Our weekly review covers 2 to 8 November, read by a risk owner rather than an analyst.
This week's thread fits in one sentence: the next shutdown of your operations may not come from your most critical server, but from a device nobody ever put on the inventory. This week, refrigerators. Nobody calls them "IT", nobody patches them, and they sit on the internet with the factory password. It is a position, not a certainty: you can argue that fridges are a grocer's problem. We think otherwise, and here is why.
Part 1: one night, more than a hundred stores
What happened
During the night of 1 to 2 November, more than a hundred businesses in several European countries (Belgium, the Netherlands, Ireland, Sweden, Finland, Luxembourg and Estonia, among others), according to Reuters, saw the temperature of their refrigerated counters and freezers climb. The attackers had reached refrigeration controllers exposed online and locked them into defrost mode. The stock was thrown out.
- Carrefour Belgium: 15 stores hit out of more than 700. Status: reported by the press, citing the company.
- Danfoss, a controller manufacturer: according to a spokesperson quoted by Dutch broadcaster NOS, the affected systems in the Netherlands were not on a secure network and still used default passwords; the weakness, the manufacturer says, lies mainly in software that was not updated. Status: reported.
- It is the second wave: during the night of 11 to 12 October, nearly 700 sites in France had suffered the same attack, and Danfoss said most of the equipment hit was legacy product that no longer receives updates (reported by AFP).
Who is behind it? Two answers not to be confused. NoName057(16) and Z-Pentest, two pro-Russian hacktivist groups, claimed the November wave; the Kremlin denies it (claimed, unverified). On Monday 9 November, France attributed the October wave to Shahid Kaveh, an offensive cyber unit of Iran's Revolutionary Guards, and summoned Iran's ambassador (confirmed by French authorities, reported by Reuters). Nothing links the two waves yet. The lesson for an executive team: whoever the attacker, they came in through the same door.
What the authorities say
On 5 November, CISA, the FBI and three other US federal agencies (Health, Agriculture, Transportation) published a joint fact sheet: malicious actors are targeting temperature and refrigeration controllers in grocery stores and cold storage. A compromised controller can be forced into continuous heating or defrost cycles, with inventory losses, equipment wear and fire risk. First recommendation: take these controllers off direct internet access, and if remote access is needed, put it behind a patched firewall or edge device. Status: confirmed. The fact sheet names no attacker and no manufacturer.
What it changes
Three assumptions fall.
"It's not IT." The refrigeration controller, the building management system, the access controls, the boiler: bought by facilities, installed by a contractor who often connects them to the internet for remote support, they sit in no access review and no patch cycle. To an attacker, they are an IP address like any other.
"It only affects grocers." The same controllers keep medicines, vaccines, samples and chemicals. A hospital, a pharmacy or a lab has the same exposure. In August, in Winnipeg, ransomware had already reached the doors and ventilation of the Health Sciences Centre (confirmed by Shared Health).
"The manufacturer handles it." A device that no longer receives updates stays in service for years. Nobody retired it, because nobody owns it.
For an executive team, the question is not "do we have connected fridges?". It is: who, here, owns the devices that are not computers, and who knows which of them answer from the internet? We wrote about it in the exposure nobody owns.
Part 2: active exploitation
Three additions to CISA's KEV catalogue this week, one of them an edge device:
- SonicWall SonicOS, SSL VPN access, on 6 November: a user holding valid credentials for another authentication method can bypass SAML controls, including SAML-enforced MFA. Gen 7 and Gen 8 firewalls, fixes available, no workaround according to SonicWall (advisory SNWLID-2026-0014). Due by 20 November for US federal agencies. Status: exploitation confirmed by CISA; SonicWall says it is investigating a report of possible exploitation.
- WordPress, on 3 November: a race condition in the core software lets an unauthenticated attacker run code on the server during an update. Federal deadline: three days. Status: exploitation confirmed by CISA.
- Apple, on 4 November: a 2024 flaw (CVE-2024-27834), fixed in May 2024 in iOS, macOS and Safari, joins the catalogue. Status: exploitation confirmed by CISA.
What it changes: last week, MFA gave way to a phone call; this week, to a flaw in the VPN that enforces it. It remains essential, but it is only as strong as the device that applies it. If your remote access runs through a SonicWall, the patch date is an executive decision, not a support ticket. And the Apple flaw echoes this week's thread: a patch released two years ago does not protect the device nobody updated.
Part 3: Canada
York University, in Toronto, disclosed a data theft: an unauthorized actor accessed web forms used by some university departments and took personal information submitted through them, mostly York ID numbers and contact details. The incident was discovered on 25 October, contained, and reported to Ontario's Information and Privacy Commissioner and to police. For a small number of people, government ID or financial account information is involved; they are being notified by email. Status: confirmed by the university.
On 3 November, before the House of Commons procedure and House affairs committee, which is studying AI and democratic institutions, Chief Electoral Officer Stéphane Perrault did not say Elections Canada's systems were safe from foreign hacking: "the worst mistake would be to believe that we are immune from attacks," he said (reported by The Hub).
The context comes from the Canadian Centre for Cyber Security. On 29 October 2025, with the RCMP, it reported (alert AL25-016) that hacktivists had tampered with exposed controllers in Canada: the pressure at a water facility, a tank gauge at an oil and gas company, the temperature and humidity of a grain silo. Three sectors, one way in: an industrial device reachable from the internet. Status: confirmed.
What it changes: York's forgotten web form and the refrigeration controller are the same problem. An asset nobody tracks, set up for a specific need years ago, and still online. The Chief Electoral Officer's answer is the right posture: assume the vulnerability, then measure it.
Part 4: AI on both sides of the table
On the attack side. In late October, CrowdStrike detailed ARTEX, an AI agent framework a China-linked group (Vapor Panda) used to target more than 200 organizations in at least 14 countries, over 11 days starting 17 October: foreign ministries, defence, semiconductors, telecoms, think tanks. The operation ran mainly on DeepSeek and a second commercial model. Two nuances: 200 is the number of targets, not victims (nine confirmed intrusions); and the human operator stepped in at decision points. Status: reported by the researchers.
On the defence side. On 4 November, OpenAI described a chain of agents that, with an unreleased cyber model, validated 948 privilege escalation flaws in the Linux kernel and produced a patch for each, for about US$1.2 million in API credits. Status: reported by the vendor.
What it changes: AI does not create new doors, it tries them all faster. The exposed controllers, unpatched VPNs and forgotten forms were already there; an agent tries them on hundreds of targets at once. The gap between "exposed" and "exploited" is shrinking, and that gap is what the register has to measure.
This week's three questions for an executive committee
- Who, here, owns the devices that are not computers (building, refrigeration, access, production), and is there a list of the ones that answer from the internet?
- Do our contracts with installers and maintenance providers say who may connect a device to the internet, with which password, and who patches it?
- If our VPN got a KEV-listed flaw tomorrow, how many days would the fix take, and who would sign the exception if it could not be done?
Your turn
Our position: a device that answers from the internet without an owner is a business risk, not a technical detail, whether it is a server or a freezer. Overstated? Tell us in the comments which "not IT" device worries you most.
FortaRisks' Exposure module monitors more than 15 industrial ports; the free exposure report shows within 48 hours what answers from the internet on your side. And thirty minutes with an expert is enough to work through your three questions.
Sources: CISA, FBI, HHS, USDA and DOT, joint fact sheet on hardening industrial refrigeration and cold chain monitoring systems (5 Nov. 2026) · CISA, KEV catalogue · CISA, KEV addition (3 Nov. 2026) · SonicWall, advisory SNWLID-2026-0014 · York University, incident notice · Canadian Centre for Cyber Security, alert AL25-016 (29 Oct. 2025). Monitoring, named in the text: Reuters, AFP, NOS, The Hub, CrowdStrike, OpenAI, Shared Health.