Maersk confirms data breach following ransomware gang claims

Global shipping and logistics giant Maersk has confirmed that attackers breached a legacy system belonging to a company it previously acquired, following claims by the WhiteArmor ransomware group that it had stolen approximately 100GB of data from the organisation.

According to Maersk, the incident has been contained and is isolated to a local system linked to LF Logistics, a supply chain company acquired by the shipping firm in 2022. The company stressed that its core operations remain unaffected and that there is currently no evidence that sensitive customer data has been disclosed. Customers can continue to book and manage shipments as normal.

WhiteArmor has demanded a $5 million ransom and claims to possess a large volume of data, including driver records, mobile device logs, administrative account details and supply chain information. Maersk has not confirmed the nature or extent of the allegedly stolen data and said its investigation remains ongoing.

The incident serves as another reminder of the risks associated with legacy systems and acquisition-related technology environments. It also highlights the continued threat ransomware groups pose to global logistics and supply chain operators, where operational disruption and sensitive business information can create significant leverage for attackers.

France accuses Iran over supermarket cyberattacks as Tehran denies involvement

Iran has rejected French allegations that it was responsible for a series of cyberattacks that disrupted refrigeration systems in supermarkets across France and other European countries. The accusations follow a wave of attacks that remotely altered temperature controls in commercial refrigeration units, leading to the spoilage of significant quantities of chilled and frozen food.

French authorities have attributed the attacks to individuals linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), describing the campaign as an unprecedented act of cyber sabotage targeting critical commercial infrastructure. French officials said the incidents affected hundreds of supermarkets, including stores operated by Intermarché, Carrefour, Monoprix and E.Leclerc, and warned that sanctions could follow.

The attacks targeted software used to remotely manage refrigeration systems, reportedly causing temperatures in some units to rise dramatically and forcing retailers to discard stock. Similar incidents have since been reported in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, raising concerns about the vulnerability of operational technology (OT) systems across Europe.

Iran has dismissed the allegations as “baseless and hostile”, while French prosecutors have opened an investigation into the suspected perpetrators. The incident highlights growing concerns over cyberattacks targeting physical infrastructure, where digital compromises can have immediate operational and economic consequences.

Poland took government services portal offline after cyberattack attempt

Poland temporarily shut down its national ePUAP e-government platform after detecting and blocking a cyberattack targeting the service. The platform is widely used by citizens, businesses and public institutions to submit official documents, communicate with government agencies and complete administrative procedures online.

According to Poland’s Digital Affairs Ministry, security teams identified and halted the attack before it could cause damage. Officials stressed that there is currently no evidence that government systems were compromised, disrupted or accessed by attackers, and that the shutdown was taken as a precautionary measure while technical assessments are carried out.

The temporary outage has made ePUAP electronic mailboxes unavailable and may also affect access to the country’s Trusted Profile digital identity service, which citizens use to access public sector platforms and digitally sign official documents. While authorities have not yet disclosed the nature of the attack or identified those responsible, restoration efforts are ongoing.

The incident highlights the growing cyber threat facing government digital services across Europe. It also underscores the difficult balance between maintaining service availability and taking proactive measures to protect critical public infrastructure from potential compromise.

N-able releases emergency fixes for critical N-central Zero-Day vulnerabilities

Remote monitoring and management provider N-able has released emergency security updates for multiple critical vulnerabilities affecting its N-central platform after security researchers publicly disclosed a series of zero-day flaws. The disclosures prompted the company to temporarily take its hosted N-central environments offline across North America, Europe and Asia-Pacific as a precaution against potential exploitation.

The vulnerabilities, which impact N-central's remote monitoring and management platform used by managed service providers (MSPs) and enterprise IT teams, include flaws that could enable remote code execution, privilege escalation, authentication bypass, cross-site scripting and server-side request forgery attacks. Security researchers also published proof-of-concept exploit code, significantly increasing the risk of malicious exploitation.

Although N-able has not confirmed any successful attacks, threat intelligence researchers reported observing active internet scanning and probing activity targeting vulnerable N-central servers shortly after the vulnerabilities were disclosed. In response, N-able released hotfixes addressing the most critical flaws and urged all on-premises customers to update immediately before restoring public access to their systems.

The incident highlights the cybersecurity risks facing remote management platforms, which are highly attractive targets because they provide privileged access to large numbers of customer environments. Security experts warn that organisations delaying patching could face elevated risks of compromise, particularly as attackers continue searching for exposed and vulnerable systems.

$740,000 in fraudulent AI charges generated after Railway customer secrets stolen

Cloud hosting provider Railway has revealed that attackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage charges. The company believes the threat actors specifically targeted AI service credentials, highlighting the growing value of access to AI platforms and developer environments.

According to Railway, attackers exploited unknown weaknesses in its build infrastructure to gain access to internal credentials and source code. They then leveraged additional vulnerabilities to obtain decryption keys used for customer environment variables, potentially exposing credentials linked to as many as 100,000 workspaces.

The attackers reportedly focused on harvesting API keys and authentication credentials associated with AI providers, cloud platforms and development services. Stolen credentials were subsequently used to consume large amounts of AI compute resources, resulting in the substantial fraudulent charges. Railway has said it is working with affected providers to obtain refunds and will cover costs that cannot be recovered.

The incident forms part of a broader wave of attacks targeting AI development platforms, with cybercriminals increasingly seeking access to valuable AI resources and credentials instead of traditional financial data. Railway says the attackers have been removed from its systems and all identified vulnerabilities have been remediated.

Cyber attacks on Australian organisations surge 39% Year-on-Year

Australian organisations faced a 39% increase in cyberattacks during October, with businesses experiencing an average of 2,117 attacks per week, according to new research from Check Point Research. While monthly attack volumes fell slightly compared with September, cybersecurity experts warn the broader trend remains firmly upward.

The report highlights a growing threat environment driven by ransomware, AI-enabled attacks and increasing exposure of sensitive data through generative AI platforms. Globally, ransomware groups claimed 1,063 victims in October, the highest monthly total recorded by Check Point and 35% higher than a year ago.

The education sector remained the most targeted industry worldwide, while agriculture experienced the fastest growth in attack activity. Researchers also identified rising concerns around employee use of generative AI tools, with nearly 3% of enterprise AI prompts classified as high-risk due to the potential exposure of sensitive business, financial and personal information.

Although phishing activity declined month-on-month, experts caution that cybercriminals are increasingly leveraging AI to automate attacks and improve efficiency. The findings reinforce the need for organisations to strengthen cyber resilience, improve employee awareness and implement clear governance around the use of AI tools.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.