https://thewarrecord.com/cyber-war/feed.xmlThe War Record: The global cyber warThe latest days of the global cyber war in the record, and the events on them, each with its sources.2026-11-12T04:20:31ZThe War Recordhttps://thewarrecord.com/CC BY 4.0, https://creativecommons.org/licenses/by/4.0/. Third-party figures carry their own source.https://thewarrecord.com/favicon.svghttps://thewarrecord.com/cyber-war/day/2026-11-08/The global cyber war: 8 November 20262026-11-12T01:51:11Z2026-11-12T01:55:51ZRussian web hosting provider ESTT said a cyberattack disrupted services across its cloud infrastructure and that it found no evidence of a leak of customer data; nobody has named an actor. The ransomware group WhiteArmor claimed an attack on Maersk and demanded 5 million US dollars, BleepingComputer reported. 1 event and 1 statement recorded.https://thewarrecord.com/cyber-war/day/2026-11-11/The global cyber war: 11 November 20262026-11-12T01:51:11Z2026-11-12T04:20:31ZMaersk said a threat actor breached systems of a company it had acquired and stole data, and the ransomware group WhiteArmor claimed the attack; no government or examining company has named an actor. ConnectWise said it was investigating malicious activity affecting some partners of its ScreenConnect service, and Huntress said it was tracking six compromised managed service providers and more than 286 endpoints across 47 organisations. Ukraine's state news agency Ukrinform said its website and X account were attacked; nobody has named an actor. 3 events and 0 statements recorded.https://thewarrecord.com/events/ev-20261112-22xv/Maersk says a threat actor breached systems of a company it acquired and stole data2026-11-12T01:51:11Z2026-11-12T01:51:11ZA.P. Moller-Maersk said that a threat actor breached systems belonging to a company it had previously acquired and stole data, BleepingComputer reported on 11 November, the day it was made public. Maersk said the incident was isolated to a local system, that current evidence indicated no sensitive data was disclosed, that it found no impact on other Maersk, customer or partner systems, and that it expected no disruption to operations; it did not say when the intrusion happened. The ransomware group WhiteArmor claimed the attack and demanded 5 million US dollars, BleepingComputer reported. No government or examining company has named an actor.https://thewarrecord.com/events/ev-20261112-dndg/Russian web hosting provider ESTT says a cyberattack with file-encrypting malware disrupted its cloud services2026-11-12T01:51:11Z2026-11-12T01:51:11ZRussian web hosting provider ESTT said a cyberattack that used file-encrypting malware disrupted services across its cloud infrastructure on Sunday 8 November, The Moscow Times reported on 9 November. ESTT said it had restored 90% of customers' virtual servers by Monday, that customer dashboards were still unavailable, and that it had found no evidence of a leak of customer data, The Moscow Times reported. Nobody has named an actor.https://thewarrecord.com/events/ev-20261112-f6hh/ConnectWise investigates malicious activity affecting ScreenConnect partners; Huntress tracks dozens of hit organisations2026-11-12T01:51:11Z2026-11-12T01:51:11ZConnectWise said on 11 November that it was investigating malicious activity affecting a limited number of partners of its ScreenConnect remote-support service, BleepingComputer reported. Huntress, a security company that examined the activity, said it began at about 17:47 UTC that day and affected cloud-hosted ScreenConnect instances, and that it was tracking six compromised managed service providers and more than 286 endpoints across 47 organisations, with numbers rising, BleepingComputer reported. None of the providers or organisations was named. Nobody has named an actor.https://thewarrecord.com/events/ev-20261112-hgd2/The Philippines' Securities and Exchange Commission says it is investigating a data security incident2026-11-12T01:51:11Z2026-11-12T01:51:11ZThe Philippines' Securities and Exchange Commission said in a statement on 9 November, the day it was made public, that it was investigating a data security incident detected on 6 November, The Manila Times reported. The SEC said no passwords were leaked and no data was modified but that individual profile information may have been exposed, and it notified the National Privacy Commission on 9 November, The Manila Times reported. Nobody has named an actor.https://thewarrecord.com/events/ev-20261112-mfem/Ukraine's state news agency Ukrinform says its website and X account were attacked2026-11-12T01:51:11Z2026-11-12T04:20:31ZUkraine's state news agency Ukrinform said its website and its account on X were attacked on 11 November; its homepage was replaced with the word ZELENET, a crossed-out Ukrainian flag and a link to a Telegram channel, and a pro-Russian slogan was put in the X account's description, the Kyiv Independent and Ukrainska Pravda reported. Ukrinform said specialists were investigating, assessing the consequences and restoring services together with the SBU and the State Service of Special Communications, and director general Serhii Cherevatyi spoke of the attack to Ukrainska Pravda. No government, agency or company has named an actor.https://thewarrecord.com/events/ev-20261112-yhjq/Poland's digital affairs minister says a cyberattack on the state platform ePUAP was detected and stopped2026-11-12T01:51:11Z2026-11-12T01:51:11ZPoland's digital affairs minister Krzysztof Gawkowski said on X on the evening of 10 November, the day it was made public, that a cyberattack on the state platform ePUAP, used to file documents with public offices, had been detected and stopped, The Record and money.pl reported. The platform was taken offline as a precaution in the night of 10 to 11 November, Wirtualnemedia.pl and money.pl reported, and a ministry spokesman said this was not because the attack had breached or disrupted it, The Record reported. Wirtualnemedia.pl and money.pl reported that Poland's Internal Security Agency (ABW) had been brought in. Nobody has named an actor.https://thewarrecord.com/events/ev-20261112-zhq6/York University in Toronto says an unauthorised actor took personal information submitted through online forms2026-11-12T01:51:11Z2026-11-12T01:51:11ZYork University in Toronto said an unauthorised actor accessed some online forms used by university departments and took personal information submitted through them, in a notice dated 6 November, the day it was made public. Global News reported that the breach was discovered on 25 October, that the forms held submissions from 2007 to October 2026 such as residence applications and surveys, and that a small number of people had government identification or financial account information exposed. The university said it found no evidence the actor went beyond the affected websites. Nobody has named an actor.https://thewarrecord.com/events/ev-20261111-6v9h/Crédit Mutuel Arkéa says a cyberattack allowed fraudulent operations and some transactions were suspended2026-11-11T13:41:45Z2026-11-11T13:41:45ZFrench banking group Crédit Mutuel Arkéa said on 4 November, the day it was made public, that it had been the target of a cyberattack that allowed fraudulent operations, that the incident was under control and that some transactions were suspended as a precaution, AFP reported; the bank gave no day for the attack. The bank said the incident had no financial consequence for its customers, AFP reported. Nobody has named an actor.https://thewarrecord.com/events/ev-20261111-75nc/Chur health centre Gleis D says patient and staff data left its network in a cyberattack2026-11-11T13:41:45Z2026-11-11T13:41:45ZThe Medizinisches Zentrum Gleis D, a health centre in Chur, Switzerland, and its pharmacy Medi Porta said a cyberattack was stopped quickly with their IT partner but that patient and staff data still left the network, Inside IT reported on 6 November, the day it was made public; no source gives the day of the attack. The centre said it was fully operational and medical care was fully assured, Netzwoche reported on 9 November. The ransomware group Cloak claimed the attack, which is recorded as its statement; no government or company has named an actor.https://thewarrecord.com/events/ev-20261111-k4bq/University of Tübingen says attackers took about 3,900 staff records from its systems2026-11-11T13:41:45Z2026-11-11T13:41:45ZThe University of Tübingen said unknown attackers had attacked its systems and taken about 3,900 records of staff members, in a press release made public on 10 November; the university gave no day for the attack. The university said the data included names, dates of birth, work email addresses, user names and departments, that students were not affected and no passwords were taken, and that a criminal complaint was being filed, heise online reported on 11 November. Nobody has named an actor.https://thewarrecord.com/events/ev-20261111-w6r3/PayCloud says unauthorised access to its Arara Message email service exposed email addresses of client companies2026-11-11T13:41:45Z2026-11-12T04:20:31ZPayCloud Holdings said in a disclosure dated 29 October, the day it was made public, that unauthorised access to Arara Message, an email delivery service run by its subsidiary Arara, led to information leaking and the service being stopped; no source gives the day the intrusion began. BleepingComputer reported that Arara disclosed on 2 November that 77 million email addresses from nearly 380 corporate clients were affected, and that SEGA said 2.2 million of its newsletter subscribers' addresses were exposed. Nobody has named an actor.https://thewarrecord.com/cyber-war/day/2026-10-28/The global cyber war: 28 October 20262026-11-11T01:43:41Z2026-11-11T01:49:07ZIris Plaza, the online shop of Japan's Iris Ohyama group, said it found unauthorized access by a third party and stopped its official online shop, and later said personal data of up to about 7.7 million people may have leaked, Netshop Tanto-sha Forum reported. 1 event and 0 statements recorded.https://thewarrecord.com/cyber-war/day/2026-10-30/The global cyber war: 30 October 20262026-11-11T01:43:41Z2026-11-11T01:49:07ZBlockchain analytics company Chainalysis made public that an external actor had gained unauthorized access to its systems and internal tools, and later said the names, usernames, password hashes and live tokens of all its users had been exposed. 1 event and 0 statements recorded.https://thewarrecord.com/cyber-war/day/2026-11-06/The global cyber war: 6 November 20262026-11-11T01:43:41Z2026-11-12T01:55:51ZJapanese retailer Nitori Holdings said a third party gained unauthorized access to a system it manages and that up to 37.62 million records of personal information, including names, addresses and phone numbers, may have leaked; nobody has named an actor. A health centre in Chur, Switzerland, said patient and staff data left its network in a cyberattack, and the ransomware group Cloak claimed it. York University in Toronto said an unauthorised actor took personal information submitted through some of its online forms, in a notice made public that day; nobody has named an actor. 3 events and 1 statement recorded.https://thewarrecord.com/events/ev-20261111-b3h5/Iris Plaza, the online shop of Japan's Iris Ohyama group, says personal data of up to about 7.7 million people may have leaked2026-11-11T01:43:41Z2026-11-11T01:43:41ZIris Plaza, the e-commerce arm of the Iris Ohyama group in Japan, said it found a suspicious file on an external cloud service it uses on 28 October, stopped its official online shop and related systems, and confirmed unauthorized access by a third party, Netshop Tanto-sha Forum reported. In a notice dated 5 November, Iris Plaza said personal data of up to about 7.7 million people may have leaked, about 5.8 million members and about 1.9 million non-members, including names, addresses, phone numbers and email addresses, according to Netshop Tanto-sha Forum; SecurityWeek also reported the 7.7 million figure. Iris Plaza said card data was not stored there, that it reported the incident to the police and the Personal Information Protection Commission, and that no misuse had been reported as of 5 November. Its own shop stays offline with no restart date, while its shops on other e-commerce malls were not affected, Netshop Tanto-sha Forum reported on 9 November. Nobody has named an actor.https://thewarrecord.com/events/ev-20261111-nt48/Japanese retailer Nitori says a third party accessed one of its systems and up to 37.62 million records may have leaked2026-11-11T01:43:41Z2026-11-11T01:43:41ZJapanese furniture and home goods retailer Nitori Holdings said in a notice dated 9 November that on 6 November it confirmed unauthorized access by a third party to a system it manages, blocked the access and began an investigation with outside specialists. Nitori said up to 37.62 million records of personal information held on its servers may have leaked, including member and purchaser names, addresses, email addresses, phone numbers, dates of birth and gender, and said login passwords and credit card information were not among them. Nitori said access may also have occurred from mid to late October. BleepingComputer, reporting the notice on 10 November, said Nitori has informed Japan's Personal Information Protection Commission and the police. Nobody has named an actor.https://thewarrecord.com/events/ev-20261111-tqa1/Blockchain analytics company Chainalysis says an external actor gained unauthorized access to its systems and internal tools2026-11-11T01:43:41Z2026-11-11T01:43:41ZBlockchain analytics company Chainalysis made public on 30 October that it had detected an external actor gaining unauthorized access to its systems and internal tools during October, gave no day for it, and said it had notified all customers and that the incident was not related to the Binance theft. Chainalysis said on 4 November that names, usernames, password hashes and live tokens of all its users had been exposed, that it took several products and its login page offline, and that it had no evidence that investigations data was accessed. It said it restored KYT, Address Screening and Reactor on 7 November and Data Solutions on 10 November (an update stamped 08:00 UTC), with every user required to reset passwords and rotate API keys; SecurityWeek reported the breach on 2 November. Nobody has named an actor.https://thewarrecord.com/events/ev-20261110-cjg0/Russia's statistics agency Rosstat says its websites came under a cyberattack; two hacker groups claim they took data2026-11-10T16:31:43Z2026-11-10T16:31:43ZRosstat said targeted attacks on its resources took place from 29 October to 1 November, Anti-Malware.ru reported on 2 November, and it told RBC its resources had been subjected to a cyberattack and that no leak of databases or legally protected information was recorded, Mediazona reported on 1 November; Rosstat told Bloomberg it had no evidence data was compromised, heise online reported on 9 November. The hacker groups Cyber Partisans BY and Silent Crow said they hacked Rosstat's federal and regional websites and took about 23 TB of data, Mediazona and Anti-Malware.ru reported. Rosstat named no attacker.https://thewarrecord.com/cyber-war/day/2026-11-01/The global cyber war: 1 November 20262026-11-10T13:50:24Z2026-11-11T04:23:06ZRussian hosting and cloud provider Beget said that on the night of 1 to 2 November an attacker reached the management layer of its architecture and erased server data, destroying its cloud infrastructure, BleepingComputer reported. Beget said 60% of shared hosting and 40% of dedicated servers had been restored by 9 November and that it saw no sign customer data was downloaded or changed, and no attacker has been named. 1 event and 1 statement recorded.https://thewarrecord.com/cyber-war/day/2026-11-10/The global cyber war: 10 November 20262026-11-10T13:50:24Z2026-11-12T01:55:51ZThe ransomware group BYOD, which took responsibility for the attack on Vanderbilt University, claimed to have more than one million Social Security numbers from it, CyberScoop reported. French Foreign Minister Jean-Noel Barrot said France was weighing measures against Iran over the cyberattacks it blames on the IRGC, some of which might never be made public, Iran International reported, and said France would push for EU sanctions. The University of Tübingen said attackers took about 3,900 staff records from its systems, in a press release made public that day; nobody has named an actor. Poland's digital affairs minister Krzysztof Gawkowski said a cyberattack on the state platform ePUAP was detected and stopped, and the platform was taken offline as a precaution; nobody has named an actor. 2 events and 2 statements recorded.https://thewarrecord.com/events/ev-20261110-q4t9/Vanderbilt University says a cyberattack may affect campus devices and systems and asks users to disconnect2026-11-10T13:50:24Z2026-11-11T04:23:06ZVanderbilt University in Nashville made public a cyberattack on the morning of Monday 9 November and warned that campus devices and systems may be affected, The Record reported. A university spokesperson said its IT team was working to contain the incident, and the university asked people to shut down devices and disconnect from campus WiFi, according to The Record. The ransomware group BYOD listed the university and made claims about stolen data, The Record reported. Vanderbilt said in an update on Tuesday 10 November that some campus-wide systems and applications, including WiFi and Outlook, were safe to use again while others such as CampusPrint stayed restricted, CyberScoop reported. No government or examining company has named an actor.https://thewarrecord.com/events/ev-20261110-scpf/Russian hosting provider Beget says an attacker erased server data and destroyed its cloud infrastructure2026-11-10T13:50:24Z2026-11-11T04:23:06ZRussian hosting and cloud provider Beget said that on the night of 1 to 2 November an attacker reached the management layer of its whole architecture and erased server data, destroying its cloud infrastructure, BleepingComputer reported. Beget said VPS, S3 and Kubernetes data were lost along with CDN and IP settings and VPS backups. Beget said 60% of shared hosting and 40% of dedicated servers had been restored by 9 November, BleepingComputer reported. It said it saw no sign that customer data was downloaded or changed and that it is working with the police. No attacker has been named.https://thewarrecord.com/cyber-war/day/2026-10-29/The global cyber war: 29 October 20262026-11-09T22:52:22Z2026-11-12T04:20:31ZBinance said it was investigating a potential security issue and temporarily halted withdrawals across multiple networks, TechCrunch reported, and the FBI later said more than $6 billion was stolen on or about 29 October and that North Korea was responsible. Russia's statistics agency Rosstat said targeted attacks on its resources took place from 29 October to 1 November, Anti-Malware.ru reported, and told RBC that no leak of protected information was recorded, while the hacker groups Cyber Partisans BY and Silent Crow said they took about 23 TB of data, Mediazona reported. PayCloud Holdings said unauthorised access to its Arara Message email service led to information leaking and the service being stopped. 3 events and 0 statements recorded.https://thewarrecord.com/cyber-war/day/2026-10-31/The global cyber war: 31 October 20262026-11-09T22:52:22Z2026-11-09T22:52:22Z1 event and 2 statements recorded.https://thewarrecord.com/cyber-war/day/2026-11-02/The global cyber war: 2 November 20262026-11-09T22:52:22Z2026-11-12T04:20:31Z10 events and 0 statements recorded.https://thewarrecord.com/cyber-war/day/2026-11-03/The global cyber war: 3 November 20262026-11-09T22:52:22Z2026-11-10T19:23:44Z1 event and 2 statements recorded.https://thewarrecord.com/cyber-war/day/2026-11-04/The global cyber war: 4 November 20262026-11-09T22:52:22Z2026-11-11T13:44:23ZFrench banking group Crédit Mutuel Arkéa said a cyberattack allowed fraudulent operations and that some transactions were suspended; nobody has named an actor. The hacktivist personas NoName057(16) and Z-Pentest claimed the attacks on European supermarket refrigeration systems, and European Commission spokesperson Thomas Regnier said those attacks were not isolated incidents, naming no culprit. 1 event and 3 statements recorded.https://thewarrecord.com/cyber-war/day/2026-11-05/The global cyber war: 5 November 20262026-11-09T22:52:22Z2026-11-09T22:52:22Z1 event and 1 statement recorded.https://thewarrecord.com/cyber-war/day/2026-11-09/The global cyber war: 9 November 20262026-11-09T22:52:22Z2026-11-12T01:55:51ZVanderbilt University made public a cyberattack that it warned may affect campus devices and systems and asked people to disconnect from campus WiFi, The Record reported, and the ransomware group BYOD listed the university and claimed to have stolen data. The Paris prosecutor's office said it requested international arrest warrants against the leader of Shahid Kaveh, which it described as an offensive cyber unit affiliated with the Revolutionary Guards, and his two deputies over the attacks of 11 and 12 October, and Foreign Minister Jean-Noel Barrot said the IRGC carried out the attack on French supermarket refrigeration. CERT-FR said in a report that it imputes offensive cyber activity targeting France to the units Shahid Shoostari and Shahid Kaveh within the IRGC's electronic and cyber centre. The Philippines' Securities and Exchange Commission said it was investigating a data security incident in which individual profile information may have been exposed; nobody has named an actor. 3 events and 3 statements recorded.https://thewarrecord.com/events/ev-20261109-25vf/Paris prosecutor seeks warrants for leaders of Shahid Kaveh, a unit it ties to the IRGC, over October fridge attacks; France summons envoy2026-11-09T22:52:22Z2026-11-09T22:52:22ZThe Paris prosecutor's office said on 9 November it has requested international arrest warrants against the leader of Shahid Kaveh, which it described as an offensive cyber unit affiliated with the Revolutionary Guards, and his two deputies, over the attacks of 11 and 12 October, Al Jazeera reported. CBS News reported the office cited the use of Farsi and IP addresses tracing to devices in Iran, and alleged the offences were carried out to serve a foreign power. Foreign Minister Jean-Noel Barrot said the IRGC carried out the attack, that the Iranian ambassador had been summoned and that sanctions would be pursued at European level. No Iranian response was found as of 9 November.https://thewarrecord.com/events/ev-20261109-33xv/Supermarket cooling systems in Germany are manipulated; food discarded in Bavaria, North Rhine-Westphalia and Lower Saxony2026-11-09T22:52:22Z2026-11-09T22:52:22ZZDF reported on 3 November that cooling systems were manipulated at supermarkets in North Rhine-Westphalia, Lower Saxony and Bavaria, including an Edeka market in Reisbach whose management said large amounts of food were thrown away, and a Rewe-affiliated market in Raesfeld affected on Monday 2 November. A store owner in Lilienthal near Bremen said goods worth over 360,000 euros were discarded, ZDF reported, and Al Jazeera reported four supermarkets in Germany affected. Prosecutors are investigating, ZDF reported; no attacker was named.https://thewarrecord.com/events/ev-20261109-3weq/Italian catering company Siaf says its refrigeration control systems were hit by a cyberattack; government calls impact limited2026-11-09T22:52:22Z2026-11-09T22:52:22ZSiaf, a catering company in Bagno a Ripoli near Florence that serves about 1.8 million meals a year to company, school and hospital canteens, said its refrigeration management and control systems were affected by a cyberattack on 2 November, that the anomaly was caught quickly and service continued, La Nazione reported. The postal police are investigating, La Nazione reported. Italy's government said the impact was limited and that there was no cause for alarm, Al Jazeera reported. No attacker was named.https://thewarrecord.com/events/ev-20261109-5jmx/Refrigeration contractor says attackers reached a computer controlling an Estonian store's system; Selver says one store affected2026-11-09T22:52:22Z2026-11-09T22:52:22ZKitman Coldtech chief executive Jann Mutso said attackers had accessed a computer controlling a client's refrigeration system and that the attack was addressed within minutes without significant damage, AP reported citing ERR. The Selver chain said one of its stores was affected, AP reported. No attacker was named.https://thewarrecord.com/events/ev-20261109-705y/Taiwan's Bank SinoPac reports 427 unauthorised transfers after hackers breached settings at mobile banking suppliers2026-11-09T22:52:22Z2026-11-10T19:23:44ZBank SinoPac said 427 unauthorised transactions from 419 customer accounts, totalling about NT$41.76 million, were made the previous day after external hackers breached security settings at suppliers of its new mobile banking system, Focus Taiwan reported on 4 November. The bank said it found no evidence that personal information was compromised. A Financial Supervisory Commission official said the receiving account was frozen, and Taipei prosecutors are investigating, Focus Taiwan reported. No attacker was named.https://thewarrecord.com/events/ev-20261109-fzek/Musgrave says a cyber incident affected refrigeration in 13 SuperValu stores in Ireland2026-11-09T22:52:22Z2026-11-09T22:52:22ZMusgrave, which owns SuperValu, said a cyber incident affected refrigeration systems in 13 SuperValu stores overnight, that its monitoring flagged the problem and that chilled and frozen products in those stores were removed from sale as a precaution, the Irish Examiner reported on 2 November. Musgrave later said the incident was fully resolved, AP reported. It named no attacker.https://thewarrecord.com/events/ev-20261109-ghg4/Romania's cyber directorate says six stores of one chain had refrigeration controllers attacked; it suspects no state actor2026-11-09T22:52:22Z2026-11-09T22:52:22ZRomania's National Cyber Security Directorate (DNSC) was notified of a possible attack on refrigeration installations at six stores of one retail chain, where temperatures rose at about 01:30 in the night of 2 November, Playtech reported. DNSC director Dan Cimpean said the attack seemed semi-amateurish, that officials did not suspect a state actor and that no other infrastructure was compromised, Al Jazeera reported. No attacker was named.https://thewarrecord.com/events/ev-20261109-gxpr/ICA and Coop stores in Sweden report refrigeration problems; one store says freezers were set to 50 C2026-11-09T22:52:22Z2026-11-12T04:20:31ZICA said a small number of its stores operating outside its central network were affected, BleepingComputer reported, and a store manager told TV4 the temperature had been set to 50 C and could not be changed, so frozen food was discarded. Coop said 7 of more than 800 stores were affected, according to BleepingComputer; AP, citing TT, reported Coop saying six stores in central Sweden had problems. No attacker was named.https://thewarrecord.com/events/ev-20261109-j2y8/French blood service EFS says temperature limits were raised at cold rooms holding plasma; no products lost2026-11-09T22:52:22Z2026-11-09T22:52:22ZFrance's blood service EFS said temperature and defrosting limits were raised to extremely high levels at three cold-storage sites for plasma, that monitoring systems detected it and that no blood products or samples were compromised, AP reported. Euronews dated the attack, which went through EFS contractor Coolworld, to the night of 1 to 2 November and reported that EFS said the high temperature was never reached. Coolworld said it was aware of the incident and that the vulnerability involved a third-party component; France's cybersecurity agency and the health ministry are investigating, AP reported. No attacker was named.https://thewarrecord.com/events/ev-20261109-jdfb/Three UK meat suppliers and a wholesaler report attacks on refrigeration controllers; NCSC says national impact is minimal2026-11-09T22:52:22Z2026-11-10T19:23:44ZThe Association of Independent Meat Suppliers said three of its members reported attacks on their refrigeration controllers, and the wholesaler Langridge Organic said it was also attacked, The Record reported on 3 November. NCSC chief executive Richard Horne said the impact at national level is minimal but enormous for a business that is hit. The Record placed the European wave in the early hours of Monday 2 November and gave no separate time for the UK attacks; no attacker was named.https://thewarrecord.com/events/ev-20261109-maqp/Refrigeration disrupted at dozens of supermarkets in Belgium and Luxembourg; Belgian prosecutor opens an investigation2026-11-09T22:52:22Z2026-11-09T22:52:22ZDelhaize said an IT incident affected refrigeration in several dozen stores, about 40 in Belgium and Luxembourg according to BleepingComputer, and AP reported that a few were in Luxembourg. Carrefour said 15 of its 700 Belgian stores were affected, Colruyt said about five Spar stores, and BleepingComputer counted about 15 Intermarché stores and an IKEA store in Mons. A butcher in Hove lost meat worth about 15,000 euros after fridge temperatures rose to 18 C, Al Jazeera reported. Belgium's federal prosecutor's office opened an investigation on 2 November, Brussels Times reported; no attacker was named.https://thewarrecord.com/events/ev-20261109-qj87/Brazilian exchange Mercado Bitcoin suspends deposits and withdrawals after a cybersecurity incident2026-11-09T22:52:22Z2026-11-10T19:23:44ZMercado Bitcoin suspended deposits and withdrawals after a cybersecurity incident on the morning of Monday 2 November and said customers were not harmed and no data breach occurred, The Record reported. Blockchain security companies cited by The Record estimated that more than $46 million left the platform late on Sunday, a figure Mercado Bitcoin did not confirm, and Tether's chief executive Paolo Ardoino said about $4.5 million in stolen funds was frozen. No attacker was named.https://thewarrecord.com/events/ev-20261109-tnk5/Binance halts withdrawals after a security incident; billions in crypto taken from its hot wallets2026-11-09T22:52:22Z2026-11-10T19:23:44ZBinance said on 29 October it was investigating a potential security issue and temporarily halted withdrawals across multiple networks, TechCrunch reported. BleepingComputer put the theft at about $6.36 billion across ten blockchains, and the FBI later said more than $6 billion was stolen on or about 29 October. Binance said it would bear the financial impact of the stolen funds, and planned to resume the first phase of withdrawals on 1 November. On 31 October the FBI said North Korea was responsible.https://thewarrecord.com/events/ev-20261109-wehw/CISA, FBI, HHS, USDA and DOT issue a joint fact sheet on attacks on refrigeration controllers; it names no actor2026-11-09T22:52:22Z2026-11-09T22:52:22ZCISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet on 5 November saying malicious cyber actors globally are targeting unpatched or internet-accessible temperature and refrigeration controllers in retail grocery and cold storage facilities. It said the actors could change temperatures and possibly cause physical impacts, and urged operators to take control devices off the internet, change default passwords and patch. FBI official Brett Leatherman said such systems are being targeted across critical infrastructure sectors globally. The fact sheet names no actor and describes no specific incident.https://thewarrecord.com/events/ev-20261109-zc4t/FBI says North Korea was responsible for the theft of more than $6 billion from Binance2026-11-09T22:52:22Z2026-11-09T22:52:22ZThe FBI said in an alert on 31 October that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October, naming the actor it calls TraderTraitor. The FBI, the Secret Service and IRS Criminal Investigation asked exchanges to block transactions tied to 628 laundering addresses the FBI published, BleepingComputer reported. President Trump said the same day that it was not known whether North Korea was behind it, AP reported. No North Korean response was found.