October 2026 was a busy month for attackers. Ransomware took down a cloud provider, hackers reached the refrigerators of French supermarkets, and AI developer tools became a favourite target. Here are the stories that matter, what they have in common and what you should do about them.
This roundup draws on the CM-Alliance October 2026 report, SafeDep’s October incident review and Peterson Technology Partners’ roundup. Figures are as reported at the time; some are attackers’ claims and may change.
Ransomware hits a cloud provider
On 7 October, ransomware disrupted the IDCF Cloud service of IDC Frontier, a SoftBank subsidiary in Japan. Reports say around 495 companies and local governments were affected. The attackers made further claims about encrypted databases and deleted snapshots that haven’t been independently confirmed.
Why it matters: when a cloud provider goes down, every customer goes down with it. It’s a reminder to keep backups that live outside your main provider and to plan for a provider outage.
Retail outages and a very physical attack
- Ahold Delhaize confirmed a cybersecurity event in mid-October that took websites, apps and customer service systems offline. Stores stayed open, and the company said it had found no evidence that sensitive data was stolen.
- In France, attackers reached the refrigeration systems of supermarkets and changed their settings, causing food losses. Reports linked the affected units to outdated firmware.
Why it matters: “smart” building equipment (fridges, HVAC, cameras) is part of the attack surface. Devices on old firmware and connected to the internet are easy targets.
Big data breaches
- Burger King Japan reported a breach of more than 11 million customer records. Payment information was not reported as affected.
- Capcom reported unauthorised access to its CAPCOM ID system affecting about 11.7 million records, with no payment card data involved.
- Many more organisations, from universities to healthcare providers, disclosed incidents during the month, several through third-party suppliers rather than their own systems.
Why it matters: if you have accounts with these services, expect phishing emails that mention them. Change reused passwords and turn on two-factor authentication.
AI tools became a target
The fastest-moving trend this month was attacks on AI developer tools and services. SafeDep’s review describes several October incidents, including:
- a compromised release of the popular LiteLLM library, published using stolen maintainer credentials, and
- a malicious, modified AI coding extension that briefly appeared in an editor’s extension marketplace.
Attackers want these tools because they sit next to API keys, source code and cloud credentials. Meanwhile, security researchers continue to warn that prompt injection, where hidden instructions in a web page or file hijack an AI agent, is still not solved. Defences have to focus on limiting what a hijacked agent can do.
There were also reports from South Korea of attackers using AI tools to speed up breaches against many organisations. Exact figures differ between reports.
Why it matters: treat AI tools like any other software supply chain. Pin versions, review extensions before installing them, rotate keys after an incident, and give AI agents the least access possible. Our AI agents roadmap and MCP roadmap cover these safeguards.
A win for defenders
Not all the news was bad. Authorities announced action against a large phishing-as-a-service network linked to around a billion phishing messages sent to organisations in some 150 countries. Taking down the tools behind phishing campaigns can cut attack volumes far faster than blocking emails one by one.
India: rules every business should know
CERT-In’s six-hour rule is already in force. Since 2022, CERT-In’s directions have required many types of cyber incidents to be reported within six hours of being noticed, along with log retention and accurate clock synchronisation.
The DPDP Rules are arriving in two stages. The Digital Personal Data Protection Rules were published on 13 November 2025:
| Date | What starts |
|---|---|
| 13 November 2026 | Registration and duties of Consent Managers only |
| 13 May 2027 | Most duties for businesses: notices and consent, reasonable security safeguards, personal-data breach reporting, data principal rights, children’s data and the penalty provisions |
Businesses have about six months to get ready. The penalty for failing to take reasonable security safeguards can reach ₹250 crore. Check the official Gazette text or get legal advice for your specific situation.
What to do this month
- Turn on two-factor authentication na email, banking, cloud and social accounts; prefer an authenticator app or passkey over SMS.
- Patch internet-facing systems first, starting with vulnerabilities known to be exploited.
- Check your backups: at least one copy offline or with a different provider, and test a restore.
- Review your suppliers: which vendors can reach your data, and what happens if they’re breached?
- Narzędzia: Lock down AI: pin versions, vet extensions, keep API keys in a secrets manager and limit what agents can do.
- Prepare for DPDP: map the personal data you hold, tighten security safeguards and write a breach-response plan, including CERT-In reporting.
Learn cybersecurity step by step
Want to turn this into a career? Our free Cybersecurity & Risk Management roadmap covers security fundamentals, SOC and incident response, cloud and AI security, and risk management, including CERT-In and DPDP, with interview questions and a cheat sheet.
Najczęstsze pytania
What were the biggest cyber attacks in October 2026?
Major incidents included ransomware that disrupted IDC Frontier's cloud service in Japan (affecting about 495 organisations), a cyber incident that took Ahold Delhaize's websites and apps offline, an attack that tampered with refrigeration systems in French supermarkets, and large data breaches at Burger King Japan and Capcom.
When do India's DPDP Rules start?
The DPDP Rules were published on 13 November 2025. Consent Manager registration starts on 13 November 2026; most duties for businesses, including security safeguards, breach reporting and data principal rights, apply from 13 May 2027.
How quickly must cyber incidents be reported in India?
CERT-In's directions of April 2022 require many types of cyber incidents to be reported to CERT-In within six hours of being noticed.
