This Week in Cyber: October 15 - 21, 2026
A cyberattack on a federal contractor disrupted court operations nationwide, compromised vendor credentials exposed Microsoft 365 customers, and hackers reached school building controls. New federal warnings covered ransomware and critical PHP vulnerabilities, while utility cybersecurity funding and GridSecCon brought new developments for the electric sector.
October 15 | Cyberattack at BAE Systems Disrupts Federal Bankruptcy Courts
A cybersecurity incident affecting BAE Systems interrupted the Bankruptcy Noticing Center, which produces and distributes official notices for federal bankruptcy courts nationwide. The incident left the center's websites and notification services unavailable.
Why it matters: Federal courts depend on one contractor to deliver bankruptcy notices across the country. When its systems went offline, courts lost access to a service required for routine proceedings. The incident raises a practical concern for agencies and utilities relying on outside providers: a vendor's recovery timeline can become their own operational limitation. Continuity plans need to account for services that cannot simply be restored by internal IT staff.
October 15 | Cyberattack Shuts Down Municipal Services in New Mexico
The town of Bernalillo, New Mexico, confirmed a cyberattack that disrupted most online government services and forced its Motor Vehicle Division to close. Residents were directed to make payments in person or by telephone while systems remained unavailable.
Why it matters: The attack began October 9, but services remained disrupted when the town confirmed the incident on October 15. Even without evidence of a compromised water or electric system, the town was unable to provide several basic government services. Municipal continuity planning has to cover billing, licensing and public access alongside critical infrastructure. A network can be isolated successfully while residents still lose access to services they depend on.
October 15 | Google Uncovers Supply Chain Attack Against Backup Software
Google Threat Intelligence and Mandiant disclosed an attack against AOMEI's software update infrastructure. Between April and July, attackers modified update-server configurations for periods lasting just five to ten minutes before restoring legitimate files. The campaign delivered malicious software through a trusted update mechanism.
Why it matters: Google's researchers found that the short attack windows could evade routine file scans and point-in-time investigations. AOMEI released an updated version of its backup software on October 19, but customers also need to determine whether earlier updates exposed their systems. The incident illustrates why checking a vendor's current security status is not enough. Operators need historical evidence to investigate what happened while the compromised service was trusted.
October 16 | California Confirms Statewide Student Data Breach
The California Department of Education began notifying families after a breach at Educational Testing Service, the contractor responsible for statewide student assessments. Attackers used compromised credentials to copy student records from a secure file transfer system. The exposed information included names, dates of birth, addresses and assessment records.
Why it matters: The unauthorized access occurred between May 22 and September 18, giving attackers months to retrieve information before the activity was discovered. The breach did not require compromising individual school districts. One contractor's access was sufficient to reach records from across California. Organizations sharing sensitive information with outside providers need to know not only who can access that data, but whether unusual transfers can be identified before months have passed.
October 16 | ConnectWise Compromise Exposes Microsoft 365 Customers
Huntress identified unauthorized access to at least 162 Microsoft 365 tenants through credentials associated with ConnectWise Cloud Backup. Investigators also observed abuse of related application identities, including attempts to obtain administrator privileges and establish persistent access. ConnectWise suspended Cloud Backup and other services while investigating.
On October 21, Microsoft linked the broader campaign to the China-associated threat group Storm-0940. The group reportedly used an AI-enabled penetration testing framework to target organizations across government, defense, energy and other industries.
Why it matters: The attackers did not need to compromise each customer's employees. They used permissions already granted to a trusted backup provider. In one case, investigators found malicious credentials added to other applications to preserve access. Removing the original vendor connection may not eliminate that persistence. Organizations need to review third-party application permissions, privileged service identities and newly created credentials, not just employee login activity. This is particularly relevant for utilities relying on cloud-based monitoring, backup and management providers.
October 16 | Hosting Provider Cyberattack Continues Disrupting Government Websites
U.S.NEXT reported continued recovery efforts following an October 9 cyberattack affecting hosted websites and email services. By October 16, portions of email access had been restored, but the company was still working to recover customer websites.
Why it matters: The disruption affected government customers that relied on U.S.NEXT for public websites and communications. Some services remained unavailable a week after the attack. The incident adds another example of public agencies depending on infrastructure they do not directly control. Agencies should know which public-facing services share a provider, what alternatives exist during an extended outage and how they will communicate with residents when normal websites and email are unavailable.
October 17 | Bullhorn Takes Software Platform Offline Following Cyber Incident
Staffing software provider Bullhorn temporarily disabled platform access after detecting a cybersecurity incident. The company brought in external incident response specialists and warned customers to remain alert for fraudulent communications impersonating Bullhorn personnel.
Why it matters: An outage creates an opportunity for attackers beyond the original compromise. Customers waiting for service restoration may receive convincing messages claiming to offer technical assistance or account recovery. Bullhorn specifically warned about this risk during its investigation. Organizations should use established vendor communication channels and verify requests for credentials, administrative access or emergency changes while a provider is responding to an incident.
October 18 | Cyberattack Reaches School Security and Building Control Systems
Jerome School District in Idaho canceled classes on October 19 and 20 after a cyberattack affected its network. The district reported that attackers gained access to internet-connected systems involving security cameras, electronic door locks and climate controls. A ransom demand was also reported.
Why it matters: Last week's attack on French supermarket refrigeration systems showed how compromised controllers can cause physical losses. Now another incident has affected systems responsible for building access, security and temperature control. These are not traditional industrial facilities, but they rely on connected equipment to operate safely. Facilities teams need to understand which building systems depend on network access and how those systems can operate when the network becomes untrusted.
October 18 | Building Automation Manufacturer Loxone Reports Cyberattack
Building automation manufacturer Loxone disclosed a cyberattack affecting its internal systems. The company identified affected business systems, including customer relationship and applicant records, but reported that deployed Miniservers, Remote Connect and Exosphere services were unaffected.
Why it matters: The Loxone incident provides an important contrast to the Jerome school attack. Loxone says its building controllers operate locally, with credentials stored on each Miniserver rather than in a central vendor account. That design allowed customer installations to continue operating while the manufacturer investigated its internal breach. For operators evaluating connected equipment, the distinction matters. A vendor compromise should not automatically become a loss of local control. Architecture and dependency on external services deserve attention during procurement, not just after an incident.
October 18 | Parkview Health Takes Network Offline After Suspicious Activity
Parkview Health in Indiana took network services offline after detecting suspicious activity. Patients experienced disruptions to MyChart, appointment reminders and other communications. Parkview had not confirmed a cyberattack at the time of reporting.
Why it matters: Healthcare providers can lose important services while investigating a potential intrusion, even before an attack is confirmed. Network isolation may be the correct security decision, but it still creates operational consequences. Hospitals and other critical facilities need downtime procedures that account for planned containment actions as well as successful attacks. Teams should know which services become unavailable when specific network segments are isolated and whether staff can continue essential work without them.
October 19 | Ahold Delhaize Confirms Malicious Activity Behind Grocery Service Disruptions
Ahold Delhaize confirmed that malicious activity caused disruptions affecting its grocery brands, including Stop & Shop, Hannaford and Food Lion. The company had first disclosed the incident on October 12. Stores remained open, but websites, applications and online ordering services were affected as systems were taken offline.
Why it matters: Two major incidents affected the food sector this month, but with different consequences. The earlier French supermarket attack manipulated refrigeration equipment, while Ahold Delhaize's shutdown primarily disrupted digital and commercial services. There is no established connection between the attacks. Together, they show why food-sector resilience requires separate consideration of business IT, distribution systems and equipment controlling physical conditions. Keeping stores open does not necessarily mean every supporting operation remains available.
October 20 | GridSecCon 2026 Brings Electric-Sector Security Leaders to Orlando
The 15th annual GridSecCon opened in Orlando, bringing together electric utility operators, cybersecurity professionals, government agencies and industry leaders. Hosted by NERC, E-ISAC and SERC, the conference focuses on cyber and physical threats, risk mitigation, operational readiness and lessons learned across the electric sector.
We are exhibiting at Booth 220, demonstrating our platform and how it helps operators with threat detection and investigation across OT environments.
Click Here to Learn More about AtlasCyber
Why it matters: GridSecCon comes as electric utilities prepare for expanded internal network security monitoring requirements under NERC CIP-015-2. At the same time, recent attacks have exposed weaknesses in third-party access, connected equipment and incident recovery. The conference provides an opportunity for utilities to compare how they are addressing these problems in practice, particularly how they monitor activity inside operational networks and investigate threats that have already crossed traditional security boundaries.
October 20 | DOE Opens $967 Million in Grid Resilience Funding
The Department of Energy announced approximately $967 million in additional grid resilience funding through its State and Tribal Formula Grant program. States, territories and tribes can request funding for grid hardening, reliability improvements and other eligible resilience projects. The application deadline is February 17, 2027.
Why it matters: This is a significant investment in electric infrastructure, but DOE explicitly excludes cybersecurity measures from eligible uses under this formula grant. Utilities should distinguish funding for physical resilience and monitoring or control technologies from funding specifically intended for cyber defense. The money flows through state and tribal programs, so local operators need to review their jurisdiction's allocation plans and eligible project categories rather than assuming they can apply directly for cybersecurity equipment.
October 20 | CISA and FBI Warn of SafePay Ransomware Targeting Critical Infrastructure
CISA, the FBI, Secret Service and international partners released a joint advisory on SafePay ransomware. The group has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024. Reported techniques include compromised credentials, exposed VPN services, vulnerable edge devices and attacks on backup systems.
Why it matters: SafePay does not depend on a single vulnerability or method of entry. The advisory describes attackers using legitimate credentials and exposed remote access before deleting shadow copies or resetting storage devices containing backups. That makes recovery infrastructure part of the attack, not simply a resource used afterward. Operators should verify that administrative access is limited, exposed edge systems are maintained and recovery copies remain usable if attackers compromise the production environment.
October 20 | Columbia, South Carolina, Investigates Cybersecurity Incident Affecting City Services
Columbia reported suspicious activity affecting several municipal applications, including business licensing, planning, GIS and resident service requests. The South Carolina Law Enforcement Division began investigating. Officials reported that police, fire, 911 and Columbia Water systems remained operational.
Why it matters: Columbia and Bernalillo both experienced disruptions to public-facing government services this week. Columbia's reported separation between affected applications and essential utility operations is an important distinction. Investigators and residents need to know which systems are unavailable and which remain functional. Municipalities should be able to determine whether an incident is confined to administrative IT or has reached systems supporting water, wastewater, electricity or public safety, then communicate that scope accurately.
October 21 | Critical PHP Vulnerabilities Trigger Emergency Warnings and Government Website Shutdowns
The NSA issued emergency guidance on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The vulnerabilities could allow attackers to execute code on vulnerable web servers without authentication.
Amazon identified an attempted exploit dating back to October 17, four days before the public disclosure and security patches. On October 21, municipal software providers CivicPlus and Granicus temporarily disabled affected services as precautions, interrupting access to some government websites and applications.
Why it matters: The PHP2Shell response has two separate problems: finding vulnerable systems and determining whether they were already accessed. Amazon detected exploitation attempts before patches became available, meaning organizations cannot assume October 21 was the beginning of the threat. The PHP security release also leaves end-of-life versions without fixes. Utilities and municipalities need to inventory PHP applications, including third-party services and appliances, apply available patches, and review historical web and system activity. Where unsupported systems cannot be secured, isolation or replacement may be necessary.
That's it for this week.
We'll be back next Thursday with the developments shaping critical infrastructure cybersecurity, operations and resilience.
