Weekly Cybersecurity Digest [October, Week 3]
Posted on October 20, 2026
Dear Valued Clients,
Welcome to this week’s cybersecurity digest from Make Sense. Across Europe, recent developments highlight the growing consequences of cyber incidents, from prolonged retail disruptions and the exposure of decades-old personal records to sophisticated spyware targeting individuals in public institutions.
This week also brings important lessons about third-party access, increasingly convincing fraud and the need for financial institutions to prepare for severe cyber disruption. Meanwhile, regulatory developments in Finland and the UK reinforce the importance of timely incident reporting, stronger technology oversight and clear organisational accountability.
✅ Top Stories of the Week
i. Ahold Delhaize Cyber Incident Disrupts Retail Operations Across Europe
Dutch retailer Ahold Delhaize confirmed on October 19 that malicious activity had prompted precautionary system shutdowns and a formal police report. The disruption affected websites, apps and distribution operations across several brands, including Albert Heijn in the Netherlands. Stores remained open, but online deliveries were interrupted. The company reported no evidence of stolen customer data, highlighting the operational consequences of cyber containment. [Read more via Ahold Delhaize]
ii. UK Legal Aid Agency Reveals Decades-Old Records Exposed in Cyberattack
The UK Legal Aid Agency disclosed new findings from its 2025 cyberattack: approximately 250,000 compromised records predated 2007, with the earliest verified record dating to 1978. Some probation-service data was also exfiltrated. Authorities said they had no indication the stolen information had been published. The update highlights the persistent risks of historical data, complex legacy systems and inadequate retention oversight. [Read more via the UK Government]
iii. Pegasus Spyware Confirmed on Serbian University Rector’s Phone
Citizen Lab and Serbia’s SHARE Foundation confirmed that the University of Belgrade’s rector was infected with Pegasus spyware in 2026 through a zero-click exploit. A former prosecutor separately received an Apple mercenary-spyware warning, although infection was not confirmed. Published on October 19, the findings underline the challenges of protecting high-risk individuals from sophisticated surveillance and the importance of independent mobile-device forensics. [Read more via Citizen Lab]
✅ Industry Trends & Insights
European Bank Intrusion Exposes Weaknesses in Third-Party Remote Access
Unit 42 detailed an intrusion at a European bank that began through a third-party-managed gateway with weak authentication. Attackers used compromised credentials for extensive reconnaissance and repeated attempts against privileged accounts. Endpoint detection stopped an attempted exploitation of a Windows Server Update Services vulnerability before persistent access was established. The investigation reinforces the importance of supplier oversight, strong authentication and timely threat detection. [Read more via Palo Alto Networks Unit 42]
Bank of England Urges Stronger Cyber Recovery Planning Amid AI Threats
The Bank of England warned that AI-enabled cyberattacks require banks to prepare for severe systems compromise, alongside prevention. Deputy Governor Sarah Breeden said the regulator is working with institutions on recovery options for rebuilding compromised systems from scratch and surveying quantum-related encryption risks. The message is particularly relevant to European financial institutions assessing operational resilience, technology dependencies and the recoverability of critical services. [Read more via Reuters]
Finnish Cybersecurity Authority Warns of Booking Scams Using Genuine Reservation Details
Finland’s National Cyber Security Centre warned that fraudsters are impersonating accommodation providers in messages containing genuine customer reservation details. Victims are directed to fraudulent websites requesting payment-card information. The source of the booking data remains unconfirmed. The campaign illustrates how authentic transaction details can strengthen social engineering and why unexpected payment requests should be verified through official channels. [Read more via Finland’s Traficom]
✅ Regulatory & Policy Updates
Finland Updates Telecom Cyber Incident Reporting Requirements for 2027
Finland’s Traficom announced revised telecom incident-reporting rules effective January 1, 2027. Operators will be required to report specified threats to service availability or security, including potential sabotage, before disruption occurs. The revision also replaces a four-tier outage classification with a single reporting threshold and aligns certain notifications with Finland’s NIS2-implementing Cybersecurity Act, reducing duplicate reporting. [Read more via Traficom]
UK Privacy Regulator Takes Action Over Police Use of Unapproved Data-Sharing Platform
The UK Information Commissioner’s Office reprimanded the Metropolitan Police and issued an enforcement notice after personnel used an unapproved third-party intelligence platform. Personal data concerning 179 individuals was uploaded without adequate safeguards or oversight. The regulator identified failures in technology approval and data protection assessments. The case demonstrates the governance risks of unauthorised tools used to process sensitive information. [Read more via the ICO]
✅ Cyber IQ Challenge + Proactive Security Hacks
Quick Quiz: Your organisation discovers that several legacy systems still hold sensitive customer records collected more than 20 years ago. Some records are no longer needed for operational purposes, and their retention requirements have not been reviewed.
What is the most effective approach to reduce the associated security and compliance risks?
A) Keep all historical records indefinitely because storage is inexpensive.
B) Restrict access to the records but leave the retention arrangements unchanged.
C) Review legal and business retention requirements, securely delete data no longer required, and apply appropriate access controls and monitoring to retained information.
D) Transfer the historical records to a third-party cloud provider and assume responsibility for their protection has been transferred.
(Answer below)
Smart Security Moves of the Week:
- Reassess historical data retention: Identify sensitive information stored in legacy applications, databases and archives. Review retention periods and ensure information no longer required is securely disposed of, subject to applicable obligations.
- Strengthen third-party management access: Review privileged access to remotely managed infrastructure, enforce strong authentication and ensure administrative activities are logged and monitored.
- Protect centralised security platforms: Maintain current patches, safeguard configuration backups and rotate potentially exposed credentials when management infrastructure is compromised.
- Verify payment-related communications: Encourage employees and customers to independently confirm unexpected requests involving financial or personal information, even when messages contain accurate transaction details.
- Test incident-reporting readiness: Confirm which incidents and threats are reportable, who makes the reporting decision and how teams will meet the deadlines imposed by applicable regulations.
Answer: C) Review legal and business retention requirements, securely delete data no longer required, and apply appropriate access controls and monitoring to retained information.
Historical information can remain sensitive even when it is no longer actively used. Effective data protection requires organisations to understand why information is retained, how long it is needed and what security measures remain appropriate throughout its lifecycle.
Reducing unnecessary data holdings can also reduce the scale and consequences of future breaches.
✅ Conclusion
This week’s developments highlight the importance of understanding where an organisation’s vulnerabilities lie and how effectively it can respond when critical systems are compromised.
The prolonged disruption at Ahold Delhaize demonstrates the operational consequences of cyber incidents, while the European banking investigation exposes the risks associated with third-party access. The Bank of England’s warning adds another dimension: organisations must be prepared to recover from increasingly sophisticated attacks, including those involving AI.
The Legal Aid Agency’s findings also remind us that sensitive information can remain a security liability long after its original purpose has ended.
For European organisations, the priorities are clear: stronger oversight of critical systems and suppliers, responsible data management, tested recovery capabilities and clear accountability for security and regulatory obligations.
Final reflection: If a critical system were compromised tomorrow, would your organisation know what information and services were at risk, who was responsible and how to restore operations securely?
At Make Sense, we help organisations translate cybersecurity, risk management and regulatory requirements into practical measures that strengthen security and operational resilience.
Stay secure,
The Make Sense SRL Team & CyberTania
