Security news
Real breaches, defender's view.
What happened, what attackers were after, and how deception technology fits into the response.
- ·CredentialsCritical
Denmark's national population register breached — 8.8 million records exposed via '123456' password
An attacker ran 14 million automated searches against Denmark's Central Person Register (CPR) in September using an IT company's account protected by the password '123456', exfiltrating names, addresses and ID numbers for virtually the entire Danish population.
Deception angle
Third-party account credentials are a primary initial access vector. A decoy identity provider or a fake internal API endpoint would catch the automated bulk-query pattern immediately — 14 million searches in 10 days is an unmistakable signal that no real user should generate.
- ·RansomwareCritical
Albert Heijn hit by cyberattack — empty shelves, no deliveries for a week
A cybersecurity incident at Ahold Delhaize took down Albert Heijn's online shopping, loyalty cards, electronic shelf prices and restocking systems, leaving shelves empty and halting deliveries across the Netherlands. Losses are estimated above 10 million euros.
Deception angle
The attackers spent time inside the logistics and warehouse systems before triggering visible disruption. A decoy order-management server or a fake warehouse network node in the same segment catches that pre-disruption reconnaissance before any outage begins.
- ·VulnerabilityCritical
Hackers remotely triggered defrost on 400+ French supermarket fridges overnight
Attackers gained remote access to Danfoss, Copeland and Dixell refrigeration controllers across hundreds of French stores and raised setpoints to 50C, extended defrost cycles to delay alarms, and caused fires at some sites. Perishable food was written off at scale.
Deception angle
Industrial control systems (refrigeration, HVAC, BMS) are now active attack targets. A decoy ICS management interface — mimicking a Danfoss or Modbus endpoint — catches scanning and credential attempts against OT devices before a live controller is reached.
- ·Nation-stateHigh
Svenska kraftnat (Sweden power grid) confirms data breach — Everest ransomware
Sweden's national power grid operator confirmed that the ransomware group Everest had breached its systems and exfiltrated data. The electricity supply was not affected, but sensitive operational and employee data was exposed.
Deception angle
Critical infrastructure operators are high-value targets where dwell time is long. A decoy server inside the OT or corporate network segment — posing as an engineering workstation or historian — catches lateral movement in an environment where every touch is abnormal.
- ·VulnerabilityCritical
FortiGate management interface RCE exploited before patch availability
A pre-auth remote code execution vulnerability in FortiGate HTTPS management was actively exploited by multiple threat actors within 48 hours of disclosure, with mass scanning beginning immediately.
Deception angle
A decoy FortiGate on port 443 captures every probe and exploit attempt in real time, letting you correlate scanner IPs against your real infrastructure before those IPs rotate. The FortiGate profile also catches CVE-specific path patterns.
- ·RansomwareCritical
Ransomware operators increasingly delete backups before encrypting — new wave hits logistics sector
A cluster of ransomware incidents across European logistics companies showed a consistent pattern: attackers spent 3 to 7 days enumerating and wiping backup systems before triggering encryption, leaving victims with no recovery path.
Deception angle
A decoy NAS or backup server in the same subnet as real backup infrastructure catches exactly this enumeration. The attacker hits the decoy first, you disconnect the source machine, and the real backups remain intact.
- ·Nation-stateCritical
Salt Typhoon found in nine US telecoms — years of undetected access
The Chinese state-sponsored group Salt Typhoon had persistent access inside nine major US telecoms, intercepting calls and SMS of senior government officials for an extended period before discovery.
Deception angle
Long-dwell nation-state actors move slowly and stay quiet. They still traverse internal networks to reach high-value targets. A decoy SSH server or file share in the core network catches that lateral movement even when the attacker is careful.
- ·VulnerabilityCritical
Ivanti Connect Secure zero-days exploited in mass campaign before patches
Two zero-day vulnerabilities in Ivanti Connect Secure VPN were chained for unauthenticated remote code execution, with nation-state actors and criminal groups exploiting thousands of devices globally before a patch was available.
Deception angle
VPN appliance exploitation is now the most common initial access vector in enterprise breaches. A decoy VPN login page or a fake network segment behind a decoy firewall catches lateral movement immediately after the initial foothold.
- ·AI threatHigh
Agentic AI workflows compromised via prompt injection in customer data
Multiple organisations reported that AI agents processing customer emails and documents had their instructions overridden via embedded prompt injections, leading to data exfiltration and unauthorised API calls.
Deception angle
An MCP server decoy or a fake internal API catches AI agents that have been redirected by a prompt injection. If your agents are instructed to exfiltrate data to an internal endpoint, a decoy version of that endpoint fires an alert before any real data moves.
- ·CredentialsHigh
Infostealer logs fuel surge in credential-based initial access — 4 billion records in circulation
Security researchers reported a new high-water mark in stolen credential availability, with infostealer malware generating logs that give attackers valid usernames and passwords for corporate SSO, VPN and SaaS tools.
Deception angle
Stolen credentials are tried against every accessible service. A decoy Keycloak or identity provider endpoint catches credential stuffing in the first minutes of an attempted intrusion, before any real system is touched.
- ·Supply chainCritical
CI/CD pipeline compromise used to poison builds at 40 organisations
A threat actor gained access to a shared build infrastructure provider and injected malicious steps into pipelines at 40 customer organisations, inserting backdoors into software shipped to end users.
Deception angle
After a supply-chain compromise, attackers land inside developer networks with valid build credentials. A decoy development server — fake GitLab instance, fake package registry — catches them the moment they start exploring for further access.
- ·CredentialsCritical
Secrets manager exfiltration campaign targets HashiCorp Vault and AWS Secrets Manager
A financially motivated group systematically targeted exposed secrets manager APIs across cloud environments, using stolen cloud credentials to enumerate and bulk-download secrets before triggering any existing detection rules.
Deception angle
A decoy Vault instance on port 8200 catches health checks, seal-status probes and auth attempts — the exact sequence automated tools run. The real Vault never sees the attacker if the decoy is found first.
More on deception detection in the Kandaro blog.