A living map of incidents, disruptions, and observations from the field. Not every event carries a lesson. The ones that do, noted here.
Attackers forced supermarket refrigeration into defrost through controllers reachable from the public internet. The question for every organisation is who owns the building systems a contractor can reach remotely, and who may disconnect them.
Kiteworks asked customers to switch off a critical service before any compromise was confirmed. The important control was not technical. It was the authority to choose a controlled interruption.
McKesson didn't pay ShinyHunters' $55.2 million demand, and the data leaked anyway. The real failure was elsewhere: what the company didn't know about its own exposure.
A joint US advisory on AI-generated tooling against Siemens PLCs is really a story about economics, not capability. Here's what that shift means for anyone running exposed industrial controllers.
CEVA Logistics was attacked. Valve, Bol, De Bijenkorf, Ajax, and ING all had to notify their own customers. None of them chose CEVA as a security vendor. They chose it as a warehouse.
