppliers and tools hold remote administrative access to our estate, and what evidence do we have that each is patched, monitored and still needed?Sources- PHP flaws: NCSC alert · Axios · CNN- Ahold Delhaize: [Ahold Delhaize statement](https://newsroom.aholddelhaize.com/ahold-delhaize-update-on-status-of-cybersecurity-incident/) · Grocery Dive · Reuters via The Star- BeyondTrust: Rapid7 · Cyber Daily · Tech TimesBoardroom Resilience is general information for senior leaders, not professional advice for any specific organisation. To discuss your board's position, contact Logica Security at logicasecurity.com.

A cyber attack on refrigeration controls spoiled stock and caused fires at hundreds of French supermarkets, while Ahold Delhaize spent the week recovering from a precautionary shutdown. We also cover a ConnectWise backup compromise that gave attackers a way into customers' Microsoft 365 environments.This weekFrench supermarket fridges hacked remotely: building controls are now a direct operational riskAhold Delhaize shutdown emptied shelves: recovery time, not the breach, drives revenue lossConnectWise backup tool abused to reach Microsoft 365: suppliers' standing access is exposureThree questions for your boardWhich of our sites have refrigeration, building or plant controls that can be reached remotely, and who outside our organisation holds that access?If we had to shut core systems as a precaution, how many days could our sites and distribution keep trading, and when did we last test that?Which outside applications hold standing access to our email and files, and could we still restore our data if our backup provider went offline?SourcesFrench supermarket refrigeration attack: France 24 · CBC News · The RegisterAhold Delhaize incident: NL Times · Reuters via AOL · DutchNewsConnectWise Cloud Backup compromise: BleepingComputer · The Hacker News · iTnewsBoardroom Resilience is general information for senior leaders, not professional advice for any specific organisation. To discuss your board's position, contact Logica Security at logicasecurity.com.

A ransomware attack on a Japanese cloud provider left hundreds of customers restoring from their own backups, and a UK retailer's breach became public through its own app. Separately, US agencies warned that a campaign against Fortinet firewalls is still locking owners out of their own devices.This weekIDC Frontier ransomware hit 495 customers, who were told to rebuild from their own backupsASOS breach became public via its own app, and exposed more data than first statedFBI warns FortiBleed firewall campaign continues, with lockouts leading on to ransomwareThree questions for your boardIf our main cloud provider told us to restore everything from our own backups, which systems could we actually bring back, and how fast?Which third parties can see our customer data or send messages in our name, and who has reviewed their access this year?Have we confirmed that every internet-facing firewall and remote access gateway, including those at our sites, requires multi-factor sign-in, and have we checked them for admin accounts we didn't create?SourcesIDC Frontier cloud ransomware: ASCII.jp · BigGo Finance · CybernewsASOS data breach: BleepingComputer · BBC via Yahoo News · TechCrunch via Yahoo FinanceFortiBleed advisory: Help Net Security · Cybersecurity Dive · DecipherBoardroom Resilience is general information for senior leaders, not professional advice for any specific organisation. To discuss your board's position, contact Logica Security at logicasecurity.com.