North Star Labs on the events that matter.

HookPhish· Nov 7, 2026, 11:06 AM

the dwell time crisis: securing healthcare networks against silent reconnaissance

Texas-based Medina Healthcare System was targeted by the Scarlettgroup ransomware gang, with the breach discovered on November 3, 2026.

Industrial Cyber· Nov 7, 2026, 11:06 AM

shifting the advantage in the manufacturing threat landscape

A new report highlights that manufacturing has become the primary target for ransomware attacks in the third quarter of 2026, with a significant 80% surge in global victims.

SC Media· Nov 7, 2026, 11:05 AM

the refrigeration breach and the failure of agent-based visibility

Investigators are examining suspected cyberattacks at U.S. military commissaries that caused refrigeration systems to defrost and spoil food. These incidents are being compared to a wave of similar attacks targeting refrigeration infrastructure across Europe.

low_slow_c2

the dwell time paradox: identifying bossai through network-layer behavioral analysis

Researchers identified the 'BOSSAI' operation, an AI-assisted attack network that has targeted government services, banks, and military systems across multiple countries.

Enterprise IT World· Nov 7, 2026, 11:04 AM

ClassAction.org· Nov 7, 2026, 11:04 AM

the silent interval: addressing lateral movement in the aftermath of healthcare data exposure

HCA Healthcare confirmed that an unauthorized party accessed systems on August 12, 2026, resulting in the exposure of personal information belonging to medical residents, with notifications sent in November 2026.

Morgan & Morgan· Nov 7, 2026, 1:04 AM

the architecture of persistence: why the sarku japan breach highlights a systemic failure in dwell-time visibility

Sarasota US Topco, Inc., which operates the Sarku Japan restaurant chain, reported a data breach to the Texas Attorney General on October 28, 2026.

GovTech· Nov 7, 2026, 1:03 AM

the operational cost of dwell time: why job role revisions cannot replace network-layer visibility

Union County, Pennsylvania, has initiated revisions to its job roles following a recent cyberattack, as local governments continue to grapple with the operational impacts of security incidents.

The Record from Recorded Future News· Nov 7, 2026, 1:03 AM

the unseen operational risk: securing critical refrigeration infrastructure against lateral movement

U.S. officials are urging operators to secure cooling systems following a series of cyberattacks on refrigeration infrastructure that have caused significant operational disruptions in Europe.

cloud_east_west

the gap in the credential-recovery flow: why cloud-native lateral movement demands network-layer visibility

WAGO disclosed a vulnerability (CVE-2026-18963) in its Building Cloud Services credential-recovery flow that could have allowed unauthenticated access to accounts.

Viakoo, Inc· Nov 6, 2026, 7:05 PM

SOCRadar· Nov 6, 2026, 7:05 PM

the silent shelf: closing the visibility gap in supermarket industrial control systems

A wave of cyberattacks targeting refrigeration systems at European supermarkets caused temperatures to rise, leading to food spoilage; the incidents have prompted warnings from the FBI and CISA regarding the security of internet-exposed industrial control systems.

cloud_east_west

the architecture of oversight: exposing the year-long blind spot in cloud infrastructure

A cloud migration error in February 2025 left an internal DigiCert system exposed to the internet for over a year, resulting in the unauthorized access of customer identity documents and PII.

Aviatrix· Nov 6, 2026, 7:05 PM

SecurityWeek· Nov 6, 2026, 7:05 PM

the velocity of compromise: addressing the retail security gap after the ahold delhaize incident

Ahold Delhaize updated its 2026 financial guidance following a significant cybersecurity incident in October that compromised the personal information of over 2.2 million people.

zero_day_post_exploit

the hidden dwell time: infrastructure visibility after the hippo analytics breach

Hippo Analytics Inc. reported a data breach in November 2026 after a vulnerability in its online quote tool exposed the personal information of over 43,000 individuals.

Data Breach Watch· Nov 6, 2026, 7:05 PM

Infosecurity Magazine· Nov 6, 2026, 7:05 PM

the silent control loop: securing transport refrigeration from unauthorized command

CISA and the FBI issued an advisory warning that critical infrastructure sectors, including transportation, are being targeted by actors exploiting vulnerabilities in industrial refrigeration controllers. The warning follows incidents where attackers manipulated temperature settings in cold storage facilities.

SecuBuzz· Nov 6, 2026, 7:05 PM

beyond the perimeter: identifying lateral movement in the aftermath of the digicert breach

A data breach at DigiCert exposed an internal system containing customer contact details and sensitive identity documents, including passports and driver's licenses. Customers are advised to monitor for potential credential compromise.

KOMO News· Nov 6, 2026, 7:04 PM

beyond the perimeter: securing election integrity through network-layer visibility

Washington Secretary of State Steve Hobbs confirmed a cyberattack targeted the agency's website during the election season. While the site experienced temporary outages due to high traffic and bot activity, officials confirmed that vote tabulation machines remain secure and disconnected from the internet.

supply_chain

the architecture of trust: closing the dwell time gap in higher education

Cybercriminals exploited a vulnerability in a third-party vendor tool used by the California Community Colleges system to steal financial aid reimbursements intended for hundreds of students.

GovTech· Nov 6, 2026, 7:04 PM

HookPhish· Nov 6, 2026, 7:04 PM

the dwell time collapse: why incident response is losing to the ransomware timeline

A financial services organization, fidepartners.com, was targeted by the INC Ransom ransomware group in a data breach discovered on November 3, 2026.

SOCRadar· Nov 6, 2026, 7:04 PM

beyond the perimeter: securing transportation infrastructure against unmanaged controller exploitation

Federal agencies released a fact sheet on November 5, 2026, warning that threat actors are remotely targeting refrigeration controllers in critical infrastructure sectors, including transportation. The attacks involve exploiting unpatched or internet-exposed devices to manipulate temperature and defrost cycles.

Industrial Cyber· Nov 6, 2026, 7:04 PM

the hidden link in the cold chain: securing unmanaged refrigeration infrastructure

Federal agencies have flagged the risk of cyberattacks on operational technology (OT) controllers used in refrigeration, impacting the transportation and food sectors. The guidance urges organizations to harden systems against unauthorized remote access.

HIPAA Journal· Nov 6, 2026, 7:04 PM

the unseen command: protecting critical refrigeration from network-layer compromise

The FBI, CISA, and HHS have issued a warning to critical infrastructure organizations regarding potential cyberattacks on refrigeration systems, which could impact the storage of medical supplies and food.

al.com· Nov 6, 2026, 11:07 AM

the logistics of invisible assets: why retail refrigeration is the new frontier for adversary exploitation

Supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia reported cyberattacks that manipulated freezer and refrigerator settings, leading to widespread food spoilage.

Data Breach Watch· Nov 6, 2026, 11:07 AM

the silent drift in retail: why the container store event highlights a critical visibility gap

The Container Store was identified as a potential victim of a data breach on November 5, 2026, according to reports from Ransomware.live, though the incident remains unconfirmed by the company.

Privacy Unpacked· Nov 6, 2026, 11:07 AM

the dwell time crisis in higher education: why the columbia university breach was a failure of visibility, not technology

A data breach at Columbia University was confirmed on November 2, 2026, affecting nearly 3 million individuals. The incident involved the exposure of sensitive personal information, including Social Security numbers and driver's license numbers.

living-off-the-land (lotl)

the fiscal cost of the invisible network: lessons from the ahold delhaize incident

Ahold Delhaize disclosed that an October cybersecurity incident, which forced the company to take systems offline, is expected to reduce fourth-quarter net sales by up to $282 million.

Distribution Brief· Nov 6, 2026, 11:07 AM

Seoul Economic Daily· Nov 6, 2026, 11:07 AM

Closing the industrial blind spot: why network-layer visibility is the new imperative for critical infrastructure

Security analysts report that hackers are increasingly using AI-powered tools to exploit known vulnerabilities in industrial control devices, prompting US agencies like CISA and the NSA to warn of threats to internet-exposed equipment.

Security Magazine· Nov 6, 2026, 11:06 AM

the refrigeration risk: securing unmanaged infrastructure against lateral movement

Cyberattacks targeting internet-connected refrigeration systems have expanded beyond retail to impact blood banks and U.S. military facilities.

Nextgov/FCW· Nov 6, 2026, 11:05 AM

the silent control loop: neutralizing unauthorized commands in industrial infrastructure

U.S. agencies released guidance on hardening industrial refrigeration systems following reports of suspected cyber sabotage at military bases and grocery stores. The incidents involve attackers remotely altering settings to cause equipment failure.

Breached.Company· Nov 6, 2026, 11:05 AM

the operational reality of lateral movement in healthcare infrastructure

The University of New Mexico Health Sciences Center was forced to divert ambulances following a cyberattack on October 26, 2026, which a ransomware group known as Byod claimed responsibility for.

cloud_east_west

the velocity of destruction: why behavioral network telemetry is the final barrier against infrastructure collapse

A major Russian web hosting provider experienced a cyberattack that destroyed data across its cloud infrastructure, resulting in significant service disruptions for hundreds of websites.

DataBreaches.net· Nov 6, 2026, 11:03 AM

Yahoo News· Nov 6, 2026, 11:03 AM

the operational silence: why cooling systems are the next target for lateral movement

Following attacks on cooling systems in Europe, U.S. federal agencies are urging operators in the transportation and food sectors to secure operational technology devices by removing them from the public internet.

TechJack Solutions· Nov 6, 2026, 11:03 AM

Closing the visibility gap in Siemens SIMATIC IoT2050 environments

A critical CVSS 10.0 vulnerability in Siemens SIMATIC IoT2050 industrial gateways is being actively exploited to gain unauthorized access and deploy persistent backdoors in manufacturing and critical infrastructure environments.

BleepingComputer· Nov 6, 2026, 11:02 AM

the silent shift in the cold chain: why refrigeration controllers are the new frontline

The FBI and CISA, alongside the Department of Transportation and other agencies, warned that hackers are exploiting unpatched refrigeration controllers to cause equipment damage and temperature fluctuations in critical infrastructure.

Govly· Nov 6, 2026, 1:06 AM

the silent failure: network-layer blind spots and the august 2026 commissary freezer disruptions

The Department of Defense is investigating freezer failures that occurred at approximately six U.S. military commissaries in August 2026 as suspected cyberattacks.

TechCrunch· Nov 6, 2026, 1:06 AM

the unseen cold: securing industrial refrigeration against persistent network intrusion

CISA, the FBI, and other federal agencies issued a joint warning regarding cyberattacks targeting internet-connected industrial refrigeration and cold chain monitoring systems. These attacks, which have impacted grocery stores, cold storage facilities, and U.S. military bases, pose risks of physical damage, inventory loss, and fire hazards.

zero_day_post_exploit

the dwell time collapse: beyond the wordpress rce event

Security researchers report over 240,000 blocked exploit attempts targeting an unauthenticated remote code execution vulnerability in WordPress core since its disclosure on October 28.

Wordfence· Nov 6, 2026, 1:06 AM

CISA· Nov 6, 2026, 1:05 AM

Closing the cold chain security gap: moving beyond endpoints to secure industrial refrigeration

CISA and government partners issued guidance to secure industrial refrigeration and cold chain systems following a series of international cyberattacks that manipulated temperature controls.

CISA· Nov 6, 2026, 1:05 AM

the temperature of trust: protecting critical transportation infrastructure from unmanaged edge threats

Federal agencies, including the Department of Transportation, issued a warning regarding global cyber threats targeting vulnerabilities in internet-accessible electronic temperature controllers used in critical infrastructure, including the transportation sector.

Industrial Cyber· Nov 6, 2026, 1:05 AM

Closing the industrial control systems visibility gap: why OT security requires more than surface-level monitoring

Crytica Security and Carahsoft have partnered to enhance OT threat detection capabilities for the US public sector, aiming to address security gaps in industrial control systems.

Charlotte Observer· Nov 6, 2026, 1:04 AM

the silent path: securing unmanaged industrial assets against remote tampering

US authorities have issued warnings regarding an ongoing cyber threat targeting industrial refrigeration systems, raising concerns about potential remote tampering.

Help Net Security· Nov 6, 2026, 1:04 AM

beyond the node-red exploit: securing manufacturing ot through network behavior

Threat actors are exploiting an authentication vulnerability in Node-RED, a tool widely used in industrial control and manufacturing environments, to deploy Linux bots and backdoors.

Security Magazine· Nov 6, 2026, 1:03 AM

the velocity of failure: network visibility and the kddi breach

Security Magazine reported on a significant data breach involving KDDI Corporation that resulted in the exposure of 12.2 million customer email addresses.

living-off-the-land (lotl)

the silent signal in the eyemed vision care breach

EyeMed Vision Care, a vision insurance provider based in Cincinnati, Ohio, has begun notifying individuals regarding a data breach resulting from an email error.

The HIPAA Journal· Nov 5, 2026, 7:07 PM

IBL News· Nov 5, 2026, 7:07 PM

rethinking the higher education ransomware timeline

Howard University partially reopened following a ransomware attack that forced the cancellation of classes for two days. The university is working with the FBI to investigate the incident, and there is currently no evidence that personal information was accessed.

London Tech News· Nov 5, 2026, 7:05 PM

the hidden toll of invisible lateral movement in retail operations

Online retailer ASOS reported an £8 million financial impact following a recent cyberattack. The company stated that recovery efforts are currently on track.

The Record from Recorded Future News· Nov 5, 2026, 7:04 PM

Closing the detection gap: lateral movement in the aftermath of the BYOD ransomware campaign

The BYOD ransomware gang, which has been linked to recent attacks on hospitals, claimed responsibility for a cyber incident at Michigan State University.

The Hacker News· Nov 5, 2026, 7:03 PM

beyond the token: addressing session-based lateral movement in modern enterprise

This report highlights active phishing and token theft campaigns, specifically SkyW4lker and Mir0Auth, which exploit Microsoft 365 device-code authentication to compromise US corporate accounts.

Mezha· Nov 5, 2026, 7:03 PM

the visibility gap: why identity breaches survive at the network layer

Web-hosting provider DreamHost disclosed a breach discovered on October 23, 2026, where attackers accessed its File Manager to steal FTP/SFTP usernames and passwords. Webmail session information and credentials for a limited number of users may have also been exposed.

low_slow_c2

the architecture of machine-speed defense: responding to the i4c advisory

The Indian Cybercrime Coordination Centre (I4C) issued an advisory warning financial institutions about AI-driven cyberattacks that enable machine-speed compromises. The agency noted that global regulators, including those in the United States and Britain, are increasingly focused on mitigating risks posed by agentic AI in the financial sector.

Reuters· Nov 5, 2026, 7:03 PM