Weekly Cybersecurity Digest [October, Week 5]
Posted on November 3, 2026
Dear Valued Clients,
Welcome to this week’s cybersecurity digest from Make Sense. Recent developments across Europe show how cybersecurity incidents can extend beyond digital systems, disrupting essential public services, exposing sensitive information and even causing physical damage through compromised operational technology.
Meanwhile, new findings reveal persistent weaknesses in supplier security, while developments in AI bring both emerging threats and new defensive capabilities. Regulatory updates from France and the UK also reinforce the importance of data protection, software security and organisational accountability.
✅ Top Stories of the Week
i. Moldova Government Cyberattack Exposes Data Linked to 750,000 Personal Identifiers
Moldova’s Electronic Governance Agency disclosed on October 27 that attackers had extracted personal information linked to approximately 750,000 national identification numbers. The attack targeted government systems between October 19 and 23, prompting security checks across 82 digital services and temporary shutdowns of vulnerable systems. Authorities reported further unsuccessful intrusion attempts. The incident highlights risks arising from interconnected government platforms and insufficiently protected data access. Read more via Moldova’s Electronic Governance Agency
ii. Second Wave of Cyberattacks Targets Supermarket Refrigeration Systems Across Europe
Supermarkets in Belgium, Sweden, Ireland, Luxembourg and other European countries reported suspected cyberattacks on refrigeration systems on November 2. Attackers reportedly manipulated temperature controls, forcing retailers to remove or discard affected food products. The incidents resemble an earlier attack in France, although investigators have not established a connection. The disruption highlights the physical consequences of vulnerabilities in internet-connected operational technology. Read more via The Record
iii. Cyberattack Disrupts Belgian Tax Services Ahead of Filing Deadline
Belgium’s Federal Public Service Finance announced on October 28 that a cyberattack had forced the temporary shutdown of MyMinfin and several other digital services. The disruption occurred shortly before a tax-filing deadline, prompting authorities to promise extensions for affected taxpayers. Investigators reported no indication of stolen data at the time. The incident demonstrates how cyber disruptions can affect essential public administration and service availability. Read more via the Belgian Federal Government
✅ Industry Trends & Insights
UK Watchdog Identifies Cybersecurity Gaps in Police and Fire Services
A UK inspection published on October 27 identified significant cybersecurity weaknesses across policing and fire and rescue services, particularly in third-party supplier oversight. Investigators found shortcomings in ongoing security assurance, incident-reporting obligations and access to supplier security logs. The findings highlight the importance of continuous supplier monitoring and clear accountability when external providers handle sensitive information. Read more via The Record
EU Launches €42 Million Initiative to Advance AI-Powered Cybersecurity
The European Cybersecurity Competence Centre announced three projects on October 29, bringing together more than 70 partners across 14 EU Member States and the UK. Backed by approximately €42 million, the initiatives will explore generative AI applications for threat detection, incident response and infrastructure protection. The programme reflects Europe’s effort to develop trustworthy, auditable AI capabilities for cybersecurity while reducing technological dependencies. Read more via the European Cybersecurity Competence Centre
UK Cybersecurity Agency Warns of AI-Powered Attacks on Critical Infrastructure
The UK’s National Cyber Security Centre warned on November 3 that AI-powered malware is highly likely to feature in ransomware attacks against critical national infrastructure by 2028. Its assessment predicts faster vulnerability discovery, social engineering and exploitation rather than entirely new attack methods. The findings emphasise the need to address existing security weaknesses before AI enables attackers to exploit them at greater speed and scale. Read more via the UK’s NCSC
✅ Regulatory & Policy Updates
French Privacy Regulator Imposes €7 Million Fine Over Unauthorised App Tracking
France’s CNIL announced on October 29 that it had fined FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT a combined €7 million for using tracking technology without valid consent. The mobile application collected browsing information for personalised recommendations and algorithm training. The regulator also required corrective measures. The decision reinforces the importance of consent management, transparency and lawful data collection in digital services. Read more via the CNIL
UK Budget Signals Future Consultation on Liability for Insecure Software
The UK’s October 28 Budget announced plans to consult in 2027 on tackling insecure technology at source and determining responsibility for cyber breaches. The proposal builds on an existing product liability review and could influence future expectations for software providers. No new liability requirements have been enacted. The announcement reflects growing policy attention to secure software development and vendor accountability. Read more via the UK Government
✅ Cyber IQ Challenge + Proactive Security Hacks
Quick Quiz: An organisation’s customer portal requires users to log in. However, a customer discovers they can change an identification number in an API request and access another customer’s records.
What is the primary security weakness?
A) Insufficient encryption of data in transit.
B) Broken Object Level Authorization (BOLA).
C) DNS spoofing.
D) Weak password complexity requirements.
(Answer below)
Smart Security Moves of the Week:
- Review API access controls: Ensure users can access only the records and functions they are authorised to use. Validate permissions on every relevant request, not just during login.
- Secure operational technology: Identify internet-connected building management, refrigeration and industrial control systems. Restrict remote access, segment networks and monitor unauthorised configuration changes.
- Strengthen supplier assurance: Review third-party security requirements, reporting obligations and access to relevant logs. Verify that critical suppliers maintain effective incident-response and recovery arrangements.
- Prepare for AI-accelerated threats: Prioritise known vulnerabilities, improve detection capabilities and review how AI tools are used internally. Strong foundational security controls remain essential.
- Audit digital tracking practices: Examine cookies, SDKs and mobile application trackers. Ensure personal data collection respects applicable consent requirements and that users’ choices are technically enforced.
Answer: B) Broken Object Level Authorization (BOLA).
BOLA occurs when an application fails to verify whether a user is authorised to access a specific resource. Authentication alone is insufficient; access permissions must be checked for each relevant request.
✅ Conclusion
This week’s developments highlight how vulnerabilities in connected systems, third-party services and public-sector infrastructure can have consequences far beyond the initial compromise.
For European organisations, the challenge is not only to respond to emerging threats but also to address existing security gaps, strengthen supplier oversight and ensure critical services remain resilient.
As AI reshapes both cyber threats and defensive capabilities, effective governance and strong foundational security controls remain essential.
Final reflection: Does your organisation have sufficient visibility over its critical systems and dependencies to identify and contain a compromise before it causes wider disruption?
At Make Sense, we help organisations translate cybersecurity, risk management and regulatory requirements into practical measures that strengthen security and operational resilience.
Stay secure,
The Make Sense SRL Team & CyberTania
