An incident affecting 700 supermarkets exploited outdated refrigeration devices that were exposed directly to the internet. The intrusion caused millions of dollars in losses and contributed to fires.
5:35 PMArs Technica12 stories from 9 sources
Cyber failures are reaching the physical world and core financial systems
Day’s Recap
Supporting Articles
Hackers took control of software managing refrigeration units at French supermarkets and forced some equipment to heat dramatically overnight. The affected units were older models whose security software could not be updated to address a known risk.
10:10 AMSchneier on Security
Cyberattacks reportedly affected about 20 financial institutions earlier this month, with attackers allegedly using stolen partner bank credentials and weaknesses in payment APIs to divert funds. CERT-In urged banks, NBFCs and fintech firms to disable compromised interfaces, strengthen transaction controls and tighten customer verification.
3:30 PMEconomic TimesBank of America hired 1,000 contractors to fix software vulnerabilities identified by Anthropic's Mythos, revealing the labor costs of defending enterprise systems against AI-assisted security testing.
4:06 PMCNBC5:35 PMArs Technica
Fridge hack costing millions and sparking fires stemmed from poor security
Summary
An incident affecting 700 supermarkets exploited outdated refrigeration devices that were exposed directly to the internet. The intrusion caused millions of dollars in losses and contributed to fires.
Internet exposure turned neglected refrigeration equipment into a route to disrupt physical operations at scale.
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Connected operational technology can convert basic cybersecurity failures into costly disruptions and real-world safety hazards.
10:10 AMSchneier on Security
Cyberattack on Connected Fridges in France
Summary
Hackers took control of software managing refrigeration units at French supermarkets and forced some equipment to heat dramatically overnight. The affected units were older models whose security software could not be updated to address a known risk.
The attack converted a software vulnerability into direct physical and commercial damage, including potential spoilage
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Connected industrial devices can turn cyberattacks into immediate real-world losses, especially when legacy equipment cannot be secured.
3:30 PMEconomic Times
Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures
Summary
Cyberattacks reportedly affected about 20 financial institutions earlier this month, with attackers allegedly using stolen partner bank credentials and weaknesses in payment APIs to divert funds. CERT-In urged banks, NBFCs and fintech firms to disable compromised interfaces, strengthen transaction controls and tighten customer verification.
The attacks expose payment APIs and third party access credentials as a shared vulnerability across
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
A weakness in one partner connection can now enable fraud across multiple financial institutions.
4:06 PMCNBC
Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos
Summary
Bank of America hired 1,000 contractors to fix software vulnerabilities identified by Anthropic's Mythos, revealing the labor costs of defending enterprise systems against AI-assisted security testing.
The key shift is that AI can expose weaknesses faster than organizations can remediate them,
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI is turning software remediation into a larger and more urgent operating cost for major institutions.
Other Developments
A curated list of other prominent stories from this day.
Microsoft and Japan's National Police Agency dismantled a cybercrime marketplace linked to more than one billion phishing and scam messages worldwide, including fake parking-ticket and package-delivery alerts.
4:03 PMThe Verge
Suspected Israeli cyber-espionage operations have prompted heightened security crackdowns and counter-intelligence measures in Iran and Lebanon.
12:51 PMAl JazeeraMatthew Green has warned that AI systems could eventually outperform humans at cryptanalysis of symmetric and public-key encryption. Bruce Schneier is more optimistic, arguing that cryptographers' tendency to over-engineer systems may provide more protection than Green expects.
10:24 AMSchneier on SecurityThe United Kingdom has sanctioned Cryptomus, a cryptocurrency platform that experts link to payments involving ransomware, narcotics, darknet markets, fraud and cybercrime services. The platform also allegedly helped Russia evade existing financial restrictions.
10:22 AMKrebs on Security
Anthropic warns that small AI models with the ability to replicate themselves could spread through internet-connected devices. Such systems could create a new generation of autonomous computer worms.
8:55 AMArs TechnicaThe Bank of England and IMF warn that cyberattacks could threaten the stability of the banking system and erode public confidence in digital money. Severe disruption could push consumers toward holding cash outside banks.
8:39 AMFinextraSumsub has selected IPinfo as its primary provider of IP geolocation and VPN detection. The capability will support fraud prevention for more than 4,000 clients across financial services, crypto, trading, and iGaming.
5:40 AMFinextra
Seventy-seven percent of companies using AI-powered fraud defenses report better results than they achieved with manual controls. The findings suggest that deployed AI tools are delivering measurable gains for fraud prevention teams.
4:00 AMPYMNTS4:03 PMThe Verge
Microsoft and Japan took down a cybercrime network behind over a billion scam messages
Summary
Microsoft and Japan's National Police Agency dismantled a cybercrime marketplace linked to more than one billion phishing and scam messages worldwide, including fake parking-ticket and package-delivery alerts.
The takedown targets the infrastructure that lets criminals scale scams, not just individual messages or
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Breaking the service layer can reduce scam volume quickly, but lasting gains depend on stopping criminals from rebuilding the same infrastructure.
12:51 PMAl Jazeera
Suspected Israeli online operations cause alarm in Iran and Lebanon
Summary
Suspected Israeli cyber-espionage operations have prompted heightened security crackdowns and counter-intelligence measures in Iran and Lebanon.
The immediate shift is from suspected digital surveillance to broad internal security action. Authorities in
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Cyber-espionage is expanding into a wider security confrontation that could affect digital access, privacy, and regional stability.
10:24 AMSchneier on Security
The Future of AI Cryptanalysis
Summary
Matthew Green has warned that AI systems could eventually outperform humans at cryptanalysis of symmetric and public-key encryption. Bruce Schneier is more optimistic, arguing that cryptographers' tendency to over-engineer systems may provide more protection than Green expects.
The key uncertainty is whether AI will find practical weaknesses in deployed cryptography faster than
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI could turn cryptanalysis from a specialized research problem into a faster-moving operational threat to widely used encryption.
10:22 AMKrebs on Security
U.K. Sanctions Cryptomus for RU Money Laundering
Summary
The United Kingdom has sanctioned Cryptomus, a cryptocurrency platform that experts link to payments involving ransomware, narcotics, darknet markets, fraud and cybercrime services. The platform also allegedly helped Russia evade existing financial restrictions.
The sanctions target financial infrastructure that connects cybercrime proceeds with sanctioned Russian interests. Cryptomus and
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
The move treats crypto payment platforms as strategic enablers of both cybercrime and sanctions evasion.
8:55 AMArs Technica
Anthropic warns small AI models could self-replicate through IoT devices
Summary
Anthropic warns that small AI models with the ability to replicate themselves could spread through internet-connected devices. Such systems could create a new generation of autonomous computer worms.
The decisive shift would be lowering the cost and technical barrier for malware to adapt,
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Self-replicating AI malware could make large-scale attacks against poorly secured IoT devices faster, cheaper and harder to contain.
8:39 AMFinextra
BoE and IMF warn of cyber threat to banking system
Summary
The Bank of England and IMF warn that cyberattacks could threaten the stability of the banking system and erode public confidence in digital money. Severe disruption could push consumers toward holding cash outside banks.
The core risk is no longer limited to individual institutions: a major attack could spread
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Cyber resilience is becoming a condition for maintaining confidence in the banking system, not merely an IT or compliance issue.
5:40 AMFinextra
Sumsub Selects IPinfo to Bring Evidence-Backed IP Intelligence to Fraud Prevention
Summary
Sumsub has selected IPinfo as its primary provider of IP geolocation and VPN detection. The capability will support fraud prevention for more than 4,000 clients across financial services, crypto, trading, and iGaming.
Sumsub is making IP intelligence a standardized input in its identity and fraud controls rather
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
Reliable IP and VPN signals can strengthen fraud screening, but their value depends on how Sumsub combines them with identity, device, and behavioral evidence.
4:00 AMPYMNTS
Finance Teams Finally Have Proof AI Fraud Tools Pay Off
Summary
Seventy-seven percent of companies using AI-powered fraud defenses report better results than they achieved with manual controls. The findings suggest that deployed AI tools are delivering measurable gains for fraud prevention teams.
The 77% result moves AI fraud prevention from a technology bet toward an operational investment
Unlock the full First Pass Analysis to get a better understanding of why this story mattersWhy it matters
AI-based fraud detection is gaining the proof points needed to accelerate adoption across finance and security teams.
Make it yours
Build Your First Pass.
Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!