The Week Hackers Went Grocery Shopping

Supermarket fridges cooked to 50°C, a prime minister's private footage up for sale, an AI chip that made a lethal call, and a Roadster that apparently flies.

Welcome to Friday. Kick off your shoes, because this was one of those weeks where cyber stopped being an abstract thing and walked straight into the supermarket aisle. In France, attackers pushed hundreds of supermarket refrigeration systems into defrost until fires broke out. In the Netherlands, supermarket Albert Heijn's cyber incident reached its distribution centres, and its CEO warned the shelves would empty. And in Ukraine, investigators say a chip Nvidia calls a consumer product for students made the final decision in a deadly drone strike.

But the stories that stayed with us were less sensational and more facepalm. A refrigeration controller whose admin password is today's date. An admin account granting access to PII of millions in Denmark protected by "123456". Meta's source code walking out the door on one employee's stolen login. We keep picturing elite adversaries, and then it turns out someone left the back door on the latch. So pour something nice, get comfortable, and let's go through it together.

1. Someone is selling a peek inside Netanyahu's inner circle

A Telegram channel has started leaking what it says are confidential videos and photos of Israeli Prime Minister Benjamin Netanyahu, including footage from his military helicopter and photos from inside the Wing of Zion jet. The channel claims hackers got into the phones of Israeli Ambassador Yossi Shelley and Sara Netanyahu, and it wants $1,011 in Bitcoin for the first batch (3 Bitcoin for the full set).

The weak spot around a head of state is rarely the head of state. It's the spouse, the ambassador, the aide, anyone whose phone sits close to power but outside the tightest security bubble. This leak suggests this is more about attention and embarrassment than money.

https://x.com/IntCyberDigest/status/2110404521209819221

2. France's supermarket fridges, hacked to 50°C

Attackers took control of Danfoss refrigeration controllers across French supermarkets and forced them to defrost at up to 50°C (a colleague told me they were 'slow cooking'), and fires broke out. The count kept climbing all day: first up to 200 Intermarché stores and fewer than 100 Coopérative U stores, then 300+ at Intermarché and Netto plus 80 Carrefour stores. Paris prosecutors have opened an investigation, a PM aide says France's cyber agency ANSSI found a flaw in Danfoss software, and France fears other EU countries may be hit too.

Danfoss says most affected units were legacy devices that no longer get security updates. Back in August, Claroty found that Danfoss AK-SM 800A controllers accept a password derived from the date, and counted 2,765 of them exposed online. The username is admin and the password is literally today's date, and there's also a documented login bypass via a POST request to /xml.cgi. Our investigation found these fridges all over the world, yet as far as we know only the ones in France were hit.

https://x.com/IntCyberDigest/status/2109753360282767451

3. An Nvidia dev chip made the kill decision, investigators say

Ukrainian investigators say a Russian drone that killed three people in Zaporizhzhia in July left the strike decision to an Nvidia Jetson Orin chip. Nvidia's response: the Jetson is a consumer product sold to students.

Both things can be true at once, and that's exactly the uncomfortable bit. Export controls and corporate policies were built with missiles and military-grade hardware in mind, not hobbyist boards that ship to anyone. We often talk about autonomous weapons as a future problem. This report suggests the future has already shipped, and it runs on off-the-shelf parts.

https://x.com/IntCyberDigest/status/2109619013558976890

4. Meta's private GitHub breached

Hackers broke into a private Meta GitHub repository and stole source code, getting in with an employee's stolen credentials. They also took personal data on about 1,500 people, mostly US employees, which had been sitting in the repo against Meta's own policy.

Code repos become junk drawers at pretty much every company, and attackers know exactly where to rummage. If you can't say with confidence what's in your private repos, this weekend's coffee might be a good moment to wonder.

https://x.com/IntCyberDigest/status/2110064081550082158

5. The Saudi bug in OpenAI's boardroom

A Saudi OpenAI engineer was arrested for bugging OpenAI's executive conference room. The device was plugged into a USB port behind a TV and hidden in toilet paper. Yes, toilet paper. We also found a photo of the engineer posing in Silicon Valley with Saudi Crown Prince Mohammed bin Salman.

AI labs are intelligence targets just like any defence contractor, and the cheapest way in is still a person with a badge and a USB stick. Physical security and insider-risk programmes will never be the glamorous part of the job, but it is an important one.

https://x.com/IntCyberDigest/status/2110130770522018273

Also worth your attention

A homebrew app called Overdrive turns jailbroken PS5s into a 1,669-game store, just 10 days after the Relapse jailbreak.
https://x.com/IntCyberDigest/status/2109572231701385430

Albert Heijn halted work at several distribution centres after its cyber incident, and its CEO warns fresh food shelves will empty.
https://x.com/IntCyberDigest/status/2109683379171922227

MediaMarkt pulled every Ledger product after a buyer found hidden LTE modules inside two Nano X wallets, days after a reseller implant drained $92.9M from 311 wallets.
https://x.com/IntCyberDigest/status/2109958375521788285

The owner of ransomware recovery firm MonsterCloud is charged with fraud for secretly paying $8M in ransoms and billing clients $19M, while his site said "Don't Pay the Ransom".
https://x.com/IntCyberDigest/status/2108726730122997936

Android quietly adds your phone number to every Google account on the device, burner and work accounts included, and here's where to switch it off.
https://x.com/IntCyberDigest/status/2110779965281284468

And for dessert: the Roadster can fly

After a week of burning fridges and bugged boardrooms, let's end on something purely fun. Tesla's Roadster was seen lifting off at night in a big cloud of smoke, and we posted the only reasonable reaction: "THE ROADSTER CAN FLY. THIS IS INSANE."

As if that weren't enough, it also does 0-60 in 0.81 seconds, and the production car will reportedly do even better. Not cyber, but you've earned something fun before the weekend.

https://x.com/IntCyberDigest/status/2110901853630476721

https://x.com/IntCyberDigest/status/2110903439756775623

Before you log off

There's something oddly comforting about a week like this. The scariest stories weren't really about genius exploits. They came down to a date used as a password, one stolen login, a device nobody updated, and a USB stick behind a TV. Those are fixable problems, and most of the fixes are boring, cheap and completely within our control.

So here's a small weekend assignment: change one default you've been meaning to change. Turn off that Google phone number setting, rotate the password you know is weak, or finally find out what's exposed on your network. Then close the laptop and go enjoy your weekend.