Cyber Incidents 2-5 Nov 2026: What Is Confirmed

A roundup going around on 4 and 5 November 2026 ("Black October update: 55 new attacks in 48 hours") lists dozens of incidents as if they were one wave. It is not one wave, and not every item holds up. We checked each item against the organisation's own statement, a regulator, the police or a reputable outlet. Many are confirmed incidents, such as the attacks on refrigeration controllers across Europe, unauthorized access at NTT Docomo, the Amadeus booking-system incident and a WordPress core flaw now in CISA's exploited-vulnerabilities list. Some are claims only. A few are wrong or old. The bank items are in our separate bank post and are not repeated here.

Who this is for: security leaders, OT and facilities owners, retail and logistics teams, and anyone asked "did you see this?" by their board this week.

Independent analysis. PlayCISO is not affiliated with any organisation named. Facts are as reported on 5 November 2026 and may change. Most corporate notices were not opened directly; see Sources for what we read and what came via search summaries.

Confirmed incidents

Cold-chain controller attacks

• France, EFS plasma freezers. Le Canard enchaine reported on 3 November that the maintenance contractor Coolworld, a supplier to the French blood service EFS, was attacked on the night of 1-2 November and its freezers (normally around -30C) were reprogrammed to a setpoint of 110C. An on-call technician noticed the temperature rise. The attack was on the contractor, not on EFS systems, per IT-Connect's account. EFS first cited donor samples, then acknowledged transfusion plasma was affected. Units, temperatures reached, losses and the method are unpublished, and no attacker is named. A health-ministry statement reported by a news site says no serious operational impact and no confirmed destruction of stock. Single original report; we did not find an EFS primary statement.
• Europe wave. AP reported on 4 November that supermarket freezers in at least 11 countries were affected, starting Monday 2 November; Germany, Romania and the UK were added on Tuesday 3 November. Counts differ by outlet (from 7 to about 11). Carrefour Belgium said 15 of more than 700 stores were affected, "extremely limited". Belgian prosecutors opened an investigation. It follows an October wave in France that hit about 700 stores.
• Bavarian butcher. Regional press reports that overnight into 2 November the remote-control systems of several cold rooms at a butcher in the district of Neustadt an der Waldnaab were manipulated, with setpoints up to 150C. Damage is in the five-figure euro range and Kripo Weiden is investigating whether it links to the European attacks. Possible link, not established.
• What officials said. EU agriculture Commissioner Christophe Hansen on 2 November called it "a deliberate attempt to disrupt our food supply chain" and also said food security is not currently at risk. CERT-FR alert CERTFR-2026-ALE-012 covers Danfoss AK-SM/AK-SC and Copeland/Dixell xweb supervisors, and France's ANSSI director told the Senate on 21 October that the problem involves internet-exposed equipment and weak passwords. No single vendor or entry point is confirmed for the whole wave: in Estonia, press says the attacker reached a client's controller via a refrigeration firm; in Sweden, units on old 4G.

Telecom and transport

• NTT Docomo. On 5 November Docomo stopped its online shop and My docomo from about 01:05 JST and said unauthorized external access to its servers was "highly likely"; the scope and cause are under investigation and no data leak is confirmed. Separately, from about 11:18 JST voice, data and SMS were hard to use nationwide. Docomo has not said the outage is linked. Japanese media only; we did not open a Docomo release.
• Amadeus and airlines. Amadeus describes a vulnerability in its booking display environment, with data processed from August 2023 to September 2026 possibly affected. Singapore Airlines said on 3 November that about 46,000 booking records were accessed (names, booking references, itineraries; for some, contact details, KrisFlyer numbers and passport details), that its own systems were not breached and that card and bank data were not exposed. Malaysia Airlines said some customer data may be affected. Cathay says an unauthorised party used an Amadeus system-account credential. Reported via TechRadar and trade press.

Supply chain and software

• NIKKE launcher. Korean press reports that a domain used for the game service was taken over by a third party on 27 September and four JavaScript files on the CDN that the PC launcher loads were altered, delivering remote-control malware aimed at browser-saved passwords, account data and crypto wallets. Level Infinite and Shift Up apologised on 4-5 November; the mobile game is unaffected. How many PCs were hit is not disclosed. The roundup's "45 million downloads" is the game's total, not the number of victims.
• GitBook and PancakeSwap. GitBook disclosed on 2 November that attackers using AI agents obtained infrastructure credentials. Integration tokens, Git Sync keys, API tokens and Assistant visitor questions were potentially exposed; it found no evidence customer content was altered, revoked all personal API tokens, and restored service on 3 November. PancakeSwap took its GitBook-hosted docs offline for a time. Crypto trade press; GitBook's own notice was not opened. "Potentially exposed" is not "taken".
• WordPress core. CVE-2026-119977 is a race condition in the core full-package upgrade (CWE-367, CVSS 8.1) that allows unauthenticated code execution during the update window. It affects 4.7 to 7.1.3, is fixed in 7.1.4, and was added to CISA's KEV catalog on 3 November with a federal deadline of 6 November. It is not a general "take over any site" bug: the attacker needs the update window.
• Douzone Bizon. Korean press reports an intrusion into a development server around 26 October and then a backup server; a joint public-private team is investigating. Its Smart A10 product has about 110,000 customer firms, but affected firms and people are not yet identified. The roundup's link to a Korea Electric Power subsidiary is unverified.
• Frontline Education and JCPS. Jefferson County Public Schools says a breach at its HR vendor Frontline Education potentially exposed 37,000 or more current and former employees and others (SSNs, emails, home addresses). Frontline found the flaw in mid-August and told JCPS on 13 October; JCPS's own network was not compromised. This is a vendor-wide incident, not a JCPS hack.
• mSecure. mSeven told current and former users on 3 November that an unauthorized actor obtained an encrypted copy of a user-information database, with no evidence the actor accessed the confidential data inside. It advises changing stored passwords, resetting 2FA and removing passkeys. Reported scope is cloud-sync users; mSeven's own notice was not opened.

State and political

• Kyiv Independent. On 4 November attackers reached the site's content system and a newsletter service and sent four emails, the first saying Zelensky had "launched a nuclear warhead at Kyiv". Staff deleted the posts and closed the hole; the outlet says payment data is not at risk. The outlet attributes it to Russia from the content and similarity to the Air Alert incident; no technical proof is published.
• Ukraine's Air Alert app. At 22:47 local time on 1 November the app pushed fake radiation, chemical and street-fighting alerts. The Air Force said the app was "likely subjected to hostile interference", with no real threat. Ukraine's Centre for Strategic Communications blamed Russia; that attribution is Ukraine's claim, not independently confirmed. Sirens did not sound.
• APT29 watering hole. Sekoia (via Help Net Security, 4 November) describes lookalike and compromised sites serving exploits for already-patched iOS and Android flaws, attributed to APT29 with "moderate to high confidence". Sekoia says up-to-date OS versions are safe. We read secondary coverage, not the Sekoia report.
• Rosstat. The Record reports that Rosstat confirmed a cyberattack and that its site was defaced for about an hour. The Belarusian Cyber Partisans and Silent Crow claim months inside and data theft; Rosstat says it found no evidence protected data leaked. The leak is disputed.

Government, health and education

• La Laguna (Tenerife). The council announced a cybersecurity incident on 2 November affecting its website, e-office, file management and tax apps, and extended deadlines. Local press, citing council sources, reports a $5 million bitcoin demand that the council refuses to pay. The council has not confirmed the attack type or any data theft.
• NSW Health. Cyber Security NSW declared a "major incident" after an isolated server for the Oral Health Fee For Service Scheme site was targeted; NSW Police are investigating. Officials say no patient data was affected. The hacker claims about 100,000 documents (about 70 GB); police reportedly believe about 4 GB was taken. The claims are unverified.
• Washington State elections website. Secretary of State Steve Hobbs confirmed a cyberattack on the office's website; some pages were briefly unavailable and restored. Tabulation machines are not internet-connected and were not affected, per the office. Local media only.
• Poland, culture ministry. The ministry confirmed an incident in its SOP grants and scholarship system on 6 October, reported it to CSIRT GOV and the data protection authority, and shut the system. No traces of copying were found but a leak is not excluded. About 24,000 registered users is one outlet's count, not a count of victims.
• Bristol. The Independent reports at least 320,000 files from Bristol City Council servers have appeared on the dark web, with 39 schools' data accessed in September. The council has not confirmed what is online.

Consumer and retail

• Muji. Ryohin Keikaku announced on 4 November that about 1.09 million MUJI Card member records "may have been accessed": full card numbers, card ID and birth date. About 345,000 of those cards are still valid. Expiry date, security code and name were not included. This is part of a wider incident disclosed on 30 October covering up to 27.26 million app and online-store records.
• SEGA ALL.Net / Aime. SEGA's arcade unit said on 2 November that ALL.Net and Aime servers were accessed by a third party; online play and Aime stopped from 1 November, with no restart date. No user or partner data leak is confirmed and no payment data was on those servers. Some Bandai Namco arcade titles were also affected.
• Arara Message (Japan). Intrusion into the email-delivery service on 28-31 October; service halted on 31 October. Asoview (about 15.82 million members) and Bic Camera Group (about 14.9 million) report possible leaks; counts are described as possible and still rising.
• Holcim. The Emperador group listed Holcim around 31 October and claims about 360 GB. Holcim confirmed "limited, unauthorised access to data and its theft" and says industrial control systems, plants and logistics were unaffected. The 360 GB is the attackers' claim.
• Li Auto in Russia. Owner master accounts are being taken over, car screens go dark and owners are asked for about 45,000 rubles; the distributor Sinomach Auto confirmed the problem. The method is unconfirmed.
• Ahold Delhaize. With Q3 results on 4 November the company said its October cyberattack will cut Q4 net sales by EUR 200-250 million and underlying operating income by EUR 75-100 million. That is lost sales and guidance, not profit lost.
• Sompo Japan. A contractor's FAQ system for the SMILING ROAD business dashcam service was accessed on 2-3 October; about 60,000 inquiries (not unique people) are affected. This is not roadside assistance, as the roundup says.
• Giftee. A third party exploited a vulnerability in a group subsidiary's system and fraudulently issued e-gifts; expected loss is about JPY 550 million, an estimate. No personal data leak is confirmed.
• Zyxel. GreyNoise counted 996 compromised GS1900 switches in 48 countries via CVE-2026-7273, with 564 victims on default credentials. This is not a zero-day: the fix shipped in June 2026 firmware, before exploitation around 17 August.

What the roundup got wrong or old

• ECB malware on 22 October: no 2026 report found. The only match is a 2019 ECB website incident.
• Harvard, 850,000: no source for the figure, and the incident is a November 2025 vishing breach.
• Adobe Commerce "unpatched": true only in early September (exploitation since about 4 September); a fix followed.
• Berlin city government was an August attack. Polkadot (Hyperbridge) was April.
• Nomura, IHG, Pegasus, BitMart, Chainstack: we found no 2026 incident. Not found does not mean disproven; the news index for days-old events is thin.
• The UK NCSC "foothills" quote: no source found. NCSC chief Richard Horne told the BBC the issue affected "the whole food supply chain".
• Zyxel "before a fix existed": contradicted, the fix came first.
• "Two airlines, 1.2 million": not found.
• "110C" in the plasma freezers: a setpoint, not a measured temperature.

Timeline

What security leaders should do this week

• Inventory internet-exposed OT, refrigeration and building-management supervisors. Find any that are reachable from the internet, change default passwords and put remote access behind a VPN or gateway with MFA. Start with the vendors in CERT-FR's alert (Danfoss, Copeland/Dixell). Our OT exposure parser helps read scan output, and the Cold-Chain Wargame rehearses the decisions.
• Review supplier and contractor remote access. The French case was a maintenance contractor, the Estonian one a refrigeration firm. Ask who can reach your equipment and how, using the vendor risk assessment.
• Patch WordPress to 7.1.4 and apply current iOS and Android updates. CISA's KEV deadline for the WordPress flaw is 6 November; Sekoia says patched mobile devices are safe from the APT29 chain.
• Rotate keys and tokens held on third-party platforms such as GitBook. Revoke and reissue integration, Git Sync and API tokens, and review what your public docs expose.
• Check launcher and CDN integrity. If you ship a desktop launcher or load scripts from a CDN, monitor domain ownership and file hashes; NIKKE's files were altered after a domain takeover.
• If you use mSecure, follow the vendor's advice: change stored passwords, reset 2FA and remove passkeys.
• Check which booking intermediaries hold your travellers' data. The Amadeus incident reached airlines that were not themselves breached. The third-party breach response checklist sets out the steps. For the agentic-AI angle behind some of these stories, see our ARTEX and GTIG post.

FAQ

Did hackers set blood-plasma freezers to 110C?

Partly. Le Canard enchaine reported that freezers serviced by the EFS supplier Coolworld were reprogrammed to a setpoint of 110C on the night of 1-2 November. A setpoint is the target the controller was given, not a measured temperature. Units affected, temperatures reached and losses are unpublished, and the original report is a single source.

Are the European supermarket freezer attacks linked to Russia?

Not confirmed. NoName057(16) and Z-Pentest reportedly claimed it in posts later deleted. The EU names no culprit and Romania's cyber chief called it "semi-amateurish" and did not suspect a state actor. Treat the Russia link as a claim.

Is the Docomo outage a cyberattack?

Docomo said unauthorized external access to its servers was "highly likely" and halted its online shop and My docomo. The separate nationwide voice, data and SMS outage from about 11:18 JST has not been linked to the access by Docomo, and no data leak is confirmed.

Was Harvard hacked for 850,000 people?

We found no source for 850,000. Harvard's confirmed incident is a phone-phishing breach of alumni and development databases found on 18 November 2025. It is not a November 2026 event and no affected count was published in the sources we found.

Sources

All accessed 5 November 2026. "Read" means we opened the page; "via search" means we saw only a search summary or snippet. We did not open most corporate or regulator notices directly, so several facts rest on press reports of them. Items we could not source are labelled in the text.

• AP via TechXplore: European countries snared in freezer cyberattacks (4 Nov; Hansen quote, country counts; read)
• IT-Connect: EFS and Coolworld freezers (cites CERT-FR alert CERTFR-2026-ALE-012, which we did not open; read)
• Al Jazeera: who is attacking Europe's supermarket freezers (3 Nov; read)
• Infranken: Bavarian butcher cold rooms (regional press; read)
• Cybernews: pro-Russian claim for the refrigeration attacks (claim only; read)
• Nikkei: Docomo online shop and My docomo (5 Nov; via search); SMHN (read)
• TechRadar: Singapore Airlines, 46,000 booking records, Amadeus (airline notices not opened; read)
• Newspim: NIKKE launcher (Korean press; operator notice not opened)
• Decrypt: GitBook AI-agent security breach (GitBook's own notice not opened)
• The Hacker News: CISA confirms WordPress exploitation (CISA KEV page not opened; via search)
• Kyiv Independent: hit by suspected Russian cyberattack (primary; read)
• Al Jazeera: Ukraine blames Russia after Air Alert app false warnings (read)
• Help Net Security: APT29 watering hole (Sekoia) (Sekoia original not opened; read)
• The Record: Rosstat attack (read)
• Krebs on Security: renting an address at the White House (Layer3 Intel finding; read)
• ITmedia: Muji card members (Japanese press; company release not opened); ITmedia: Asoview / Arara
• DutchNews: Ahold Delhaize cost (company release not opened)
• inside-it.ch: Holcim confirms cyberattack (Swiss press; via search)
• WDRB: JCPS and Frontline Education; Frontline notice (via search)
• ACS Information Age: NSW Health (official NSW statement not opened)
• KOMO: Washington Secretary of State website
• Help Net Security: Zyxel CVE-2026-7273 (GreyNoise)
• Harvard Magazine: Alumni Affairs breach (2025 incident)
• ECB press release, 15 Aug 2019 (the only matching ECB incident)

Other items (La Laguna, Poland, Bristol, SEGA, Li Auto, Beget, Sompo, Giftee, Douzone Bizon, mSecure, Japan Times) rest on local or national press reports we saw mainly via search summaries. The bank incidents are covered in our bank post.

This article is general information, not legal or security advice. Follow your vendors' and national authorities' guidance.